Configuring Authentication for Cisco Routers and Switches

Adding username and password authentication to Cisco routers and switches doesn't take more than a few minutes, does not require a software upgrade in most cases, and will increase router and switch security.

Boosting authentication increases security by forcing hackers to guess both the username and password rather than just a password. And authentication can be passed to a central server so that users and passwords can be created and modified in one spot without having to change the configuring on every router and switch in the company. Additionally, this type of authentication is needed to configure Secure Shell access to routers and switches, which encrypts administration traffic. Cisco supports username and password authentication on almost every device so a software upgrade is probably not needed before configuration. But Secure Shell requires a software upgrade in many cases.

This article will include configuration examples for local and TACACS+ server authentication. A nice example for configuring RADIUS authentication on routers and switches or passing authentication back to the company's Active Directory can be found at TechRepublic..

In many cases, administrators just configure a telnet password for their network devices, which is the least secure way to permit access. Here is an example of the way those routers are configured.

RouterA#configure terminal

RouterA(config)# line vty 0 4

A router's telnet interface is called a vty, short for Virtual Teletype Terminal.

RouterA(config)# password letmein

RouterA(config)# end

This will allow access to router via telnet by just the password letmein. Below is an example of configuring a router for username and password authentication from a local database stored on the router itself. If you have more than one router or switch, each router will need to be configured. Either way is more secure than just a password by itself. A more complex password increases security, so use passwords that are difficult to guess and create usernames that are not as simple to guess like admin or cisco..

RouterA#configure terminal