ssh -l [username] [ip]
Establishes an encrypted SSH connection from a Cisco IOS device to a remote host for secure remote management.
Definition: ssh -l [username] [ip] is a Cisco IOS privileged exec command. Establishes an encrypted SSH connection from a Cisco IOS device to a remote host for secure remote management.
Overview
The `ssh -l [username] [ip]` command is used in Cisco IOS Privileged EXEC mode to establish an encrypted SSH connection from a Cisco router or switch to a remote host. This command is essential for secure remote management, allowing network administrators to access and manage remote devices over an encrypted channel, protecting sensitive data such as login credentials and configuration commands from eavesdropping. SSH (Secure Shell) is a cryptographic network protocol that provides a secure alternative to Telnet, which transmits data in plaintext.
In modern networks, SSH is the de facto standard for remote CLI access, and Cisco devices support both SSH server and client functionality. The `ssh` command in IOS enables the device to act as an SSH client, initiating outbound connections to other SSH-enabled devices (routers, switches, servers, etc.). This is particularly useful for network automation, troubleshooting, and managing devices that are not directly reachable via console or auxiliary ports.
The command is typically used when you need to securely access another network device from your current management session, for example, when you are logged into a central router and need to configure a remote branch router. Alternatives include Telnet (unencrypted, not recommended), SNMP (for monitoring, not interactive CLI), or direct console access (requires physical presence). The `ssh` command fits into the broader workflow of network management as part of a secure access strategy, often used in conjunction with AAA (Authentication, Authorization, and Accounting) for centralized authentication and command logging.
Important IOS behavior: The SSH client requires that the remote device supports SSH and that the IOS image includes the IPsec feature set (k9 images) for cryptographic support. The command is executed from Privileged EXEC mode (enable mode), not from user EXEC or global configuration mode. The output is displayed interactively; once the connection is established, you are presented with the remote device's CLI prompt.
To return to the original device, you must exit the SSH session (e.g., by typing `exit` or `logout`). The command does not modify the running configuration; it is an operational command. However, the device must have SSH client capabilities enabled (which is default in k9 images).
The connection uses TCP port 22 by default. If the remote device is not reachable or SSH is not enabled, the command will fail with an error message like "% Connection refused by remote host" or "% No route to host". The command supports various options such as specifying a port number with `-p` or enabling verbose output with `-v`.
For CCNA and CCNP candidates, understanding the `ssh` command is crucial for secure device management and is a key skill in network security and troubleshooting scenarios.
ssh -l [username] [ip]When to Use This Command
- Securely accessing a remote router or switch for configuration changes
- Connecting to a network device in a different subnet for troubleshooting
- Managing devices over the internet or untrusted networks
- Automating remote device access via scripts using SSH
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| username | WORD | Specifies the username to use for authentication with the remote SSH server. This must be a valid username configured on the remote device. Common mistakes include using a username that does not exist on the remote host, which will result in authentication failure. |
| ip | A.B.C.D | The IP address or hostname of the remote SSH server. This can be an IPv4 address in dotted decimal notation (e.g., 192.168.1.1) or a hostname if DNS resolution is configured. Common mistakes include using an incorrect IP address or a hostname that cannot be resolved, leading to connection timeout or failure. |
Command Examples
Basic SSH connection to a router
ssh -l admin 192.168.1.1Password: Router#
The command prompts for the password of user 'admin' on the remote host at 192.168.1.1. After successful authentication, the CLI prompt changes to the remote device's privileged EXEC mode.
SSH connection with verbose output for debugging
ssh -v -l cisco 10.0.0.1SSH: host key not found SSH: host key accepted SSH: authentication successful Password: RemoteRouter#
The -v flag enables verbose mode, showing steps like host key verification and authentication status. This is useful for troubleshooting connection issues.
Understanding the Output
The output of the ssh command is interactive. Initially, it may prompt for the password. If verbose mode is enabled, it shows progress messages: 'host key not found' indicates first-time connection, 'host key accepted' means the key was trusted, and 'authentication successful' confirms login.
After successful login, the remote device's prompt appears, indicating you are now in its CLI. If the connection fails, error messages like 'Connection refused' or 'Host unreachable' will appear. A successful connection means you can execute commands on the remote device.
Configuration Scenarios
Establishing an SSH Session from a Central Router to a Remote Branch Router
A network administrator is logged into the central router (R1) and needs to securely access the remote branch router (R2) to verify its configuration. Both routers are reachable via the network and have SSH enabled.
Topology
R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2Steps
- 1.Step 1: Enter privileged EXEC mode on R1: R1> enable
- 2.Step 2: Initiate SSH connection to R2 with username 'admin': R1# ssh -l admin 10.0.12.2
- 3.Step 3: Enter the password for user 'admin' when prompted (password is not displayed).
- 4.Step 4: Once authenticated, you are now at the CLI of R2 (e.g., R2>). Perform necessary configuration or verification tasks.
- 5.Step 5: Exit the SSH session to return to R1: R2> exit
! No configuration is required on R1 for the SSH client; the command is executed directly. ! On R2, SSH server must be enabled (example config): R2(config)# ip domain-name example.com R2(config)# crypto key generate rsa modulus 2048 R2(config)# ip ssh version 2 R2(config)# line vty 0 4 R2(config-line)# transport input ssh R2(config-line)# login local
Verify: After successful connection, you should see the remote device's prompt (e.g., R2>). Use 'show ssh' on R2 to verify active SSH sessions: R2# show ssh
Watch out: If the SSH connection fails with '% Connection refused by remote host', ensure that the remote device has SSH server enabled and that the VTY lines are configured to accept SSH connections (transport input ssh).
Using SSH with a Non-Default Port for Security
An organization uses a non-standard SSH port (e.g., 2222) on some devices to reduce automated attacks. The administrator needs to connect to a server at 192.168.10.100 using port 2222.
Topology
Admin PC---(Management Network)---Cisco Router---(Internet)---Server (192.168.10.100)Steps
- 1.Step 1: Enter privileged EXEC mode on the Cisco router: Router> enable
- 2.Step 2: Use the -p option to specify the port: Router# ssh -l admin -p 2222 192.168.10.100
- 3.Step 3: Enter the password when prompted.
- 4.Step 4: Perform required tasks on the remote server.
- 5.Step 5: Exit the session: exit
! No additional configuration is needed on the Cisco router for the SSH client. ! The remote server must be listening on port 2222.
Verify: Successful connection displays the remote server's prompt. Use 'show tcp brief' on the router to see the established connection: Router# show tcp brief
Watch out: If the connection times out, verify that the remote server is listening on the specified port and that firewall rules allow outbound SSH on that port from the router.
Troubleshooting with This Command
When using the `ssh -l [username] [ip]` command for troubleshooting, the primary goal is to establish a secure remote session to diagnose issues on another device. Healthy output is a successful login to the remote device, where you are presented with its CLI prompt. Problem indicators include error messages such as '% Connection refused by remote host', '% No route to host', '% Authentication failed', or '% Connection closed by remote host'.
These errors help pinpoint the issue. For example, 'Connection refused' typically means the remote device is not running an SSH server or the port is blocked. 'No route to host' indicates a network reachability problem.
'Authentication failed' means the username or password is incorrect. To diagnose, first verify IP connectivity using `ping` from the source device to the destination IP. If ping succeeds, check if the remote device has SSH enabled by attempting a Telnet connection to port 22 (e.g., `telnet 10.0.12.2 22`); if you get a banner, SSH is running.
If Telnet to port 22 fails, SSH is likely not enabled or the port is filtered. On the remote device, verify SSH configuration: ensure that 'ip ssh version 2' is configured, that a host key exists (via 'crypto key generate rsa'), and that VTY lines have 'transport input ssh'. Also check that the username used exists locally or is authenticated via AAA.
If the connection drops immediately after authentication, check for VTY access-class restrictions or session limits. Correlate with 'debug ip ssh' on the remote device to see detailed authentication and connection attempts. On the source device, use 'debug ip ssh client' to see client-side events.
Another common issue is SSH version mismatch; ensure both devices support SSHv2. If the remote device is a Cisco IOS device, you can also use 'show ip ssh' to verify SSH server status. For persistent issues, check that the IOS image includes the necessary crypto features (k9 image).
The `ssh` command is a vital tool for remote troubleshooting, allowing you to access devices that may be in different locations or behind firewalls. By following a systematic approach—checking connectivity, verifying SSH service, and reviewing authentication—you can quickly resolve connection problems.
CCNA Exam Tips
CCNA exam may test that SSH requires a configured hostname and domain name on the device.
Remember that SSH uses TCP port 22; the exam might ask about port numbers.
Know that SSH version 2 is preferred over version 1 for security; the command 'ip ssh version 2' enables it.
The exam may present a scenario where SSH fails due to missing RSA keys; generating keys with 'crypto key generate rsa' is required.
Common Mistakes
Forgetting to generate RSA keys on the remote device before attempting SSH.
Using 'ssh -l' with a username that doesn't exist on the remote device, causing authentication failure.
Not having the remote device configured for SSH (e.g., missing 'transport input ssh' on VTY lines).
ssh -l [username] [ip] vs telnet [ip]
Both commands initiate remote terminal sessions from a Cisco IOS device to a remote host, but differ fundamentally in security: SSH encrypts all traffic, while Telnet transmits data in cleartext. They are often compared when deciding between secure vs. legacy management access.
| Aspect | ssh -l [username] [ip] | telnet [ip] |
|---|---|---|
| Security | Encrypted, authenticates server and user | Unencrypted, no server authentication |
| Default Port | TCP/22 | TCP/23 |
| Authentication | Requires username; supports keys and passwords | No username required; uses login credentials |
| Data Encryption | All traffic encrypted (AES, 3DES, etc.) | No encryption; plaintext transmission |
| Typical Use | Secure remote management over untrusted networks | Legacy or lab environments where security is not a concern |
| Configuration Dependency | Requires SSH server config on remote device and ip ssh on local | Requires only VTY lines configured for Telnet |
Use ssh -l [username] [ip] when managing devices across insecure networks or when compliance requires encrypted remote access.
Use telnet [ip] only in isolated, controlled lab environments where security is irrelevant and simplicity is desired.
Platform Notes
In IOS-XE, the `ssh` command syntax is identical to classic IOS, but the output of `show ssh` may include additional fields like session ID and encryption algorithm. The command is available in Privileged EXEC mode. For NX-OS, the equivalent command is `ssh [username@]ip` or `ssh -l [username] [ip]`, but NX-OS also supports `ssh` with options like `-v` for version and `-p` for port.
However, NX-OS uses a different underlying SSH implementation, and the command may have slight differences in behavior (e.g., default SSH version is 2). On Cisco ASA, the equivalent command is `ssh -l [username] [ip]` from the ASA's CLI, but the ASA also requires SSH to be enabled with `ssh [ip] [mask] [interface]` and `crypto key generate rsa`. The ASA does not support all IOS SSH options.
For IOS-XR, the `ssh` command is available but with different syntax: `ssh [username@]ip` or `ssh -l [username] [ip]`. IOS-XR also supports `ssh` with options like `-p` and `-v`. Note that IOS-XR uses a more modern SSH implementation and may have stricter key exchange algorithms.
Between IOS versions, the `ssh` command has remained largely consistent, but older IOS 12.x versions may only support SSHv1 by default, requiring explicit configuration for SSHv2. In IOS 15.x and later, SSHv2 is the default. Also, in some older IOS versions, the `ssh` command may not support the `-p` option; instead, you would use `ssh -l [username] [ip] [port]` (without the -p flag).
Always check the specific IOS documentation for your version. For CCNA and CCNP candidates, it's important to know that the `ssh` command is universally available on Cisco devices that support cryptographic features, but the exact syntax and options may vary slightly across platforms.
Related Commands
crypto key generate rsa
Generates RSA key pairs used to enable SSH on Cisco IOS devices. The modulus size determines key strength — minimum 768 bits for SSH version 1, 1024 bits recommended for SSH version 2.
ip ssh version 2
Enables SSH version 2 on the router for secure remote management, replacing the less secure version 1.
show ssh
Displays the status and configuration of SSH server connections on a Cisco device, used to verify SSH sessions, authentication methods, and encryption settings.
telnet [ip]
The telnet command establishes an unencrypted remote terminal session to another network device using the Telnet protocol, typically for remote management and troubleshooting.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions