transport input all
Configures a VTY line to accept all supported protocols (Telnet, SSH, etc.) for incoming connections, typically used to allow remote management access.
Definition: transport input all is a Cisco IOS line config command. Configures a VTY line to accept all supported protocols (Telnet, SSH, etc.) for incoming connections, typically used to allow remote management access.
Overview
The 'transport input all' command is a Line Configuration mode command used on Cisco IOS devices to specify which protocols are allowed for incoming connections on a VTY (Virtual Teletype) line. VTY lines are used for remote management access via protocols such as Telnet and SSH. By default, VTY lines may have no transport input configured, which can prevent remote access, or may be restricted to a specific protocol like Telnet or SSH.
The 'transport input all' command enables all supported protocols, including Telnet, SSH, and others like rlogin (though rlogin is rarely used today). This command is critical for network engineers who need to ensure flexible remote access during initial device setup, troubleshooting, or in environments where both Telnet and SSH are used for legacy or compatibility reasons. However, from a security perspective, it is generally recommended to restrict transport input to SSH only using 'transport input ssh' to encrypt management traffic.
The command is applied per line or range of lines (e.g., line vty 0 4). It does not affect outbound connections from the device. Understanding this command is essential for CCNA and CCNP candidates as it directly impacts device accessibility and security.
In the broader configuration workflow, after configuring IP addresses and enabling remote access protocols (like SSH server), you must configure the VTY lines with the appropriate transport input command to allow connections. Without this command, remote login attempts will fail. The command is immediate and affects the running configuration; it can be verified with 'show running-config | section line vty'.
Privilege level 15 (enable) is required to enter line configuration mode. A common mistake is forgetting to apply the command to all VTY lines, leaving some lines inaccessible. Also, if SSH is not configured on the device, using 'transport input ssh' will block all remote access, so 'transport input all' can be a fallback during initial setup.
In summary, 'transport input all' is a straightforward but powerful command that enables remote management, and its use must be balanced with security considerations.
transport input allWhen to Use This Command
- Enabling both Telnet and SSH on VTY lines for network devices that need to support legacy and secure access methods.
- Configuring a lab router to accept any transport protocol for testing and troubleshooting remote connectivity.
- Allowing multiple management protocols during a migration from Telnet to SSH without disrupting existing access.
- Setting up a device in a multi-vendor environment where different administrators use different protocols.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| protocol | all | telnet | ssh | rlogin | none | Specifies the allowed protocol(s) for incoming connections. 'all' enables all supported protocols (Telnet, SSH, rlogin). 'telnet' restricts to Telnet only. 'ssh' restricts to SSH only. 'rlogin' restricts to rlogin (rarely used). 'none' disables all incoming connections. The default is no transport input, which effectively blocks all connections. Common mistake: using 'transport input all' in production without considering security implications. |
Command Examples
Enable all transport protocols on VTY lines 0-4
line vty 0 4
transport input allRouter(config-line)# transport input all Router(config-line)#
The command is entered in line configuration mode. No output is shown upon success; the prompt returns. This enables Telnet, SSH, and other supported protocols on VTY lines 0 through 4.
Verify transport input configuration
show running-config | include line vty|transport inputline vty 0 4 transport input all
The 'show running-config' output confirms that the VTY lines are configured with 'transport input all'. The first line indicates the VTY lines being configured, and the second line shows the transport setting.
Understanding the Output
The 'transport input all' command does not produce any output upon execution; it silently configures the line. To verify, use 'show running-config' or 'show line'. In 'show running-config', look for 'transport input all' under the relevant 'line vty' section.
If you see 'transport input none' or 'transport input telnet', that indicates restricted protocols. A common mistake is to forget that 'transport input all' includes Telnet, which is insecure; for production, use 'transport input ssh' instead.
Configuration Scenarios
Allow both Telnet and SSH for initial device setup
A network engineer is deploying a new Cisco router in a lab environment. During initial configuration, both Telnet and SSH need to be available for remote access. After SSH is properly configured, the engineer plans to restrict to SSH only.
Topology
PC (192.168.1.100) --- (Gi0/0) R1 (192.168.1.1)Steps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Enter line configuration mode for VTY lines 0 to 4: line vty 0 4
- 3.Step 3: Enable all transport protocols: transport input all
- 4.Step 4: Optionally set a password for Telnet access: password cisco
- 5.Step 5: Enable login: login
- 6.Step 6: Exit and save configuration: end, write memory
! configure terminal line vty 0 4 transport input all password cisco login end write memory !
Verify: Use 'show running-config | section line vty' to verify the transport input setting. Expected output includes 'transport input all' under the line vty configuration.
Watch out: If no password is set and 'login' is configured, the device will prompt for a password but will not accept any password if none is configured, causing login failures. Always set a password or use 'login local' for AAA.
Restrict VTY lines to SSH only for secure management
A production network requires secure remote management. The engineer has already configured SSH on the router and wants to disable Telnet to prevent unencrypted access.
Topology
Management PC (10.0.0.10) --- (Gi0/0) R2 (10.0.0.1)Steps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Enter line configuration mode for VTY lines 0 to 15: line vty 0 15
- 3.Step 3: Restrict transport to SSH only: transport input ssh
- 4.Step 4: Ensure login uses local authentication: login local
- 5.Step 5: Exit and save: end, write memory
! configure terminal line vty 0 15 transport input ssh login local end write memory !
Verify: Attempt to Telnet to the router's IP; it should be rejected. SSH connection should succeed. Use 'show ip ssh' to verify SSH status and 'show running-config | section line vty' to confirm transport input ssh.
Watch out: If SSH is not fully configured (e.g., missing hostname, domain name, or RSA keys), 'transport input ssh' will block all remote access, locking the engineer out. Always verify SSH functionality before applying this restriction.
Troubleshooting with This Command
When troubleshooting remote access issues, the 'transport input' command is one of the first places to check. A common symptom is that a Telnet or SSH connection attempt times out or is immediately rejected. The healthy output of 'show running-config | section line vty' should show the intended transport input setting (e.g., 'transport input ssh' or 'transport input all').
If the line shows 'transport input none' or no transport input statement at all, incoming connections will be blocked. Another indicator is the 'show line' command, which displays the configured transport input for each line. For example, 'show line vty 0' will output 'Transport input: all' if configured.
If the transport input is set to 'ssh' but SSH is not enabled on the device (e.g., no ip ssh version 2), connections will fail. In that case, check 'show ip ssh' to see if SSH is enabled and properly configured. If the transport input is 'all' but Telnet connections are failing, verify that the VTY password is set and login is enabled.
A step-by-step diagnostic flow: 1) Check physical connectivity and IP reachability (ping). 2) Verify that the VTY lines are not exhausted (show users). 3) Check the transport input setting on the VTY lines. 4) If using SSH, verify SSH configuration and that the device has RSA keys. 5) Check for ACLs applied to the VTY lines (access-class) that may be blocking the source IP. 6) Check for any VTY timeouts or session limits. Correlating with debug commands: 'debug ip telnet' can show Telnet negotiation attempts, while 'debug ip ssh' can show SSH handshake failures. For example, if 'debug ip ssh' shows 'SSH: connection failed - no transport input', it indicates the VTY line is not configured for SSH.
In summary, the transport input command is a gatekeeper for remote management; misconfiguration here is a common cause of access issues.
CCNA Exam Tips
CCNA exam tip: 'transport input all' enables both Telnet and SSH; for security, the exam expects 'transport input ssh' only.
CCNA exam tip: Remember that 'transport input' is configured under 'line vty' mode, not globally.
CCNA exam tip: If a VTY line has 'transport input none', no remote access is possible; this is a common misconfiguration.
CCNA exam tip: The exam may ask which protocol is allowed when 'transport input all' is set; answer: Telnet, SSH, and others.
Common Mistakes
Mistake 1: Using 'transport input all' in production, exposing the device to insecure Telnet access.
Mistake 2: Forgetting to apply the command to all VTY lines (e.g., only configuring line vty 0 but not 1-4).
Mistake 3: Confusing 'transport input' with 'transport output'; input controls incoming connections, output controls outgoing.
transport input all vs transport input ssh
These commands both configure which protocols are permitted for incoming connections on VTY lines, but they represent opposite ends of the security spectrum. They are often compared when deciding between convenience and secure remote management access.
| Aspect | transport input all | transport input ssh |
|---|---|---|
| Allowed Protocols | All supported protocols (Telnet, SSH, rlogin, etc.) | SSH only (typically SSHv2) |
| Security Level | Low – includes unencrypted Telnet | High – only encrypted SSH |
| Configuration Keyword | "all" | "ssh" |
| Typical Use Case | Lab environments or legacy networks requiring multiple access methods | Production networks enforcing secure remote management |
| Effect on Existing Sessions | Immediately allows new connections via any protocol | Immediately blocks non-SSH new connections |
Use transport input all when you need to allow various access methods for troubleshooting or in a controlled lab environment where security is not a primary concern.
Use transport input ssh when you require encrypted remote management access and want to eliminate unsecured Telnet sessions for security compliance.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the syntax is identical: 'transport input all' under line vty configuration. However, IOS-XE may have additional VTY line features like 'transport preferred none' to avoid protocol preference issues. The NX-OS equivalent is 'transport input' under the line vty configuration, but NX-OS uses 'telnet' and 'ssh' as options; 'all' is not supported; instead, you can configure both protocols individually: 'transport input telnet ssh'.
On ASA firewalls, remote access is configured differently using 'ssh' and 'telnet' commands under the management interface, not VTY lines. ASA does not have a 'transport input' command; instead, you use 'ssh 192.168.1.0 255.255.255.0 management' to allow SSH from a subnet. In IOS versions prior to 12.x, the 'transport input' command existed but default behavior varied; some older versions defaulted to 'telnet' only.
In IOS 15.x and later, the default is no transport input, which blocks all connections. IOS-XR uses a different paradigm: remote access is controlled via 'ssh server' and 'telnet server' commands, and VTY lines are not used in the same way. For CCNA/CCNP studies, focus on IOS and IOS-XE, as NX-OS and ASA are covered in separate tracks.
Always verify the platform documentation, as syntax and behavior can vary.
Related Commands
line vty 0 4
Enters line configuration mode for virtual terminal (VTY) lines 0 through 4 to configure remote access settings like Telnet/SSH, ACLs, and timeout parameters.
show line
Displays line configuration and status information for console, auxiliary, and vty lines, used to verify line settings and monitor user connections.
transport input ssh
Restricts incoming Telnet or SSH connections on a VTY line to only SSH, blocking unencrypted Telnet access for secure remote management.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions