telnet [ip]
The telnet command establishes an unencrypted remote terminal session to another network device using the Telnet protocol, typically for remote management and troubleshooting.
Definition: telnet [ip] is a Cisco IOS privileged exec command. The telnet command establishes an unencrypted remote terminal session to another network device using the Telnet protocol, typically for remote management and troubleshooting.
Overview
The telnet command in Cisco IOS is used to establish an unencrypted remote terminal session to another network device using the Telnet protocol. This command is essential for network engineers who need to remotely manage and troubleshoot routers, switches, and other network devices. Telnet operates over TCP port 23 and provides a bidirectional, interactive text-oriented communication facility.
While Telnet is widely used for its simplicity and ubiquity, it transmits all data, including login credentials, in clear text, making it insecure over untrusted networks. Therefore, it is often replaced by SSH (Secure Shell) in production environments. However, Telnet remains a valuable tool for lab environments, legacy devices, and initial device configuration before SSH is enabled.
The telnet command is typically executed from privileged EXEC mode, and it requires that the target device has Telnet server enabled (usually via the 'line vty' configuration). When you issue the command, IOS opens a TCP connection to the specified IP address and port (default 23). The session behaves like a direct console connection, allowing you to enter commands on the remote device.
The output is buffered, meaning you may need to use terminal monitor to see debug output. The command does not modify the running configuration; it only initiates a session. The privilege level required to use telnet is generally 1 (user EXEC) or higher, but some implementations may restrict it.
In the broader workflow, telnet is often used after initial connectivity is verified via ping, and before more advanced troubleshooting with debug commands. It is also used to check if a specific port is open (by specifying a non-standard port) or to test application layer connectivity. Understanding telnet is fundamental for CCNA and CCNP candidates as it appears in many lab scenarios and exam questions.
telnet [ip]When to Use This Command
- Remotely managing a router or switch from a management workstation
- Troubleshooting connectivity to a remote device by verifying TCP port 23 reachability
- Accessing a device's CLI when console access is not available
- Verifying that Telnet service is enabled and reachable on a target device
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| ip-address | A.B.C.D | The IP address of the destination device you want to connect to. This can be an IPv4 address in dotted decimal format. Common mistakes include using a hostname that is not resolvable or an unreachable IP address. |
| port | <1-65535> | The TCP port number to connect to. Default is 23 (Telnet). You can specify a different port to test connectivity to other services (e.g., 80 for HTTP, 25 for SMTP). Common mistake: forgetting that the remote device must be listening on that port. |
| /source-interface | source-interface <interface-name> | Specifies the source interface from which the Telnet connection originates. This is useful for policy-based routing or when you need the connection to come from a specific IP address. Common mistake: using an interface that is down or not configured. |
Command Examples
Basic Telnet to a remote router
telnet 192.168.1.1Trying 192.168.1.1 ... Open User Access Verification Username: admin Password: Router>
The 'Trying' line indicates the router is attempting to connect. 'Open' means the TCP connection succeeded. The router then prompts for username and password. After successful authentication, the user is placed in user EXEC mode (Router>).
Telnet with a specific source interface
telnet 10.0.0.1 /source-interface loopback0Trying 10.0.0.1 ... Open User Access Verification Username: admin Password: Router>
The /source-interface option forces the Telnet session to use the IP address of Loopback0 as the source. This is useful when you need to match ACLs or routing policies that depend on the source IP.
Understanding the Output
The Telnet command output begins with 'Trying <ip> ...' indicating the connection attempt. If successful, 'Open' appears, followed by the login prompt. The login process is identical to a console session.
If the connection fails, you may see 'Connection refused' (Telnet disabled or ACL blocking) or 'Timeout' (no route or host down). In a real network, a successful Telnet means the remote device is reachable and its VTY lines are configured for Telnet access. Always verify that the remote device has 'transport input telnet' on its VTY lines and that an ACL is not blocking the source IP.
Configuration Scenarios
Remote Management of a Branch Router via Telnet
A network engineer needs to remotely configure a branch router (R2) from the headquarters router (R1). Both routers are connected via a WAN link. Telnet is used because SSH is not yet configured on R2.
Topology
R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2Steps
- 1.Step 1: On R2, configure the VTY lines to allow Telnet access: R2(config)# line vty 0 4
- 2.Step 2: Set a password for Telnet access: R2(config-line)# password cisco
- 3.Step 3: Enable login on VTY lines: R2(config-line)# login
- 4.Step 4: Ensure the VTY lines are in privileged EXEC mode: R2(config-line)# privilege level 15
- 5.Step 5: From R1, initiate Telnet to R2's IP address: R1# telnet 10.0.12.2
! On R2 interface GigabitEthernet0/0 ip address 10.0.12.2 255.255.255.252 no shutdown ! line vty 0 4 password cisco login privilege level 15 !
Verify: After entering the password, you should see the R2 prompt (e.g., R2> or R2#). Use 'show users' on R2 to see active Telnet sessions.
Watch out: If the VTY password is not set, the connection will be rejected. Also, ensure that the 'login' command is configured; otherwise, the VTY lines will not prompt for a password.
Testing TCP Port Connectivity Using Telnet
A network engineer suspects that a web server (192.168.1.100) is not responding on port 80. They use Telnet to test TCP connectivity to that port from a router.
Topology
R1(Gi0/0)---192.168.1.0/24---Server(192.168.1.100)Steps
- 1.Step 1: From R1, attempt to Telnet to the server's IP address on port 80: R1# telnet 192.168.1.100 80
- 2.Step 2: If successful, the screen may go blank or show a banner. Type 'GET / HTTP/1.0' and press Enter twice to see the HTTP response.
- 3.Step 3: To exit, use Ctrl+Shift+6, then X to return to the router prompt, then disconnect with 'disconnect'.
! No configuration needed on the router for this test. The server must have a service listening on port 80.
Verify: If the connection is successful, you will see a blank screen or a banner. If it fails, you will see 'Connection refused' or 'Timeout'. Use 'show tcp brief' to see active TCP connections.
Watch out: If the server is not reachable, the Telnet command will hang until timeout (default 30 seconds). Use Ctrl+Shift+6 then X to abort. Also, some servers may close the connection immediately if they don't receive proper HTTP request.
Troubleshooting with This Command
The telnet command is a powerful troubleshooting tool for verifying TCP connectivity to remote devices. Healthy output typically shows a blank screen or a login prompt, indicating that the TCP handshake succeeded and the remote service is responding. Problem indicators include 'Connection refused' (meaning the remote device is reachable but no service is listening on that port), 'Timeout' (meaning the remote device is not reachable or is blocking the connection), or 'Host unreachable' (meaning there is no route to the destination).
When troubleshooting, focus on the specific error message. For example, 'Connection refused' suggests that the destination is up but the port is closed or filtered; you should check if the service is running on the remote device and if ACLs are blocking the port. 'Timeout' suggests a network issue; verify routing, ACLs, and that the destination is powered on.
To diagnose step-by-step: first, ping the destination to confirm IP connectivity. If ping fails, troubleshoot Layer 3. If ping succeeds but Telnet fails, check if the destination is listening on the specified port (e.g., using 'show tcp brief' on the destination).
Also, check for ACLs on intermediate routers or on the destination itself that may be blocking the port. On the source router, use 'debug ip packet' (with caution) to see if packets are being sent and if any ICMP unreachable messages are received. Correlate Telnet output with 'show ip route' to ensure the destination is reachable, and with 'show access-lists' to see if traffic is permitted.
If you are testing connectivity to a specific port, remember that Telnet itself uses TCP port 23; if you specify a different port, you are essentially using Telnet as a generic TCP client. This is useful for testing SMTP (port 25), HTTP (80), or any other TCP-based service. In summary, the telnet command is a quick and effective way to test application layer connectivity and is often the first tool used after basic IP connectivity is verified.
CCNA Exam Tips
CCNA exam tip: Telnet is unencrypted; SSH is the secure alternative. The exam may ask you to choose SSH over Telnet for security.
CCNA exam tip: The 'transport input telnet' command under VTY lines enables Telnet; if missing, Telnet will be refused.
CCNA exam tip: You can use 'telnet' from user EXEC mode; no need to enter privileged EXEC first.
CCNA exam tip: The /source-interface option is a Cisco IOS extension; the exam may test your knowledge of specifying a source IP for Telnet.
Common Mistakes
Mistake 1: Forgetting to configure 'transport input telnet' on VTY lines, causing 'Connection refused'.
Mistake 2: Trying to Telnet to a device that has an ACL blocking TCP port 23 from the source IP.
Mistake 3: Using Telnet over the internet without encryption, exposing credentials in plaintext.
telnet [ip] vs ssh -l [username] [ip]
Both `telnet [ip]` and `ssh -l [username] [ip]` are used to initiate remote terminal sessions from a Cisco IOS device, but they differ fundamentally in security and authentication. Telnet sends all data in cleartext, while SSH provides encrypted communication, making them often compared when balancing convenience against security.
| Aspect | telnet [ip] | ssh -l [username] [ip] |
|---|---|---|
| Security | No encryption; plaintext | Encrypted session |
| Authentication | Password only; no username needed | Username and password or key-based |
| Default Port | TCP/23 | TCP/22 |
| Configuration Required | Remote device must enable Telnet server | Remote device must have SSH server configured (crypto keys, etc.) |
| Transport Protocol | TCP | TCP |
Use telnet [ip] when testing basic reachability or accessing legacy devices that lack SSH support on a trusted, isolated network.
Use ssh -l [username] [ip] when security is required or when connecting over untrusted networks to enforce encryption and strong authentication.
Platform Notes
In IOS-XE, the telnet command syntax and behavior are identical to classic IOS. However, IOS-XE devices may have stricter default VTY configurations, such as requiring SSH or using local authentication. On NX-OS, the equivalent command is 'telnet' as well, but NX-OS uses a different configuration model for VTY lines (using 'line vty' but with 'password' and 'login local' typical).
On ASA firewalls, the telnet command is available but is often used to connect to other devices; the ASA itself can be configured to accept Telnet connections (though SSH is preferred). In IOS-XR, the telnet command is not available by default; instead, you use 'ssh' or 'telnet' via the 'exec' command? Actually, IOS-XR does not support the telnet command; you must use SSH.
For older IOS versions (12.x), the telnet command works the same as in 15.x and 16.x, but the default timeout may be different. In all platforms, the telnet command does not require any special privilege beyond user EXEC, but the VTY lines on the remote device must be configured to allow Telnet. Note that in some IOS versions, you can specify a source interface using the '/source-interface' parameter, but in others you may need to use the 'telnet' command with 'source' keyword (e.g., 'telnet 10.0.0.1 /source-interface loopback0').
Always check the specific IOS documentation for exact syntax.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions