본문 바로가기
카테고리 없음

Generate Rsa Keys Cisco Switch

sumtarepu1988 2020. 8. 29. 16:24



Contents

Finding Feature Information

Run show crypto key mypubkey rsa to see if you do, in fact, have a key fully generated and registered under a non-default name. If there is, then you can tell the ssh process to use this key with ip ssh rsa keypair-name xxx. If the first command doesn't show anything useful then I'd say you can go ahead and generate a new key. Cisco IOS Security Command Reference: Commands A to C, Cisco IOS XE Release 3SE (Catalyst 3850 Switches) 1. Crypto key generate rsa. TogenerateRivest,Shamir,andAdelman(RSA)keypairs,usethecryptokeygeneratersacommandinglobal configurationmode.

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http:/​/​www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Prerequisites for Configuring the Switch for Secure Shell (SSH) and Secure Copy Protocol (SCP)

The following are the prerequisites for configuring the switch for secure shell (SSH):

  • For SSH to work, the switch needs an RSA public/private key pair. This is the same with Secure Copy Protocol (SCP), which relies on SSH for its secure transport.
  • Before enabling SCP, you must correctly configure SSH, authentication, and authorization on the switch.
  • Because SCP relies on SSH for its secure transport, the router must have an Rivest, Shamir, and Adelman (RSA) key pair.
  • SCP relies on SSH for security.
  • SCP requires that authentication, authorization, and accounting (AAA) authorization be configured so the router can determine whether the user has the correct privilege level.
  • A user must have appropriate authorization to use SCP.
  • A user who has appropriate authorization can use SCP to copy any file in the Cisco IOS File System (IFS) to and from a switch by using the copy command. An authorized administrator can also do this from a workstation.
Related Concepts

Restrictions for Configuring the Switch for SSH

The following are restrictions for configuring the switch for secure shell.

Generate

  • The switch supports Rivest, Shamir, and Adelman (RSA) authentication.
  • SSH supports only the execution-shell application.
  • The SSH server and the SSH client are supported only on DES (56-bit) and 3DES (168-bit) data encryption software.
  • The switch supports the Advanced Encryption Standard (AES) encryption algorithm with a 128-bit key, 192-bit key, or 256-bit key. However, symmetric cipher AES to encrypt the keys is not supported.
  • This software release does not support IP Security (IPSec).
  • When using SCP, you cannot enter the password into the copy command. You must enter the password when prompted.
Related Concepts

Information about SSH

Secure Shell (SSH) is a protocol that provides a secure, remote connection to a device. SSH provides more security for remote connections than Telnet does by providing strong encryption when a device is authenticated. This software release supports SSH Version 1 (SSHv1) and SSH Version 2 (SSHv2).

SSH and Switch Access

For SSH configuration examples, see the “SSH Configuration Examples” section in the “Configuring Secure Shell” section in the “Other Security Features” chapter of the

Cisco IOS Security Configuration Guide, Cisco IOS Release 12.4

.

SSH functions the same in IPv6 as in IPv4. For IPv6, SSH supports IPv6 addresses and enables secure, encrypted connections with remote IPv6 nodes over an IPv6 transport.


Note

For complete syntax and usage information for the commands used in this section, see the command reference for this release and the “Secure Shell Commands” section of the “Other Security Features” chapter of the

Cisco IOS Security Command Reference, Release 12.4

and the

Cisco IOS IPv6 Command Reference

.

SSH Servers, Integrated Clients, and Supported Versions

The SSH feature has an SSH server and an SSH integrated client, which are applications that run on the switch. You can use an SSH client to connect to a switch running the SSH server. The SSH server works with the SSH client supported in this release and with non-Cisco SSH clients. The SSH client also works with the SSH server supported in this release and with non-Cisco SSH servers.

The switch supports an SSHv1 or an SSHv2 server.

The switch supports an SSHv1 client.

SSH supports the Data Encryption Standard (DES) encryption algorithm, the Triple DES (3DES) encryption algorithm, and password-based user authentication.

SSH also supports these user authentication methods:

  • TACACS+
  • RADIUS
  • Local authentication and authorization
Related Concepts
Related Tasks

SSH Configuration Guidelines

Follow these guidelines when configuring the switch as an SSH server or SSH client:

  • An RSA key pair generated by a SSHv1 server can be used by an SSHv2 server, and the reverse.
  • If the SSH server is running on a stack master and the stack master fails, the new stack master uses the RSA key pair generated by the previous stack master.
  • If you get CLI error messages after entering the crypto key generate rsa global configuration command, an RSA key pair has not been generated. Reconfigure the hostname and domain, and then enter the crypto key generate rsa command. For more information, see Related Topics below.
  • When generating the RSA key pair, the message No host name specified might appear. If it does, you must configure a hostname by using the hostname global configuration command.
  • When generating the RSA key pair, the message No domain specified might appear. If it does, you must configure an IP domain name by using the ip domain-name global configuration command.
  • When configuring the local authentication and authorization authentication method, make sure that AAA is disabled on the console.
Related Tasks

Secure Copy Protocol Overview

The Secure Copy Protocol (SCP) feature provides a secure and authenticated method for copying switch configurations or switch image files. SCP relies on Secure Shell (SSH), an application and a protocol that provides a secure replacement for the Berkeley r-tools.

For SSH to work, the switch needs an RSA public/private key pair. This is the same with SCP, which relies on SSH for its secure transport.

Because SSH also relies on AAA authentication, and SCP relies further on AAA authorization, correct configuration is necessary.

  • Before enabling SCP, you must correctly configure SSH, authentication, and authorization on the switch.
  • Because SCP relies on SSH for its secure transport, the router must have an Rivest, Shamir, and Adelman (RSA) key pair.

Note

When using SCP, you cannot enter the password into the copy command. You must enter the password when prompted.

Secure Copy Protocol Concepts

The Secure Copy Protocol (SCP) feature provides a secure and authenticated method for copying switch configurations or switch image files. SCP relies on Secure Shell (SSH), an application and a protocol that provides a secure replacement for the Berkeley r-tools.

To configure the Secure Copy feature, you should understand the SCP concepts.

The behavior of SCP is similar to that of remote copy (rcp), which comes from the Berkeley r-tools suite, except that SCP relies on SSH for security. SCP also requires that authentication, authorization, and accounting (AAA) authorization be configured so the router can determine whether the user has the correct privilege level.

For information about how to configure and verify SCP, see the “Secure Copy Protocol” section in the

Cisco IOS Security Configuration Guide: Securing User Services, Release 12.4

.

Related References

How to Configure SSH

Setting Up the Switch to Run SSH

Beginning in privileged EXEC mode, follow these steps to set up your switch to run SSH:

Before You Begin

Configure user authentication for local or remote access. This step is required. For more information, see Related Topics below.

SUMMARY STEPS

1.configureterminal

2.hostnamehostname

3.ip domain-namedomain_name

4.crypto key generate rsa

5.end


DETAILED STEPS

Command or Action Purpose
Step 1 configureterminal
Example:

Enters the global configuration mode.
Step 2 hostnamehostname
Example:

Configures a hostname and IP domain name for your switch.

Note

Follow this procedure only if you are configuring the switch as an SSH server.
Step 3 ip domain-namedomain_name
Example:

Configures a host domain for your switch.
Step 4 crypto key generate rsa
Example:

Enables the SSH server for local and remote authentication on the switch and generates an RSA key pair. Generating an RSA key pair for the switch automatically enables SSH.

We recommend that a minimum modulus size of 1024 bits.

When you generate RSA keys, you are prompted to enter a modulus length. A longer modulus length might be more secure, but it takes longer to generate and to use.

Note

Follow this procedure only if you are configuring the switch as an SSH server.
Step 5 end
Example:

Returns to privileged EXEC mode.
Related Concepts
Related Tasks

Configuring the SSH Server

Beginning in privileged EXEC mode, follow these steps to configure the SSH server:


Note

This procedure is only required if you are configuring the switch as an SSH server.

SUMMARY STEPS

1.configureterminal

2.ip sshversion [1 | 2]

3.ip ssh {timeoutseconds | authentication-retriesnumber}

4.Use one or both of the following:

  • transport input ssh

5.end


DETAILED STEPS

Command or Action Purpose
Step 1 configureterminal
Example:

Enters the global configuration mode.
Step 2 ip sshversion [1 | 2]
Example:

(Optional) Configures the switch to run SSH Version 1 or SSH Version 2.

  • 1—Configure the switch to run SSH Version 1.
  • 2—Configure the switch to run SSH Version 2.

If you do not enter this command or do not specify a keyword, the SSH server selects the latest SSH version supported by the SSH client. For example, if the SSH client supports SSHv1 and SSHv2, the SSH server selects SSHv2.
Step 3 ip ssh {timeoutseconds | authentication-retriesnumber}
Example:

Configures the SSH control parameters:

  • Specify the time-out value in seconds; the default is 120 seconds. The range is 0 to 120 seconds. This parameter applies to the SSH negotiation phase. After the connection is established, the switch uses the default time-out values of the CLI-based sessions. By default, up to five simultaneous, encrypted SSH connections for multiple CLI-based sessions over the network are available (session 0 to session 4). After the execution shell starts, the CLI-based session time-out value returns to the default of 10 minutes.
  • Specify the number of times that a client can re-authenticate to the server. The default is 3; the range is 0 to 5.

Repeat this step when configuring both parameters.
Step 4 Use one or both of the following:
  • line vtyline_number [ending_line_number]
  • transport input ssh

Example:

or

(Optional) Configures the virtual terminal line settings.

  • Enters line configuration mode to configure the virtual terminal line settings. For line_number and ending_line_number, specify a pair of lines. The range is 0 to 15.
  • Specifies that the switch prevent non-SSH Telnet connections. This limits the router to only SSH connections.
Step 5 end
Example:

Returns to privileged EXEC mode.

Monitoring the SSH Configuration and Status

This table displays the SSH server configuration and status.
Table 1 Commands for Displaying the SSH Server Configuration and Status

Command

Purpose

show ip ssh

Shows the version and configuration information for the SSH server.

show ssh

Shows the status of the SSH server.

For more information about these commands, see the “Secure Shell Commands” section in the “Other Security Features” chapter of the

Cisco IOS Security Command Reference

.

Additional References

Related Documents

Crypto Key Generate Rsa Command

Related Topic Document Title

Configuring Identity Control policies and Identity Service templates for Session Aware networking.

Session Aware Networking Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)
Configuring RADIUS, TACACS+, Secure Shell, 802.1X and AAA.

Securing User Services Configuration Guide Library, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)

Error Message Decoder

Description Link

To help you research and resolve system error messages in this release, use the Error Message Decoder tool.

MIBs

MIB MIBs Link

All supported MIBs for this release.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

Technical Assistance

Description Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

Configuration of SSH on Cisco Switch in Packet Tracer 2019

This Article is about the configuration of SSH on Cisco Switch. You can configure SSH on Cisco devices very easily using these simple steps:

  1. Crate a Packet Tracer Topology Lab
  2. Basic IP Setting for connectivity
  3. Set hostname and domain-name on Switch
  4. Set console and enable password for SSH login
  5. Generate the RSA Keys
  6. Setup the Line VTY configurations
  7. Create the username password for SSH access from PC
  8. Verify SSH access

For the configurations of SSH in packet tracer on Cisco switch, you are required to follow the above steps. Let start and perform these steps one by one. (Learn what is PSSH)

Crate a Packet Tracer Topology Lab

Our first step is to open the packet tracer and need to create a simple lab. For this topology we will use only one switch and a PC. Simply drag these two items on dashboard. Now we will connect them with straight through connection.

Basic IP Setting for connectivity

The next step is assign the suitable IP setting to these devices. For keeping it simple and making basic connectivity we will assign just two IP address to these device. We will assign the IP address to PC. For this will open the PC setting and then IP configuration. Here we will assign an IP address to host, in our case we are going to assign it 192.168.1.1 with the default gateway. For default gateway we will assign the IP address 192.168.1.10. We assign the second IP address to our Vlan1 interface on switch. And its IP address will be the gateway of host that is 192.168.1.10. For this we will use the basic commands.
Switch> enable

Switch# config t

Switch(config)#interface vlan 1

Switch (config-if)# ip address 192.168.1.10 255.255.255.0

Switch (config -if)#no shut

Once you done with basic IP setting, you can verify the connectivity by pinging the interface vlan1 IP from host.

Set host-name and domain-name on Switch

For SSh configurations you need to configure a host-name and domain-name for your switch you can do this with these simple commands.

Switch # config t

Switch (config)#hostname SW1

SW1 ( config)#ip domain-name w7cloud.com

Set console and enable password for SSH login

For SSH access it is required that you must configure the console and enable password on your cisco switch. You can set these two passwords with following commands.

SW1 ( config)#line console 0

SW1(config-line)#password cisco

SW1(config -line)#logging synchronous

SW1(config- line)#login local

SW1 (config- line)#exit

SW1 # enable secret cisco

Generate the RSA Keys

Your Cisco switch must have RSA keys that for the SSH process. You can generate the RSA keys with following command:

SW1 ( config)# crypto key generate rsa

How many bits in the modulus [512]: 1024

% Generating 1024 bit RSA keys, keys will be non-exportable…[OK]

Set the size of key to 1024 bits.

Generate

If your Cisco Switch is running an older version of Cisco IOS image, then it is extremely recommended that you upgrade to latest Cisco IOS.

Setup the Line VTY configurations

For the configuration of SSH on cisco switch you need the following line vty configurations, and input transport is required to set to SSH. Set the login-to-local, & password to 7.

sw1 ( config)#line vty 0 4

sw1 ( config-line)#transport input ssh

sw1( config -line)#login local

Create Rsa Keys Cisco Switch

sw1(config- line)#password 7

sw1(config- line ) #exit

Create the username password for SSH access from PC

If you do not have a username for SSH access you need to create a username. You can do it with this simple command:

How To Generate Rsa Key Cisco Switch

Sw1# config t

sw1 (config ) # username w7cloud password cisco

Make sure the password encryption services is enabled on your switch, this service will encrypt your password, & when you do “sh run”, you’ll see only the encrypted password, not clear text password.

SW1# service password-encryption

Verify SSH access from Host

Once you done with the above configurations you can test all these configuration by creating a SSH connection from Host. You do it the command ssh –l <username> <IP address>. Open the host command prompt and use the command

Cisco Crypto Key Gen Rsa

C:>ssh -l waqas 192.168.1.10

It will ask for password, provide the password that you created with this username in previous steps. Then it asked for console password and then you need to provide the enable password. Now you are in your Cisco switch. You can perform switch configurations from your host.

From the switch, if you use the command ‘sh ip ssh’, it will also confirm that SSH is enabled on this cisco swith.

For better understanding please watch the video and like it.

Crypto key generate

Generate Rsa Keys Cisco Switch 2017


I hope this will be a helpful for you, please share your comments. If you like this then share this on social media. Thank you for reading this..!

Generate Rsa Key Command

Guide on Cisco Router Configuration for Beginners

Related: 4 Best SSH Client Used by Professionals





티스토리툴바