Back to Command Reference
Line ConfigDomain 5.0
transport input ssh
The final step in securing a router. Executed in Line Configuration mode, this command explicitly drops all incoming Telnet (cleartext) connection attempts, forcing network administrators to use the encrypted SSH protocol.
CLI Deployment Scenarios
Router(config)# line vty 0 4
Router(config-line)# transport input ssh
! If you attempt to Telnet from another device now, the connection will be instantly refused.
CCNA Exam Gotchas
[!]
The Default State Danger
If you generate RSA keys and set up local login, SSH becomes active on the router. However, by default, the VTY lines are set to transport input all. This means Telnet is still actively listening alongside SSH. To satisfy security lab requirements, you must explicitly issue transport input ssh to kill the Telnet daemon entirely.