Skip to main content

How to Configure Passwords to Secure your Cisco Router



Maybe you have a new router or you want to verify that you have security properly configured on your existing router. Either way, password security is critical to properly securing your Cisco router. So let’s get started configuring passwords on your Cisco router.
Types of Cisco Router Passwords

When it comes to basic password security, there are three basic types:


Line Passwords


Privileged mode Passwords (enable mode)


Username Passwords (optional)

Let’s explore these.

Line Passwords

Line passwords are configured on router lines. Examples of lines are:


Console Line - The console is the main serial administrative port on a router. This is where you configure the router when it is new and has no network configuration.


Aux Line – The aux line is an auxiliary port. Like the console, it is a physical port on every router. You can think of it as a backup console port. Besides being a backup console port, the aux port is periodically used for administrative console dial up access to the router.


VTY Lines – Vty lines are “virtual tty” lines and are used when you connect to the router via telnet or ssh. These are not physical lines on the router but virtual “inbound network lines”.


Async Lines – Async lines are asynchronous serial lines and are optional. These async lines are created when you insert an async serial card in a router. You can use the async serial lines to connect dumb-terminals (text-based terminals), serial printers, or modems.

All of these different lines need a password configured on them. Let’s find out how to configure Cisco router line passwords.
Configuring Cisco Router Line Passwords

There are two commands used to configure line passwords, no matter what kind of line you are using. The commands are password and login. The password command is used to set your line password. The login command, when entered by itself, is used to tell the router to use the password that is configured on the line. Here is an example of how this is configured on the console port:



As you can see in the graphic, we first set the password to cisco using password cisco, then enabled login using that password with the login command.

We repeat this on the aux port, like this:



Finally, we configure the same commands on the VTY lines. The catch to doing this is that there is more than one VTY. Because you don’t want to have to configure them one at a time, you use a VTY range when performing the configuration. Using a VTY range works by specifying your router’s starting and ending VTY number. Inside the configuration mode for this range of VTYs is where you are configuring the password and login commands. In the past, router only had 0-4, or 5, VTY lines. Today, most routers have 0-15, or 16, VTY lines. Make sure that you know how many VTY’s your router has so that there aren’t some lines that are left without a password. Here is what you do to tell how many lines your router has:



As you can see from the screenshot above, this router has 16 (actually 0 to 15) VTY lines. You know this because the last line number is 15.

Here is how you would configure the password and login commands on the VTY lines using the range of VTY’s:




Configuring Cisco Router Privileged mode Passwords

Another basic router security requirement is that you configure a password used to enter privileged mode (enable mode). The enable password is a well-known way to do this but it is not recommended anymore because it does not encrypt the password with a strong encryption mechanism.

The enable secret command does encrypt the password with a strong encryption mechanism and it also sets a password to enter enable mode. Here is how you configure an enable secret password:


Testing Password Configuration

To test our new password configuration from the console port, exit out of all IOS modes. Once logged off, press enter to log back in.

You will be prompted with the console login prompt. Enter your console line password, cisco. Once you are logged in, type enable and press enter. You will be prompted for your privilege mode password. Type Cisco! and press enter. You should now be logged in. Here is an example:


Username Passwords

Optionally, you can configure usernames and associated passwords on a Cisco router. This is a more advanced level of security than line passwords. Once configured on the lines, the line password is then ignored.

You configure the usernames with the username command and can add their password on the same command line. Optionally, you can configure the privilege level of that user. Level 15 is the administrative user.

Once you create the username, you need to tell each line to use the local username/password database, on the router. To do this, go back to each line and type login local.

Here is an example:



Now let’s test it out:



Notice that we were prompted for a username. We typed in one of the users we setup, admin. We were then prompted for admin’s password. Also, because we specified that admin’s privilege was 15, we were put directly into privileged mode, with full administrative privileges (and without having to type enable).

Popular posts from this blog

HOW TO EDIT THE BCD REGISTRY FILE

The BCD registry file controls which operating system installation starts and how long the boot manager waits before starting Windows. Basically, it’s like the Boot.ini file in earlier versions of Windows. If you need to edit it, the easiest way is to use the Startup And Recovery tool from within Vista. Just follow these steps: 1. Click Start. Right-click Computer, and then click Properties. 2. Click Advanced System Settings. 3. On the Advanced tab, under Startup and Recovery, click Settings. 4. Click the Default Operating System list, and edit other startup settings. Then, click OK. Same as Windows XP, right? But you’re probably not here because you couldn’t find that dialog box. You’re probably here because Windows Vista won’t start. In that case, you shouldn’t even worry about editing the BCD. Just run Startup Repair, and let the tool do what it’s supposed to. If you’re an advanced user, like an IT guy, you might want to edit the BCD file yourself. You can do this

DNS Scavenging.

                        DNS Scavenging is a great answer to a problem that has been nagging everyone since RFC 2136 came out way back in 1997.  Despite many clever methods of ensuring that clients and DHCP servers that perform dynamic updates clean up after themselves sometimes DNS can get messy.  Remember that old test server that you built two years ago that caught fire before it could be used?  Probably not.  DNS still remembers it though.  There are two big issues with DNS scavenging that seem to come up a lot: "I'm hitting this 'scavenge now' button like a snare drum and nothing is happening.  Why?" or "I woke up this morning, my DNS zones are nearly empty and Active Directory is sitting in a corner rocking back and forth crying.  What happened?" This post should help us figure out when the first issue will happen and completely avoid the second.  We'll go through how scavenging is setup then I'll give you my best practices.  Scavenging s

AD LDS – Syncronizing AD LDS with Active Directory

First, we will install the AD LDS Instance: 1. Create and AD LDS instance by clicking Start -> Administrative Tools -> Active Directory Lightweight Directory Services Setup Wizard. The Setup Wizard appears. 2. Click Next . The Setup Options dialog box appears. For the sake of this guide, a unique instance will be the primary focus. I will have a separate post regarding AD LDS replication at some point in the near future. 3. Select A unique instance . 4. Click Next and the Instance Name dialog box appears. The instance name will help you identify and differentiate it from other instances that you may have installed on the same end point. The instance name will be listed in the data directory for the instance as well as in the Add or Remove Programs snap-in. 5. Enter a unique instance name, for example IDG. 6. Click Next to display the Ports configuration dialog box. 7. Leave ports at their default values unless you have conflicts with the default values. 8. Click N