On this page 13 sections
  1. 1. Lab topology
  2. 2. Console access and command modes
  3. 3. Hostname, passwords and console login
  4. 4. Router LAN interface
  5. 5. Switch identity and management address
  6. 6. PC addressing and connectivity
  7. 7. SSH and VTY lines
  8. 8. Test SSH login
  9. 9. Save the configuration
  10. 10. Back up to a lab server
  11. 11. Restore settings from a backup
  12. 12. Quick troubleshooting
  13. 13. Cisco references
Lab use only. Apply these techniques only to systems you own or have explicit permission to test.
01

1. Lab topology

Example: an administrator PC connects to a switch and a router. Configure both devices through the console, then manage them from PC1 using SSH.

Use fresh Cisco IOS / IOS XE lab devices. Interface names depend on the model; replace Gi0/0 with Gi0/0/0 if necessary. Packet Tracer may support fewer commands.

Both switch ports use VLAN 10. This simple topology needs no trunk. Replace password placeholders before pasting any configuration.

Topology and addressing — reference only
PC1 -------- SW1 -------- R1
       Fa0/1    Gi0/1  Gi0/0
           VLAN 10

Device  Interface   Address           Default gateway
PC1     Ethernet    192.168.10.10/24  192.168.10.1
SW1     VLAN 10     192.168.10.2/24   192.168.10.1
R1      Gi0/0       192.168.10.1/24   Not needed here

/24 = 255.255.255.0
02

2. Console access and command modes

Example: R1 has no IP address yet. Connect its console cable and open a terminal. Typical console settings are 9600 baud, 8 data bits, no parity, 1 stop bit and no flow control; check your model. On a fresh lab device, answer no to the initial configuration dialog.

The prompt identifies your mode: > is user EXEC, # is privileged EXEC, (config)# is global configuration, (config-if)# is interface configuration, and (config-line)# is terminal-line configuration.

  • enable: enter privileged EXEC.
  • configure terminal: enter global configuration.
  • exit: move up one configuration level; from EXEC, end the session.
  • end: return from configuration mode directly to privileged EXEC.
  • ?: show available commands or arguments.
  • show ip interface brief: list interface names, IPv4 addresses and status.

Every command block shows the device and its current mode. Type only the text after the prompt; do not paste the prompt itself. PC1> identifies the PC terminal; its actual prompt depends on the operating system.

R1 — type only what follows each prompt
Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface GigabitEthernet0/0
R1(config-if)# exit
R1(config)# end
R1# show ip interface brief
03

3. Hostname, passwords and console login

Example: create a local administrator named netadmin on R1. Use different strong values for <ENABLE_SECRET> and <ADMIN_SECRET>.

  • hostname R1: set the name displayed in the prompt.
  • no ip domain-lookup: prevent DNS lookups after mistyped commands.
  • enable secret: protect access through enable.
  • username netadmin privilege 15 secret: create a full administrator who enters privileged EXEC directly.
  • line console 0: select the physical console line.
  • login local: authenticate against the device's local username database.
  • logging synchronous: redraw typed input after system messages.
  • exec-timeout 10 0: close an idle session after 10 minutes, 0 seconds.

Create the account before enabling local login. These examples assume no existing AAA configuration.

R1 — local administration
R1# configure terminal
R1(config)# hostname R1
R1(config)# no ip domain-lookup
R1(config)# enable secret <ENABLE_SECRET>
R1(config)# username netadmin privilege 15 secret <ADMIN_SECRET>
R1(config)# line console 0
R1(config-line)# login local
R1(config-line)# logging synchronous
R1(config-line)# exec-timeout 10 0
R1(config-line)# end
04

4. Router LAN interface

Example: R1 Gi0/0 connects to SW1. Assign 192.168.10.1 as the gateway for the lab subnet.

  • interface GigabitEthernet0/0: select the physical port.
  • description: document the cable destination.
  • ip address: assign an IPv4 address and subnet mask.
  • no shutdown: enable the interface; shutdown disables it.
  • show ip route connected: display directly connected IPv4 networks.

Expected: Gi0/0 becomes up/up after the cable and switch port are active. No static route is required for this connected subnet.

R1 — configure the LAN connection
R1# configure terminal
R1(config)# interface GigabitEthernet0/0
R1(config-if)# description LAN_to_SW1_Gi0/1
R1(config-if)# ip address 192.168.10.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# end
R1 — verify
R1# show ip interface brief
R1# show ip route connected
05

5. Switch identity and management address

Example: PC1 connects to SW1 Fa0/1 and R1 connects to SW1 Gi0/1. Put both ports in VLAN 10 and manage SW1 at 192.168.10.2.

A VLAN is a separate Layer 2 network. An access port carries one untagged VLAN. An SVI (Switch Virtual Interface) gives the switch a logical IP interface for that VLAN; Layer 2 physical ports do not need their own IP addresses.

  • vlan 10: create or select VLAN 10.
  • name LAB_LAN: label the VLAN.
  • switchport mode access: make the port an access port.
  • switchport access vlan 10: assign the port to VLAN 10.
  • interface vlan 10: select the SVI for the management address.
  • ip default-gateway 192.168.10.1: set the gateway for SW1's own remote-subnet traffic when IP routing is disabled.
  • show vlan brief: check VLANs and access-port membership.

The switch gateway does not configure PC1 or enable inter-VLAN routing. The SVI becomes up/up when VLAN 10 exists and at least one member port is active and forwarding traffic.

SW1 — identity and console login; start at privileged EXEC
Switch# configure terminal
Switch(config)# hostname SW1
SW1(config)# no ip domain-lookup
SW1(config)# enable secret <SWITCH_ENABLE_SECRET>
SW1(config)# username netadmin privilege 15 secret <SWITCH_ADMIN_SECRET>
SW1(config)# line console 0
SW1(config-line)# login local
SW1(config-line)# logging synchronous
SW1(config-line)# exec-timeout 10 0
SW1(config-line)# end
SW1 — VLAN, access ports and SVI
SW1# configure terminal
SW1(config)# vlan 10
SW1(config-vlan)# name LAB_LAN
SW1(config-vlan)# exit
SW1(config)# interface FastEthernet0/1
SW1(config-if)# description PC1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# no shutdown
SW1(config-if)# exit
SW1(config)# interface GigabitEthernet0/1
SW1(config-if)# description R1_Gi0/0
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# no shutdown
SW1(config-if)# exit
SW1(config)# interface vlan 10
SW1(config-if)# ip address 192.168.10.2 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)# exit
SW1(config)# ip default-gateway 192.168.10.1
SW1(config)# end
SW1 — verify
SW1# show vlan brief
SW1# show ip interface brief
SW1# ping 192.168.10.1
06

6. PC addressing and connectivity

Example: in Packet Tracer, open PC1 > Desktop > IP Configuration > Static. Set IP 192.168.10.10, mask 255.255.255.0 and gateway 192.168.10.1. DNS is unnecessary for connections made directly to IP addresses.

  • ipconfig: display PC1's addressing.
  • ping: test IP reachability.
  • arp -a: display learned IPv4-to-MAC mappings.

Expected: both devices respond. Repeat an initial failed ping while ARP resolution or spanning tree settles. Successful ping does not mean SSH is enabled yet.

PC1 — check the network
PC1> ipconfig
PC1> ping 192.168.10.1
PC1> ping 192.168.10.2
PC1> arp -a
07

7. SSH and VTY lines

Example: PC1 can ping both devices. Enable SSH on R1 and SW1 separately.

SSH provides encrypted remote CLI access, normally on TCP port 22. VTY (Virtual Teletype) lines are virtual terminals for remote CLI sessions, not physical ports or VLANs.

  • ip domain-name netlab.example: supply the domain used by traditional RSA setup; no public DNS record is needed.
  • crypto key generate rsa modulus 2048: create a 2048-bit RSA identity key for SSH.
  • ip ssh version 2: select SSHv2.
  • line vty 0 4: select five remote-session lines, numbered 0 to 4.
  • login local: use existing local accounts; this does not create a user.
  • transport input ssh: allow SSH on the selected lines and exclude Telnet.
  • exec-timeout 10 0: disconnect idle remote sessions after ten minutes.
  • show ip ssh: check SSH server status.
  • show line: inspect available terminal lines.

The following transcripts assume the devices are named R1 and SW1. Generate keys after setting the hostname and domain. If the one-line RSA syntax is rejected, use crypto key generate rsa and choose 2048 at the prompt. The device image must support SSH. Replacing an existing key changes the host identity.

Inspect show line and show running-config. If VTY lines 5–15 exist, apply the optional block to those lines too.

R1 — R1 and SW1 — run separately on each device
R1# configure terminal
R1(config)# ip domain-name netlab.example
R1(config)# crypto key generate rsa modulus 2048
R1(config)# ip ssh version 2
R1(config)# line vty 0 4
R1(config-line)# login local
R1(config-line)# transport input ssh
R1(config-line)# exec-timeout 10 0
R1(config-line)# end
SW1 — R1 and SW1 — run separately on each device
SW1# configure terminal
SW1(config)# ip domain-name netlab.example
SW1(config)# crypto key generate rsa modulus 2048
SW1(config)# ip ssh version 2
SW1(config)# line vty 0 4
SW1(config-line)# login local
SW1(config-line)# transport input ssh
SW1(config-line)# exec-timeout 10 0
SW1(config-line)# end
R1 — Optional — only on devices with VTY lines 5–15
R1# configure terminal
R1(config)# line vty 5 15
R1(config-line)# login local
R1(config-line)# transport input ssh
R1(config-line)# exec-timeout 10 0
R1(config-line)# end
SW1 — Optional — only on devices with VTY lines 5–15
SW1# configure terminal
SW1(config)# line vty 5 15
SW1(config-line)# login local
SW1(config-line)# transport input ssh
SW1(config-line)# exec-timeout 10 0
SW1(config-line)# end
R1 — R1 and SW1 — verify SSH and line settings
R1# show ip ssh
R1# show line
R1# show running-config
SW1 — R1 and SW1 — verify SSH and line settings
SW1# show ip ssh
SW1# show line
SW1# show running-config
08

8. Test SSH login

Example: connect from PC1 using netadmin and the secret configured on the destination device. Keep console access until both SSH logins work.

  • ssh netadmin@192.168.10.1: connect to R1 using OpenSSH.
  • ssh -l netadmin 192.168.10.1: equivalent syntax for Packet Tracer's PC client.
  • show privilege: check your privilege level after login.
  • show users: list active terminal sessions.
  • exit: close the SSH session.

Expected: R1# or SW1#, because netadmin has privilege 15. On a real client's first connection, verify the host-key fingerprint through a trusted channel.

PC1 with OpenSSH — connect to one device at a time
PC1> ssh netadmin@192.168.10.1
PC1> ssh netadmin@192.168.10.2
Packet Tracer PC1 — connect to one device at a time
PC1> ssh -l netadmin 192.168.10.1
PC1> ssh -l netadmin 192.168.10.2
R1 — Inside an SSH session — check access and disconnect
R1# show privilege
R1# show users
R1# exit
SW1 — Inside an SSH session — check access and disconnect
SW1# show privilege
SW1# show users
SW1# exit
09

9. Save the configuration

Example: connectivity and SSH work. Save R1 and SW1 separately so their settings survive reboot.

running-config contains active settings; changes take effect immediately. startup-config contains saved settings normally loaded at boot.

  • copy running-config startup-config: save the active configuration.
  • show startup-config: inspect the saved configuration.

Press Enter at Destination filename [startup-config] to accept the default. No reload is needed to save.

R1 — R1 and SW1 — save and confirm
R1# copy running-config startup-config
R1# show startup-config
SW1 — R1 and SW1 — save and confirm
SW1# copy running-config startup-config
SW1# show startup-config
10

10. Back up to a lab server

Example: connect a TFTP server to SW1 Fa0/2. Give it 192.168.10.50/24, gateway 192.168.10.1, and enable its TFTP service. Place its switch port in VLAN 10 before transferring files.

  • copy running-config tftp:: export the active configuration to a TFTP server.

When prompted, enter server address 192.168.10.50 and filename R1-baseline.cfg or SW1-baseline.cfg. Verify both files exist after transfer.

TFTP has no encryption or authentication; use an isolated lab. Configuration backups contain sensitive data.

SW1 — connect the backup server
SW1# configure terminal
SW1(config)# interface FastEthernet0/2
SW1(config-if)# description LAB_TFTP_SERVER
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# no shutdown
SW1(config-if)# end
SW1# copy running-config startup-config
R1 — R1 and SW1 — run separately and choose distinct filenames
R1# ping 192.168.10.50
R1# copy running-config tftp:
SW1 — R1 and SW1 — run separately and choose distinct filenames
SW1# ping 192.168.10.50
SW1# copy running-config tftp:
11

11. Restore settings from a backup

Example: recover settings from R1-baseline.cfg. The router must already have IP connectivity to the server. Keep console access.

  • copy tftp: running-config: prompt for the server IP and source filename, then merge the file into active settings.
  • This MERGES settings; commands absent from the backup may remain.

Changes apply immediately and may alter access. Inspect the file first, then verify before saving.

A full rollback requires the platform's replacement procedure; switch VLAN data may also be stored separately.

R1 — merge the reviewed backup
R1# copy tftp: running-config
12

12. Quick troubleshooting

Example: PC1 cannot manage SW1. Check the link and VLAN first, then IP addressing and SSH.

  • show interfaces status: check switch port connectivity and VLAN assignment.
  • show ip interface brief: identify incorrect addresses or down interfaces.
  • show vlan brief: confirm VLAN 10 and its access ports.
  • show spanning-tree vlan 10: check which ports are forwarding.
  • show ip ssh: confirm that the SSH server is enabled.
  • show running-config: inspect local accounts, interfaces and all VTY ranges.

Administratively down: enable the correct interface with no shutdown. Down/down: check cable, power and the peer port.

Vlan10 down: confirm the VLAN exists and has an active forwarding member port. Ping fails: check IP, mask, duplicate addresses and VLAN membership.

Ping works but SSH fails: check keys, local credentials and every VTY range. Settings disappear after reboot: confirm you saved the configuration.

SW1 — inspect the path and management service
SW1# show interfaces status
SW1# show ip interface brief
SW1# show vlan brief
SW1# show spanning-tree vlan 10
SW1# show ip ssh
SW1# show running-config
13

13. Cisco references

Cisco — Configure SSH on Routers:
https://www.cisco.com/c/en/us/support/docs/security-vpn/secure-shell-ssh/4145-ssh.html

Cisco — Configuring a Management IP Address on Catalyst Switches:
https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10594-8.html