Enable Remote SSH Access to 2621 Router

Author	All Replies
Edrick Premium join:2004-09-11 Orlando, FL	Enable Remote SSH Access to 2621 Router Hey I have a Cisco 2621 Router setup with SSH which I can access just fine inside of the network however I need to grant access to an outside party to do some configuration but it doesn't seem that you can connect to SSH on the WAN interface there's no firewall on the router. -- Ricky Smith
	to forum · permalink · · 2009-04-22 16:55:11 ·
kamikatze join:2007-11-02	There should be no problem to connect from the outside. The quickest way here would be to post your config.
	to forum · permalink · · 2009-04-22 19:12:32 ·
Edrick Premium join:2004-09-11 Orlando, FL 1 edit	reply to Edrick Last login: Fri Feb 13 22:00:35 on console Trinity:~ rickysmith$ ssh admin@10.0.1.1 *WARNING* The device you are accessing only allows access by AUTHORIZED PERSONNEL ONLY!Password: Vortex#show conf Using 10580 out of 29688 bytes ! version 12.4 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service sequence-numbers ! hostname Vortex ! boot-start-marker boot-end-marker ! security authentication failure rate 3 log security passwords min-length 6 logging buffered 51200 enable secret 5 enable password 7 110248511F1B1E0F0D ! aaa new-model ! ! aaa authentication login default local aaa authentication login sdm_vpn_xauth_ml_1 local aaa authentication login sdm_vpn_xauth_ml_2 local aaa authorization exec default local aaa authorization network sdm_vpn_group_ml_1 local aaa authorization network sdm_vpn_group_ml_2 local ! ! aaa session-id common clock timezone PCTime -5 clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00 no network-clock-participate slot 1 no network-clock-participate wic 0 no ip source-route ip cef ! ! no ip dhcp use vrf connected ip dhcp excluded-address 10.0.1.0 10.0.1.20 ! ip dhcp pool LAN network 10.0.1.0 255.255.255.0 domain-name Vortex.localdomain dns-server 208.67.222.222 208.67.220.220 default-router 10.0.1.1 lease 7 ! ! no ip bootp server ip name-server 208.67.222.222 ip name-server 208.67.220.220 ip ddns update method sdm_ddns1 HTTP! ! multilink bundle-name authenticated ! ! ! ! voice service voip allow-connections h323 to h323 allow-connections h323 to sip allow-connections sip to h323 allow-connections sip to sip no supplementary-service sip moved-temporarily redirect ip2ip sip registrar server expires max 300 min 60 ! ! voice class codec 1 codec preference 1 g711alaw ! ! ! ! ! ! ! ! ! ! ! ! voice translation-rule 1 rule 1 /$^9$/ // ! voice translation-rule 2 rule 1 /./ /3215944124/ ! ! voice translation-profile DiscardDigit9 translate calling 2 translate called 1 ! voice translation-profile Local-CLID translate calling 2 ! ! ! crypto pki trustpoint TP-self-signed-42 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-42 revocation-check none rsakeypair TP-self-signed-42 ! ! crypto pki certificate chain TP-self-signed-4 certificate self-signed 01 nvram:IOS-Self-Sig#7.cer ! ! username admin privilege 15 password 7 username rsmith privilege 15 secret 5 . archive log config hidekeys ! ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 ! crypto isakmp client configuration group default key pool SDM_POOL_1 ! ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac ! ! ip tcp synwait-time 10 ! class-map type inspect match-any SDM_HTTPS match access-group name SDM_HTTPS class-map type inspect match-any SDM_SSH match access-group name SDM_SSH class-map type inspect match-any SDM_SHELL match access-group name SDM_SHELL class-map type inspect match-any sdm-cls-access match class-map SDM_HTTPS match class-map SDM_SSH match class-map SDM_SHELL class-map type inspect match-any SDM_AH match access-group name SDM_AH class-map type inspect match-any SDM_ESP match access-group name SDM_ESP class-map type inspect match-all sdm-access match class-map sdm-cls-access match access-group 102 ! ! ! ! ! interface Null0 no ip unreachables ! interface FastEthernet0/0 description WAN$FW_OUTSIDE$ ip address dhcp no ip redirects no ip unreachables no ip proxy-arp ip nat outside ip virtual-reassembly no ip route-cache cef ip route-cache flow no ip mroute-cache duplex auto speed auto no mop enabled ! interface FastEthernet0/1 description LAN$FW_INSIDE$ ip address 10.0.1.1 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip nat inside ip virtual-reassembly no ip route-cache cef ip route-cache flow no ip mroute-cache duplex auto speed auto no mop enabled ! ip local pool SDM_POOL_1 10.0.2.100 10.0.2.110 ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 FastEthernet0/0 ! ! ip http server ip http access-class 1 ip http authentication local ip http secure-server ip http path flash: ip nat inside source list 101 interface FastEthernet0/0 overload ! ip access-list extended SDM_AH remark SDM_ACL Category=1 permit ahp any any ip access-list extended SDM_ESP remark SDM_ACL Category=1 permit esp any any ip access-list extended SDM_HTTPS remark SDM_ACL Category=1 permit tcp any any eq 443 ip access-list extended SDM_SHELL remark SDM_ACL Category=1 permit tcp any any eq cmd ip access-list extended SDM_SSH remark SDM_ACL Category=1 permit tcp any any eq 22 ! access-list 1 remark HTTP Access-class list access-list 1 remark SDM_ACL Category=1 access-list 1 permit 10.0.1.0 0.0.0.255 access-list 1 deny any access-list 101 permit ip 10.0.1.0 0.0.0.255 any access-list 101 remark SDM_ACL Category=18 access-list 102 remark SDM_ACL Category=128 access-list 102 permit ip any any access-list 103 remark VTY Access-class list access-list 103 remark SDM_ACL Category=1 access-list 103 permit ip 10.0.1.0 0.0.0.255 any access-list 103 deny ip any any snmp-server community public RO snmp-server location Brightverse NOC snmp-server contact Edrick Smith no cdp run ! ! ! ! tftp-server flash:RingList.xml tftp-server flash:DistinctiveRingList.xml tftp-server flash:Analog1.raw tftp-server flash:Analog2.raw tftp-server flash:AreYouThere.raw tftp-server flash:AreYouThereF.raw tftp-server flash:Bass.raw tftp-server flash:CallBack.raw tftp-server flash:Chime.raw tftp-server flash:Classic1 tftp-server flash:Classic1.raw tftp-server flash:Classic2.raw tftp-server flash:ClockShop.raw tftp-server flash:Drums1 tftp-server flash:Drums1.raw tftp-server flash:Drums2.raw tftp-server flash:FilmScore.raw tftp-server flash:HarpSynth.raw tftp-server flash:Jamaica.raw tftp-server flash:KotoEffect.raw tftp-server flash:MusicBox.raw tftp-server flash:Piano1.raw tftp-server flash:Piano2.raw tftp-server flash:Pop.raw tftp-server flash:Pulse1.raw tftp-server flash:Ring1.raw tftp-server flash:Ring2.raw tftp-server flash:Ring3.raw tftp-server flash:Ring4.raw tftp-server flash:Ring5.raw tftp-server flash:Ring6.raw tftp-server flash:Ring7 tftp-server flash:Ring7.raw tftp-server flash:Sax1.raw tftp-server flash:Sax2.raw tftp-server flash:Vibe.raw tftp-server flash:List.xml tftp-server flash:TN-CampusNight.png tftp-server flash:TN-CiscoFountain.png tftp-server flash:TN-Fountain.png tftp-server flash:TN-MorroRock.png tftp-server flash:TN-NantucketFlowers.png tftp-server flash:CampusNight.png tftp-server flash:Cisco tftp-server flash:CiscoFountain.png tftp-server flash:Fountain.png tftp-server flash:MorroRock.png tftp-server flash:NantucketFlowers.png tftp-server flash:Desktops/320x212x12/List.xml tftp-server flash:Desktops/320x212x12/CampusNight.png tftp-server flash:Desktops/320x212x12/CiscoFountain.png tftp-server flash:Desktops/320x212x12/CiscoLogo.png tftp-server flash:Desktops/320x212x12/Fountain.png tftp-server flash:Desktops/320x212x12/MorroRock.png tftp-server flash:Desktops/320x212x12/NantucketFlowers.png tftp-server flash:Desktops/320x212x12/TN-NantucketFlowers.png tftp-server flash:Desktops/320x212x12/TN-MorroRock.png tftp-server flash:Desktops/320x212x12/TN-Fountain.png tftp-server flash:Desktops/320x212x12/TN-CiscoLogo.png tftp-server flash:Desktops/320x212x12/TN-CampusNight.png tftp-server flash:Desktops/320x212x12/TN-CiscoFountain.png ! control-plane ! ! ! ! ! ! ! dial-peer voice 1 voip description Voicemail translation-profile outgoing Local-CLID preference 7 destination-pattern ... session protocol sipv2 session target dns:chiv1.voipstreet.com dtmf-relay rtp-nte codec g711ulaw ! dial-peer voice 100 voip description SIP tunk to chiv1.voipstreet.com translation-profile outgoing DiscardDigit9 destination-pattern 9T session protocol sipv2 session target dns:chiv1.voipstreet.com dtmf-relay rtp-nte codec g711ulaw ! dial-peer voice 4 voip description "Incoming Calls" huntstop session protocol sipv2 incoming called-number 3215944124 dtmf-relay rtp-nte codec g711ulaw ! ! sip-ua credentials username password realm chiv1.voipstreet.com authentication username password nat symmetric role passive nat symmetric check-media-src no remote-party-id srv version 1 retry options 1 mwi-server dns:chiv1.voipstreet.com expires 3600 port 5060 transport udp unsolicited registrar dns:chi-reg.voipstreet.com expires 3600 ! ! ! telephony-service max-ephones 5 max-dn 5 ip source-address 10.0.1.1 port 2000 max-redirect 10 auto assign 1 to 5 system message voicemail 123 max-conferences 4 gain -6 call-forward pattern .T moh en_bacd_music_on_hold.au multicast moh 239.0.0.1 port 2000 dn-webedit time-webedit transfer-system full-consult transfer-pattern .T create cnf-files version-stamp 7960 Feb 20 2009 20:09:38 ! ! ephone-dn 1 dual-line number 300 label Edrick Smith description Edrick Smith name Edrick Smith hold-alert 30 originator night-service bell ! ! ephone-dn 2 dual-line number 301 ! ! ephone-dn 3 dual-line number 302 ! ! ephone-dn 4 dual-line number 303 ! ! ephone-dn 5 dual-line number 3215944124 label Main Number description Main Number name Main Number call-forward noan 123 timeout 18 ! ! ephone 1 device-security-mode none mac-address 000F.23FC.A55B username "esmith" password type 7970 button 1:1 2:5 pin 4872 night-service bell ! ! ! ephone 2 device-security-mode none mac-address 0023.6C7F.E0BC type CIPC button 1:2 2:5 ! ! ! ephone 3 device-security-mode none mac-address 001B.6331.F3A6 button 2:5 ! ! ! ephone 4 no multicast-moh device-security-mode none ! ! ! ephone 5 no multicast-moh device-security-mode none ! ! ephone-hunt 1 sequential pilot 400 list 300, 301 preference 0 secondary 7 ! ! banner login ^C*WARNING* The device you are accessing only allows access by AUTHORIZED PERSONNEL ONLY!^C ! line con 0 transport output telnet line aux 0 transport output telnet line vty 0 4 access-class 103 in privilege level 15 password 7 transport input ssh ! scheduler allocate 4000 1000 ! end Vortex# -- Ricky Smith
	to forum · permalink · · 2009-04-22 21:14:08 ·
Bigzizzzle Premium join:2005-01-27 Franklin, TN	please sanitize your config; exclude and change all username passwords and or your vpn key. they can be easily used / decoded.
	to forum · permalink · · 2009-04-22 21:34:38 ·
Bink join:2006-05-14 Denver, CO	reply to Edrick access-list 103 is controlling access to your vty ports/preventing your outside party access. Include your outside party in this access list and you should be good.
	to forum · permalink · · 2009-04-22 22:03:49 ·
Edrick Premium join:2004-09-11 Orlando, FL	reply to Edrick Ah thanks! fixed -- Ricky Smith
	to forum · permalink · · 2009-04-22 22:33:36 ·


Friday, 04-Dec 04:11:59	Terms of Use \| Privacy Policy \| Hosting by www.nac.net - DSL,Hosting & Co-lo \| feedback \| contact over 10 years online! © 1999-2009 dslreports.com. republican-creole page compression OFF