Skip to main content

Cisco IOS

Description​

The Cisco IOS connector connects to Cisco IOS, IOS-XE, and IOS-XR devices via SSH and runs CLI show commands to enumerate local user accounts and their privilege levels. It maps IOS privilege levels (0–15) to entitlements and identifies level-15 accounts as privileged.

System Type Classification​

FieldValue
System TypeInfrastructure
Default Scan Priority200

Version Support​

OrbisID EditionSupported
CommunityNo
ProYes
EnterpriseYes

Supported Protocol​

ProtocolPortNotes
SSH22 TCPSSHv2 required; SSHv1 not supported

What OrbisID Discovers​

DataSource
Local user accounts`show running-config
Privilege levels (0–15)privilege level N in user config stanza
Enabled secret presenceenable secret / enable password detection

Connection Requirements​

Required Permissions​

The scanning account requires privilege level 1 or higher to run show commands. For full discovery, privilege level 15 (enable mode) is recommended.

Minimum permissions:

  • SSH login access to the device
  • show running-config — or equivalent parser view with username section visibility

Credential Mapping​

OrbisID FieldValue
credential.usernameIOS local username
credential.passwordIOS password
system.hostnameDevice management IP or hostname

Network Requirements​

The OrbisID server must have SSH access to the Cisco device on port 22.

Configuration Steps​

  1. Create a local user on the Cisco device with sufficient privilege: 
    username orbisid-scanner privilege 15 secret <password>
  2. Create a Credential in OrbisID:
    • Username: orbisid-scanner
    • Password: IOS password
  3. Navigate to Systems → Add System
  4. Fill in the fields:
FieldValue
NameDescriptive name (e.g., Cisco IOS – Core Router)
OS TypeCiscoIos
System TypeInfrastructure
HostnameDevice management IP or hostname
CredentialThe scanning credential
  1. Click Test Connection
  2. Click Save

Troubleshooting​

SymptomLikely CauseResolution
Authentication failedInvalid username or passwordVerify local user credentials on the device
Connection refusedSSH not enabledRun ip ssh version 2 and line vty 0 4 / transport input ssh
No accounts returnedshow running-config not authorisedUse privilege level 15 for the scanning account
Permission deniedACL on vty linesAdd the OrbisID server IP to the VTY access list