Courseiva
SecurityLine Config

transport input ssh

Restricts incoming Telnet or SSH connections on a VTY line to only SSH, blocking unencrypted Telnet access for secure remote management.

Definition: transport input ssh is a Cisco IOS line config command. Restricts incoming Telnet or SSH connections on a VTY line to only SSH, blocking unencrypted Telnet access for secure remote management.

Overview

The `transport input ssh` command is a critical security configuration applied to VTY (Virtual Teletype) lines on Cisco IOS devices. It restricts incoming remote management connections to only SSH (Secure Shell), blocking unencrypted Telnet access. This command is essential for securing network devices against eavesdropping, session hijacking, and credential theft, as Telnet transmits all data—including passwords—in plaintext. SSH provides encrypted communication, authentication, and integrity verification, making it the standard for remote CLI access in modern networks.

Networking professionals use this command when configuring remote management access on routers, switches, and wireless controllers. It is typically applied after enabling SSH on the device (via `ip ssh version 2` and generating RSA keys) and before applying ACLs or AAA authentication. The command is set per VTY line (0-4 or 0-15) and can be combined with `transport input telnet` to allow both protocols, but for security best practices, only SSH should be permitted.

In the broader configuration workflow, `transport input ssh` is part of a layered security approach: first, secure the physical access (console port), then enable SSH, then restrict VTY access with ACLs, and finally apply AAA for authentication. The command does not affect existing sessions; it only prevents new Telnet connections. It is saved to the running configuration and persists after reload if written to startup config.

A common mistake is forgetting to enable SSH and generate RSA keys before applying this command, which would lock out all remote access. Also, if the device has multiple VTY lines, the command must be applied to all lines that allow remote access. The command is available in IOS 12.0 and later, and is supported on most Cisco platforms.

Syntax·Line Config
transport input ssh

When to Use This Command

  • Securing remote management access to a router by disabling Telnet and allowing only encrypted SSH connections.
  • Complying with security policies that require encrypted remote administration protocols.
  • Preventing unauthorized interception of credentials and session data over the network.
  • Configuring a management VTY line for SSH-only access while other lines remain for console or auxiliary use.

Command Examples

Enable SSH-only on VTY lines 0-4

line vty 0 4 transport input ssh
R1(config-line)# transport input ssh
R1(config-line)#

The command is entered in line configuration mode. No output is shown if successful; the prompt returns. This configures all five VTY lines to accept only SSH connections.

Verify transport input setting

show line vty 0 4
   Tty Line Typ    Tx/Rx    A Modem  Roty AccO AccI   Uses   Noise  Overruns   Int
*    0   0 VTY              -    -      -    -    -      0       0     0/0       -
     1   1 VTY              -    -      -    -    -      0       0     0/0       -
     2   2 VTY              -    -      -    -    -      0       0     0/0       -
     3   3 VTY              -    -      -    -    -      0       0     0/0       -
     4   4 VTY              -    -      -    -    -      0       0     0/0       -

Line 0, Location: '', Type: 'VTY'
Length: 24 lines, Width: 80 columns
Baud rate (TX/RX) is 9600/9600
Status: Ready
Capabilities: none
Modem state: Ready
Special Chars: Escape  Hold  Stop  Start  Disconnect  Activation
    ^^x    none   -     -       none
Timeouts:    Idle EXEC    Idle Session   Modem Answer  Session   Dispatch
           00:10:00        never                        none     not set
 Idle Session Disconnect Timer: never
 Session Limit is not set.
Time since activation: never
Editing is enabled.
History is enabled, history size is 10.
DNS resolution in show commands is enabled
 Full user help is disabled
 Allowed input transports are SSH.
 Allowed output transports are Telnet.
 Preferred transport is Telnet.
 No output characters are padded.
 No special data display characters.

The output shows the configuration of VTY lines. Key line: 'Allowed input transports are SSH.' confirms that only SSH is permitted for incoming connections. Other transports (like Telnet) are not listed, meaning they are blocked.

Understanding the Output

The 'show line vty' command displays detailed line parameters. The critical field is 'Allowed input transports' which lists protocols permitted for incoming connections. If it shows 'SSH', then only SSH is allowed; if it shows 'Telnet' or 'All', then Telnet is also permitted.

A secure configuration should show only 'SSH'. The output also includes line status, baud rate, timeouts, and other settings that are not directly related to transport input but help verify the overall line configuration.

Configuration Scenarios

Restrict VTY Lines to SSH Only on a Router

A network administrator wants to secure remote management access to a Cisco router by disabling Telnet and allowing only SSH connections. This ensures all management traffic is encrypted.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2 Management PC (192.168.1.100) connected to R1 via management network.

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Enable SSH version 2: ip ssh version 2
  3. 3.Step 3: Generate RSA keys (1024-bit): crypto key generate rsa modulus 1024
  4. 4.Step 4: Enter line configuration mode for VTY lines 0-4: line vty 0 4
  5. 5.Step 5: Set the transport input to SSH only: transport input ssh
  6. 6.Step 6: (Optional) Apply an ACL to restrict source IP: access-class 10 in
  7. 7.Step 7: Exit and save: end, write memory
Configuration
! Full IOS config block
Router(config)# ip ssh version 2
Router(config)# crypto key generate rsa modulus 1024
Router(config)# line vty 0 4
Router(config-line)# transport input ssh
Router(config-line)# end
Router# write memory

Verify: Use `show ip ssh` to verify SSH is enabled and version. Use `show line vty 0 4` to confirm transport input is set to SSH. Attempt to Telnet to the router's IP; it should be rejected. SSH should work.

Watch out: If RSA keys are not generated before applying `transport input ssh`, all remote access (including SSH) will fail because SSH cannot start. Always generate keys first.

Allow Both SSH and Telnet on a Switch for Migration

A network team is migrating from Telnet to SSH on a switch. They want to allow both protocols temporarily during the transition to avoid locking out administrators who still use Telnet.

Topology

SW1(Gi0/1)---192.168.10.0/24---Admin PC (192.168.10.50) SW1 has VTY lines 0-15.

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Enable SSH and generate RSA keys (if not already done): crypto key generate rsa modulus 2048
  3. 3.Step 3: Enter line configuration mode for all VTY lines: line vty 0 15
  4. 4.Step 4: Set transport input to allow both Telnet and SSH: transport input telnet ssh
  5. 5.Step 5: (Optional) Set a timeout and session limit: exec-timeout 5 0, session-limit 5
  6. 6.Step 6: Exit and save: end, write memory
Configuration
! Full IOS config block
SW1(config)# crypto key generate rsa modulus 2048
SW1(config)# line vty 0 15
SW1(config-line)# transport input telnet ssh
SW1(config-line)# exec-timeout 5 0
SW1(config-line)# end
SW1# write memory

Verify: Use `show line vty 0 15` to see transport input includes both telnet and ssh. Test Telnet and SSH connections from the admin PC; both should succeed.

Watch out: Leaving Telnet enabled is a security risk. Ensure the migration is completed and then change to `transport input ssh` only. Also, if the switch has older IOS, it may not support SSH; verify with `show ip ssh`.

Troubleshooting with This Command

When troubleshooting remote access issues related to `transport input ssh`, the first step is to verify the current transport setting on the VTY lines using `show line vty 0 4` (or appropriate line range). The output will display 'Transport Input' field; if it shows 'ssh', only SSH is allowed. If it shows 'telnet' or 'all', Telnet is permitted. A common symptom is that Telnet connections are rejected with a 'Connection refused' or 'Protocol not available' message. This indicates that the transport input is set to SSH only, or that SSH is not properly configured.

Next, check SSH configuration with `show ip ssh`. Healthy output shows SSH version 2 enabled, authentication timeout, and retries. If SSH is not enabled, the output will indicate 'SSH disabled'. Also verify that RSA keys are generated using `show crypto key mypubkey rsa`. If no keys exist, SSH cannot function.

Another issue is that the VTY lines may have an ACL applied via `access-class` that blocks the source IP. Use `show ip access-lists` to verify. Also check if the VTY lines are in use with `show users`; if all lines are occupied, new connections are rejected.

For SSH-specific issues, use `debug ip ssh` (with caution) to see authentication attempts. Common errors include 'SSH version 2 not supported' (client mismatch) or 'Authentication failed' (wrong credentials). Also ensure that the device has a hostname and domain name configured, as SSH requires them for key generation.

Correlate with `show logging` to see connection attempts and errors. If Telnet is blocked but SSH works, the transport input is correctly set. If both fail, check IP connectivity with `ping` from the management station to the device's management IP.

CCNA Exam Tips

1.

CCNA exam tip 1: Remember that 'transport input ssh' must be paired with 'login local' or AAA to enforce authentication; otherwise, no password is required.

2.

CCNA exam tip 2: The default transport input on VTY lines is 'telnet' (or 'all' in some IOS versions). You must explicitly configure 'transport input ssh' to disable Telnet.

3.

CCNA exam tip 3: To allow both SSH and Telnet, use 'transport input telnet ssh' (order matters for some versions).

4.

CCNA exam tip 4: The 'transport input' command only affects incoming connections; outgoing connections (like SSH from the router) are controlled by 'transport output'.

Common Mistakes

Mistake 1: Forgetting to configure SSH server (hostname, domain-name, crypto key) before enabling transport input ssh, causing connection failures.

Mistake 2: Applying 'transport input ssh' to the console or aux line, which is unnecessary and may block local access.

Mistake 3: Not saving the configuration after setting transport input, so the change is lost on reload.

transport input ssh vs login local

The 'transport input ssh' and 'login local' commands are both commonly applied to VTY lines to secure remote management, but they address different layers: one restricts the transport protocol (SSH vs Telnet) and the other specifies the authentication method (local username/password vs AAA). They are often used together but are not interchangeable.

Aspecttransport input sshlogin local
ScopeControls allowed transport protocols (SSH only)Controls authentication method (local database)
Configuration ModeLine configuration mode; typically VTY linesLine configuration mode; console, VTY, or aux lines
DependenciesRequires SSH server to be enabled globally (ip ssh)Requires local usernames to be configured (username command)
PrecedenceDetermines if SSH can be used at all; overrides any Telnet attemptsActs as a fallback if no AAA method is configured; can be overridden by aaa authentication login
Typical UseEnforce encrypted remote access by blocking unencrypted TelnetAuthenticate users using local credentials when AAA server is unavailable

Use transport input ssh when you need to enforce that all remote management sessions use SSH and block unencrypted Telnet access.

Use login local when you need to authenticate users against the local username database, typically as a fallback or when AAA is not deployed.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the command syntax is identical: `transport input ssh`. However, IOS-XE may have additional VTY line configuration options like `transport preferred none` to avoid protocol negotiation delays. The output of `show line` is similar but may include additional fields like 'Modem' and 'Accounting'.

On NX-OS (e.g., Nexus switches), the equivalent command is `transport input ssh` applied to VTY lines, but NX-OS uses a different line configuration model. The command is `line vty` and then `transport input ssh`. NX-OS also supports `ssh server` global configuration to enable SSH. The verification command is `show ssh server`.

On ASA firewalls, remote access is managed via SSH using `ssh` commands under the management interface, not VTY lines. The equivalent is `ssh 192.168.1.0 255.255.255.0 management` to allow SSH from a subnet, and `ssh version 2` to enforce version 2. There is no direct `transport input` command.

In IOS-XR (e.g., ASR 9000), the command is `ssh server` under global configuration, and VTY lines are not used. Instead, `ssh` is enabled globally. The transport input concept does not apply; instead, you disable Telnet with `no telnet server`.

Behavior differences: In older IOS 12.x, `transport input ssh` also requires `ip ssh` commands to be configured. In IOS 15.x and 16.x, SSH is more robust and supports features like SSHv2 and SCP. Always use the latest recommended version.

Related Commands

ip ssh version 2

Enables SSH version 2 on the router for secure remote management, replacing the less secure version 1.

line vty 0 4

Enters line configuration mode for virtual terminal (VTY) lines 0 through 4 to configure remote access settings like Telnet/SSH, ACLs, and timeout parameters.

login local

Configures the line to require local username/password authentication using the local database, typically applied to console, vty, or aux lines for secure access.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions