Console Port, Telnet, and SSH Handling

This chapter covers the following topics:

Console Port Overview for the Cisco ASR 1000 Series Routers

The console port on the Cisco ASR 1000 Series Router is an EIA/TIA-232 asynchronous, serial connection with no flow control and an RJ-45 connector. The console port is used to access the router and is located on the front panel of the Route Processor (RP).

For information on accessing the router using the console port, see the “Accessing the CLI Using a Directly-Connected Console” section on page 3-2 .

Console Port Handling Overview

Users using the console port to access the router are automatically directed to the IOS command-line interface, by default.

If a user is trying to access the router through the console port and sends a break signal (a break signal can be sent by entering Ctrl-C or Ctrl-Shift-6, or by entering the send break command at the Telnet prompt ) before connecting to the IOS command-line interface, the user is directed into a diagnostic mode by default if the nonRPIOS subpackages can be accessed.

These settings can be changed by configuring a transport map for the console port and applying that transport map to the console interface.

Telnet and SSH Overview for the Cisco ASR 1000 Series Routers

Telnet and Secure Shell (SSH) on the Cisco ASR 1000 Series Routers can be configured and handled like Telnet and SSH on other Cisco platforms. For information on traditional Telnet, see the line command in the Cisco IOS Terminal Services Command Reference guide located at: http://www.cisco.com/en/US/docs/ios/12_2/termserv/command/reference/trflosho.html#wp1029818.

For information on configuring traditional SSH, see the “Configuring Secure Shell” chapter of the Cisco IOS Security Configuration Guide located at: http:/​/​www.cisco.com/​en/​US/​docs/​ios/​12_2/​security/​configuration/​guide/​scfssh.html .

The Cisco ASR 1000 Series Routers also introduces persistent Telnet and persistent SSH. Persistent Telnet and persistent SSH allow network administrators to more clearly define the treatment of incoming traffic when users access the router through the Management Ethernet port using Telnet or SSH. Notably, persistent Telnet and persistent SSH provide more robust network access by allowing the router to be configured to be accessible through the Ethernet Management port using Telnet or SSH even when the IOS process has failed.

Persistent Telnet and Persistent SSH Overview

In traditional Cisco routers, accessing the router using Telnet or SSH is not possible in the event of an IOS failure. When Cisco IOS fails on a traditional Cisco router, the only method of accessing the router is through the console port. Similarly, if all active IOS processes have failed on a Cisco ASR 1000 Series Router that is not using persistent Telnet or persistent SSH, the only method of accessing the router is through the console port.

With persistent Telnet and persistent SSH, however, users can configure a transport map that defines the treatment of incoming Telnet or SSH traffic on the Management Ethernet interface.

See the Configuring Persistent Telnet and the Configuring Persistent SSH for information on the various other options that are configurable using persistent Telnet or persistent SSH transport maps.

Configuring a Console Port Transport Map

This task describes how to configure a transport map for a console port interface on the Cisco ASR 1000 Series Router.

SUMMARY STEPS

    1.    enable

    2.    configure terminal

    3.    transport-map type console transport-map-name

    4.    connection wait [allow interruptible | none]

    5.    exit

    6.    transport type console console-line-number input transport-map-name


DETAILED STEPS
     Command or ActionPurpose
    Step 1enable


    Example: 
    Router> enable
     

    Enables privileged EXEC mode.

    • Enter your password if prompted.
     
    Step 2configure terminal


    Example: 
    Router# configure terminal
     

    Enters global configuration mode.

     
    Step 3transport-map type console transport-map-name


    Example: 
    Router(config)# transport-map type console consolehandler
     

    Creates and names a transport map for handling console connections, and enter transport map configuration mode.

     
    Step 4connection wait [allow interruptible | none]

    Example: 
    Router(config-tmap)# connection wait none


    Example: 
    

		   
          		 
			 
     Specifies how a
				console connection will be handled using this transport map:
			 
    

			 
    • allow 
					 interruptible—The console connection waits for an
				  IOS vty line to become available, and also allows user to enter diagnostic mode
				  by interrupting a console connection waiting for the IOS vty line to become
				  available. This is the default setting.
				
      • 

    

			 
    Note   
                
               Users can
				interrupt a waiting connection by entering 
				Ctrl-C or 
				Ctrl-Shift-6.
			 
    

			 
    • none—The console connection immediately enters
				  diagnostic mode.
				
      • 

    

		   
      
    

    Step 5 exit
		   

    Example:
			 
    Router(config-tmap)# exit
    

		   
          		 
			 
     Exits transport
				map configuration mode to re-enter global configuration mode.
			 
    

		   
      
    

    Step 6transport 
				type 
				console 
			 console-line-number 
			 input 
			 transport-map-name
		  
     

    Example:
			 
    

		   

    Example:
			 
    Router(config)# transport type console 0 input consolehandler
    

		   
          		 
			 
     Applies the
				settings defined in the transport map to the console interface.
			 
    

			 
     The 
				transport-map-name for this command must match the
				
				transport-map-name defined in the 
				transport-map 
				  type 
				  console 
				comm and.
			 
    

		   
      
    

    

    

    Examples
    

     In the following
		example, a transport map to set console port access policies is created and
		attached to console port 0:
	 
    

    Router(config)# transport-map type console consolehandler
Router(config-tmap)# connection wait allow interruptible
Router(config-tmap)# exit
Router(config)# transport type console 0 input consolehandler

    

    

    

    

    Configuring
	 Persistent Telnet
    

    
		
     This task describes
		  how to configure persistent Telnet on the Cisco ASR 1000 Series Routers.
		
    

	 
    

    Before You Begin
    
		
     For a persistent
		  Telnet connection to access an IOS vty line on the Cisco ASR 1000 Series
		  Router, local login authentication must be configured for the vty line (the 
		  login command
		  in line configuration mode). If local login authentication is not configured,
		  users will not be able to access IOS using a Telnet connection into the
		  Management Ethernet interface with an applied transport map.
		
    

	 
    
SUMMARY STEPS
      1.   
      enable
		  
      

      2.   
      configure 
			 terminal
		  
      

      3.   
      transport-map 
				type 
				persistent 
				telnet 
			 transport-map-name
		  
      

      4.   
      connection 
				wait [allow {interruptible}| 
			 none {disconnect}]
		  
      

      5.   
      transport 
				interface 
				gigabitethernet 
				0
		  
      

      6.   
       exit
		  
      

      7.   
       transport
			 type persistent telnet input 
			 transport-map-name
		  
      


    DETAILED STEPS
       Command or ActionPurpose
      Step 1enable
		  
       

      Example:
			 
      Router> enable
      

		   
            		 
			 
       Enables
				privileged EXEC mode. 
			 
      

			 
      •  Enter your
				  password if prompted.
				
        • 

      

		   
      
      

      Step 2configure 
			 terminal
		  
       

      Example:
			 
      Router# configure terminal
      

		   
            		 
			 
       Enters global
				configuration mode.
			 
      

		   
      
      

      Step 3transport-map 
				type 
				persistent 
				telnet 
			 transport-map-name
		  
       

      Example:
			 
      Router(config)# transport-map type persistent telnet telnethandler
      

		   
            		 
			 
       Creates and
				names a transport map for handling persistent Telnet connections, and enters
				transport map configuration mode. 
			 
      

		   
      
      

      Step 4connection 
				wait [allow {interruptible}| 
			 none {disconnect}]
		   

      Example:
			 
      Router(config-tmap)# connection wait none
      

		   

      Example:
			 
      

		   
            		 
			 
       Specifies how a
				persistent Telnet connection will be handled using this transport map:
			 
      

			 
      • allow—The Telnet connection waits for an IOS vty
				  line to become available, and exits the router if interrupted.
				
        • 

      • allow 
					 interruptible—The Telnet connection waits for the
				  IOS vty line to become available, and also allows user to enter diagnostic mode
				  by interrupting a Telnet connection waiting for the IOS vty line to become
				  available. This is the default setting.
				
        • 

      

			 
      Note   
                
               Users can
				interrupt a waiting connection by entering 
				Ctrl-C or 
				Ctrl-Shift-6.
			 
      

			 
      • none—The Telnet connection immediately enters
				  diagnostic mode.
				
        • 

      • none 
					 disconnect—The Telnet connection does not wait for
				  the IOS vty line and does not enter diagnostic mode, so all Telnet connections
				  are rejected if no vty line is immediately available in IOS.
				
        • 

      

		   
      
      

      Step 5transport 
				interface 
				gigabitethernet 
				0
		  
       

      Example:
			 
      Router(config-tmap)# transport interface gigabitethernet 0
      

		   
            		 
			 
       Applies the
				transport map settings to the Management Ethernet interface (interface
				gigabitethernet 0).
			 
      

			 
       Persistent
				Telnet can only be applied to the Management Ethernet interface on the Cisco
				ASR 1000 Series Routers. This step must be taken before applying the transport
				map to the Management Ethernet interface.
			 
      

		   
      
      

      Step 6 exit
		   

      Example:
			 
      Router(config-tmap)# exit
      

		   
            		 
			 
       Exits
				transport map configuration mode to re-enter global configuration mode.
			 
      

		   
      
      

      Step 7 transport
			 type persistent telnet input 
			 transport-map-name
		   

      Example:
			 
      

		   

      Example:
			 
      Router(config)# transport type persistent telnet input telnethandler
      

		   
            		 
			 
       Applies the
				settings defined in the transport map to the Management Ethernet interface.
			 
      

			 
       The 
				transport-map-name for this command must match the
				
				transport-map-name defined in the 
				transport-map 
				  type 
				  persistent 
				  telnet comm and.
			 
      

		   
      
      

      

      

      Examples
      

       In the following
		example, a transport map that will make all Telnet connections wait for an IOS
		vty line to become available before connecting to the router, while also
		allowing the user to interrupt the process and enter diagnostic mode, is
		configured and applied to the Management Ethernet interface (interface
		gigabitethernet 0).
	 
      

       The transport map is
		then applied to the interface when the 
		transport 
		  type 
		  persistent
		  
		  telnet 
		  input command is entered to enable persistent
		Telnet. 
	 
      

      Router(config)# transport-map type persistent telnet telnethandler
Router(config-tmap)# connection wait allow interruptible
Router(config-tmap)# transport interface gigabitethernet 0
Router(config-tmap)# exit
Router(config)# transport type persistent telnet input telnethandler
      

      

      

      

      Configuring
	 Persistent SSH
      

      
		
       This task describes
		  how to configure persistent SSH on the Cisco ASR 1000 Series Routers.
		
      

	 
      
SUMMARY STEPS
        1.   
      enable
		  
        

        2.   
      configure 
			 terminal
		  
        

        3.   
      transport-map 
				type 
				persistent 
				ssh 
			 transport-map-name
		  
        

        4.   
      connection 
				wait [allow {interruptible}| 
			 none {disconnect}]
		  
        

        5.   
      rsa 
				keypair-name 
			 rsa-keypair-name
		  
        

        6.   
      
			 authentication-retries number-of-retries 
		  
        

        7.   
       time-out
			 timeout-interval 
		  
        

        8.   
      transport 
				interface 
				gigabitethernet 
				0
		  
        

        9.   
       exit
		  
        

        10.   
       transport
			 type persistent ssh input 
			 transport-map-name
		  
        


      DETAILED STEPS
         Command or ActionPurpose
        Step 1enable
		  
         

        Example:
			 
        Router> enable
        

		   
              		 
			 
         Enables
				privileged EXEC mode. 
			 
        

			 
        •  Enter your
				  password if prompted.
				
          • 

        

		   
      
        

        Step 2configure 
			 terminal
		  
         

        Example:
			 
        Router# configure terminal
        

		   
              		 
			 
         Enters global
				configuration mode.
			 
        

		   
      
        

        Step 3transport-map 
				type 
				persistent 
				ssh 
			 transport-map-name
		  
         

        Example:
			 
        Router(config)# transport-map type persistent ssh sshhandler
        

		   
              		 
			 
         Creates and
				names a transport map for handling persistent SSH connections, and enters
				transport map configuration mode. 
			 
        

		   
      
        

        Step 4connection 
				wait [allow {interruptible}| 
			 none {disconnect}]
		   

        Example:
			 
        Router(config-tmap)# connection wait allow interruptible
        

		   

        Example:
			 
        

		   
              		 
			 
         Specifies how a
				persistent SSH connection will be handled using this transport map:
			 
        

			 
        • allow—The SSH connection waits for the vty line to
				  become available, and exits the router if interrupted.
				
          • 

        • allow 
					 interruptible—The SSH connection waits for the vty
				  line to become available, and also allows users to enter diagnostic mode by
				  interrupting a SSH connection waiting for the vty line to become available.
				  This is the default setting.
				
          • 

        

			 
        Note   
                
               Users can
				interrupt a waiting connection by entering 
				Ctrl-C or 
				Ctrl-Shift-6.
			 
        

			 
        • none—The SSH connection immediately enters
				  diagnostic mode.
				
          • 

        • none 
					 disconnect—The SSH connection does not wait for
				  the vty line from IOS and does not enter diagnostic mode, so all SSH
				  connections are rejected if no vty line is immediately available.
				
          • 

        

		   
      
        

        Step 5rsa 
				keypair-name 
			 rsa-keypair-name
		  
         

        Example:
			 
        Router(config-tmap)# rsa keypair-name sshkeys
        

		   
              		 
			 
         Names the RSA
				keypair to be used for persistent SSH connections.
			 
        

			 
         For persistent
				SSH connections, the RSA keypair name must be defined using this command in
				transport map configuration mode. The RSA keypair definitions defined elsewhere
				on the router, such as through the use of the 
				ip 
				  ssh 
				  rsa 
				  keypair-name command, do not apply to persistent
				SSH connections.
			 
        

			 
         No 
				  rsa-keypair-name is defined by default.
			 
        

		   
      
        

        Step 6
			 authentication-retries number-of-retries 
		   

        Example:
			 
        Router(config-tmap)# authentication-retries 4
        

		   
              		 
			 
         (Optional)
				Specifies the number of authentication retries before dropping the connection.
			 
        

			 
         The default 
				number-of-retries is 3.
			 
        

		   
      
        

        Step 7 time-out
			 timeout-interval 
		   

        Example:
			 
        Router(config-tmap)# time-out 30
        

		   
              		 
			 
         (Optional)
				Specifies the SSH time-out interval in seconds.
			 
        

			 
         The default 
				timeout-interval 
				is 120 seconds.
			 
        

		   
      
        

        Step 8transport 
				interface 
				gigabitethernet 
				0
		  
         

        Example:
			 
        Router(config-tmap)# transport interface gigabitethernet 0
        

		   
              		 
			 
         Applies the
				transport map settings to the Management Ethernet interface (interface
				gigabitethernet 0).
			 
        

			 
         Persistent
				SSH can only be applied to the Management Ethernet interface on the Cisco ASR
				1000 Series Routers.
			 
        

		   
      
        

        Step 9 exit
		   

        Example:
			 
        Router(config-tmap)# exit
        

		   
              		 
			 
         Exits
				transport map configuration mode to re-enter global configuration mode.
			 
        

		   
      
        

        Step 10 transport
			 type persistent ssh input 
			 transport-map-name
		   

        Example:
			 
        

		   

        Example:
			 
        Router(config)# transport type persistent ssh input sshhandler
        

		   
              		 
			 
         Applies the
				settings defined in the transport map to the Management Ethernet interface.
			 
        

			 
         The 
				transport-map-name for this command must match the
				
				transport-map-name defined in the 
				transport-map 
				  type 
				  persistent 
				  ssh command .
			 
        

		   
      
        

        

        

        Examples
        

         In the following
		example, a transport map that will make all SSH connections wait for the vty
		line to become active before connecting to the router is configured and applied
		to the Management Ethernet interface (interface gigabitethernet 0). The RSA
		keypair is named sshkeys.
	 
        

         This example only
		uses the commands required to configure persistent SSH.
	 
        

        Router(config)# transport-map type persistent ssh sshhandler
Router(config-tmap)# connection wait allow
Router(config-tmap)# rsa keypair-name sshkeys
Router(config-tmap)# transport interface gigabitethernet 0

        

         In the following
		example, a transport map is configured that will apply the following settings
		to any users attempting to access the Management Ethernet port via SSH:
	 
        

        •  Users using SSH will wait for the vty
		  line to become active, but will enter diagnostic mode if the attempt to access
		  IOS through the vty line is interrupted.
		
          • 

        •  The RSA keypair name is sshkeys
		
          • 

        •  The connection
		  allows one authentication retry.
		
          • 

        •  The banner “
		  --Waiting for vty line-- ” will appear if the connection is waiting for the vty
		  line to become active.
		
          • 

        

         The transport map is
		then applied to the interface when the 
		transport 
		  type 
		  persistent
		  
		  ssh 
		  input command is entered to enable persistent SSH:
		
	 
        

        Router(config)# transport-map type persistent ssh sshhandler
Router(config-tmap)# connection wait allow interruptible
Router(config-tmap)# rsa keypair-name sshkeys
Router(config-tmap)# authentication-retries 1

        

        Router(config-tmap)#banner wait X
Enter TEXT message.  End with the character 'X'.
--Waiting for vty line--
X
Router(config-tmap)# 
time-out 30
Router(config-tmap)# transport interface gigabitethernet 0
Router(config-tmap)# exit
Router(config)# transport type persistent ssh input sshhandler
        

        

        

        

        Viewing Console
	 Port, SSH, and Telnet Handling Configurations
        

         Use the 
		show 
		  transport-map 
		all 
		 
		  name 
		transport-map-name | 
		  type 
		console 
		 
		  persistent
		  
		ssh 
		 
		  telnet]]] EXEC or privileged EXEC command to view
		the transport map configurations. 
	 
        

         In the following
		example, a console port, persistent SSH, and persistent Telnet transport are
		configured on the router and various forms of the 
		show 
		  transport-map command are entered to illustrate
		the various ways the 
		show 
		  transport-map command can be entered to gather
		transport map configuration information. 
	 
        

        Router# show transport-map all
Transport Map:
  Name: consolehandler
  Type: Console Transport
Connection:
  Wait option: Wait Allow Interruptable
  Wait banner: 
Waiting for the IOS CLI
 
Transport Map:
  Name: sshhandler
  Type: Persistent SSH Transport
Interface:
  GigabitEthernet0
Connection:
  Wait option: Wait Allow Interruptable
  Wait banner: 
Waiting for IOS prompt
  
SSH:
  Timeout: 120
  Authentication retries: 5
  RSA keypair: sshkeys
Transport Map:
  Name: telnethandler
  Type: Persistent Telnet Transport
Interface:
  GigabitEthernet0
Connection:
  Wait option: Wait Allow Interruptable
  Wait banner: 
Waiting for IOS process
  
Transport Map:
  Name: telnethandling1
  Type: Persistent Telnet Transport
Connection:
  Wait option: Wait Allow
Router# show transport-map type console
Transport Map:
  Name: consolehandler
  Type: Console Transport
Connection:
  Wait option: Wait Allow Interruptable
  Wait banner: 
Waiting for the IOS CLI
  
Router# show transport-map type persistent ssh
Transport Map:
  Name: sshhandler
  Type: Persistent SSH Transport
Interface:
  GigabitEthernet0
Connection:
  Wait option: Wait Allow Interruptable
  Wait banner: 
Waiting for IOS prompt
  
SSH:
  Timeout: 120
  Authentication retries: 5
  RSA keypair: sshkeys
Router# show transport-map type persistent telnet
 
Transport Map:
  Name: telnethandler
  Type: Persistent Telnet Transport
Interface:
  GigabitEthernet0
Connection:
  Wait option: Wait Allow Interruptable
  Wait banner: 
Waiting for IOS process
  
Transport Map:
  Name: telnethandling1
  Type: Persistent Telnet Transport
Connection:
  Wait option: Wait Allow
Router# show transport-map name telnethandler 
Transport Map:
  Name: telnethandler
  Type: Persistent Telnet Transport
Interface:
  GigabitEthernet0
Connection:
  Wait option: Wait Allow Interruptable
  Wait banner: 
Waiting for IOS process
  
Router# show transport-map name consolehandler
Transport Map:
  Name: consolehandler
  Type: Console Transport
Connection:
  Wait option: Wait Allow Interruptable
  Wait banner: 
Waiting for the IOS CLI
  
Router# show transport-map name sshhandler
Transport Map:
  Name: sshhandler
  Type: Persistent SSH Transport
Interface:
  GigabitEthernet0
Connection:
  Wait option: Wait Allow Interruptable
  Wait banner: 
Waiting for IOS prompt
  
SSH:
  Timeout: 120
  Authentication retries: 5
  RSA keypair: sshkeys
Router#

        

         The 
		show 
		  platform 
		  software 
		  configuration 
		  access 
		  policy command can be used to view the current
		configurations for the handling of incoming console port, SSH, and Telnet
		connections. The output of this command provides the current wait policy for
		each type of connection, as well as any information on the currently configured
		banners. 
	 
        

        Router# show platform software configuration access policy 
The current access-policies
Method      : telnet
Rule        : wait
Shell banner: 
Wait banner : 
Method      : ssh
Rule        : wait
Shell banner: 
Wait banner : 
Method      : console
Rule        : wait with interrupt
Shell banner: 
Wait banner : 

        

         In the following
		example, the connection policy and banners are set for a persistent SSH
		transport map, and the transport map is enabled. 
	 
        

         The 
		  show 
		  platform 
		  software 
		  configuration 
		  access 
		  policy output is given both before the new
		transport map is enabled and after the transport map is enabled so the changes
		to the SSH configuration are illustrated in the output. 
	 
        

        Router# show platform software configuration access policy
 
The current access-policies
Method      : telnet
Rule        : wait with interrupt

Wait banner : 
Waiting for IOS Process
Method      : ssh
Rule        : wait
Shell banner: 
Wait banner : 
Method      : console
Rule        : wait with interrupt
Shell banner: 
Wait banner : 
Router# configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)# transport-map type persistent ssh sshhandler
Router(config-tmap)# connection wait allow interruptible

Router(config-tmap)# rsa keypair-name sshkeys
Router(config-tmap)# transport interface gigabitethernet 0
Router(config-tmap)# exit
Router(config)# transport type persistent ssh input sshhandler 
Router(config)# exit
Router# show platform software configuration access policy
The current access-policies
Method      : telnet
Rule        : wait with interrupt

Wait banner : 
Waiting for IOS process
Method      : ssh
Rule        : wait with interrupt

Wait banner : 
Waiting for IOS
Method      : console
Rule        : wait with interrupt
Shell banner: 
Wait banner : 
        

        

        

        Important Notes and
	 Restrictions
        

         The important notes
		and restriction pertaining to the console port, SSH, and telnet handling
		include:
	 
        

        •  The Telnet and SSH settings made in
		  the transport map override any other Telnet or SSH settings when the transport
		  map is applied to the Management Ethernet interface.
		
          • 

        •  Only local usernames and passwords
		  can be used to authenticate users entering a Management Ethernet interface. AAA
		  authentication is not available for users accessing the router through a
		  Management Ethernet interface using persistent Telnet or persistent SSH.
		
          • 

        •  Applying a
		  transport map to a Management Ethernet interface with active Telnet or SSH
		  sessions can disconnect the active sessions. Removing a transport map from an
		  interface, however, does not disconnect any active Telnet or SSH sessions.
		
          •