Configure Cisco switch telnet login and password

Contributor Icon Contributed by qmchenry Date Icon May 27, 2004  
Tag Icon Tagged: Cisco switch

The ability to telnet into a Cisco switch greatly simplifies remote administration of the device. This recipe describes enabling telnet logins and password protecting them.


To enable telnet logins into a Cisco switch and set the telnet password to keepout use the following commands from configuration mode:

line vty 0 15
password keepout
login

To telnet to the switch, it must have an IP address configured.

Previous recipe | Next recipe |
 
  • Anonymous
    This would be even more useful if the person writing it assumed the user had NO knowledge of cisco switches whatsoever.

    Do the following to get up to the stage above:

    from the command window (run: cmd)

    telnet (ip address)

    (password)

    enable (to get into secret mode)

    (secret password)

    conf t (This gets you into the above mentioned configuration mode)

    line vty 0 15

    password (your new password)

    exit

    exit

    exit

    Your done!
  • bravepc
    You have done what?

    The switch will arrive with a serial light blue cable. Connect it to the console port at the Cisco switch, and to the serial port on a pr.

    Open a terminal session (in ZP Hyperterm), use default settings and give session any name. In that way, tou don even need an ip

    But, this is the very entry point to the switch config. Somebody has to write a long manual here!
  • Jacob
    how to open a ZP hyperterm?
  • your suggession is right Given by you.


    Thanks a lot
  • Oscar P. Snick
    To Anonymous above, you can't telnet to a switch that has no login. Bravepc describes the method well.

    Cisco already has a "long" manual. If it was effective, however, I wouldn't have ended up here.

    Thanks for the info.
  • Lessa
    To first configure a Cisco switch, be it any model #, it first has to be connected in out-of-band management: via console cable. Out-of-band can be taken as out of bandwidth, meaning not online. Not using the Ethernet or internet connections. In-band would be the opposite, meaning using Ethernet or internet connections. In-band = telnetting, SDM, etc.

    Note: I CANNOT remember how to set the IP to enter to get into telnet.. you have to have an IP, but I cannot remember what the commands are to set it. I believe it might be int vlan (#), and then setting that IP, as vty does not have an IP option. I am unsure. I did try this in Packet Tracer 5.0 and setting the vlan 1 IP did not change any affect when trying to ping or telnet to the switch.

    1.) Connect console cable
    2.) Use terminal emulation program to connect to switch or router. HyperTerminal in XP, Putty in XP & Vista, or (I've never heard 'ZP' before), ZP Hyperterm. I'm sure there are others as well. The default settings should be: Bits Per Second: 9600, Data Bits: 8, Parity: None, Stop Bits: 1, Flow Control: None. If this is not what you have, then correct it to the ones listed previously. Connect
    3.) Enter Privileged Exec mode via typing enable. The prompt with ">" dictates that it is "user" mode. Exec mode is "#".
    4.) Enter configure terminal mode by typing that in after enable (while in exec/privileged mode)or config t for short.
    5.) Type in line vty 0 15 (meaning virtual telnet 0 - 15, 16 in all. You can set different passwords for different vtys. It is not limited to ONLY 0 15. Meaning ONLY 0-15.)
    6.) Type "password *password*", where the asterisks dictate what you want to set your password as.
    7.) Type "login", to make sure that someone connecting via telnet will have to enter the password you just set. Otherwise, it's just free access. Remember "login".
    8.) Type end, this will take you back STRAIGHT to privileged exec mode, this way you do not have to keep typing "exit".
    9.) Type "wr", short for "write", which will then automatically (via write's default settings) save running-config to startup-config. This is shorter than typing "copy run start", which is also shorter than "copy running-config startup-config".
    10.) You can either just disconnect from console 0 (or as the switch states it: con0) or type "logout" which will take you to the beginning, where you will have to press enter and re-login via secret and enable passwords.

    Note: I CANNOT remember how to set the IP to enter to get into telnet.. you have to have an IP, but I cannot remember what the commands are to set it.

    Now, via telnet:

    1.) Open up command (start menu > run > cmd)
    2.) Type "telnet (ip set)"
    3.) If the privilege was set to, say, "15", then once the password was entered (as it is now prompting for the password if "login" was remembered), then once logged-in you will be in, I am 90% sure, enable mode without having to enter the enable password & enable secret, just the set telnet. I may have this backwards as I do not have much experience with the telnetting (I will be doing some testing later on)
    4.) Config t to use most commands, or show *whatever here* to get started. All show commands are in exec mode only, not config mode. There is a very limited amount of show commands in user mode.

    Okay, well.. if any mistakes are found, or if you know what I did not, please correct. I was typing this in during class, so please excuse me. I had limited time to mess around with Packet Tracer 5.0 before I had to move onto another page, or I would have researched answering my own questions. Thanks for reading.
  • darkman001
    i think a method to configure a telnet r admission ip :

    1) u need to go to enable mode
    2)Conf t
    3)interface vlan 1
    4) ip add 10.0.0.0 255.255.255.0

    I am new at cisco but i think this si how u do it


    (sry 4 my writhing but i am Croatian xD )
  • Shaun VT
    Thanks Helped Alot
  • o meu
    k treta
  • madcow
    think that service password encryption should be enabled. (even if its low end security) u do not want save the passwords in clear text. and you probably want to create an access to block off access from the entire world (you only want to connect to it from within your own network) so:

    !enter configuration mode
    conf t

    !enable service password encryption
    service password encryption

    !password for privilaged acccess
    enable password keepout

    !access list for whatever you netblock is
    access-list 1 permit 192.168.0.0 0.0.0.255

    !enter telnet config mode
    line vty 0 4
    password keepout
    login
    access-class 1 in
blog comments powered by Disqus