Chapter 8
Configuring Switch-Based Authentication
Configuring SSH
This section has this configuration information:
•
•
•
Configuration Guidelines
Follow these guidelines when configuring the switch as an SSH server or SSH client:
•
•
•
•
•
Setting Up the Switch to Run SSH
Follow these steps to set up your switch to run SSH:
1.
2.
3.
4.
Beginning in privileged EXEC mode, follow these steps to configure a host name and an IP domain name
and to generate an RSA key pair. This procedure is required if you are configuring the switch as an SSH
server.
Command
Step 1
configure terminal
Step 2
hostname hostname
Step 3
ip domain-name domain_name
78-16156-01
Configuration Guidelines, page 8-39
Setting Up the Switch to Run SSH, page 8-39
Configuring the SSH Server, page 8-40
server)
An RSA key pair generated by a SSHv1 server can be used by an SSHv2 server, and the reverse.
If you get CLI error messages after entering the crypto key generate rsa global configuration
command, an RSA key pair has not been generated. Reconfigure the host name and domain, and then
enter the crypto key generate rsa command. For more information, see the
to Run SSH" section on page
When generating the RSA key pair, the message
you must configure a host name by using the hostname global configuration command.
When generating the RSA key pair, the message
must configure an IP domain name by using the ip domain-name global configuration command.
When configuring the local authentication and authorization authentication method, make sure that
AAA is disabled on the console.
Download the cryptographic software image from Cisco.com. This step is required. For more
information, refer to the release notes for this release.
Configure a host name and IP domain name for the switch. Follow this procedure only if you are
configuring the switch as an SSH server.
Generate an RSA key pair for the switch, which automatically enables SSH. Follow this procedure
only if you are configuring the switch as an SSH server.
Configure user authentication for local or remote access. This step is required. For more
information, see the
"Configuring the Switch for Local Authentication and Authorization" section
on page
8-36.
Purpose
Enter global configuration mode.
Configure a host name for your switch.
Configure a host domain for your switch.
(required)
(required only if you are configuring the switch as an SSH
8-39.
No host name specified
No domain specified
Catalyst 3560 Switch Software Configuration Guide
Configuring the Switch for Secure Shell
"Setting Up the Switch
might appear. If it does,
might appear. If it does, you
8-39