One of the great things about GNS3 is you can have many devices as part of a topology and
you can access the consoles of every device.
So as an example, router
1 and router 2 can be accessed directly through GNS3 on my local PC.
However, in the real world, you probably going to want to telnet to devices
because you don't want to walk to the device and connect to the console, that's not realistic if the
devices are on the other side of the country or other side of the world.
So you're going to want to use a protocol such as Telnet to gain access to the remote devices.
Let's assume that router 1 is in one part of the network and router 2 is in a different part of
the network.
In this example, I'll Telnet from router 1 to router 2, let's see what happens by default, so telnet to
to 10.1.1.2.
I'm told that password is required, but none is set in most cases by default, you cannot telnet to
a router.
You have to do some configuration to allow telnet sessions.
So on router 2 type CONFT the line VTY and specify a VTY range from 0 to a number that depends
on the device.
So on this router, the VTY ranges from 0 to 903, which means you could have 904 simultaneous virtual
terminal lines or VTY lines on the router.
In other words, 904 sessions could be made to the router
at the same time, you'll often see and documentation that they'll create VTY lines 0 to 4, which
gives you five VTY lines.
That's something from the old days
but a lot of Cisco devices today support many more VTY lines than that.
So as an example on this switch, VTY 0 notice there's 1500 VTY lines on this virtual iOS V layer
2 switch
and if I connect to this physical 3750 and type line VTY 0, notice this one has 16 VTY lines.
So that really depends on the device.
This iOS V layer 2 switch has 1001 VTY lines.
I'm going to specify, login and notice.
I'm told that a login is disabled until a password is set.
So once again, if I telnet to the router,
the telnet session is closed, so on router 2 let's add a password of Cisco and now try and telnet to the
router.
Notice I'm prompted for a password.
Now if I type enable, I'm allowed in because this router has an enable password, but if no enable password
was set, so let's disconnect, if no enabled password was set or no secret password was set.
Notice what happens, telnet to the router, enter my telnet password, type enable
and I cannot get to enable mode because no password is configured, you must configure either an enable
password or a secret password, secret being better to go to enable mode through a telnet or SSH session.
So notice the configuration that we did show run pipe begin VTY.
In this case, we enabled 5 VTY lines, 0 to 4, we're using a password on the line for those 5
VTY lines, the same password is used for all of them.
You could specify different passwords for different VTY lines if you wanted to but in this example
we'll keep the password the same.
Hence, when I telnet from router 1 to router 2, I need to put in the password on the line
but to go to enable mode I need to type the enable or secret password. Now again
on the VTY line, similar to the console
we could use the option login local which would use a local username and password database.
Telnet back again, notice now, I'm asked for the username and password of the user, but in this case it's
it's failing.
So let's see what's going on.
Show, run, pipe, include user.
There's no user account configured, so hence the authentication was failing, so I need to type username
whatever the username is and the password of that user.
So now I can log in
and then type enable to go to privilege mode. So once again, what do we do?
We created a user.
called David with a relevant password, not a good idea to use passwords such as the following, you
should use secret.
So I should have done this username, David Secret Cisco.
Now, I'm told I cannot have both a user password and a user secret choose one or the other. So do show
run pipe, include user.
Notice the user is still using a password rather than a secret.
So let's say no username, David
and recreated with a secret, and that's allowed now. Notice previously the password was in clear text,
do show run pipe include user.
The username is now MD5 hash, so it's much more secure.
Notice the difference now, however, when I telnet and put my username in and my password, I still
have to put in my enable password, but that's a secret password
and what I can do additionally here is specify privilege and give David full privileges
rather than the user having to type the enable password or secret password in this case. So back on router 1
telnet to router 2 username is David password is Cisco notice, I'm taken immediately to privilege mode
mode whereas previously I had to type, enable, and then put in the secret password.
Now, the biggest problem with Telnet is its clear text, so I'll exit back to router 1, let's start doing
a capture here
and I'll capture the traffic
received on this interface. I remember we created a secret password, so on the router show run,
Doesn't show us what that uses password is.
What happens when we telnet, however, so telnet username is David Password, is Cisco straight to
privilege mode. I'll search for telnet
and let's look
through the packet's first.
So
scrolling along, there's D A V I D,
asking for a password now C I S C O.
We've just captured the user's password if we follow the TCP stream.
I'll just copy that into notepad so you can see it clearly
but what you're seeing here is the TCP stream showing the username and the password, so the password
is shown in clear text.
Telnet allows you to capture passwords and other data off the wire, so it's not a great idea to use
telnet.
You may think it's good to use a secret password, but be careful.
The secret password is hashed on the router, but when the data is sent across the wire, it's in clear
text so a hacker can capture the password.
So you should be using SSH rather than telnet.
Before showing SSH, one last thing on Telnet, you can
also set an exact time out on your telnet sessions so that they get disconnected if there's no activity
for a period of time.
In this example, after 5 minutes, the telnet session would be disconnected
but you could specify another value if you wanted to.