How to Enable SSH on a Cisco Switch (Step-by-Step + Fixes)

Secure remote access is a basic requirement for managing Cisco switches. SSH replaces Telnet by encrypting login credentials and management traffic.

This guide shows how to enable SSH correctly—and what to check if it doesn’t work.

Step 1: Configure Hostname and Domain

hostname SW1
ip domain-name example.local

Step 2: Create a Local User

username admin privilege 15 secret YourPassword
enable secret YourEnablePassword

Step 3: Generate RSA Keys

crypto key generate rsa modulus 2048

Step 4: Enable SSH v2

ip ssh version 2

Step 5: Restrict VTY to SSH

line vty 0 15
login local
transport input ssh

Step 6: Ensure Management IP Exists

interface vlan 1
ip address 192.168.1.10 255.255.255.0
no shutdown

Common Issues

SSH not working

• No management IP
• VLAN interface down

Connection refused

• VTY not set to SSH
• Telnet still enabled

RSA key errors

• Missing hostname/domain

How to Test

ssh -l admin 192.168.1.10

FAQ

Recommended RSA key size?
2048-bit

Does Catalyst 2960 support SSH?
Yes (with proper IOS)

How to disable Telnet?
Use transport input ssh

Final Tip

If you are configuring SSH across multiple switch models, check IOS support and lifecycle status in advance. Some older platforms may support SSH but lack newer security features.