It's time to show you how to configure Cisco icons for public authentication.
I've created this simple topology with only one out there and the cloud, which is in fact my Windows
recording machine.
There is also a layer of connectivity between the windows, which will be the S6 client and their out
there, which will be the S.H. server.
Let's test the layer of connectivity between Windows and their outer.
I am pinging their outer.
And it's working.
Let's start with a basic SSX configuration will enable essayistic on the router at this moment, SSX
is not enabled on the router.
We can see that Port 22 is closed out there and it's not possible to connect to the router using Pooty
and S.H..
Let's see if Port 22 is open.
And I'm using the telnet comment to let the IP address of the router and the Port 20 to.
And we see that the connection failed, and that means that the port is closed.
I'm opening a console connection to their outher.
The first step is to configure a hostname, I am entering the global configuration mode and I am executing
the command hostname and honey like say I want.
Anyway, the host name was already configured, but configuring a hostname is mandatory for enabling
SSX good.
The second step is to configure a domain name.
IP domain name and any domain domain dot com next will enable the SSX demon, which also means generating
an RSA key pair on their outer crypto key, generate RSA, choose a key with a length of at least two
thousand forty eight beeks.
If you go with the default, which is 512, it won't work.
The client will not authenticate to this server with such a short key.
So the key will have a length of 2048 because.
SSX enabled.
And I enable a stage version to IPSC stage version to perfect now porked 22 is open on the out.
Let's check it again using the telnet comment.
And we noticed that it it's connected to the outer.
The next step is to configure the white lines to accept SSX and the local authentication, local authentication
means that the users are defined locally on the device.
It's not training or a yes or a tax server.
So line with why zero and for transport input SFH, I can also allow tallit or not, if I add telnet
tell, it will also be permitted on the device and if I don't add telnet, I can connect only using
S.H..
Let's allow both S.H. and tell and log in local.
OK, all I've enabled SSX on the router and the default authentication method is using the password.
Let's try to connect to the router using SSL and Pooty.
I am opening Puti the IP address of the router then that one, that one that, then the default port
is 22.
SSX and open.
And it's working, there is already a user configured on the router yuan and the password is Cisco.
Perfect example, just fine.
The next step is to enable public authentication on they're out there and the Vietnamese to import the
public key from our Windows or Linux operating system, depending on what we're using.
If we are using windows and we've generated the keys on windows, we'll open the public key file in
a text editor.
Let's open the public key we've just generated in the last lecture.
This is the public I generated the key with Pooty Key generator, and I am opening the file in Notepad
Plus plus this is the public and I will copy to the clipboard only the public without the begin comment
and end parts.
So only the public this is the public key that I will copy to the clipboard copy.
And I will paste it into the score out there, back to the score out there, I'm writing in global configuration
mode, IP, SSX, Bob Keychain.
This public will be used by a specific user in this example, let's say Windows user, so user name
Windows user, then keys string and enter.
Once I entered the Keys string comment, I can keep adding lines until I type the exit command.
In this case, I'll simply paste the contents of the clipboard, which is the publicly and based.
Perfect, I'm typing exit exit again and the last exit comment.
And I am saving the configuration by executing two and right.
To that, it's possible to add the multiple public keys for a single user.
This allows you to have multiple users access.
They're out there with the same username, but with different key pairs.
OK, the configuration is done.
Let's check if it works.
I'll try to connect from Windows using beauty to the sea squirt out there and see if it authenticates
the client using the keys.
Let's verify first that the writer has the correct public key.
We can print out the key fingerprint or using the following comment.
So from enablement either on show running config pipe a vertical bar, begin Popke.
OK, this is the key fingerprint, and I'll verify if it's the same inputting key generator.
I am opening petechiae generator and I am loading the private key.
This is the private key and this is the corresponding public.
Let's check the fingerprints.
This is the key fingerprint extending in six C f.
And they're out there.
Six, if it's the same, by the way, this is a hexadecimal string on the router, we have the correct
key.
If the key fingerprints or Hesh matches, we can continue.
I'm closing pooty key generator, so on Windows, I am opening Pooty and looking for connection, SFH
and authentication.
Here I am clicking on the browse button and select the private key used for authentication.
Private key file for authentication, browse desktop and the private keys and open.
Now, on the main screen, I can save the session so that I will not lose the settings.
All right, here, the IP address, if they're out there, then that one, that one, but then the default
part is 22 SSX.
And I'll give this station a name like, say, Aaron, Cisco and Safe.
I've saved the session and open.
It's asking for the user name Windows user, and I'm hitting enter.
Great, we have successfully authenticated to the router using the SSA to keep bear with the message,
authenticating with public key and the key comment, it didn't ask for a password anymore.
OK, that's all in the second part of this lecture, I'll show you how to configure the escort out there
for S.H. Public key authentication if the SSX client is a Linux machine.
See you in a second.