cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
22915
Views
0
Helpful
12
Replies
Highlighted
Beginner

transport input telnet ssh help

Hello,

I had two questions about remotely login to switch or router :

1. What is the default setting on switch or router to accept remote login (i.e., telnet or ssh)

2. If i configure...TRANSPORT INPUT TELNET SSH... which one is default and accepted first by switch or router. I mean I know that it will accept both but I want to know that If I configure both to accept then which one has the first priority or by default which one is accepted first, tenet or ssh.

Thanks

12 REPLIES 12
Highlighted
Cisco Employee

Re: transport input telnet ssh help

1) Default settings on all VTYs are "transport input all" --> all the supported protocols, that includes both telnet and ssh.

2) There is no priority level on which one is accepted first. Basically it just listens on both protocols (telnet - tcp/23 and ssh - tcp/22) for remote management.

Here is the command description for your reference:

http://www.cisco.com/en/US/docs/ios/termserv/command/reference/tsv_s1.html#wp1069219

Hope that helps.

Highlighted
Beginner

Re: transport input telnet ssh help

thanks for your answer but I got this question in exam and it was asking me which will be choosen by default by router or switch and they give me two options..telnet or ssh, so which one is correct ?

Highlighted
Cisco Employee

Re: transport input telnet ssh help

I would say the default would be telnet, eventhough I think the question is incorrect. Purely because with SSH you would need to generate the RSA keypair, etc etc before you can even use SSH to access the router. So base on that theory, telnet would be the answer.

Highlighted
Beginner

Re: transport input telnet ssh help

Answer -1 : The default setting on switch/router to accept remote access is telnet.

Answer -2 : If the command is " TRANSPORT INPUT TELNET SSH ", then the system will accept remote access by default through telnet, but if SSH is enabled it will accept SSH.

Highlighted
Beginner

Re: transport input telnet ssh help

Dear,

 

I have both enabled but i dont able to do the ssh, however I am able to telnet the device.

 

Kindly let me know what could be wrong ?

Highlighted
Hall of Fame Guru

Re: transport input telnet ssh help

@Ashis Patra

 

Have you confirmed your RSA keypair?

Highlighted
Beginner

Re: transport input telnet ssh help

Dear Marvin,

 

I am getting the below error while trying to login the device. Are you asking about the below command in bold whether ts there in the switch or not? If Yes then this command is not there in the switch.

Server: ssh 10.X.X.X
ssh: connect to host 10.X.X.X port 22: Connection refused

 

crypto key generate rsa modulus 1024

 

Thanks,

Ashis

Highlighted
Hall of Fame Guru

Re: transport input telnet ssh help

The "crypto key generate..." command will never be in the running-config as it is a runtime command used only to generate a new key.

 

However you should have at least one RSA key present. You can confirm it with the following command:

 

show crypto key mypubkey rsa
Highlighted
Beginner

Re: transport input telnet ssh help

Thanks Marvin I am getting this output. Please explain me.

 

show crypto key mypubkey rsa
% Key pair was generated at: 19:00:09 GMT Oct 22 2018
Key name: CISCO
Key type: RSA KEYS
On Cryptographic Device: act2 (label=act2, key index=24)
Usage: General Purpose Key
Key is not exportable.
Key Data:

30820122 

Highlighted
Hall of Fame Guru

Re: transport input telnet ssh help

That looks ok. Can you ssh to any other device?

 

What is the device you are attempting to access?

 

Can you provide the output of "show version" from it?

 

 

Highlighted
Beginner

Re: transport input telnet ssh help

Dear Marvin,

 

Sorry for the late response. I am able to do the ssh to other device. Please find the below output FYI. And kindly advice.

 

sh version
Cisco IOS XE Software, Version 16.06.01
Cisco IOS Software [Everest], ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 16.6.1, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2017 by Cisco Systems, Inc.
Compiled Sat 22-Jul-17 05:55 by mcpre


Cisco IOS-XE software, Copyright (c) 2005-2017 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.


ROM: IOS-XE ROMMON
Hostname uptime is 3 weeks, 2 days, 16 hours, 44 minutes
Uptime for this control processor is 3 weeks, 2 days, 16 hours, 46 minutes
System returned to ROM by Reload Command at 18:53:16 GMT Mon Oct 22 2018
System restarted at 18:49:58 GMT Mon Oct 22 2018
System image file is "bootflash:isr4300-universalk9.16.06.01.SPA.bin"
Last reload reason: Reload Command

 

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

 

Suite License Information for Module:'esg'

--------------------------------------------------------------------------------
Suite Suite Current Type Suite Next reboot
--------------------------------------------------------------------------------
FoundationSuiteK9 None None None
securityk9
appxk9

AdvUCSuiteK9 None None None
uck9
cme-srst
cube


Technology Package License Information:

-----------------------------------------------------------------
Technology Technology-package Technology-package
Current Type Next reboot
------------------------------------------------------------------
appxk9 None None None
uck9 None None None
securityk9 securityk9 EvalRightToUse securityk9
ipbase ipbasek9 Permanent ipbasek9

cisco ISR4351/K9 (2RU) processor with 1797107K/6147K bytes of memory.
Processor board ID FLM2133W0J2
3 Gigabit Ethernet interfaces
32768K bytes of non-volatile configuration memory.
4194304K bytes of physical memory.
3125247K bytes of flash memory at bootflash:.
0K bytes of WebUI ODM Files at webui:.

Configuration register is 0x2102

 

Thanks,

Ashis

Highlighted
Hall of Fame Guru

Re: transport input telnet ssh help

That's odd. All of the common issues seem ok.

 

You have an image that supports strong crypto, you have an RSA key, you've enabled ssh input, your client PC can ssh to other devices.

 

Is it possible somebody has modified the Diffie-Hellman (dh) key exchange specification?

 

It is probably best to do a packet capture of an attempted logon from your PC. You can then examine the initial communications attempt and see exactly where it is failing.

 

If you haven't already seen it, also have a look at this guide:

 

https://community.cisco.com/t5/security-documents/guide-to-better-ssh-security/ta-p/3133344