Sign in Subscribe
CCNA

How to Enable SSH on Cisco Routers and Switches

This post walks beginners through enabling SSH on Cisco routers and switches step by step. It covers hostname and domain name setup, RSA key generation, local user creation, VTY line configuration, and verification commands. SSH configuration maps directly to CCNA exam objective 4.8.

Jay Whale

• 3 min read
How to Enable SSH on Cisco Routers and Switches

If you've been using Telnet to manage your Cisco devices, it's time to upgrade. Telnet sends everything in plaintext, including your passwords. SSH (Secure Shell) encrypts the entire session, making it the standard for remote device management. In this guide, you'll learn how to enable SSH on Cisco routers and switches step by step.

Why SSH Matters for the CCNA

SSH configuration appears directly in CCNA exam objective 4.8 under IP Services. Beyond the exam, every production network uses SSH for secure CLI access. Learning this now builds a habit you'll carry throughout your career.

Prerequisites Before You Configure SSH

💻
The best SSH/Telnet client I've ever used: If you're doing serious CLI work daily, SecureCRT is the best terminal client I've come across in 20+ years of networking. I don't currently have a licence because I'm not doing enough console work to justify the cost — but the moment that changes, it's the first thing I'd buy. PuTTY is free and gets the job done, but SecureCRT is in a different league.

Before you start, your device needs a few things in place:

  • A hostname: The default "Router" or "Switch" hostname won't work. You need a unique hostname set.
  • A domain name: Cisco uses the hostname and domain name together to generate the RSA encryption keys.
  • An IP address on a management interface: You need a reachable interface to connect to (a loopback or a VLAN interface on a switch works well).
  • Local user credentials or AAA: SSH requires authentication. The simplest method uses a local username and password.

Step-by-Step SSH Configuration

Step 1: Set the Hostname and Domain Name

Router(config)# hostname SW1
SW1(config)# ip domain-name anythingoverip.com

Step 2: Generate RSA Encryption Keys

This is the step that actually enables SSH on the device. Cisco recommends a key size of at least 2048 bits. Anything under 768 bits will be rejected by modern SSH clients.

SW1(config)# crypto key generate rsa modulus 2048

You'll see a message confirming the keys were generated. This also automatically enables SSH on the device.

Step 3: Create a Local User Account

SW1(config)# username admin privilege 15 secret Str0ngP@ss!

Using secret instead of password stores the password as an MD5 hash rather than plaintext. Always use secret.

Step 4: Configure the VTY Lines for SSH

VTY lines are the virtual terminal lines used for remote access. You need to tell them to use SSH only and to authenticate using local credentials.

SW1(config)# line vty 0 15
SW1(config-line)# transport input ssh
SW1(config-line)# login local

Setting transport input ssh blocks Telnet entirely on those lines. If you want to allow both during a transition period, you can use transport input ssh telnet, but the goal is SSH only.

SW1(config)# ip ssh version 2

SSHv1 has known vulnerabilities. Force version 2 on every device.

Verifying Your SSH Configuration

After configuring, verify everything is working with these commands:

SW1# show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 120 secs; Authentication retries: 3

SW1# show ssh
%No SSHv1 server connections running.
%No SSHv2 server connections running.

The show ip ssh command confirms SSH is enabled and shows the version. The show ssh command lists active SSH sessions. The output above reflects a device with no clients currently connected; once a client connects, you will see session details such as the connection ID, username, encryption cipher, and state.

Testing the Connection

From another Cisco device, test with:

Router# ssh -l admin 192.168.1.1

From a Linux or Mac terminal, use:

ssh [email protected]

If your connection succeeds and you're prompted for the password you created in Step 3, the configuration is working correctly.

Quick Troubleshooting Tips

  • Connection refused: Check that RSA keys were generated and the VTY lines have transport input ssh configured.
  • Authentication failed: Confirm the username and secret are correct and that login local is set on the VTY lines.
  • SSH version mismatch: Older clients may not support SSHv2. Try updating your SSH client.

What's Next

Now that your device is secured with SSH, the next logical step is understanding how network time is synchronized across your devices. In the next post, we'll cover NTP (Network Time Protocol) configuration, another key IP Services topic on the CCNA exam. Accurate timestamps matter more than you might think, especially when you're reading logs after an incident.

🔧
For day-to-day SSH sessions to Cisco devices, SecureCRT is hard to beat — it supports tabbed sessions, saved credentials, and scripting, which makes managing multiple devices far more efficient than a basic terminal client. SecureCRT, PuTTY and MobaXterm.

Tools and resources for this topic