How do I SSH into this 2960x ?

[jmaxwellUSAF]

Hello.

In short, how do I configure the 2960x_SWITCH1 so that I can SSH into it?

SSH services are up.

My ethernet cable connects to access ports with the same "vlan 77" on 2960x_SWITCH1 and 9300_SWITCHSTACK1.

On 2960x_SWITCH1 is configured interface vlan 77   192.168.100.101 255.255.255.0

I cannot successfully ping from or to either device.

May you please assist?

Thank you.

[MHM Cisco World]

https://www.thegeekstuff.com/2013/08/enable-ssh-cisco/

are the IP you assign to PC is in same subnet as VLAN ?
if not then it will never work, you need to use PC have IP with same subnet of VLAN.

[jmaxwellUSAF]

My PC is on enterprise network with routers in-between. I can successfully SSH into all other devices.

[MHM Cisco World]

My ethernet cable connects to access ports with the same "vlan 77" <<- this what you need to clarify?
the PC connect directly to SW or not ?

[balaji.bandi]

I use basic quick template for my lab - this will help you :

config t
!
enable secret 5 $1$jtK0$yyHFcVM7xyelts1csVwrV/
!
username cisco privilege 15 secret 5 $1$0qFD$ZEMDi.7z1QTtF4EuPdlSY.
aaa new-model
!
ip domain-name bb.com
!
no ip http server
no ip http secure-server
!
ip ssh version 2
######### Generate SSH keys :
crypto key generate rsa
!
line vty 0 4
privilege level 15
transport input ssh
!

[jmaxwellUSAF]

This is helpful, but I don't see how this solves the technical issue.

If the devices cannot ping each-other, then it seems they don't have connectivity. The 2960x does not allow IP addresses on ports, but does allow ip addresses on vlans. I researched that assigning an IP address to a vlan is the way to access it for SSH. But it is not working in my situation.

It seems there is a problem in which I cannot make an IP address for a vlan interface in which that vlan already has an IP address assigned for that vlan in a different device.

Is the solution to make a new vlan, assign an IP address to it in the 2960x, then make that same vlan on an adjacent device that has routing ability? This seems convoluted.

Why can't I ping between the adjacent devices? (ICMP is layer 3, but so is SSH)

May you please explain to me how to configure this 2960 so I can SSH to it-- especially regarding the necessary IP addressing and VLANS?

Thank you.

[balaji.bandi]

I have suggest was in impression you have already vlan in place.

if not follow below steps :

interface vlan 77   192.168.100.101 255.255.255.0 ( as per information this vlan already created) and up and running I take this is working ?

what port PC connected ?

so post show run  (quickly help you)

here is steps if you like to try :

config t

!

vlan 77

!

IP routing

!

interface vlan 77

IP address 192.168.100.101 255.255.255.0

no shutdown

!

interface gig 1/0/1 (this where your PC going to connect)

switchport mode access

switchport access vlan 77

no shutdown

!

end

PC configure IP address 192.168.100.102 255.255.255.0 Gateway 192.168.100.101

from PC ping 192.168.100.101 (if that success)

download putty from internet

and use putty to log 192.168.100.101 port 22 (follow my other config to work this)

[jmaxwellUSAF]

I corrected the port on the 9300 stack. I now have successful ping from 9300 to 2960x.

I still cannot SSH to 2960. Also I cannot ping 2960x from device 2 hops away from 2960x.

Maybe this is a routing issue? Though all devices can reach the 9300Stack, and the 9300Stack has a route to the 2960x, and the 2960x has a route to the 9300Stack.

9300-switch-stack#sh run | beg 1/0/11
interface GigabitEthernet1/0/11
switchport access vlan 77
switchport mode access
trust device cts
auto qos video cts
service-policy input AutoQos-4.0-Trust-Cos-Input-Policy
service-policy output AutoQos-4.0-Output-Policy

======================================

show run of 2960x switch...

((!!OMITTED!!))#sh run
Building configuration...

Current configuration : 4235 bytes
!
! Last configuration change at 16:58:52 EST Mon Jan 16 2023
!
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname ((!!OMITTED!!))
!
boot-start-marker
boot-end-marker
!
enable secret 9 ((!!OMITTED!!))
!
username ((!!OMITTED!!)) privilege 15 secret 9 ((!!OMITTED!!))
username ((!!OMITTED!!)) secret 9 ((!!OMITTED!!))
no aaa new-model
clock timezone EST -5 0
clock summer-time DEST recurring
switch 1 provision ws-c2960x-24td-l
!
ip domain-name ((!!OMITTED!!))
!
crypto pki trustpoint TP-self-signed-((!!OMITTED!!))
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-((!!OMITTED!!))
revocation-check none
rsakeypair TP-self-signed-((!!OMITTED!!))
!
crypto pki certificate chain TP-self-signed-((!!OMITTED!!))
certificate self-signed 05
((!!OMITTED!!))
quit
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface FastEthernet0
no ip address
!
interface GigabitEthernet1/0/1
switchport mode access
spanning-tree portfast
!
interface GigabitEthernet1/0/2
switchport mode access
!
interface GigabitEthernet1/0/3
switchport mode access
!
interface GigabitEthernet1/0/4
!
((!!OMITTED!!))
!
interface GigabitEthernet1/0/18
!
interface GigabitEthernet1/0/19
switchport access vlan 77
switchport mode access
!
interface GigabitEthernet1/0/20
((!!OMITTED!!))
interface TenGigabitEthernet1/0/2
!
interface Vlan1
no ip address
shutdown
!
interface Vlan 77
ip address 192.168.100.2 255.255.255.0
!
ip default-gateway 192.168.100.1
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 192.168.100.1
ip ssh version 2
!
no vstack
!
line con 0
password 7 ((!!OMITTED!!))
logging synchronous
login local
line vty 0 4
exec-timeout 5 0
password 7 ((!!OMITTED!!))
login local
transport input ssh
line vty 5 14
exec-timeout 5 0
password 7 ((!!OMITTED!!))
login local
transport input ssh
line vty 15
exec-timeout 5 0
login local
transport input ssh
!
end

[jmaxwellUSAF]

When SSH into a switch, is there a need to connect an ethernet cable to the management port? (I don't think so.)

[balaji.bandi]

Couple of things still missing to get bottom of the problem ?

still cannot SSH to 2960. Also I cannot ping 2960x from device 2 hops away from 2960x.   ( what is the device ?is this PC ? what is the PC IP address ?) and where is that PC connected ?

make this below  change - you do not need both, when you looking ip routing (default gateway not required)

no ip default-gateway 192.168.100.1
!

ip routing   < - (did not see this in the config)
ip route 0.0.0.0 0.0.0.0 192.168.100.1

then test it.

still not working post below information :

1. what is the device  IP address you trying to reach 2960

2. can you provide traceroute from the PC IP to 2960 switch IP ?

3. from 2960 post show ip interface brief.

4. from 2960 post show ip route