SSh session not working.

sagarmistry

I have followed all commands for ssh.
ip domain name is set. login local is set. username and password is set.

I can also telnet into my two switches and one router connected to both. Ping all IPs as well.

What am I missing for ssh login??

siggnation

Go to line vty 0 15 and try setting this: transport input ssh telnet

Also, under global configuration mode, ip ssh version 2 is good.

Prior to what I said above, please ensure you generated rsa keys to enable ssh:

(config)#crypto key generate rsa --> hit enter and input 512 (512 is a good example, the higher the number, the stronger the key).

RouteMyPacket

#1 Rule of asking others for assistance

Show your existing config

tecnodog7

Lol RouteMyPacket is right. Please paste your config.

sagarmistry

Switch_3550_1#show run
Building configuration...


Current configuration : 4582 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Switch_3550_1
!
enable secret 5 $1$qMCN$Zt77AdgDumIpBrI4rOvWb/
enable password 7 14141B180F0B
!
username SagarMist secret 5 $1$HLte$bOkO8U7pqz5OekTcFrl2h.
username sagar password 7 01100F175804
no aaa new-model
ip subnet-zero
ip domain-name sagarswitch.com
!
vtp domain Sagarswitch3550
vtp mode transparent
!
!
crypto pki trustpoint TP-self-signed-587564672
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-587564672
revocation-check none
rsakeypair TP-self-signed-587564672
!
!
crypto pki certificate chain TP-self-signed-587564672
certificate self-signed 01
30820251 308201BA A0030201 02020101 300D0609 2A864886 F70D0101 04050030
30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 35383735 36343637 32301E17 0D393330 33303130 30303035
395A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3538 37353634
36373230 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
B1B811CE C1F9298B B534FC5B 299CBA57 181B5D80 032E7B42 F40FFA9B F0114E15
AF0339BA 53A9D203 4547B14B 5A5830E3 ABA086AE A1459BE6 BDA59C49 9AC69B5C
900CD0C2 344FF1C2 E77A5D0F 76E0882D 0A11C9CB 5033C479 5FBBEF7A 66113549
2289E473 F6869FE9 66BEA591 59942854 51ABB106 D27D7942 DAF37327 98C9CBD3
02030100 01A37B30 79300F06 03551D13 0101FF04 05300301 01FF3026 0603551D
11041F30 1D821B53 57495443 485F3335 35302E73 61676172 73776974 63682E63
6F6D301F 0603551D 23041830 1680149E 4F5747F1 116DE2BE 24F5B8CA 9BF6E58E
2CCECE30 1D060355 1D0E0416 04149E4F 5747F111 6DE2BE24 F5B8CA9B F6E58E2C
CECE300D 06092A86 4886F70D 01010405 00038181 0037DC93 ACD2BDDE BA5EB977
41E84399 31844F2C BE4032B1 4C548875 880612C3 9D19D72B 5604D454 D80D3CEC
04793CB2 8EBE9B54 EEFD1036 DF7A94CD 73A3C42C D8FC023C 2B8B654A AAEF93C3
ED8B68E4 1285FEAD 04C90C51 38C271E3 05575310 2F4940C6 4260C01D 1CB56EE9
3A654C41 8ABDBCD8 4A63B717 140C167F 7CB98D28 60
quit
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
vlan 50
name SALES
!
ip ssh version 2
!
!
interface FastEthernet0/1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport port-security maximum 40
switchport port-security
!
interface FastEthernet0/2
switchport mode access
!
interface FastEthernet0/3
switchport mode access
!
interface FastEthernet0/4
switchport mode access
!
interface FastEthernet0/5
switchport mode access
!
interface FastEthernet0/6
switchport mode access
!
interface FastEthernet0/7
switchport mode access
!
interface FastEthernet0/8
switchport mode access
!
interface FastEthernet0/9
switchport mode access
speed 100
duplex full
!
interface FastEthernet0/10
switchport mode access
!
interface FastEthernet0/11
switchport mode access
!
interface FastEthernet0/12
switchport mode access
!
interface FastEthernet0/13
switchport mode access
!
interface FastEthernet0/14
switchport mode access
!
interface FastEthernet0/15
switchport mode access
!
interface FastEthernet0/16
switchport mode access
!
interface FastEthernet0/17
switchport mode access
!
interface FastEthernet0/18
switchport mode access
!
interface FastEthernet0/19
switchport mode access
!
interface FastEthernet0/20
switchport mode access
!
interface FastEthernet0/21
switchport mode access
!
interface FastEthernet0/22
switchport mode access
!
interface FastEthernet0/23
switchport mode access
!
interface FastEthernet0/24
switchport mode access
!
interface GigabitEthernet0/1
switchport mode dynamic desirable
!
interface GigabitEthernet0/2
switchport mode dynamic desirable
!
interface Vlan1
ip address 10.1.1.10 255.255.255.0
ip security dedicated unclassified genser
ip security add
!
interface Vlan50
description SALES
ip address 10.1.50.10 255.255.255.0
ip security dedicated unclassified genser
ip security add
!
interface Vlan100
no ip address
!
ip classless
ip http server
ip http secure-server
!
!
control-plane
!
banner motd ^C
*******************************************************


WELCOME TO SAGAR'S SWITCH 3550:


*******************************************************






^C
!
line con 0
exec-timeout 0 0
password 7 02050D480809
logging synchronous
login local
line vty 0 4
password 7 02050D480809
login local
transport input telnet ssh
line vty 5 15
password 7 01100F175804
login local
transport input telnet ssh
!
end


Switch_3550_1#

sagarmistry

siggnation wrote: »

Go to line vty 0 15 and try setting this: transport input ssh telnet

Also, under global configuration mode, ip ssh version 2 is good.

Prior to what I said above, please ensure you generated rsa keys to enable ssh:

(config)#crypto key generate rsa --> hit enter and input 512 (512 is a good example, the higher the number, the stronger the key).

Done all that.

RouteMyPacket

Basics first, what are you pinging from (x.x.x.x?), attempting to connect to (x.x.x.x?). Can you ping the switch?

Interesting config, so how about we debug this and see what we get. On the console

debug ip ssh
sh ip ssh

Try to connect via SSH, what's the output? Also, since you chose SSH v2 then your RSA key needs to at least be 768 bits, so if you selected 512 as a previous user advised. Change that, typically go with no less than 1024

DCD

What are you using to SSH into the switch and what version of SSH are you using?

sagarmistry

RouteMyPacket wrote: »

Basics first, what are you pinging from (x.x.x.x?), attempting to connect to (x.x.x.x?). Can you ping the switch?

Interesting config, so how about we debug this and see what we get. On the console

debug ip ssh
sh ip ssh

Try to connect via SSH, what's the output? Also, since you chose SSH v2 then your RSA key needs to at least be 768 bits, so if you selected 512 as a previous user advised. Change that, typically go with no less than 1024

So when I'm on my router 10.1.3.2 I can ping the switch which is 10.1.1.10.

I can also ping it from the command prompt on my laptop connected to switch with ip 10.1.1.10.

From my laptop I can telnet both of the above ip.


debug results:
Switch_3550_1#debug ip ssh
Incoming SSH debugging is on

Switch_3550_1#sh ip ssh
SSH Enabled - version 2.0
Authentication timeout: 120 secs; Authentication retries: 3
Switch_3550_1#


Just changed the crpto key to 1024. When I try to connect via ssh it says connection time out.

sagarmistry

DCD wrote: »

What are you using to SSH into the switch and what version of SSH are you using?

Tried both tera term with SSH and extra putty. Same result. connection time out.

Version 2 of SSH.

ecuadra

Remove existing vty line password, go to line vty 0 15 and do a no password

do a show ip ssh and show ssh and let us know the full output of both commands

try using the command prompt instead

ssh -l username ip

press enter and then input the password, make sure you can ping the switch first

also what is the ip/mask of the laptop and the ip/mask of the switch

sagarmistry

ecuadra wrote: »

Remove existing vty line password, go to line vty 0 15 and do a no password

do a show ip ssh and show ssh and let us know the full output of both commands

try using the command prompt instead

ssh -l username ip

press enter and then input the password, make sure you can ping the switch first

also what is the ip/mask of the laptop and the ip/mask of the switch

Switch_3550_1#show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 120 secs; Authentication retries: 3
Switch_3550_1#show ssh
%No SSHv2 server connections running.
%No SSHv1 server connections running.
Switch_3550_1#

I tried to ping the switch from command prompt on my laptop. Laptop is connected to the switch.

But it doesn't ping the switch's IP: 10.1.1.10

Sorry but I couldn't understand this command:ssh -l username ip where do I type it, command prompt? In there it says no ssh function.

I have connected ethernet from the switch to the laptop but it says no internet connection. I have set the IP manually to 10.1.1.109 255.255.255.0

and Switch's IP is 10.1.1.10 255.255.255.0

Dieg0M

Is there any filtering done between where you are pinging and the switch (ACL's/Firewalls) ?

sagarmistry

Dieg0M wrote: »

Is there any filtering done between where you are pinging and the switch (ACL's/Firewalls) ?

I didn't issue any commands other than base configs. No idea what ACL is as of right now. So guessing no. :P

sagarmistry

Guys, Also just need your opinion on which test bundle to buy for CCENT.

The lab bundle or the regular bundle??

I have routers and switches at home but don't know if I need more lab practice. following jeremy right now.

RouteMyPacket

You need to start with the basics, it is the same process you will use throughout your career. I cannot stand people throwing out troubleshooting tips when the basics haven't been discovered.

Remove passwords from vty lines, trying ssh -l, any filtering? Every single one of those are irrelevant until you can confirm L1 - L3 connectivity

How do you have the network laid out? How many devices are there? What are their functions? What good is SSH and Passwords if you cannot even reach the device?

So when I'm on my router 10.1.3.2 I can ping the switch which is 10.1.1.10.

Ok, so you have a router and a switch, they are on two separate networks. I can already tell from your switch configuration that you want it to perform your inter-vlan routing, you have multiple SVI's configured. So what are you using the router for?

WHAT ARE YOU TRYING TO ACCOMPLISH?

If you want to implement a router on a stick, then you will trunk the switch to the router. Configure your L2 Vlans on the switch and assign access ports to whatever Vlan you want, in your case vlans 1 and 50

On the router you will create sub interfaces for each vlan, plug the trunk port on the switch into the router port

On router:

interface FastEthernet0/1.1
description VLAN 1
encapsulation dot1Q 1
ip address 10.1.1.254 255.255.255.0

interface FastEthernet0/1.50
description VLAN 50
encapsulation dot1Q 50
ip address 10.1.50.254 255.255.255.0


Say your "Management" Vlan is 1 so the switch gets IP that it already has, so leave that interface alone. Delete the 50 and 100 vlan interfaces

Create your L2 VLANs on the switch

vlan 50
name Data

vlan 100
name BlaBla

int f0/2
switchport host
switchport access vlan 50
no shut

int f0/3
switchport host
no shut

How are you handling DHCP? If you want, static the IP for a quick test. Connect your PC to one of those ports, can the PC reach it's default gateway?


If you want the router to handle DHCP, thenc reate multiple pools

ip dhcp pool VLAN1
network 10.1.1.0 255.255.255.0
domain-name abc.com
default-router 10.1.1.254
dns-server 4.2.2.2 8.8.8.8

ip dhcp pool VLAN50
network 10.1.50.0 255.255.255.0
domain-name abc.com
default-router 10.1.50.254
dns-server 4.2.2.2 8.8.8.8

ip dhcp excluded-address 10.1.1.254
ip dhcp excluded-address 10.1.50.254

Do we have connectivity now, BASIC connectivity? Can you ping from a PC connected to a switchport to it's default gateway?

DCD

In your first post you said you could telnet to all the devices but it was unclear if the other 2 devices SSH connection was working. IF you can connect to those devices with ssh then it the switch. If you can't connect to both of those it maybe your client software is mis-configured. Since Telnet works that rules out the password and connectivity problems.

JeanM

+1 on everything RouteMyPacket said. Start with the basics, clearly define your setup/config and then add more to it as you read how it works and what it is you are trying to do. Shotgun approach usually is a waste of time.

sagarmistry

RouteMyPacket wrote: »

You need to start with the basics, it is the same process you will use throughout your career. I cannot stand people throwing out troubleshooting tips when the basics haven't been discovered.

Remove passwords from vty lines, trying ssh -l, any filtering? Every single one of those are irrelevant until you can confirm L1 - L3 connectivity

How do you have the network laid out? How many devices are there? What are their functions? What good is SSH and Passwords if you cannot even reach the device?

So when I'm on my router 10.1.3.2 I can ping the switch which is 10.1.1.10.

Ok, so you have a router and a switch, they are on two separate networks. I can already tell from your switch configuration that you want it to perform your inter-vlan routing, you have multiple SVI's configured. So what are you using the router for?

WHAT ARE YOU TRYING TO ACCOMPLISH?

If you want to implement a router on a stick, then you will trunk the switch to the router. Configure your L2 Vlans on the switch and assign access ports to whatever Vlan you want, in your case vlans 1 and 50

On the router you will create sub interfaces for each vlan, plug the trunk port on the switch into the router port

On router:

interface FastEthernet0/1.1
description VLAN 1
encapsulation dot1Q 1
ip address 10.1.1.254 255.255.255.0

interface FastEthernet0/1.50
description VLAN 50
encapsulation dot1Q 50
ip address 10.1.50.254 255.255.255.0


Say your "Management" Vlan is 1 so the switch gets IP that it already has, so leave that interface alone. Delete the 50 and 100 vlan interfaces

Create your L2 VLANs on the switch

vlan 50
name Data

vlan 100
name BlaBla

int f0/2
switchport host
switchport access vlan 50
no shut

int f0/3
switchport host
no shut

How are you handling DHCP? If you want, static the IP for a quick test. Connect your PC to one of those ports, can the PC reach it's default gateway?


If you want the router to handle DHCP, thenc reate multiple pools

ip dhcp pool VLAN1
network 10.1.1.0 255.255.255.0
domain-name abc.com
default-router 10.1.1.254
dns-server 4.2.2.2 8.8.8.8

ip dhcp pool VLAN50
network 10.1.50.0 255.255.255.0
domain-name abc.com
default-router 10.1.50.254
dns-server 4.2.2.2 8.8.8.8

ip dhcp excluded-address 10.1.1.254
ip dhcp excluded-address 10.1.50.254

Do we have connectivity now, BASIC connectivity? Can you ping from a PC connected to a switchport to it's default gateway?

Ok Here's What I have at home:
2 switches: one 3550 one 2900 XL
1 router: 2651xm series.


My laptop is connected to 3550 switch. Both switches are connected to 2651 router.

2651 Router is connected to home dlink router. hence the Internet.

Now, I can TELNET all these devices from each other. I.e I can telnet the router from 3550 switch and 2900 switch. From my router I can telnet both switches. I can ping all these devices when I'm on one of those device. I.e. when I'm on switch I can ping the router and vice versa.

HOWEVER, from my PC connected to 3550 switch, I get can't ping any of them or telnet any of them or SSH any of them.

I have ethernet connected to my PC from port 5 of 3550 switch. but it shows me no network connection.

On port 5 i have this command set: switchport mode access. and port 5 is in default VLAN.

All I'm trying to accomplish is to do SSH on that switch, I haven't tried SSH on any other switch or router, just the basic 3550 my PC is connected to.

Also, i have set the IP of my PC in LOCAL AREA CONNECTION 2, which is the ethernet connected to the switch as 10.1.1.109 255.255.255.0

So I'm in same network as VLAN 1 of switch 3550.


So maybe I need to configure something to get network connection via ethernet first? then I'll be able to SSH into the switch??

sagarmistry

JeanM wrote: »

+1 on everything RouteMyPacket said. Start with the basics, clearly define your setup/config and then add more to it as you read how it works and what it is you are trying to do. Shotgun approach usually is a waste of time.

I did. I followed all the commands needed for it. On 13th video of CBT nuggets jeremy does SSH and I followed all commands he had issued. I didn't jump right onto SSH. just misconfigured something somewhere.

sagarmistry

DCD wrote: »

In your first post you said you could telnet to all the devices but it was unclear if the other 2 devices SSH connection was working. IF you can connect to those devices with ssh then it the switch. If you can't connect to both of those it maybe your client software is mis-configured. Since Telnet works that rules out the password and connectivity problems.

Ok Here's What I have at home:
2 switches: one 3550 one 2900 XL
1 router: 2651xm series.


My laptop is connected to 3550 switch. Both switches are connected to 2651 router.

2651 Router is connected to home dlink router. hence the Internet.

Now, I can TELNET all these devices from each other. I.e I can telnet the router from 3550 switch and 2900 switch. From my router I can telnet both switches. I can ping all these devices when I'm on one of those device. I.e. when I'm on switch I can ping the router and vice versa.

HOWEVER, from my PC connected to 3550 switch, I get can't ping any of them or telnet any of them or SSH any of them.

I have ethernet connected to my PC from port 5 of 3550 switch. but it shows me no network connection.

On port 5 i have this command set: switchport mode access. and port 5 is in default VLAN.

JeanM

So there you go, looks like you have connectivity issue and not SSH issue "HOWEVER, from my PC connected to 3550 switch, I get can't ping any of them or telnet any of them or SSH any of them."

Is the 2651 running NAT behind the dlink or does the dlink have routes back to the 2651 networks?

Post a diagram of the network, it's hard to tell what goes where.

sagarmistry

JeanM wrote: »

So there you go, looks like you have connectivity issue and not SSH issue "HOWEVER, from my PC connected to 3550 switch, I get can't ping any of them or telnet any of them or SSH any of them."

Is the 2651 running NAT behind the dlink or does the dlink have routes back to the 2651 networks?

Post a diagram of the network, it's hard to tell what goes where.

So this is my HOMELAB.

Subnet mask for all of the IP's is the same: 255.255.255.0

As said in the picture, my Laptop isn't getting network connection when I give it IP: 10.1.1.109

I MADE SOME CHANGES AND CONNECTED THE SWITCH DIRECTLY TO HOME ROUTER AND THUS THE INTERNET.

I realized that i have to issue more commands if I connect internet directly to the router.

So for now this is the home lab and i'll be adding second router.

But first thing first: my laptop isn't getting internet connection.

All other devices are well connected to each other and can be pinged from each other as shown in the picture.

Dieg0M

Ok, your first post was not clear at all. You meant you can telnet to the switch from the routers and switches but cant from your PC. From your router try: "ssh -l sagar 10.1.1.10". You might need to configure SSH on that router to be able to type that command or upgrade the IOS. For the PC issue, you should try and change your speed settings and make sure the port is in the up/up state. From the configs it seems like the only issue you have is connectivity between your PC and the switch.

sagarmistry

Dieg0M wrote: »

Ok, your first post was not clear at all. You meant you can telnet to the switch from the routers and switches but cant from your PC. From your router try: "ssh -l sagar 10.1.1.10". You might need to configure SSH on that router to be able to type that command or upgrade the IOS. For the PC issue, you should try and change your speed settings and make sure the port is in the up/up state. From the configs it seems like the only issue you have is connectivity between your PC and the switch.

Yea my bad. Didn't think it through. Should have just posted the topology from the start.

So for the PC issue, port 5 is up/up. I issued commands speed 100 and duplex full.

Still no network connection.

JeanM

<sup>Ok first things first.

What is the subnet on the local interface of your dlink router? is it 192.168.0.x ?

If you are trying to get routing to work between the 10. and 192. then you need to think about how traffic would flow from your laptop to dlink and back.</sup>

sagarmistry

JeanM wrote: »

<sup>Ok first things first.

What is the subnet on the local interface of your dlink router? is it 192.168.0.x ?

If you are trying to get routing to work between the 10. and 192. then you need to think about how traffic would flow from your laptop to dlink and back.</sup>

default gateway is 192.168.0.1 and sub is 255.255.255.0

but dlink router is connected to the switch, shouldn't this just provide internet connection to all ports of my switch?
all ports on switch is issues this command: switchport mode access

JeanM

Does the dlink know anything about the 10. network?
Meaning, does the dlink have a routing protocol to learn that there is also a 10.x network on the local side OR did you add a static route on the dlink router for it to know about the 10. network?
OR are you going to run NAT instance between 10. lab network and 192. local lan network with internet connectivity?

sagarmistry

JeanM wrote: »

Does the dlink know anything about the 10. network?
Meaning, does the dlink have a routing protocol to learn that there is also a 10.x network on the local side OR did you add a static route on the dlink router for it to know about the 10. network?
OR are you going to run NAT instance between 10. lab network and 192. local lan network with internet connectivity?

Wait..But all that is really required??

All I'm trying to do is ssh between my laptop and switch. I don't really need internet connection do I?

And no I haven't set anything on dlink. It's the Dlink ac 1700 router, i just bought it and attached to my modem.

JeanM

If you are trying to establish a connection between different networks (ssh or not) like when you set your laptop on 10.1.1. network but your dlink is on 192.168.0. then yes. As your laptop on 192.168.0.103 with default gw of 192.168.0.1 doesn't know anything about interface 10.1.1.10 where you are trying to SSH into.

OR set up your switch on the same ip range as your home lan segment. Many ways to do this, but you need to get your connectivity going first before you try to SSH.

ecuadra

Try to find out why your laptop cant ping the switch even though its in the same network. I would try to ssh from your laptop to the switch that is on the same network first using terra term or putty but you have to be able to ping first.