Switch> enable
Switch# configure terminal
Switch(config)# hostname SW1
SW1(config)# enable secret StrongPass123
SW1(config)# service password-encryption
SW1(config)# banner motd # Authorized access only #
SW1(config)# interface vlan 1
SW1(config-if)# ip address 192.168.1.2 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)# exit
SW1(config)# ip default-gateway 192.168.1.1
SW1(config)# line console 0
SW1(config-line)# password ConPass123
SW1(config-line)# login
SW1(config-line)# exit
SW1(config)# ip domain-name school.lk
SW1(config)# username admin secret AdminPass123
SW1(config)# crypto key generate rsa modulus 2048
SW1(config)# ip ssh version 2
SW1(config)# line vty 0 4
SW1(config-line)# login local
SW1(config-line)# transport input ssh
SW1(config-line)# end
SW1# copy running-config startup-configSSH needs more than transport input ssh. The switch also needs a domain name, an RSA key pair and a local user account, and the VTY lines must use login local so that SSH logins are checked against that user. A plain line password is not enough for SSH.
The configuration explained line by line
| Command | What it does |
|---|---|
enable | Moves from user mode (>) to privileged mode (#), where you can view and save configurations |
configure terminal | Enters global configuration mode, where settings are changed |
hostname SW1 | Names the device; the name appears in the prompt and makes it easy to identify |
enable secret ... | Sets the password needed for enable. It is stored as a strong hash, so it cannot be read from the configuration |
service password-encryption | Hides the other passwords in the configuration with weak encryption, so they cannot be read over someone's shoulder |
banner motd | Shows a legal warning to everyone who connects |
interface vlan 1 and ip address ... | Gives the switch a management IP address. A Layer 2 switch needs it only so that administrators can reach it |
ip default-gateway | Lets the switch reply to administrators on other networks |
line console 0, password, login | Protects the console port with a password |
ip domain-name, crypto key generate rsa | Creates the encryption keys that SSH needs |
username admin secret ... | Creates a local user account for SSH logins |
line vty 0 4, login local, transport input ssh | The VTY lines are the five remote-login sessions; they check the local user account and accept only SSH (Telnet is refused) |
copy running-config startup-config | Saves the configuration so that it survives a restart |
Why SSH and not Telnet?
Telnet sends everything, including the password, as plain text. Anyone capturing traffic on the network can read it. SSH encrypts the whole session. transport input ssh makes sure that Telnet cannot be used at all.
Securing the switch ports
Unused ports are a risk: anyone could plug a laptop into a free socket and join the network. Good practice:
SW1(config)# interface range fastEthernet 0/13 - 23
SW1(config-if-range)# shutdown
SW1(config-if-range)# exitPort security can also limit each port to the MAC address of the device that should be connected, and shut the port down if a different device appears.
Test before you log out. After changing VTY or SSH settings, keep your current session open and try a new SSH login. If it fails, you can still fix the problem. If you close the session first, you may need to walk to the device and use the console.
Remember
- Name the device, set an
enable secret, protect the console and allow only SSH on the VTY lines. - SSH needs a domain name, RSA keys, a local user and
login local. - Shut down unused ports and save the configuration.