yeah, but only via the console. i am able to telnet into this device. i was thinking you could not telnet into a device unless you had the login and/or password set for the device.

You have no authentication set on this router.

The username command described by Jerry will create a local account. However, I recommend going with privilege 15 on this one.

username [username] priv 15 password [password]

If you want telnet to use this local account, you need to configure the vtys as such:

line vty 0 4

login local

HTH,

__

Edison.

but here is the thing. it is using the local account for login.

i just started at a new company, and the first thing i notice was this. throughout my career, i have always used "login local" or set a vty password. it's really bugging me, because i'm like, "how is this working". the engineers here don't know why. the config i posted is complete (all ip addresses have been changed).

it's really crazy. i'm configuring tacacs now, but this is a very puzzling thing.

i am using telnet. it is prompting me for a username and password. the device is miles away. i am using secureCRT. port 23. i am able to telnet into this device and don't know why. i have never been able to do this on any other cisco device (without the vty being setup). i am going to have to put this into the lab at the house. this makes no sense to me. i'm baffled.

Dwayne

There has been an interesting discussion about user names and accounts but so far no answer to your fundamental question (which you have asked several times): how does this work to be able to telnet with no password. Here is the answer:

if the vty is not configured with the "login" command then there is no prompt for password and the connection is granted without checking passwords (even if a password were configured it would not be used unless some version of the login command is used).

So in your other jobs (and the default in IOS) is to have login (or login local or aaa new-model) configured which will result in checking passwords (or user ID and password). But on this router someone configured "no login" and the result is to permit access with no password checking.

If you configure login (or login local) under the vty lines then it will begin to check for passwords.

HTH

Rick

thanks rburts.

two things:

1. i was thinking that you could not login to a device via telnet, without having a line password or login local under the vty.

2. it is prompting me for a username and password. i was thinking that it may have been something with the ios version, but i have seen it on at least two devices here.

however, i didn't check to see if the versions were the same.

Dwayne

The more I dig into this the more unusual it becomes. Let me respond to your points here:

1) if a router is configured with "no login" then it will not prompt for a password when telnet is initiated and it will permit the telnet to connect. So yes there are circumstances where you can telnet to a router without a password being configured.

2) I am puzzled about your statement that it is prompting you for user name and password. I thought that the main point of this discussion was that you did not need a password to telnet to this router.

Perhaps there is some IOS version dependency here.

You state that the config that you post is complete, but I am finding that difficult to reconcile in what you posted. For example the posted config has no routing protocol and only a single static route:

ip route 192.168.0.0 255.255.0.0 192.168.5.5 name to_DAP_Network

but the next hop address of 192.168.5.5 is not in a local subnet and therefore is not reachable. This means that the static route is not functioning. So how are you able to reach it to telnet if it has no functioning static route?

Another thing that puzzles me is this: the posted config has no statement under the vty lines about login. So I assumed that this was the situation where the vty is configured with no login and that is what I discussed. But when I set up a test to demonstrate it I find that if I configure the vty that way then the vty has "no login" in the config. But your posted config does not have that. The only way that I can get the vty to not have any login statement at all is if I configure aaa new-model. But your posted config appears to have no new-model.

These inconsistencies make me wonder if the router that you access by telnet is really the same router from which you got the config that you posted. Perhaps you can clarify this?

HTH

Rick