Infrastructure Services · Topic 1 of 6
Troubleshooting Device Management Access
Troubleshoot console and VTY lines, Telnet, SSH, HTTP and HTTPS access, and file transfer with SCP, TFTP and FTP on Cisco IOS XE routers and switches.
- 5 min
- Telnet uses TCP 23 and sends clear text. SSH uses TCP 22 and is encrypted.
- SSH needs a hostname, a domain name and an RSA key pair.
transport input sshon the VTY lines allows only SSH.
What it is
Device management covers the ways you connect to a router to configure it and the ways you move files on and off it.
Access comes through the console port, the VTY lines for remote logins, and the HTTP and HTTPS server for a web interface. Files move with SCP, TFTP and FTP.
Most faults are an access setting that blocks you, such as the wrong transport, a missing key or an ACL. The fix starts with finding which layer says no.
How it works
Each access method has its own protocol, port and configuration, and each can fail on its own.
Console and VTY lines
The console is a local port. VTY lines are virtual terminals for Telnet and SSH, usually numbered 0 to 4 or more.
R1(config)# line console 0
R1(config-line)# logging synchronous
R1(config-line)# exec-timeout 5 0
R1(config)# line vty 0 4
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# access-class ADMIN-HOSTS intransport input ssh allows only SSH. login local checks the local username database, or a login authentication list can use AAA. An access-class limits which source addresses may connect.
Telnet and SSH
| Item | Telnet | SSH |
|---|---|---|
| Port | TCP 23 | TCP 22 |
| Security | Clear text | Encrypted |
| Needs RSA keys | No | Yes |
SSH needs a hostname, a domain name and an RSA key pair before it will start. Version 2 is the safer choice.
R1(config)# hostname R1
R1(config)# ip domain name example.com
R1(config)# crypto key generate rsa modulus 2048
R1(config)# ip ssh version 2
R1(config)# username ADMIN privilege 15 secret LocalPass1Check SSH and the sessions with these commands.
R1# show ip ssh
R1# show ssh
R1# show users
R1# show line vty 0 4show ip ssh shows whether SSH is enabled and the version. show users lists the current sessions. A router can also be the client, with ssh -l ADMIN 10.1.1.1 or telnet 10.1.1.1.
Troubleshooting remote login
Work from the network to the line.
- Can you ping the address, and does a firewall or ACL allow TCP 22?
- Is
transport inputset to the protocol you are using? - Is the ACL on the VTY lines allowing your address?
- Are the keys, domain name and
ip ssh versioncorrect? - Does
loginhave a user or an AAA list that works? - Are all VTY lines busy?
show usersshows who is using them.
HTTP and HTTPS
The router can run a web server. HTTP uses TCP 80 and HTTPS uses TCP 443.
R1(config)# no ip http server
R1(config)# ip http secure-server
R1(config)# ip http authentication local
R1# show ip http server statusTurning off plain HTTP and keeping only HTTPS is the safer option. show ip http server status shows what is enabled and the ports in use. HTTP access uses the local user database or AAA, as set by ip http authentication.
File transfer
| Method | Transport | Security |
|---|---|---|
| SCP | Over SSH, TCP 22 | Encrypted, authenticated |
| TFTP | UDP 69 | No authentication, clear text |
| FTP | TCP 21 for control | Clear text, uses a username and password |
SCP needs the SSH server running, and AAA authorization for exec must be enabled for the user.
R1(config)# aaa new-model
R1(config)# ip scp server enable
R1(config)# aaa authentication login default local
R1(config)# aaa authorization exec default local
R1# copy scp: flash:
R1# copy running-config tftp:
R1(config)# ip ftp username FTPUSER
R1(config)# ip ftp password FTPPASS
R1(config)# ip tftp source-interface Loopback0The copy command prompts for the address and file name. For FTP, the router logs in with the username and password set by ip ftp username and ip ftp password. A source-interface makes the router use an address the server will accept.
When a transfer fails, check reachability, free space in flash, the file name, and any firewall that blocks the protocol port.
Prefer SSH, HTTPS and SCP over Telnet, HTTP, TFTP and FTP, because the older protocols send data and passwords in clear text.
What to remember for the exam
Eight facts cover most questions on this topic.
- Telnet uses TCP 23 and sends clear text. SSH uses TCP 22 and is encrypted.
- SSH needs a hostname, a domain name and an RSA key pair.
transport input sshon the VTY lines allows only SSH.access-classon the VTY lines limits the source addresses.- HTTP uses TCP 80 and HTTPS uses TCP 443.
- SCP runs over SSH and needs AAA authorization for exec.
- TFTP uses UDP 69 and has no authentication.
show usersandshow ip sshhelp troubleshoot remote access.
Do not apply a new transport input or access-class on VTY lines unless you still have a way in, such as the console.
Common mistakes
These five mistakes appear often.
Missing RSA keys. SSH will not start without a key pair.
Wrong transport input. The line refuses the protocol you try.
ACL on the VTY lines. An access class that omits your host blocks you.
Forgetting AAA for SCP. The copy fails at authorization.
Using TFTP across a firewall. The UDP transfer is blocked or times out.
Check yourself
Work through these three questions.
What must exist before SSH will start on a router?
A hostname, a domain name and an RSA key pair.
Which command limits VTY access to SSH only?
transport input sshunder theline vtyconfiguration.Why is SCP preferred over TFTP?
SCP runs over SSH, so it is encrypted and authenticated, while TFTP has no authentication and sends clear text.
Topic 1 of 6 in Infrastructure Services
Test yourself on Infrastructure Services
The full Cisco CCNP 300-410 ENARSI question bank has 857 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.