Cisco 2501 and the default VTY telnet ports

[Rookcr]

Good day,

A quick question that should be easy for someone but the answer escapes me.

I have serveral Cisco 2501 routers in my company. Thay all have the default 5 Telnet or VTY terminals enabled. How would I reduce that number to just one or two?

Thanks,

Rook

 

[MTandSAV]

hi, if I'm not mistaken, you can reduce that by specifying

line vty 0 1

instead of

line vty 0 4

Now you've got only two incoming telnet connections max.

 

[Rookcr]

So I type it just like that in the config t?

I will give it a try.

 

[ior]

You probably need to remove your previous settings with the no command first. (This will probably disconnect you if you are remotely connected)

(config) no line vty 0 4
or something similar should do it.

 

[Rookcr]

Well I have had no luck. I cannot remove the router tellme me I am unable to remove the last 5 tty lines. I have even tried to seperate the line tty 0 1 and the line tty 2 4 and remove with the no command 2 4 and I am having no luck.

Any ideas.

 

[bf0x]

Rook,

Since the router will not allow you to delete vty connections I see only two other options for this to work to your benifit.

First suggestion would be to go into config mode then go into line vty 0 4 and enter the following command session-limit 2 (this will allow you to define that at any given time that only to telnet sessions can be opened.

The second option would be to configure login and passwords for vty 0 1 and do not set login information for vty 2 4. This will cause the vty connections to require a login and if ones not set then it will not allow for a password to be entered. Caution: I believe you will still need to set the password for vty 2 4 but just dont put in the command login for vty 2 4.

I hope this helps you.

 

[Rookcr]

Everyone. Thanks for the input. I did a workaround and let me know what you think.

I did the following:

line vty 0 1
password
exec-timeout
login

and so on.

line vty 2 4
login
no password

This allows for someone to try to connect then it dumbs that user. what do you think?

 

[bf0x]

Rooker,

Thats excellent. With Cisco Routers if you asign a password but do not put the command login in the settings it will disconnect the user stating that the password is set but unable to login. My only concern with what you put is that you allow someone to login but dont require them to enter a password. Have you tested this with telnet sessions to see if it works.

 

[Rookcr]

It works. My 1st 2 sessions login and then the 3rd or more cancel out with the login no password set.

 

[bf0x]

Sounds great, thank you for the info. Someday I may need this info and now I know.