When a Cisco switch is installed in a server room or network rack, a network admin doesn't want to physically walk over there for every small change. SSH and Telnet both provide this exact kind of remote access — with one crucial difference I'll explain at the end.
Step 1: Set a Privileged mode password
Before enabling remote access, set a password for Privileged EXEC mode:
enable
configure terminal
enable secret YourStrongPassword
Step 2: Set hostname and domain name (required for SSH)
SSH needs a hostname and domain name to generate an encryption key:
hostname SW1
ip domain-name company.local
Step 3: Generate an RSA encryption key
Now we generate the RSA key — the foundation of SSH's encrypted connection:
crypto key generate rsa
The system will ask for the key length (number of bits); 2048 is a good choice for solid security.
Step 4: Configure VTY lines for SSH
Now we need to tell the remote-access lines (VTY) to accept SSH:
line vty 0 15
transport input ssh
login local
exit
The transport input ssh command only allows SSH (Telnet is fully disabled). The login local command tells it to use username/passwords defined locally on the switch.
Step 5: Create a local user
For login local to work, you need at least one user:
username admin privilege 15 secret YourStrongPassword
Step 6 (optional): Also enabling Telnet
If for some reason you also need Telnet (e.g., a fully isolated lab environment):
line vty 0 15
transport input telnet ssh
exit
But note: this is only recommended for fully controlled, lab environments.
Why should SSH always be preferred over Telnet?
Here's the core point of this tutorial: Telnet sends all traffic — including the username and password — as plain text over the network. That means anyone with access to the same network, using a traffic analysis tool (like Wireshark), can read the switch's admin password directly. SSH encrypts this entire connection, and that difference makes it the only acceptable option for any real network — even internal ones.
Final test
From another computer on the network, connect via an SSH client (like PuTTY or the command line) to the switch's IP address:
ssh -l admin 192.168.1.1
If you enter the correct password, you should land in the switch's management environment.
This is exactly one of the first things we practice on real equipment in my CCNA and network security courses.
Blog