?
Solved

Cisco 881 SSH access from outside

Posted on 2012-03-18
6
Medium Priority
?
2,098 Views
Last Modified: 2012-04-07
Hello,

We are using a Cisco 881 and would like to allow SSH to the router from outside (any source)

Currently we have a NAT inside and outside.

Please help with this. Router is running the latest firmware of 15.x I believe.

Thanks
0
Comment
Question by:masdf123
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
6 Comments
 
LVL 34

Expert Comment

by:Istvan Kalmar
ID: 37736430
Hi,


you need:

int loop 1
 ip add 1.1.1.1 255.255.255.25
 ip nat inside
ip nat inside source static tcp 1.1.1.1 22 x.x.x.x 22

where x.x.x.x the public ip of the router!

Best regards,
Istvan
0
 
LVL 22

Expert Comment

by:Jody Lemoine
ID: 37737102
Once you enable SSH on the router, it it open from all sources by default. Outside access requires no further configuration unless you are using access lists or the zone based firewall to control traffic coming in from outside sources. If this is the case, you need to make sure that traffic to the router's public IP with destination port 22/tcp is permitted in the outside interface's access list (if you're just using access lists) or to the "self" zone (if you're using the zone based firewall.)
0
 
LVL 1

Author Comment

by:masdf123
ID: 37737403
jodylemoine, Could you guide me with the SSH enabling lines as well.

Thanks
0
Veeam Task Manager for Hyper-V

Task Manager for Hyper-V provides critical information that allows you to monitor Hyper-V performance by displaying real-time views of CPU and memory at the individual VM-level, so you can quickly identify which VMs are using host resources.

 
LVL 22

Expert Comment

by:Jody Lemoine
ID: 37737428
Sure.

From global configuration mode (conf t) do the following:

Set the hostname and domain names if you haven't already with:

hostname xxx
ip domain-name domain.com

Generate the encryption keys for ssh:

crypto key generate rsa modulus 2048

Set the default ssh version to 2.0:

ip ssh version 2

Write the configuration and you should be good to go.
0
 
LVL 1

Author Comment

by:masdf123
ID: 37737475
And if there are ACLs on the outside interface, I should just allow port 22 in, correct?
0
 
LVL 22

Accepted Solution

by:
Jody Lemoine earned 2000 total points
ID: 37737534
Correct.  If you're not using the zone-based firewall or context-based access control, you'll want to make sure that your ACL permits return traffic too or you'll lose Internet access.  I recommend zone-based firewall or context-based access control, but the following will work in a pinch:

ip access-list extended InternetIn
 permit tcp any any established
 permit udp any any
 permit icmp any any
 permit tcp any any eq 22
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There’s a movement in Information Technology (IT), and while it’s hard to define, it is gaining momentum. Some call it “stream-lined IT;” others call it “thin-model IT.”
You deserve ‘straight talk’ from your cloud provider about your risk, your costs, security, uptime and the processes that are in place to protect your mission-critical applications.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses
Course of the Month14 days, 20 hours left to enroll

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question