> For the complete documentation index, see [llms.txt](https://netsec.nerd-cafe.ir/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://netsec.nerd-cafe.ir/network-engineering/ccna/configuring-ssh-on-a-cisco-switch.md).

# Configuring SSH on a Cisco Switch

As a **CCNA instructor**, I'll walk you through the **step-by-step process** of configuring SSH on a Cisco switch using **practical scenarios** and **technical explanations**.

### <mark style="color:blue;">**Why Configure SSH?**</mark>

SSH (Secure Shell) encrypts remote management sessions, protecting login credentials and data from attackers. Unlike Telnet, which sends data in <mark style="color:red;">**plain text**</mark>, SSH provides <mark style="color:red;">**secure authentication**</mark> and <mark style="color:red;">**encrypted communication**</mark> over a network.

### <mark style="color:blue;">**Lab Scenario**</mark>

* **Objective:** Configure SSH on a Cisco switch for secure remote access.
* **Device:** Cisco switch (e.g., **Cisco Catalyst 2960**).
* **Software:** Cisco Packet Tracer, GNS3, or a real switch with Console access.
* **Topology:**
  * A **PC (Host)** is connected to the switch via Ethernet.
  * The **switch** has a management VLAN (VLAN 1) with an IP address.
  * The **Cloud** will use an SSH client (e.g., PuTTY) to access the switch.

<figure><img src="/files/Ram6ywnsfvDQrNuMAXSi" alt=""><figcaption><p>Topology</p></figcaption></figure>

### <mark style="color:blue;">**Step 1: Set a Hostname**</mark>

A unique hostname improves device identification and is required for SSH configuration.

#### **Command:**

```bash
Switch#configure terminal
Switch(config)#hostname SW1
SW1(config)#
```

### <mark style="color:blue;">**Step 2: Configure a Domain Name**</mark>

SSH requires a **domain name** for generating encryption keys.

#### **Command:**

```bash
SW1(config)#ip domain-name nerd-cafe.ir
```

#### **Explanation:**

* This domain name is used for SSH key generation.
* It **does not** need to be a real internet domain.

### <mark style="color:blue;">**Step 3: Generate SSH Keys**</mark>

To enable SSH, the switch needs <mark style="color:red;">**RSA key pairs**</mark> for encryption.

#### **Command:**

```bash
SW1(config)#crypto key generate rsa
The name for the keys will be: SW1.nerd-cafe.ir
Choose the size of the key modulus in the range of 360 to 4096 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.

How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 0 seconds)

SW1(config)#
```

#### **Explanation:**

* RSA keys enable <mark style="color:red;">**SSH encryption**</mark>.
* A key length of <mark style="color:red;">**1024 bits or more**</mark> is recommended for security.
* If you use <mark style="color:red;">**4096**</mark>, it’s more secure but can slow down performance.

### <mark style="color:blue;">**Step 4: Create a Local User for Authentication**</mark>

SSH requires a <mark style="color:red;">**username**</mark> and <mark style="color:red;">**password**</mark>.

#### **Command:**

```bash
SW1(config)#username admin secret Cisco@123
```

#### **Explanation:**

* `admin` → Username.
* `secret` → Uses an <mark style="color:red;">**encrypted password**</mark> (stronger than `password`).
* `Cisco@123` → The password (should be complex).

### <mark style="color:blue;">**Step 5: Enable SSH and Restrict Remote Access**</mark>

#### **Enable SSH on the VTY Lines** (Virtual Terminal Lines):

```bash
SW1(config)#line vty 0 4
SW1(config-line)#transport input ssh
SW1(config-line)#login local
SW1(config-line)#exit
SW1(config)#
```

#### **Explanation:**

* `line vty 0 4` → Configures **remote access** on ports **0-4**.
* `transport input ssh` → Restricts access to **only SSH** (disables Telnet).
* `login local` → Uses **local usernames and passwords** for authentication.

### <mark style="color:blue;">**Step 6: Set an IP Address for Remote Access**</mark>

SSH requires an IP <mark style="color:red;">**on the switch’s management VLAN (VLAN 1 by default)**</mark>**.**

#### **Command:**

```bash
SW1(config)#interface vlan 1
SW1(config-if)#ip address 192.168.202.254 255.255.255.0
SW1(config-if)#no shutdown
```

#### **Explanation:**

* `interface vlan 1` → Selects the management VLAN.
* `ip address 192.168.1.100 255.255.255.0` → Assigns an IP to VLAN 1.
* `no shutdown` → Activates VLAN 1.

### <mark style="color:blue;">**Step 7: Verify SSH Configuration**</mark>

#### **Check SSH Version:**

```bash
SW1#show ip ssh
SSH Enabled - version 1.99
Authentication methods:publickey,keyboard-interactive,password
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded):
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQCxa5e5yo0bcMkYGaJXQaJVnanvxdy+CBLiLXKZbZiT
MPLEJj94ykhIheYAG52cN68fUXnrl5PIbHcQHsaJorZawlUebdPiVAceNpbO2TiwXdrwkuTUNuHaaS9H
LEteOI7L45CtMMgDksDJZrF7MK0U5TSayPoF7kZp8FpatIwM9Q==
SW1#
```

#### Verify SSH Users:

```bash
SW1#show users
    Line       User       Host(s)              Idle       Location
*  0 con 0                idle                 00:00:00

  Interface    User               Mode         Idle     Peer Address

SW1#
```

#### Check SSH on VTY Lines:

```bash
SW1#show running-config | include vty
line vty 0 4
SW1#
```

### <mark style="color:blue;">**Step 8: Test SSH Access from a PC**</mark>

Now, use a **PC with an SSH client** (e.g., PuTTY) to access the switch. On the **Cloud**, Open **PuTTY**.

<figure><img src="/files/lQ4yNXeoeVR4ePNLFETd" alt=""><figcaption><p>Putty</p></figcaption></figure>

### <mark style="color:blue;">Keywords</mark>

`configure SSH`, `Cisco switch`, `SSH setup`, `secure remote access`, `enable SSH`, `SSH authentication`, `RSA key`, `SSH encryption`, `Cisco CLI`, `VLAN IP address`, `VTY lines`, `SSH security`, `SSH login`, `domain name`, `SSH version 2`, `SSH verification`, `SSH troubleshooting`, `PuTTY SSH`, `access control`, `network security`, `سیسکو`