SSH and telnet port open

[pcfreak49]

hello I have a question know there sometimes someone how you the port of SSH and telnet putting on Cisco 800 series

who can help me please

[paolo bevilacqua]

Postages ???

Use english, or you will not be understood.

[pcfreak49]

postages > poort

[paolo bevilacqua]

That's not english either.

[pcfreak49]

poort > port

[paolo bevilacqua]

And your question/problem is what exactly ?

[pcfreak49]

The problem is how can you open the port for ssh and telnet resident ?

[paolo bevilacqua]

What are you trying to do? "open port" does not mean anything.

[pcfreak49]

open port for ssh and telnet ?

[paolo bevilacqua]

I gave up, it is impossible to understand what you want.

[pcfreak49]

sorry that you can understand me not well but I am simply of Belgium I want the port for telnet and open SSH on the router

sorry

[Phillip Remaker]

If you are trying to CONNECT to a router using SSH or Telnet, you want to use the "transport input" command to indicate what protocols may be used to connect to the router.  Example:

line vty 0 5  !(or whatever range you like)

transport input telnet

transport input ssh

telnet uses TCP port 23, SSH uses TCP port 22, so if you use access-lists you need to open the ports.

You need to enable some form of login credential checking, or connections will not be allowed.

SSH config notes:

http://www.cisco.com/en/US/tech/tk583/tk617/technologies_tech_note09186a00800949e2.shtml

Tips on Telnet Configuration:

http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_configuration_example09186a0080202614.shtml

[pcfreak49]

how can you set up access-list for telnet and SSH?

[Phillip Remaker]

There are two options:

1) If you want to RESTRICT PACKETS at the router, you can use access-list + access-group on the interfaces.

2) If you want to RESTRICT CONNECTIONS you can use access-list and access-class on the vtys

If you are just trying to limit which IP addresses are allowed to connect, (2) is the best practice.  If you have greater paranoia and don't even want to see connection attempts reach the OS from disallowed IP addresses, (1) is the way to go, but is not the best practice.

You may want to read http://articles.techrepublic.com.com/5100-10878_11-1052538.html.

When you use the access-class command, it applies to all incoming transports, incluidng SSH and telnet.

[pcfreak49]

that has already done but if I want remote I inlogen on Cisco get I the report time out