crypto key generate rsa
Enable SSH access on a Cisco router or switch by generating the cryptographic key pair required for the SSH server.
Definition: crypto key generate rsa is a Cisco IOS global config command. Generates RSA key pairs used to enable SSH on Cisco IOS devices. The modulus size determines key strength — minimum 768 bits for SSH version 1, 1024 bits recommended for SSH version 2.
Overview
The `crypto key generate rsa` command is a fundamental tool for enabling secure management access to Cisco IOS devices. It generates an RSA key pair—a public key and a private key—that underpins cryptographic operations such as SSH (Secure Shell) for encrypted remote administration, IPsec for VPNs, and digital signatures for routing protocol authentication. Without RSA keys, SSH cannot function, leaving the device reliant on insecure Telnet.
This command is typically one of the first steps in securing a Cisco router or switch, often executed immediately after setting a hostname and domain name (both required for key generation). The command is used in global configuration mode and requires the device to have sufficient entropy; on some platforms, you may need to generate keys with a modulus of at least 2048 bits for modern security standards. The generated keys are stored in NVRAM (non-volatile RAM) and persist across reboots.
The command produces a buffered output showing the key generation progress, which can be slow on older hardware. Privilege level 15 (privileged EXEC) is required. The RSA key pair is stored in the running configuration as part of the `crypto key` configuration, and you can view it with `show crypto key mypubkey rsa`.
Alternatives include using pre-shared keys for simpler scenarios, but RSA is the standard for SSH. In a broader workflow, after generating keys, you typically enable SSH with `ip ssh version 2` and `line vty` transport input ssh. The command is also used for generating keys for digital certificates (e.g., for HTTPS or 802.1X).
A common mistake is forgetting to set the hostname and domain name first, which causes the command to fail with an error like "% Please define a hostname and domain name." The modulus size is critical: smaller moduli (e.g., 512) are insecure and may be rejected by modern SSH clients. The command also impacts the running config by adding lines like `crypto key pubkey-chain rsa` and the public key itself, though the private key is never displayed. Understanding this command is essential for CCNA and CCNP candidates as it directly relates to network security and remote access management.
crypto key generate rsa [general-keys | usage-keys] [modulus <modulus-size>]When to Use This Command
- Enable SSHv2 on a router or switch replacing insecure Telnet
- Generate a 2048-bit key for stronger encryption on internet-facing devices
- Re-generate keys after a security incident or key compromise
- Required step before ip ssh version 2 takes effect
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| modulus | <360-4096> | Specifies the size of the RSA key modulus in bits. Valid values are from 360 to 4096, but Cisco recommends a minimum of 2048 bits for security. Larger moduli provide stronger encryption but take longer to generate and use more CPU. Common mistake: using a modulus less than 1024, which is considered weak and may be rejected by SSH clients. |
Command Examples
Generate 2048-bit RSA key for SSHv2
Router(config)# ip domain-name courseiva.com Router(config)# crypto key generate rsa general-keys modulus 2048 The name for the keys will be: Router.courseiva.com Choosing a key modulus greater than 512 may take a few minutes. Generating 2048 bit RSA keys, keys will be non-exportable... [OK] (elapsed time was 4 seconds) Router(config)# ip ssh version 2
Understanding the Output
The key name is automatically formed as hostname.domain-name. Keys are stored in NVRAM. After generation, SSH is enabled on port 22.
Use show ip ssh to verify SSHv2 is active and show crypto key mypubkey rsa to view the public key.
Configuration Scenarios
Enable SSH on a Cisco Router for Secure Remote Management
A network administrator needs to replace insecure Telnet with SSH for remote management of a branch office router. The router must generate RSA keys to support SSH encryption.
Topology
Admin-PC---Internet---R1(Gi0/0)---LANSteps
- 1.Step 1: Enter privileged EXEC mode: Router> enable
- 2.Step 2: Enter global configuration mode: Router# configure terminal
- 3.Step 3: Set the hostname: Router(config)# hostname R1
- 4.Step 4: Set the domain name: R1(config)# ip domain-name example.com
- 5.Step 5: Generate RSA keys with 2048-bit modulus: R1(config)# crypto key generate rsa modulus 2048
- 6.Step 6: Configure SSH version 2: R1(config)# ip ssh version 2
- 7.Step 7: Configure VTY lines for SSH only: R1(config)# line vty 0 4, R1(config-line)# transport input ssh, R1(config-line)# login local
- 8.Step 8: Create a local user: R1(config)# username admin secret cisco123
- 9.Step 9: Exit and save: R1(config)# end, R1# write memory
! Full IOS config block hostname R1 ip domain-name example.com crypto key generate rsa modulus 2048 ip ssh version 2 line vty 0 4 transport input ssh login local username admin secret cisco123 end
Verify: Use `show ip ssh` to verify SSH is enabled and `show crypto key mypubkey rsa` to see the generated public key. Expected output for `show ip ssh`: SSH Enabled - version 2.0, Authentication timeout: 120 secs, Authentication retries: 3.
Watch out: Forgetting to set the hostname and domain name before key generation will cause the command to fail with an error. Also, ensure the modulus is at least 2048 bits for modern security compliance.
Generate RSA Keys for IPsec VPN Authentication
A site-to-site VPN between two routers requires RSA signatures for IKE authentication. Each router must generate its own RSA key pair to be used in the PKI (Public Key Infrastructure).
Topology
R1(Gi0/0)---Internet---(Gi0/0)R2Steps
- 1.Step 1: On R1, enter global config: R1> enable, R1# configure terminal
- 2.Step 2: Set hostname and domain: R1(config)# hostname R1, R1(config)# ip domain-name vpn.example.com
- 3.Step 3: Generate RSA keys with 2048-bit modulus: R1(config)# crypto key generate rsa modulus 2048
- 4.Step 4: Generate a self-signed certificate (optional): R1(config)# crypto pki trustpoint VPN-TP, R1(ca-trustpoint)# enrollment selfsigned, R1(ca-trustpoint)# subject-name CN=R1.vpn.example.com, R1(ca-trustpoint)# exit, R1(config)# crypto pki enroll VPN-TP
- 5.Step 5: Repeat steps 1-4 on R2 with appropriate hostname and domain.
- 6.Step 6: Configure IPsec parameters referencing the RSA keys (e.g., crypto isakmp policy, crypto ipsec transform-set, crypto map).
! On R1 hostname R1 ip domain-name vpn.example.com crypto key generate rsa modulus 2048 crypto pki trustpoint VPN-TP enrollment selfsigned subject-name CN=R1.vpn.example.com crypto pki enroll VPN-TP ! On R2 hostname R2 ip domain-name vpn.example.com crypto key generate rsa modulus 2048 crypto pki trustpoint VPN-TP enrollment selfsigned subject-name CN=R2.vpn.example.com crypto pki enroll VPN-TP
Verify: Use `show crypto key mypubkey rsa` to display the public key. For certificate verification, use `show crypto pki certificates`. Expected output shows the key label (e.g., R1.vpn.example.com) and the modulus size.
Watch out: The RSA key pair generated is used for both SSH and IPsec by default. If you need separate keys for different purposes, consider using labels with `crypto key generate rsa general-keys` or `usage-keys`. Also, ensure the domain name is consistent across VPN peers if using certificates.
Troubleshooting with This Command
When troubleshooting RSA key generation, the first step is to verify that the hostname and domain name are configured. Use `show running-config | include hostname` and `show running-config | include domain-name`. If they are missing, the command will fail with a clear error.
Next, check the key generation output: a healthy generation shows "The name for the keys will be: <hostname>.<domain>" followed by a percentage progress. If the process hangs or is extremely slow, the device may lack entropy; on virtual platforms, you may need to generate traffic or use `crypto key generate rsa general-keys modulus <bits>` with the `exportable` keyword if needed. After generation, verify with `show crypto key mypubkey rsa`.
The output should list the key label, modulus size, and key type (e.g., RSA general purpose). Common issues include: (1) Key generation fails due to insufficient memory—reduce the modulus size or upgrade hardware. (2) SSH still fails after key generation—check `show ip ssh` for version mismatch or authentication errors; ensure VTY lines are configured for SSH transport. (3) The key is not used by SSH—verify that `ip ssh rsa keypair-name` is not set to a non-existent key. (4) On some IOS versions, the key may be generated but not saved to NVRAM; use `write memory` to preserve it. Correlate with `debug crypto key` to see key generation details.
If the device is part of a stack, ensure the active supervisor generates the keys; standby supervisors may not have the same keys. For IPsec, use `show crypto isakmp sa` and `show crypto ipsec sa` to verify that RSA authentication is working. A common symptom is that the peer's public key is not trusted; use `show crypto pki certificates` to check certificate status.
In summary, the key generation command is usually straightforward, but issues often stem from missing prerequisites or insufficient resources.
CCNA Exam Tips
CCNA SSH configuration order: (1) hostname <name>, (2) ip domain-name <domain>, (3) crypto key generate rsa modulus 1024+, (4) ip ssh version 2, (5) line vty 0 4 → transport input ssh, login local
Without a domain name, crypto key generate rsa fails with an error
Minimum modulus for SSHv2 is 768 bits; 1024 or 2048 is best practice
Common Mistakes
Forgetting to set ip domain-name before generating keys — IOS uses hostname.domain-name as the key name
Setting modulus below 768 and expecting SSHv2 to work
Not running transport input ssh on vty lines — Telnet remains open even after SSH is configured
crypto key generate rsa vs username privilege
These two commands are often confused because both are fundamental to configuring secure SSH access on Cisco IOS devices. crypto key generate rsa provides the encryption keys necessary for SSH, while username privilege creates local user accounts for authentication. Understanding their distinct roles is essential for proper SSH setup.
| Aspect | crypto key generate rsa | username privilege |
|---|---|---|
| Function | Generates RSA public/private key pair for encryption | Creates local user account with privilege level and password |
| Configuration persistence | Stored in NVRAM as part of the RSA key pair (not in running-config directly) | Stored in running-config and saved to startup-config |
| Effect on SSH | Enables SSH server to use the generated keys for encryption | Provides authentication credentials for SSH login |
| Required for SSH | Required (at least 768-bit modulus for SSHv1, 1024-bit for SSHv2) | Required if no AAA or other authentication method is configured |
| Security impact | Key modulus size determines encryption strength | Privilege level controls command access; password should be hashed |
| Typical combination | Used with 'ip ssh' commands and 'username' for full SSH setup | Often paired with 'crypto key generate rsa' and 'line vty' commands |
Use crypto key generate rsa when you need to enable SSH on the device by generating the required RSA key pair, typically before configuring SSH version and authentication.
Use username privilege when you need to create a local user account with a specific privilege level for SSH or console login, especially for management access without a TACACS+ server.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the command syntax is identical: `crypto key generate rsa modulus <bits>`. However, IOS-XE may require the `general-keys` keyword for some features. The output format is similar but may include additional lines about key storage location.
In NX-OS (e.g., Nexus switches), the equivalent command is `crypto key generate rsa <bits>` (without the `modulus` keyword) and is executed in global configuration mode. NX-OS also supports `crypto key generate rsa <bits> label <label>` for named keys. For ASA firewalls, the command is `crypto key generate rsa modulus <bits>` in global configuration mode, but the ASA uses a different key storage mechanism and may require `crypto key generate rsa general-keys` for SSH.
In IOS-XR (e.g., ASR 9000), RSA key generation is done via `crypto key generate rsa <bits>` in global configuration, but the syntax and behavior differ significantly; IOS-XR uses a separate key management infrastructure. Older IOS versions (12.x) support moduli as low as 360 bits, but modern versions (15.x, 16.x) enforce a minimum of 512 bits and strongly recommend 2048. The command is available in all IOS versions but may have different default key labels.
On some platforms, you can generate multiple key pairs with different labels using `crypto key generate rsa general-keys label <label> modulus <bits>`. Always check the specific platform documentation for exact syntax.
Related Commands
hostname
Sets the hostname of a Cisco router or switch. The hostname appears in the CLI prompt, is used in SSH key generation (hostname.domain-name), and is advertised via CDP to neighbour devices.
no ip domain-lookup
Disables DNS lookup on mistyped commands in the CLI. Without this command, IOS attempts to resolve every unknown word as a hostname via DNS broadcast, causing 30-second hangs after typos.
username privilege
Creates a local user account with a specific privilege level (0-15) and a hashed password stored in the configuration. Privilege 15 grants full access equivalent to enable mode.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions