Configuring passwords on Cisco routers and switches

In this chapter, we will see how to configure passwords on Cisco routers and switches. Cisco devices have four types of passwords.

• Console password : Used to set password for the console access.
• Auxiliary password : It is used to set password to auxiliary port ( if the switch has one.)
• VTY lines password : Used to set password for telnet and ssh access.
• Privileged password : Used to set password for privileged access to the switch
• I am not going to show you how to set up auxiliary password here. Privileged mode of a Cisco device has some advanced IOS commands that can have disastrous consequences if used by wrong hands. So it is very important to set up a password to access privileged commands.Use the following commands.

The “enable” command takes us into privileged mode. The “conf t” mode takes us into global configuration mode which pertains to the configuration settings of the whole switch. The “enable password” sets a password for the privileged mode. ‘123456’ is the password. The “exit” command takes us out of the privileged mode. To see if a password has been set for the privileged mode, try entering into privileged mode by typing “en” command.

Encrypting passwords on Cisco routers and switches.

In the previous chapter, we have seen how to set passwords on Cisco switches or routers. Of course setting passwords does add to the security of the device but there is a small problem. The password is stored in plain text. Anyone who gets access to the switch can easily see all the passwords by typing command “show running-config or show startup-config”. Today we will see how to encrypt passwords on Cisco routers and switches.

Encrypting passwords can further enhance the security of the device. Privileged password can be encrypted by using the command “enable secret” instead of “enable password”. This command should be set from privileged global configuration mode.

Let’s see what can we see when we use the command “show running-config”.

We can see that the password we set has been encrypted, but what about other passwords. The console, auxiliary and vty lines passwords cannot be encrypted even if we use “enable secret” command. To encrypt those passwords, we have to use another command “service password-encryption” as shown below.

This command will encrypt all the passwords stored in plain text on the device.