Short and complete guide to configure SSH on Cisco router and switch for secure remote connection. The Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. The best-known example application is for remote login to computer systems by users.

SSH provides a secure channel over an unsecured network in a client-server architecture, connecting an SSH client application with an SSH server. Common applications include remote command-line login and remote command execution, but any network service can be secured with SSH. The protocol specification distinguishes between two major versions, referred to as SSH-1 and SSH-2.

The typical use of SSH Protocol

The protocol is used in corporate networks for:

• providing secure access for users and automated processes
• interactive and automated file transfers
• issuing remote commands
• managing network infrastructure and other mission-critical system components.

Configure SSH on Cisco Router or Switch

To configure SSH on Cisco router, you need to do:

1. Enable SSH on Cisco router.
2. Set Password for SSH.
3. Force remote access to use SSH.
4. Enable Password Encryption.
5. Add domain name Server (DNS).
6. Add Username and Password.

Let’s enable and configure SSH on Cisco router or switch using the below packet tracer lab. The configure on a packet tracer lab and real Cisco devices are the same. Just try to learn and do it what the SSH remote authentication needs.

Download the packet tracer lab or create your own lab. SSH Configuration Packet Tracer Lab.

In this example, I just enable and configure SSH on SW1 and trying to access it from PC1. It’s enough to learn how to configure SSH on Cisco router.

R1>
R1>enable 
R1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#
R1(config)#ip domain-name Technig.com
R1(config)#crypto key generate rsa 
The name for the keys will be: R1.Technig.com
Choose the size of the key modulus in the range of 360 to 2048 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.

How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]

R1(config)#
*Mar 1 0:5:57.974:  %SSH-5-ENABLED: SSH 1.99 has been enabled 
R1(config)#
R1(config)#username Admin password Technig
R1(config)#line vty 0 4
R1(config-line)#login local 
R1(config-line)#transport input ssh 
R1(config-line)#exit
R1(config)#ip ssh version 2
R1(config)#ip ssh authentication-retries 3
R1(config)#
R1(config)#ip ssh time-out 120
R1(config)#exit
R1#

That’s all. Let’s check the process one by one.

1. I have set DNS domain name with “IP domain-name” command.
2. Then configure the router to use RSA key pair with modulus size of 1024 bites for remote service authentication with “crypto key generate rsa” command.
3. Add username “Admin” with Password of “Technig” for ssh authentication.
4. Enabled ssh with “line vty 0 4” command.
5. Configure ssh to use local username and password with “login local” command. Remember that you can set a username and password for ssh with “username Admin password Technig” command as well. But here we configure ssh to use local username and password.
6. Configure the router to accept only ssh connection with “transport input ssh” command.
7. Configure ssh to version 2 using “IP ssh version 2” and set the authentication times to 3 with “IP ssh authentication-retries 3” command.
8. Finally set the ssh timeout to 120 seconds with “IP ssh time-out 120” command.

Related Article: Install SSH on CentOS 8.x and Red Hat Linux

The final step is to test the connectivity of ssh from PC1 with “ssh -l Admin 192.168.1.1” command for command prompt.

C:\>ssh -l Admin 192.168.1.1
Open
Password: 


R1>en
R1>enable 
Password: 
R1#

OK, the ssh works perfectly.

The post How to Configure SSH on Cisco Router or Switch? appeared first on TECHNIG.

If you faced with the below error when you try to configure banner motd on Cisco switch or router. You can easily fix Cisco Motd banner ASCII art using this MOTD Banner configuration guide.

SW1(config-line)#motd-banner !No Access for You?!
^
% Invalid input detected at '^' marker.

It means that you did not type the banner motd command correctly. Let’s test it and configure banner motd on Cisco switch and router using packet tracer.

What is MOTD Banner?

A banner is a message presented to a user who is using the Cisco switch. The type of banner you configured for use determines when this message is shown. You can configure three main types of banners on your Cisco switch, as shown here:

• The message of the Day (MOTD): This type of login message has been around for a long time on Unix and mainframe systems. The idea of the message is to display a temporary notice to users, such as issues with system availability.

  However, because the message displays when a user connects to the device before login, most network administrators are now using it to display legal notices regarding access to the switch, such as unauthorized access to this device is prohibited and violators will be prosecuted to the full extent of the law and other such cheery endearments.

• Login: This banner is displayed before login to the system, but after the MOTD banner is displayed. Typically, this banner is used to display a permanent message to the users.

• Exec: This banner displays after the login is complete when the connecting user enters User EXEC mode. Whereas all users who attempt to connect to the switch see the other banners, only users who successfully log on to the switch see this banner, which can be used to post reminders to your network administrators.

SW1#enable 
SW1#configure terminal 
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#banner motd #Admin Access only!#
SW1(config)#

Now, the Motd banner has configured on a Cisco switch. Let’s test it what is going on?

Press RETURN to get started!
Admin Access Only
User Access Verification
Password: 

Yes, you can see the message that prompts you before user authentication.

Related Search Queries:

Motd banner examples
Cisco MOTD banner ASCII art
Why should every switch have a motd banner?
Show banner motd
Cisco banner motd examples
Banner motd packet tracer
Cisco banner motd multiple lines
Banner exec

The post How to Configure Banner MOTD on Cisco Switch and Router? appeared first on TECHNIG.

Configure Static Routing is the routing that network administrator configures the network routers manually, instead of using routing protocols RIP, OSPF, etc. which utilized in the dynamic routing. The benefits of static routing are minimum bandwidth usage, no overhead on router CPU and much more and perfect for a small network with a few routers. But it is not without cons. It ‘s hard to configure all routers manually in the vast network and troubleshooting is always harder than configuration.

As a network administrator or student of CCNA, you must know the configuration of static routing. It helps you understand the process and functions of routing in the network apparently.

Configure Static Routing Using Cisco Packet Tracer

To perform this task, you must create a lab and configure the basic IP addressing for all PCs and Routers or download my CCNA Lab – Static Route with Cisco packet tracer. CCNA Lab – Static Route – no Configure.

I have configured the Static Route the same as the screenshot, and it is not yet configured routing. You must configure it with below step by step Static Routing guide.

Static Routing command syntax: Ip route [destination network address] [mask] [next hop address or interface name]

1. In the R1 type the following commands to introduce two LANs 192.168.10.0/24 and 192.168.30.0/24 for Router 1.

R1(config)#ip route 192.168.30.0 255.255.255.0 10.10.20.2 150
R1(config)#ip route 192.168.10.0 255.255.255.0 10.10.10.2 150

2. Router2: Add three networks for router 2 and be sure that do not configure it with wrong IP address.

R2(config)#ip route 192.168.10.0 255.255.255.0 10.10.10.1 150
R2(config)#ip route 10.10.10.0 255.255.255.0 10.10.20.1 150
R2(config)#ip route 192.168.20.0 255.255.255.0 10.10.20.1 150

3. Router3: Do the same as router 2 but with different destination and exit interface address.

R3(config)#ip route 192.168.30.0 255.255.255.0 10.10.20.1 150
R3(config)#ip route 10.10.20.0 255.255.255.0 10.10.10.1 150
R3(config)#ip route 192.168.20.0 255.255.255.0 10.10.10.1 150

So it’s easy and not too much difficulty. If you want to accomplish this task, firstly you must try to understand the concept of routing and then try to configure it.

You can download the complete Static Routing Lab from the link below and look at the routing configuration with ‘show ip route or show run‘ commands.  CCNA Lab – Static Route. If you have any question, please feel free to ask us.

Related Queries: 

Static routing configuration in packet tracer
Static route example
How to configure static routing on 3 routers in packet tracer
Static routing example with a diagram
Static routing pdf
Default static route
Basic static route configuration

The post How to Configure Static Routing on Cisco Router? appeared first on TECHNIG.

A step by step guide to configure Inter-VLAN Routing on the Cisco router or layer 3 switches. Basically, on a VLAN, no host can communicate with hosts within other VLANs. It means only hosts that are members of the same VLAN can communicate with each other. So if you want your VLANs hosts can communicate with each other, you must configure inter-VLAN routing using a router or a layer 3 switch. Here we completely demonstrate the Inter-VLAN configuration using a Cisco router and a layer 3 switch.

The router you are using for Inter-VLAN routing must be compatible and support Inter-Switch Link (ISL) which is a Cisco Systems proprietary protocol, and IEEE 802.1q frame format for routing on the Fast Ethernet interfaces. In Inter-VLAN the physical Fast Ethernet interface of the router is divided into sub-Interfaces for each VLAN. You can set IP address for each sub-Interface in order to route between VLANs.

How to Create VLAN on Cisco Switches?

Let’s configure it on the below Inter-VLAN routing Lab. Download the Packet Tracer Inter-VLAN routing Lab for CCNA or create your own Lab.

1. First of all, create two VLAN in the switch and named VLAN A and VLAN B with the following command.

Switch>enable 
Switch#configure terminal 
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#vlan 2
Switch(config-vlan)#name VLAN-A
Switch(config-vlan)#vlan 3
Switch(config-vlan)#name VLAN-B
Switch(config-vlan)#exit

2. OK, the VLANs A and B are created successfully. Now check them with “show vlan” command.

3. You see the result in the screenshot, the VLANs are ready for assigning switch ports to them.

Assigning Switch Ports for VLANs

In this section, the switch ports are divide and assign to VLANs. Before configuring Inter-VLAN routing, a host in a VLAN can only communicate within its own VLAN and not reach to other VLANs. So let’s configure it.

1. Try to assign switch ports for each VLANs with the following commands.

Switch(config)#interface fastEthernet 0/2
Switch(config-if)#switchport mode access 
Switch(config-if)#switchport access vlan 2
Switch(config-if)#exit
Switch(config)#
Switch(config)#interface fastEthernet 0/5
Switch(config-if)#switchport mode access 
Switch(config-if)#switchport access vlan 2
Switch(config-if)#exit

2. Now the port FastEthernet 0/2 and FastEthernet 0/5 are members of VLAN 2 which named VLAN-A. Go to set the PC3 and PC2 to VLAN-B.

3. Let’s assign a range of ports to a VLAN using “interface range” command.

Switch(config)#interface range fastEthernet 0/3-4
Switch(config-if-range)#switchport mode access 
Switch(config-if-range)#switchport access vlan 3
Switch(config-if-range)#exit

Note: The interface range command can assign a range of interfaces to a VLAN. Read more about basic VLAN configuration on “Configure VLAN on Cisco Switches Using Cisco Packet Tracer” post.

4. Now we have just done the basic VLAN configuration like creating VLAN and assigning switch ports to VLANs. Let’s enable Trunking mode on the switch port to the router and then configure Inter-VLAN routing on the router.

Configure Trunking Ports on Switch

With the command “switch port mode trunk” you can configure trunking on the FastEthernet 0/1 port of the SW1. The VLAN Trunking Protocol (VTP) let the VLANs transmit theirs traffics over a physical line simultaneously. Read more about VTP on Wikipedia website.

1. Just navigate to FastEthernet 0/1 interface and type “switchport mode trunk“ the press enter to enable trunking on Fa0/1 interface line.

Switch(config)#interface fastEthernet 0/1
Switch(config-if)#switchport mode trunk 
Switch(config-if)#

2. Now the VLANs can transmit traffic over the FastEthernet 0/1 without any problems.

Note: Try to enable trunking mode only to interface between to switch or router devices. It’s not necessary to enable it on the interface of the switch to PC.

Configure Inter-VLAN Routing on Cisco Router

Finally, the lab is ready to configure Inter-VLAN routing. If you test the PCs, they can ping with each other within a VLAN but not with other VLANs. So in order to communicate they need routing. Not network routing protocols such as Static routing or dynamic routing like RIP, and OSPF. Just need Inter-VLAN Routing which you simply configure according to below step by step Inter-VLAN routing guide.

1. Try to assign an IP address to the router and enable the interface you want to configure inter-VLAN routing.

Router>enable 
Router#configure terminal 
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#interface fastEthernet 0/0
Router(config-if)#ip address 192.168.10.1 255.255.255.248
Router(config-if)#no shutdown

2. Good, the IP 192.168.10.1 with the subnet mask of 255.255.255.248 is assigned for physical FastEthernet 0/0 interface.

Note: We need to have subinterface for each VLANs on the router. The subinterface is a virtual interface card that inter-VLAN doing routing using them.

3. Now try to create a subinterface for each VLAN with interface command and assign IP address from the different network for each VLAN. In this case, I have subnetted the 192.168.10.0/24 IP address to 3 networks.

Router(config)#interface fastEthernet 0/0.2
Router(config-subif)#
Router(config-subif)#encapsulation dot1Q 2
Router(config-subif)#ip address 192.168.10.9 255.255.255.248
Router(config-subif)#

4. See the result with “do show ip interface brief” from sub-interface area.

The virtual sub-interface FastEthernet0/0.2 has created and it has the 192.168.10.9 IP address. This sub-interface act as a default gateway for VLAN-A with an address of 192.168.10.8/29.

5. Do the same to create a sub-interface for VLAN-B also.

Router(config)#interface fastEthernet 0/0.3
Router(config-subif)#ip address 192.168.10.17 255.255.255.248

% Configuring IP routing on a LAN subinterface is only allowed if that
subinterface is already configured as part of an IEEE 802.10, IEEE 802.1Q,
or ISL vLAN.

Router(config-subif)#encapsulation dot1Q 3
Router(config-subif)#ip address 192.168.10.17 255.255.255.248
Router(config-subif)#

6. Everything is fine, but you see the error with red colour! It is because we forgot to set the encapsulation dot1Q command. Before assigning an IP address to a sub-interface, you should set IEEE 802.1q with encapsulation command.

Finally, all VLANs hosts can communicate with each other. That’s all you need to configure Inter-VLAN routing on your corporate network. Download the complete Lab of Inter-VLAN routing Cisco Packet Tracer Lab. Follow the below steps if you want to configure inter-VLAN on Layer 3 Switches or troubleshooting inter-VLAN on routers and switches.

Configure Inter-VLAN Using Layer 3 Switches

Work the same, just need a Cisco Layer 3 switch. To configure Inter-VLAN on a Layer 3 switch, you must assign an IP address to VLANs instead of sub-interfaces. Assigning an IP address to VLAN is easy, only read the “Assigning IP address to VLAN” section at the end of this articles.

To configure Inter-VLAN routing using layer 3 switches, you don’t need router anymore. All configuration has done within the layer 3 switch.

Troubleshooting and Assigning IP address to VLANs

As this post is related to configure Inter-VLAN routing, so we must do some more about VLAN configuration such as assigning IP address to VLANs, controlling VLANs remotely with Telnet, and some essential troubleshooting commands.

How to Assign an IP address to VLANs?

In order to assign an IP address to a VLAN, simply go to VLAN and set the IP address like assigning IP address to an interface of a router.

Switch(config)#interface vlan 1
Switch(config-if)#ip address 192.168.10.4 255.255.255.248
Switch(config-if)#no shutdown

Check it with “do show ip interface brief” command, whether the default VLAN 1 has gotten the IP address of 192.168.10.4/29 or not.

Yes, that’s fine. This can help you remotely configure VLANs through the internet or network.

Troubleshooting Inter-VLAN Routing

To see the VLANs on a switch, type the “show vlan” command. This command will list all created VLANs within a switch.

The “show interface trunk” command shows encapsulation and trunking status.

The “show interfaces fastEthernet 0/1 switchport” display the status of a specific switch port. See the result on the screenshot.

OK, I think it’s enough for Configuring Inter-VLAN routing. I hope you find this configure Inter-VLAN routing article’s helpful and if you have any problem or question regarding this article, ask us through the comment section.

The post Configure Inter VLAN Routing on Cisco Router and Layer 3 Switches appeared first on TECHNIG.

This is how to configure VLAN on Cisco Switch or Virtual LAN on Cisco Switches in your network. A VLAN is a switched network that is logically segmented by function, project team, or application, without regard to the physical locations of the users. VLANs have the same attributes as physical LANs, but you can group computers even if they are not physically located on the same LAN segment. Any switch port can belong to a VLAN, and unicast, broadcast, and multicast packets are forwarded and flooded only to end stations in the VLAN.

Each VLAN is considered a logical network, and packets destined for stations that do not belong to the VLAN must be forwarded through a router or bridge or layer 3 switches. Because a VLAN is considered a separate logical network.

Here we just configure VLAN on Cisco switch and not talking about VTP, STP, and other advanced Switching techniques. It is the basic VLAN configuration. Read more about VLAN on Cisco Packet Tracer CCNA Lab.

How to Configure VLAN on Cisco Switch?

Let’s start to configure VLAN on Cisco switch using Cisco Packet Tracer. You can download the VLAN Lab or create your lab within Cisco packet tracer or other network simulators.

1. Open the VLAN lab and create these three VLAN and named Marketing, Accounting, and Sales. So let’s create them with the following commands.

2. First, change the switch name with “hostname” command.

Switch>enable 
Switch#configure terminal 
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#hostname SW2
SW2(config)#

3. Now create the VLANs using “VLAN” command.

SW2(config)#vlan 2
SW2(config-vlan)#name Marketing 
SW2(config-vlan)#vlan 3
SW2(config-vlan)#name Accounting 
SW2(config-vlan)#vlan 4
SW2(config-vlan)#name Sales
SW2(config-vlan)#

4. Just type the “do sh vlan” command from config mod to see whether VLANs are created or not.

You see the VLANs are created successfully.

5. Now try to add interfaces to each of these VLANs. All the Interfaces ports are within the default VLAN and not yet grouped to Marketing, Accounting, and Sales. So try to add an interface to a VLAN with the “Switchport” command.

SW2(config)#interface fastEthernet 0/5
SW2(config-if)#switchport mode access 
SW2(config-if)#switchport access vlan 2
SW2(config-if)#exit
SW2(config)#interface fastEthernet 0/6
SW2(config-if)#switchport mode access 
SW2(config-if)#switchport access vlan 2
SW2(config-if)#

I have added the [fastEthernet 0/5] and [fastEthernet 0/6] to VLAN 2 which is our Marketing VLAN. In this method, we add each interface one by one, but you can use “Interface range” command to add a group of ports to a VLAN.

SW2(config)#interface range fastEthernet 0/2-4
SW2(config-if-range)#switchport mode access 
SW2(config-if-range)#switchport access vlan 4

6. Finally type “do sh vlan” and see the result again.

Now you can set up VLAN on your network Switches. The next step is configuring Inter-VLAN Routing. I hope you find this article helpful and do comment us about the qualities and improvements of Technig articles.

The post Configure VLAN on Cisco Switch Using Cisco Packet Tracer appeared first on TECHNIG.

Configure DHCP on Cisco Router. Last week we published a topic about installation and configuration of DHCP Server in Windows Server 2012 R2. We have introduced the DHCP Server “Install and Configure DHCP Server on Windows Server 2012 R2” and told the necessary services and network protocols requirement if you don’t know the basic of DHCP Server? you must read the article first.

Create and Configure a CCNA Lab within Cisco Packet Tracer.

Download the DHCP configuration in Cisco router lab of packet tracer from the end of this post or try to create your own network lab with two routers and their LAN networks and then configure it with the following step by step guide.

Configure the Router 1 with below IP address and initial configuration. I assume you know and understand the basic router and Switch configuration clearly. So no need to explain the functions of the basic router and switch commands line.

Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#hostname R1
R1(config)#interface serial 0/0/0
R1(config-if)#ip address 10.10.10.1 255.255.255.252
R1(config-if)#no shutdown

R1(config-if)#clock rate 64000
R1(config-if)#

For Router 2, configure the same interface serial 0/0/0 and FastEthernet 0/0 with the following commands.

Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname R2
R2(config)#interface serial 0/0/0
R2(config-if)#ip address 10.10.10.2 255.255.255.252
R2(config-if)#no shutdown

R2(config-if)#

R2(config)#interface fastEthernet 0/0
R2(config-if)#ip address 192.168.10.1 255.255.255.0
R2(config-if)#no shutdown

Configure DHCP on Cisco Router Using Packet Tracer

Let’s configure Router 2 as DHCP Server and set the clients to get their IP address from DHCP Server in Cisco Router.

In the R2 while you are in the config mode, type the command ‘IP DHCP excluded-address 192.168.10.1 192.168.10.20‘ and then press enter. This command ‘ip dhcp excluded-address’ will create an exclusive range of IP addresses which reserved for Network Servers and DHCP Server will not assign them to clients.

The ‘ip dhcp pool‘ command creates a pool for a network. You can create many pools on a router for all Local area network that connected to the router.

R2>enable
R2#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R2(config)#ip dhcp excluded-address 192.168.10.1 192.168.10.20
R2(config)#ip dhcp pool Technig_Clients
R2(dhcp-config)#
R2(dhcp-config)#network 192.168.10.0 255.255.255.0
R2(dhcp-config)#default-router 192.168.10.1
R2(dhcp-config)#dns-server 192.168.10.100
R2(dhcp-config)#

Now go to client setting and set the IP Configuration to DHCP and see the client get a new IP address from DHCP Server.

So that’s it, configure DHCP on Cisco router within a minute! Simple and easy.

DHCP Relay on Cisco Router

Remember some DHCP options (DHCP Relay Agent) when you need to provide IP addresses from a DCHP server to clients that are outside of your network or are not in the same Local Area Network. You must use the ‘ip helper-address‘ to forward the DHCP client requests to the remote host.

Configure the R1 to relay the DHCP client request. It does not work without routing. So configure Routers with static or dynamic routing. Here I’m testing with RIP.

R1>enable
R1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#interface fastEthernet 0/0
R1(config-if)#ip helper-address 10.10.10.2
R1(config-if)#exit

R1(config)#router rip
R1(config-router)#network 10.10.10.0
R1(config-router)#network 192.168.30.0
R1(config-router)#exit

Go to the client IP configuration setting and see the forwarded request by DHCP Server.

Hope you learn the configuration of the DHCP Server on the Cisco Router and Download the DHCP on Cisco Router Packet Tracer.

Related Search: 

Configure DHCP on cisco router interface
Configure DHCP on cisco router in packet tracer
What is DHCP pool
Configure DHCP on cisco switch 2960
How to configure DHCP pool on cisco switch
IP DHCP excluded-address
Cisco DHCP lease command
IP DHCP server

The post How to Configure DHCP on Cisco Router? appeared first on TECHNIG.