exec-timeout [min] [sec]
Sets the inactivity timeout for an EXEC session on a line, automatically logging out idle users to free up resources and enhance security.
Definition: exec-timeout [min] [sec] is a Cisco IOS line config command. Sets the inactivity timeout for an EXEC session on a line, automatically logging out idle users to free up resources and enhance security.
Overview
The `exec-timeout` command is a critical security and resource management tool in Cisco IOS. It sets the inactivity timeout for an EXEC session on a line (such as console, auxiliary, or vty lines). When a user session remains idle for the specified duration, the router automatically logs out the user, freeing up the line for other connections and reducing the risk of unauthorized access if a terminal is left unattended.
This command is part of the line configuration mode and is typically applied to all vty lines to enforce session timeouts for remote SSH or Telnet users. The concept behind this command is session management: network devices have limited line resources (e.g., 16 vty lines by default), and idle sessions can exhaust these resources, preventing new legitimate connections. Additionally, from a security perspective, an unattended session could be hijacked by an attacker.
Alternatives include using `absolute-timeout` (which logs out after a fixed time regardless of activity) or relying on SSH idle timeout settings, but `exec-timeout` is the most common and flexible method. In a typical workflow, after configuring authentication and authorization (e.g., AAA), you set `exec-timeout` to enforce session limits. The command takes effect immediately on the line; existing sessions are not affected until they become idle.
The timeout value is stored in the running configuration and can be saved to startup-config. Note that the timeout applies to the EXEC process, not the line itself; if a user is in a sub-mode (e.g., config mode), the timer still counts. The default timeout is 10 minutes on most lines, but it's best practice to set a shorter value (e.g., 5 minutes) for vty lines.
The command requires line configuration mode, which is accessible from global config. There is no impact on the running config beyond the line configuration lines. Understanding this command is essential for CCNA and CCNP candidates as it appears in security and infrastructure management topics.
exec-timeout [min] [sec]When to Use This Command
- Configure a 5-minute timeout on console lines to prevent unauthorized access if an admin walks away.
- Set a 10-minute timeout on VTY lines for remote SSH sessions to reduce risk of session hijacking.
- Apply a 0-minute timeout (no timeout) on a management console during maintenance windows to avoid disconnection.
- Enforce a 2-minute timeout on auxiliary lines for dial-in users to conserve modem resources.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| minutes | <0-35791> | Specifies the number of minutes of inactivity before the session is terminated. The range is 0 to 35791 minutes (about 24.8 days). A value of 0 disables the timeout, meaning the session never times out. Common values are 5, 10, or 15 minutes. A common mistake is setting 0 for vty lines, which is a security risk. |
| seconds | <0-2147483> | Optional additional seconds to add to the minutes value. The range is 0 to 2147483 seconds (about 24.8 days). If omitted, seconds default to 0. This allows fine-grained timeout settings, e.g., 5 minutes and 30 seconds. A common mistake is forgetting that the total timeout is minutes + seconds; setting both to 0 disables timeout. |
Command Examples
Set 5-minute timeout on console line
Router(config-line)# exec-timeout 5 0Router(config-line)#
No output is generated; the command is applied silently. The timeout is set to 5 minutes and 0 seconds.
Set 10-minute 30-second timeout on VTY lines
Router(config-line)# exec-timeout 10 30Router(config-line)#
Sets the timeout to 10 minutes and 30 seconds. After this idle period, the session will be terminated.
Understanding the Output
The exec-timeout command does not produce any output when configured. To verify the setting, use 'show running-config | section line' or 'show line'. In 'show line', look for the 'Timeout' field under the specific line number; it displays the timeout in minutes and seconds (e.g., 'Timeout: 5 minutes').
A value of '0' means no timeout. Good practice is to set a timeout between 5-15 minutes for most lines; a timeout of 0 should be used sparingly and only in secure environments.
Configuration Scenarios
Set inactivity timeout on vty lines for remote access
A network administrator wants to enforce a 5-minute idle timeout on all vty lines (0-4) to prevent idle SSH sessions from consuming resources and to improve security. This is a common baseline configuration for remote management.
Topology
Admin PC --- SSH --- Router (vty lines 0-4)Steps
- 1.Step 1: Enter global configuration mode: Router> enable
- 2.Step 2: Enter line configuration mode for vty lines 0-4: Router(config)# line vty 0 4
- 3.Step 3: Set the exec-timeout to 5 minutes: Router(config-line)# exec-timeout 5
- 4.Step 4: (Optional) Set a timeout for the console line as well: Router(config-line)# line console 0
- 5.Step 5: (Optional) Router(config-line)# exec-timeout 10
- 6.Step 6: Exit configuration mode and verify: Router(config-line)# end
! line vty 0 4 exec-timeout 5 ! line console 0 exec-timeout 10 !
Verify: Use 'show running-config | section line vty' to verify the timeout is set. Expected output includes 'exec-timeout 5' under the vty lines. Also, 'show line' can be used to see current timeout settings.
Watch out: If you set exec-timeout 0, the session never times out, which is a security risk. Always use a positive value for vty lines.
Disable exec-timeout on console line for lab environment
In a lab environment, an engineer wants to disable the inactivity timeout on the console line to avoid being logged out during long configuration sessions. This is acceptable in a controlled lab but not in production.
Topology
PC (console cable) --- Router (console line 0)Steps
- 1.Step 1: Enter global configuration mode: Router> enable
- 2.Step 2: Enter line configuration mode for console 0: Router(config)# line console 0
- 3.Step 3: Disable the timeout by setting minutes and seconds to 0: Router(config-line)# exec-timeout 0 0
- 4.Step 4: Exit and verify: Router(config-line)# end
! line console 0 exec-timeout 0 0 !
Verify: Use 'show running-config | section line console' to see 'exec-timeout 0 0'. Also, 'show line console 0' will show 'Timeout: Idle EXEC 0:00:00'.
Watch out: Disabling timeout on console is convenient but can leave the session open if the console is left unattended. In production, always set a reasonable timeout.
Troubleshooting with This Command
When troubleshooting issues related to `exec-timeout`, the primary symptom is users being unexpectedly disconnected from their sessions. This often occurs when the timeout value is set too low for the typical work patterns. For example, if an engineer is reading a long output or taking a short break, a 5-minute timeout might log them out.
Conversely, if sessions are not timing out at all, the timeout may be set to 0 or a very high value, which can lead to resource exhaustion. To diagnose, first check the running configuration for the relevant lines using `show running-config | section line`. Look for `exec-timeout` statements.
If none appear, the default timeout (10 minutes) applies. Use `show line` to see the current timeout settings for all lines; the output includes 'Timeout: Idle EXEC' with the configured value. If a user is currently connected, `show users` displays active sessions and their idle time.
If a session has been idle longer than the timeout but hasn't been disconnected, check if the timeout is disabled (0). Another common issue is that the timeout applies only to the EXEC process; if a user is in a sub-mode (e.g., config mode), the timer still counts. To correlate with other commands, use `debug line` to monitor line events, though this is rarely needed.
A step-by-step diagnostic flow: 1) Identify the line type (console, vty, aux). 2) Check the running config for `exec-timeout`. 3) Use `show line` to confirm the active timeout. 4) If users are being disconnected too quickly, increase the timeout. 5) If sessions are not timing out, ensure the timeout is not set to 0 and that the line is not configured with `no exec-timeout` (which is not a valid command; use `exec-timeout 0` to disable). Remember that `exec-timeout` is per-line, so different lines can have different values. Also, the timeout is reset by any keypress, including typing commands or pressing Enter.
If a user is in a long-running command (e.g., `ping` with a large count), the timer continues to count, so they might be disconnected before the command completes. In such cases, consider using `absolute-timeout` instead, or increase the timeout. Finally, note that the `exec-timeout` command does not affect the time a user spends in privileged EXEC mode; it only applies to the EXEC session overall.
Understanding these nuances helps in configuring appropriate timeout values for different operational needs.
CCNA Exam Tips
Remember that exec-timeout applies to EXEC mode sessions, not to privileged EXEC mode directly; it affects the user after login.
The default timeout is 10 minutes on most lines; the exam may ask you to change it to a specific value.
Setting exec-timeout 0 0 disables the timeout entirely—this is a security risk and often a wrong answer in security scenarios.
The command is configured in line configuration mode (config-line), not global config.
Common Mistakes
Forgetting to enter line configuration mode before issuing the command, resulting in '% Invalid input detected'.
Using 'exec-timeout 0' without specifying seconds, which defaults to 0 minutes 0 seconds (no timeout) instead of the intended 0 minutes.
Setting the timeout too short (e.g., 1 minute) causing frequent disconnections during normal use.
exec-timeout [min] [sec] vs line console 0
The `exec-timeout` and `line console 0` commands are often discussed together because `exec-timeout` is commonly configured after entering line configuration mode via `line console 0`. While `line console 0` selects the console line for parameter changes, `exec-timeout` specifies the idle timeout for that line, making them complementary but distinct in function.
| Aspect | exec-timeout [min] [sec] | line console 0 |
|---|---|---|
| Scope | per-line idle timeout setting | enters configuration mode for a specific line |
| Configuration mode | line configuration subcommand | global configuration command |
| Effect | sets maximum idle time before session termination | does not directly apply settings; enables line parameters |
| Persistence | saved per line in running-config | no persistent effect; only enters submodal |
| Typical use | enforce logout after inactivity | begin configuring console access controls |
Use `exec-timeout [min] [sec]` when you need to automatically log out idle users from a specific line to free resources and improve security.
Use `line console 0` when you need to enter line configuration mode for the console port to configure settings such as password, timeout, or authorization.
Platform Notes
In Cisco IOS-XE (e.g., on Catalyst 9000 switches or ISR 4000 routers), the `exec-timeout` command syntax and behavior are identical to classic IOS. However, on some IOS-XE platforms, the default timeout for vty lines may be 0 (disabled) in certain software versions, so it's important to verify. On NX-OS (Cisco Nexus switches), the equivalent command is `session-timeout` under line configuration.
For example, to set a 10-minute timeout on vty lines: `line vty` then `session-timeout 10`. Note that NX-OS uses `session-timeout` instead of `exec-timeout`, and the value is in minutes only (no seconds). On Cisco ASA firewalls, the equivalent is `timeout` under the `ssh` or `telnet` configuration, e.g., `ssh timeout 5` sets idle timeout for SSH sessions.
ASA does not have a line-based timeout; instead, it is per protocol. For IOS-XR (Cisco routers running IOS-XR), the command is `exec-timeout` as well, but it is configured under the `line` configuration mode similarly. However, IOS-XR uses a different configuration hierarchy; you enter `line console` or `line default` and then `exec-timeout`.
The syntax is the same: `exec-timeout minutes [seconds]`. In IOS versions 12.x and earlier, the command was identical. In 15.x and 16.x, no changes were made to the command itself.
One nuance: on some older IOS versions, the default timeout for console line was 0 (disabled), but in modern versions, it's 10 minutes. Always check the specific platform documentation. Overall, the command is consistent across Cisco platforms with minor variations in naming or scope.
Related Commands
line console 0
Enters line configuration mode for the console port (line 0) to configure console access parameters such as password, timeout, and exec mode.
line vty 0 4
Enters line configuration mode for virtual terminal (VTY) lines 0 through 4 to configure remote access settings like Telnet/SSH, ACLs, and timeout parameters.
show line
Displays line configuration and status information for console, auxiliary, and vty lines, used to verify line settings and monitor user connections.
show running-config
Displays the current active configuration in DRAM, showing all non-default settings.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions