[Yandex Cloud documentation](../../index.md) > [Yandex Virtual Private Cloud](../index.md) > [Tutorials](index.md) > Additional settings and tools > Installing the Cisco CSR 1000v virtual router

# Installing the Cisco CSR 1000v virtual router


In Yandex Cloud, you can deploy the Cisco Cloud Services Router (CSR) 1000v on a ready-made VM image. 

To install the CSR 1000v and configure SSH access to it:

1. [Get your cloud ready](#before-you-begin).
1. [Create an SSH key pair](#create-ssh-keys).
1. [Create a VM with the Cisco Cloud Services Router](#create-router).
1. [Set the host name for the router](#hostname).
1. [Create a user with administrator privileges](#create-user).
1. [Configure authentication using SSH keys](#enable-ssh).
1. [Check the SSH connection to the router](#test-ssh).

If you no longer need the resources you created, [delete them](#clear-out).

## Getting started {#before-you-begin}

Sign up for Yandex Cloud and create a [billing account](../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../billing/quickstart/index.md) and [link](../../billing/operations/pin-cloud.md) a cloud to it.

If you have an active billing account, you can create or select a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).

[Learn more about clouds and folders here](../../resource-manager/concepts/resources-hierarchy.md).

### Required paid resources {#paid-resources}

{% note alert %}

When using a Cisco CSR 1000v image without a license, the router throughput is limited to 100 Kbps. To remove this limitation, [install a license](https://www.cisco.com/c/en/us/td/docs/routers/csr1000/software/configuration/b_CSR1000v_Configuration_Guide/b_CSR1000v_Configuration_Guide_chapter_01000.html).

{% endnote %}

The cost of using a virtual router includes:

* Fee for a disk and a continuously running VM (see [Yandex Compute Cloud pricing](../../compute/pricing.md)).
* Fee for using a dynamic or static external IP address (see [Yandex Virtual Private Cloud pricing](../pricing.md#prices-public-ip)).

## Create an SSH key pair {#create-ssh-keys}

To connect to a [VM](../../compute/concepts/vm.md) over SSH, you need a key pair: the public key resides on the VM, and the private one is kept by the user. This method is more secure than connecting with login and password.

{% note info %}

SSH connections using a login and password are disabled by default on public Linux images that are provided by Yandex Cloud.

{% endnote %}

Cisco Cloud Services Router (CSR) 1000v only supports keys generated using the RSA algorithm.

To create a key pair:

{% list tabs group=operating_system %}

- Linux/macOS {#linux-macos}

  1. Open the terminal.
  1. Use the `ssh-keygen` command to create a new key:

     ```bash
     ssh-keygen -t rsa -b 2048
     ```

     After you run the command, you will be asked to specify the names of files where the keys will be saved and enter the password for the private key. The default name is `id_rsa`. Keys are created in the `~/.ssh` directory.

     The public part of the key will be saved in the `<key_name>.pub` file.

- Windows 10/11 {#windows}

  1. Run `cmd.exe` or `powershell.exe`.
  1. Use the `ssh-keygen` command to create a new key:

     ```shell
     ssh-keygen -t rsa -b 2048
     ```

     After you run the command, you will be asked to specify the names of files where the keys will be saved and enter the password for the private key. The default name is `id_rsa`. The keys are created in `C:\Users\<username>\.ssh\` or `C:\Users\<username>\` depending on the command-line interface.

     The public part of the key will be saved to a file named `<key name>.pub`.

- Windows 7/8 {#windows7-8}

  Create keys using the PuTTY app:
  1. [Download](https://www.putty.org) and install PuTTY.
  1. Add the folder with PuTTY to the `PATH` variable:

      1. Click **Start** and type **Change system environment variables** in the Windows search bar.
      1. Click **Environment Variables...** at the bottom right.
      1. In the window that opens, find the `PATH` parameter and click **Edit**.
      1. Add your folder path to the list.
      1. Click **OK**.

  1. Launch the PuTTYgen app.
  1. Select **RSA** for the type of pair to generate and set the length to 2048. Click **Generate** and move the cursor in the field above it until key creation is complete.

     ![ssh_generate_key](../../_assets/compute/ssh-putty/ssh-generate-key-rsa.png)

  1. In **Key passphrase**, enter a strong password. Enter it again in the field below.
  1. Click **Save private key** and save the private key. Do not share its key phrase with anyone.
  1. Save the key to a text file. To do this, copy the public key from the text field to a text file named `id_rsa.pub`. Please note that the key must be written as a **single line** (no returns or line breaks).

{% endlist %}

{% note warning %}

Save the private key in a secure location, as you will not be able to connect to the VM without it.

{% endnote %}

## Create a VM with the Cisco Cloud Services Router {#create-router}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), navigate to the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) dashboard, click **Create resource**, and select `Virtual machine instance`.
  1. Under **Boot disk image**, in the **Product search** field, enter `Cisco CSR` and select a [Cisco CSR](https://yandex.cloud/en/marketplace/products/yc/cisco-csr) public image.
  1. Under **Location**, select an [availability zone](../../overview/concepts/geo-scope.md) where your VM will reside. If you do not know which availability zone you need, leave the default one.
  1. Under **Computing resources**, switch to the `Custom` tab and specify the [platform](../../compute/concepts/vm-platforms.md), number of vCPUs, and amount of RAM:

      * **Platform**: `Intel Ice Lake`
      * **vCPU**: `2`
      * **Guaranteed vCPU performance**: `100%`
      * **RAM**: `4 GB`

  1. Under **Network settings**:

      * In the **Subnet** field, select the network and subnet to which you want to connect your VM. If the [network](../concepts/network.md#network) or [subnet](../concepts/network.md#subnet) you need does not exist yet, [create it](../operations/subnet-create.md).
      * In the **Public IP address** field, select a static IP address from the list, or leave `Auto` to assign your VM a random external IP address from the Yandex Cloud pool.

  1. Under **Access**, select **SSH key** and specify the VM access credentials:

      * In the **Login** field, enter a username. Do not use `root` or other reserved usernames. To perform operations requiring superuser privileges, use the `sudo` command.
      * In the **SSH key** field, select the SSH key saved in your [organization user](../../organization/concepts/membership.md) profile.
        
        If there are no SSH keys in your profile or you want to add a new key:
        
        1. Click **Add key**.
        1. Enter a name for the SSH key.
        1. Select one of the following:
        
            * `Enter manually`: Paste the contents of the public SSH key. You need to [create](../../compute/operations/vm-connect/ssh.md#creating-ssh-keys) an SSH key pair on your own.
            * `Load from file`: Upload the public part of the SSH key. You need to create an SSH key pair on your own.
            * `Generate key`: Automatically create an SSH key pair.
            
              When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the `/home/<user_name>/.ssh` directory. In Windows, unpack the archive to the `C:\Users\<user_name>/.ssh` directory. You do not need additionally enter the public key in the management console.
        
        1. Click **Add**.
        
        The system will add the SSH key to your organization user profile. If the organization has [disabled](../../organization/operations/os-login-access.md) the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource.

  1. Under **General information**, specify the VM name: `cisco-router`.
  1. Under **Additional**, disable `Serial console access`.
  1. Click **Create VM**.

  It may take a few minutes to create your VM. When the VM status changes to `RUNNING`, you can use the serial console.

{% endlist %}

## Set the host name for the router {#hostname}

{% list tabs group=instructions %}

- Management console {#console}
  
  1. In the [management console](https://console.yandex.cloud), select the folder containing your VM.
  1. Navigate to **Compute Cloud**.
  1. In the VM list, select `cisco-router`.
  1. Go to the ![image](../../_assets/console-icons/terminal.svg) **Serial console** tab and click **Connect**.
  1. Wait for the operating system to start up completely.
  1. To switch to privileged mode, run the `enable` command in the serial console:

      ```text
      cisco-router.ru-central1.internal>enable
      ```

  1. Enter configuration mode and set the host name for the router:

      ```text
      cisco-router.ru-central1.internal#configure terminal
      Enter configuration commands, one per line. End with CNTL/Z.
      cisco-router.ru-cent(config)#hostname cisco-router
      ```

      The router name at the beginning of the command line should change to `cisco-router`.

{% endlist %}

## Create a user with administrator privileges {#create-user}

Create a user with administrator privileges and password authentication disabled:

{% list tabs group=instructions %}

- Management console {#console}

  In the serial console, run this command:

  ```text
  cisco-router(config)#username test-user privilege 15
  ```

{% endlist %}

## Configure authentication using SSH keys {#enable-ssh}

1. If your public SSH key is longer than 72 characters, split it into chunks of 72 characters each by running this command in your computer terminal:

   ```bash
   fold -bw 72 <public_key_file_path>
   ```

   This will output your public SSH key split into chunks, 72 characters in each.

1. In the serial console, enable access to the VM over SSH:

   ```text
   cisco-router(config)#aaa new-model
   cisco-router(config)#ip ssh server algorithm authentication publickey 
   cisco-router(config)#ip ssh pubkey-chain
   ```

1. Create a user named `test-user` and, in `conf-ssh-pubkey-data` mode, provide your public SSH key in chunks no longer than 72 characters, beginning with `ssh-rsa` and ending with the username:

   ```text
   cisco-router(conf-ssh-pubkey)#username test-user
   cisco-router(conf-ssh-pubkey-user)#key-string
   cisco-router(conf-ssh-pubkey-data)#<public_key_row>
   ...
   cisco-router(conf-ssh-pubkey-data)#<public_key_row>
   cisco-router(conf-ssh-pubkey-data)#exit
   cisco-router(conf-ssh-pubkey-user)#exit
   cisco-router(conf-ssh-pubkey)#exit
   cisco-router(config)#exit
   ```

1. Make sure that the key is added:

   ```text
   cisco-router#show run | beg ip ssh
   ip ssh pubkey-chain
     username test-user
      key-hash ssh-rsa <key_hash> <username_associated_with_this_key>
   !
   !
   ...
   ```

1. Compare the SSH key hash on the router with the key hash on your computer:

   ```bash
   ssh-keygen -E md5 -lf <public_key_file_path>
   ```

1. In the serial console, enter the password that enables the privileged mode:

   ```text
   cisco-router#configure terminal
   cisco-router(config)#enable secret <password>
   ```

## Check the SSH connection to the router {#test-ssh}

1. Log in to the router via SSH by running this command in your computer terminal:

   ```bash
   ssh -i <private_key_file_path> test-user@<router_public_IP_address> 
   ```

   If the configuration is correct, you will log in to the router as `test-user`. If these actions produce no connection, make sure the router configuration is correct in the serial console, i.e., check whether you ran the `aaa new-model` command, the key hashes are identical on your computer and the router, and password authorization is disabled for the test user. If still unable to locate the issue, repeat the previous steps. 
1. Enter the `enable` command and password. If the configuration is correct, you can proceed to configuring the router.

## How to delete the resources you created {#clear-out}

To stop paying for the resources you created:
* [Delete](../../compute/operations/vm-control/vm-delete.md) the VM.
* [Delete](../operations/address-delete.md) the static public IP if you reserved one.