(M3) 2.4.3 Configure Telnet and Ssh

- DOC - Configuring Switch-Based Authentication

TELNET

(config)#line vty 0 15
(config-line)#transport input telnet  or (config-line)#transport input all

SSH

(config)#line vty 0 15
(config-line)#transport input ssh  or (config-line)#transport input all

Setting Up the Switch to Run SSH

	Command	Purpose
Step 1	configure terminal	Enter global configuration mode.
Step 2	hostname hostname	Configure a hostname for your switch.
Step 3	ip domain-namedomain_name	Configure a host domain for your switch.
Step 4	crypto key generate rsa	Enable the SSH server for local and remote authentication on the switch and generate an RSA key pair. We recommend that a minimum modulus size of 1024 bits. When you generate RSA keys, you are prompted to enter a modulus length. A longer modulus length might be more secure, but it takes longer to generate and to use.
Step 5	end	Return to privileged EXEC mode.
Step 6	show ip ssh or show ssh	Show the version and configuration information for your SSH server. Show the status of the SSH server on the switch.
Step 7	copy running-config startup-config	(Optional) Save your entries in the configuration file.

To delete the RSA key pair, use the crypto key zeroize rsa global configuration command. After the RSA key pair is deleted, the SSH server is automatically disabled.

Configuring the SSH Server

Beginning in privileged EXEC mode, follow these steps to configure the SSH server:

	Command	Purpose
Step 1	configure terminal	Enter global configuration mode.
Step 2	ip ssh version [1 | 2]	(Optional) Configure the switch to run SSH Version 1 or SSH Version 2. •1—Configure the switch to run SSH Version 1. •2—Configure the switch to run SSH Version 2. If you do not enter this command or do not specify a keyword, the SSH server selects the latest SSH version supported by the SSH client. For example, if the SSH client supports SSHv1 and SSHv2, the SSH server selects SSHv2.
Step 3	ip ssh {timeout seconds |authentication-retriesnumber}	Configure the SSH control parameters: •Specify the time-out value in seconds; the default is 120 seconds. The range is 0 to 120 seconds. This parameter applies to the SSH negotiation phase. After the connection is established, the switch uses the default time-out values of the CLI-based sessions. By default, up to five simultaneous, encrypted SSH connections for multiple CLI-based sessions over the network are available (session 0 to session 4). After the execution shell starts, the CLI-based session time-out value returns to the default of 10 minutes. •Specify the number of times that a client can re-authenticate to the server. The default is 3; the range is 0 to 5. Repeat this step when configuring both parameters.
Step 4	line vty line_number[ending_line_number] transport input ssh	(Optional) Configure the virtual terminal line settings. •Enter line configuration mode to configure the virtual terminal line settings. For line_number and ending_line_number, specify a pair of lines. The range is 0 to 15. •Specify that the switch prevent non-SSH Telnet connections. This limits the router to only SSH connections.
Step 5	end	Return to privileged EXEC mode.
Step 6	show ip ssh or show ssh	Show the version and configuration information for your SSH server. Show the status of the SSH server connections on the switch.
Step 7	copy running-config startup-config	(Optional) Save your entries in the configuration file.

To return to the default SSH control parameters, use the no ip ssh {timeout | authentication-retries} global configuration command.

Displaying the SSH Configuration and Status

To display the SSH server configuration and status, use one or more of the privileged EXEC commands in Table 9-5:

Table 9-5 Commands for Displaying the SSH Server Configuration and Status 

Command	Purpose
show ip ssh	Shows the version and configuration information for the SSH server.
show ssh	Shows the status of the SSH server.

Resetting Switches to Factory Defaults

http://www.cordero.me/blog/resetting-catalyst-switches-to-factory-defaults

Reset Switch Configuration

1. Type in “write erase” to erase the NVRAM filesystem:

Switch#wr erase
Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]
[OK]
Erase of nvram: complete
Switch#

2. When that’s finished, type in “reload” and do NOT save the config:

Switch#reload
*Mar  2 05:51:10.245: %SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvrameload
Proceed with reload? [confirm]

*Mar  2 05:51:14.062: %SYS-5-RELOAD: Reload requested by console. Reload reason: Reload command
Using driver version 1 for media type 1
Base ethernet MAC Address: 18:ef:63:70:d6:00
Xmodem file system is available.
The password-recovery mechanism is enabled.
Initializing Flash...
mifs[2]: 0 files, 1 directories
mifs[2]: Total bytes     :    3870720
mifs[2]: Bytes used      :       1024
mifs[2]: Bytes available :    3869696
mifs[2]: mifs fsck took 0 seconds.
mifs[3]: 416 files, 8 directories
mifs[3]: Total bytes     :   27998208
mifs[3]: Bytes used      :   13362176
mifs[3]: Bytes available :   14636032
mifs[3]: mifs fsck took 6 seconds.
...done Initializing Flash.
done.
Loading "flash:/c3750-ipbasek9-mz.122-50.SE1/c3750-ipbasek9-mz.122-50.SE1.bin"...@@@@@@@@@

Reset VLAN Information

1. Type in “show vlan” to see if there are any VLANs configured:

Switch#sh vlan br

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa1/0/1, Fa1/0/2, Fa1/0/3
Fa1/0/4, Fa1/0/5, Fa1/0/6
Fa1/0/7, Fa1/0/8, Fa1/0/9
Fa1/0/10, Fa1/0/11, Fa1/0/12
Fa1/0/13, Fa1/0/14, Fa1/0/15
Fa1/0/16, Fa1/0/17, Fa1/0/18
Fa1/0/19, Fa1/0/20, Fa1/0/21
Fa1/0/22, Fa1/0/23, Fa1/0/24
Gi1/0/1, Gi1/0/2
10   HR                               active
50   PRINTERS                         active
99   VOIP                             active
100  IT                               active
999  Remote-Span                      active
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup
Switch#

2. Next type in “dir flash:” to verify the vlan.dat file

Switch#dir flash:
Directory of flash:/

2  -rwx         756   Mar 1 1993 04:47:02 +00:00  vlan.dat
!--- This vlan.dat file stores user-configured VLANs.
3  drwx         512   Mar 1 1993 00:12:38 +00:00  c3750-ipbasek9-mz.122-50.SE1

27998208 bytes total (14636032 bytes free)
Switch#

3. Delete the “vlan.dat” file

Switch#delete flash:vlan.dat
Delete filename [vlan.dat]?
Delete flash:vlan.dat? [confirm]
Switch#

4. Reload once again

Switch#reload
Proceed with reload? [confirm]

*Mar  1 00:24:17.621: %SYS-5-RELOAD: Reload requested by console. Reload reason: Reload command

5. Now just confirm that the VLANs are gone and we are back to a factory default setting

Switch#sh vlan
*Mar  1 00:02:02.272: %LINK-5-CHANGED: Interface Vlan1, changed state to administratively downbr

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa1/0/1, Fa1/0/2, Fa1/0/3
Fa1/0/4, Fa1/0/5, Fa1/0/6
Fa1/0/7, Fa1/0/8, Fa1/0/9
Fa1/0/10, Fa1/0/11, Fa1/0/12
Fa1/0/13, Fa1/0/14, Fa1/0/15
Fa1/0/16, Fa1/0/17, Fa1/0/18
Fa1/0/19, Fa1/0/20, Fa1/0/21
Fa1/0/22, Fa1/0/23, Fa1/0/24
Gi1/0/1, Gi1/0/2
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup
Switch#

If you can not get into the switch, reset it pressing the MODE button:

Follow these steps to return your switch to the factory default settings:

1.Press and hold the Mode button.

The switch LEDs begin blinking after about 2 seconds. If the switch is not configured, the LEDs above the mode button turn green. You can omit this step and run Express Setup to configure the switch.

2.Continue holding down the Mode button. The LEDs stop blinking after an additional 8 seconds, and then the switch reboots.

The switch now behaves like an unconfigured switch. You can configure the switch by using Express Setup as described in the switch getting started guide that is included with the switch.