Basic Cisco Router Setup: Hostname, Passwords, Banner and SSH

Every router you touch, in a lab or in production, should get the same basic setup before anything else: a hostname, proper passwords, a war...

Every router you touch, in a lab or in production, should get the same basic setup before anything else: a hostname, proper passwords, a warning banner and SSH instead of Telnet. In this Packet Tracer 8.x lab I will walk you through that baseline step by step, explain why each command matters, and show you how to verify that SSH really works from a PC.

Prefer video? Watch more hands-on labs on the Technical Hakim YouTube channel.

Lab topology

Devices used:

• 1 x Cisco 2911 router (R1)
• 1 x Cisco 2960-24TT switch (SW1)
• 1 x PC (PC1) connected to SW1 Fa0/1
• 1 x console cable from PC1 RS-232 to R1 Console (optional, for the console part)

R1 GigabitEthernet0/0 connects to SW1 GigabitEthernet0/1 with a straight-through cable.

Figure: Lab topology with R1, SW1 and PC1, plus the optional console cable.

Device	Interface	IP address	Subnet mask	Default gateway
R1	G0/0	192.168.1.1	255.255.255.0	N/A
PC1	Fa0	192.168.1.10	255.255.255.0	192.168.1.1

Lab credentials used in this post (use your own, stronger ones on real equipment):

Purpose	Value
Enable secret	Hakim@Enable1
Console password	Hakim@Con1
SSH user / secret	admin / Hakim@Admin1
Domain name	technicalhakim.local

Step 1: Hostname and quality-of-life settings

When you first open the CLI tab, Packet Tracer may ask "Would you like to enter the initial configuration dialog? [yes/no]:". Type no.

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# no ip domain-lookup

hostname R1 changes the prompt and is also required later for SSH, because the RSA key name is built from the hostname and domain name. no ip domain-lookup stops the router from treating every mistyped command as a hostname and trying to resolve it through DNS, which otherwise freezes your session for several seconds.

Step 2: Protect privileged EXEC mode

R1(config)# enable secret Hakim@Enable1

Always use enable secret, not enable password. The secret is stored as a hash in the configuration. If both are configured, the router ignores enable password and uses enable secret.

Step 3: Secure the console line

R1(config)# line console 0
R1(config-line)# password Hakim@Con1
R1(config-line)# login
R1(config-line)# exec-timeout 5 0
R1(config-line)# logging synchronous
R1(config-line)# exit

• password sets the line password, and login tells the line to actually ask for it. Without login, the password is configured but never checked.
• exec-timeout 5 0 logs out an idle session after 5 minutes and 0 seconds. exec-timeout 0 0 disables the timeout, which is handy in a lab but bad practice in production.
• logging synchronous reprints your command line after a log message interrupts it, so you do not lose track of what you were typing.

Step 4: Encrypt plain-text passwords and add a banner

R1(config)# service password-encryption
R1(config)# banner motd #Authorized access only. Disconnect now if you are not authorized.#

service password-encryption converts every plain-text password in the configuration (such as the console password) into Cisco type 7 format. Type 7 is a weak, reversible encoding. It only stops someone from reading passwords over your shoulder, so it is not a substitute for enable secret and username ... secret.

banner motd sets the message-of-the-day banner. The first character after motd (here #) is the delimiter, and the banner ends at the next #. Do not use the delimiter character inside the banner text. Keep the message legal and neutral; never write "Welcome", because that can read like an invitation.

Step 5: Configure the LAN interface

R1(config)# interface gigabitEthernet 0/0
R1(config-if)# description LAN to SW1
R1(config-if)# ip address 192.168.1.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit

Router interfaces are shut down by default, so no shutdown is essential. You should see the interface change state to up a moment later.

Step 6: Enable SSH version 2

SSH needs four things: a hostname (done), a domain name, an RSA key pair and a way to authenticate users.

R1(config)# ip domain-name technicalhakim.local
R1(config)# username admin privilege 15 secret Hakim@Admin1
R1(config)# crypto key generate rsa
The name for the keys will be: R1.technicalhakim.local
Choose the size of the key modulus in the range of 360 to 4096 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.

How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]

R1(config)# ip ssh version 2
R1(config)# line vty 0 4
R1(config-line)# login local
R1(config-line)# transport input ssh
R1(config-line)# exec-timeout 10 0
R1(config-line)# exit

• ip domain-name is combined with the hostname to name the key pair (R1.technicalhakim.local).
• username admin privilege 15 secret ... creates a local user stored as a hash. Privilege 15 drops the user straight into privileged EXEC mode after login.
• crypto key generate rsa creates the key pair. SSH version 2 needs a modulus of at least 768 bits; I use 1024 in the lab and 2048 on real devices. Once the keys exist, SSH is enabled automatically.
• ip ssh version 2 disables the older, weaker SSH version 1.
• line vty 0 4 selects the five virtual terminal lines used for remote access. login local makes them check the local username database instead of a line password. transport input ssh allows SSH and blocks Telnet.

Save everything:

R1# copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
[OK]

Step 7: Verify

Check SSH status

R1# show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 120 secs; Authentication retries: 3

If this says "SSH Disabled", you have no RSA keys. Check that the hostname and domain name are set and generate the keys again.

Check the running configuration

R1# show running-config
...
service password-encryption
!
hostname R1
!
enable secret 5 $1$mERr$...
!
no ip domain-lookup
ip domain-name technicalhakim.local
!
username admin privilege 15 secret 5 $1$mERr$...
!
ip ssh version 2
!
interface GigabitEthernet0/0
 description LAN to SW1
 ip address 192.168.1.1 255.255.255.0
 duplex auto
 speed auto
!
banner motd ^CAuthorized access only. Disconnect now if you are not authorized.^C
!
line con 0
 exec-timeout 5 0
 password 7 0822455D0A16...
 logging synchronous
 login
!
line vty 0 4
 exec-timeout 10 0
 login local
 transport input ssh
!
end

Things to notice: the enable secret and user secret are stored as type 5 hashes, the console password shows as type 7 because of service password-encryption, and IOS displays the banner delimiter as ^C no matter which character you typed. The hash strings in your lab will be different from mine; I have shortened them here.

Test SSH from PC1

Set PC1's IP address from the table, then open Desktop > Command Prompt:

C:\>ssh -l admin 192.168.1.1

Password:

Authorized access only. Disconnect now if you are not authorized.

R1#

The -l option is the login username. Because the user has privilege 15, you land directly at the R1# prompt. Type exit to close the session. Now try telnet 192.168.1.1 from the same PC; the connection should be refused because the VTY lines only accept SSH.

On R1, show users lists active sessions while the SSH connection is open, and show ssh shows the SSH connection details, including the version and cipher.

The failed Telnet attempt from PC1 looks like this:

C:\>telnet 192.168.1.1
Trying 192.168.1.1 ...
% Connection refused by remote host

Optional hardening

R1(config)# login block-for 120 attempts 3 within 60
R1(config)# security passwords min-length 10

login block-for blocks all login attempts for 120 seconds if there are 3 failed attempts within 60 seconds, which slows down password guessing. security passwords min-length 10 refuses new passwords shorter than 10 characters. If your Packet Tracer version does not accept one of these, skip it; the core lab works without them.

Common mistakes

• "% Please define a domain-name first." You ran crypto key generate rsa before ip domain-name. Set the domain name and try again. The hostname must also be something other than the default "Router".
• Forgetting login on the console. The password is stored but never asked for, so anyone with a console cable gets in.
• VTY lines with login but no password and no login local. Remote users are rejected with "Password required, but none set". For SSH, use login local.
• login local with no username configured. Nobody can log in remotely. Create the user first.
• Key size too small for version 2. A 512-bit key does not support SSH version 2. Generate the key again with 1024 bits or more.
• Interface left shut down or PC without the right IP. Ping 192.168.1.1 from PC1 before blaming SSH.
• Not saving the configuration. If you close Packet Tracer or reload R1 without copy running-config startup-config, everything is lost.

Summary

A secure baseline for any Cisco router is: hostname, no ip domain-lookup, enable secret, a console password with login, service password-encryption, a banner motd, and SSH version 2 with ip domain-name, a local username ... secret, crypto key generate rsa, login local and transport input ssh on the VTY lines. Verify with show ip ssh and a real SSH login from a PC, then save the configuration.

Related tutorials

• Standard vs Extended ACLs on Cisco Routers: Lab with Examples
• Inter-VLAN Routing with Router-on-a-Stick (Packet Tracer Lab)
• OSPF Single-Area Configuration: Full Lab with Verification
• DHCP Server on a Cisco Router plus DHCP Relay (ip helper-address)

Sources

• RFC 4253, The Secure Shell (SSH) Transport Layer Protocol: https://www.rfc-editor.org/rfc/rfc4253
• Cisco Security Configuration Guide: Secure Shell Version 2 Support
• Cisco IOS Security Command Reference (enable secret, service password-encryption, login block-for)
• Cisco IOS Configuration Fundamentals Configuration Guide (banners, line configuration)