PuTTY vs SecureCRT vs Tera Term: Terminal Emulators for Cisco Labs
The terminal emulator is the one tool you stare at for every minute of every lab, yet most learners grab whatever a tutorial names first and never reconsider it. That's fine until you're driving eight nodes in a CML topology at once, hunting for the show command output you ran twenty minutes ago, or wondering why your Mac refuses to SSH into an older IOS image. The three emulators that dominate Cisco work — PuTTY, Tera Term, and SecureCRT — barely differ in their ability to open a single session. They differ enormously in how much friction they add once you're running many sessions and need a durable record of what you did. Here's how they actually compare, and how to match one to your budget and your workload.
First, know what you're connecting to
A terminal emulator does two jobs in Cisco work, and the distinction drives everything else. The first is a serial console connection: you plug a rollover or USB console cable into the device and the emulator talks to a COM port. Cisco's console defaults are the durable 9600 8N1 — 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control. If a live device shows garbage on connect, a wrong baud rate is almost always why. The second job is a network session over SSH or Telnet to the device's management IP once it has one. SSH is encrypted and is what you use everywhere real; Telnet is cleartext and only acceptable inside an isolated lab.
In a Cisco Modeling Labs environment you rarely touch a physical cable, but the same two paths exist. CML exposes each node's console line, and you can reach it either from the built-in terminal in the browser UI or, when enabled, over SSH/Telnet to the controller's terminal server — check your CML version's documentation for the exact address and port, since that detail moves between releases. The browser terminal is convenient for a quick look, but it can't write a log file to your disk, which is the single biggest reason to point a real emulator at the lab instead. Once a node has a reachable management address, you SSH straight to it like any other device.
PuTTY: the free, do-everything default
PuTTY is the reflexive choice on Windows for good reason: it's free and open source, it's a single tiny executable that needs no installation, and it speaks every protocol you'll meet — SSH, Telnet, raw, rlogin, and serial. That serial support matters, because it means one tool covers both console cabling and network sessions. It also ships a useful family of companion utilities: PuTTYgen for generating and converting SSH keys, Pageant as an in-memory key agent, and Plink/PSCP for scripting and file transfer from the command line.
PuTTY's limits show up at scale, not on your first session. There are no tabs — every session is its own window, so a five-node lab becomes five floating windows to arrange and mislabel. Saved sessions live in a flat list with no folders, which gets unwieldy as your device count climbs. Logging works but is deliberately manual: you set it per session under Session > Logging (choose 'All session output' and a file path) before you connect, and it's easy to forget. None of this is disqualifying — plenty of working engineers live in PuTTY for years — but you feel every bit of the friction when you're managing many devices at once.
Tera Term: free, with stronger serial and macros
Tera Term is the other free, open-source Windows staple, and it earns its following on console-heavy work. Its serial handling is excellent and its logging is a step past PuTTY's: you can timestamp each captured line and rotate logs, which turns a session capture into something you can actually cite later when you're documenting what changed and when. For anyone spending real time on physical or emulated console lines, that timestamping alone can be the deciding feature.
Its standout is the built-in TTL macro language (Tera Term Language). TTL lets you script repetitive console interactions — logging in, pushing a baseline config, walking a set of devices — without paying for commercial tooling. Like PuTTY, Tera Term is Windows-only and single-window in feel, and its interface is dated. But if you want free plus scripting plus first-class serial and logging, it's the strongest option in that price bracket.
SecureCRT: paid, built for managing many devices
SecureCRT (from VanDyke Software) is the commercial answer, and what you're paying for is everything that makes running a dozen sessions bearable. It's genuinely cross-platform across Windows, macOS, and Linux — a real advantage if you don't live on Windows. Sessions open in tabs and tiles inside one window, and a Session Manager lets you organize saved devices into folders instead of a flat list, so a large topology stays navigable. It supports SSH2, Telnet, and serial, so like the others it covers both access paths.
For lab and production work its two heavy features are logging and scripting. Logging is robust and, crucially, template-driven: you can bake substitution variables like hostname, session name, and date into the log filename so every device auto-writes to its own dated file with no manual setup per session. Scripting supports Python along with VBScript, JScript, and PerlScript, which is a more capable automation surface than TTL for most people. Add keyword highlighting, logon actions, and button bars, and it clearly targets the engineer touching many devices a day. It's a paid license with a time-limited free trial; because editions and pricing change, check VanDyke's current page rather than trusting a number you read in a guide. The honest verdict: if you manage a handful of lab nodes occasionally, it's overkill, and if devices are your full-time job, the tabs, session manager, and automatic per-device logging pay for themselves quickly.
Built-in tools, logging, and how to choose
You may not need to install anything. macOS and Linux ship an OpenSSH client, and modern Windows 10/11 includes one too, so `ssh user@host` in Terminal or PowerShell reaches any device with SSH enabled. For serial consoles on macOS and Linux, command-line tools like `screen`, `picocom`, or `minicom` connect straight to the USB serial device at 9600 baud (the device name looks like `/dev/ttyUSB0` on Linux or `/dev/tty.usbserial-XXXX` on macOS). One recurring gotcha is worth planning for: older IOS images — and some CML node types — only offer legacy key-exchange and host-key algorithms that a current OpenSSH client disables by default, so a plain `ssh` fails with a 'no matching key exchange method' or 'no matching host key' error. The fix is to re-enable the old algorithm explicitly, shown below. GUI emulators like PuTTY and SecureCRT often sidestep this because they negotiate down more readily or expose the setting in a dialog.
Whatever you pick, log your lab sessions from the start. A captured session is your undo history, your evidence of what a command actually returned, and the raw material for lab notes — and on a graded lab it's how you reconstruct what you configured when something didn't score the way you expected. Turn logging on before you connect, not after you've already run the interesting commands.
For guidance by budget and need: if you're on Windows, want zero cost, and mostly run one or two sessions, PuTTY is the sensible default. If you do heavy console work or want free scripting with timestamped logs, choose Tera Term. If you work across macOS or Linux, keep many sessions open at once, or want automatic per-device logging and real Python scripting, SecureCRT is worth the license — and if you like the idea of tabs and folders but not the price, MobaXterm is a capable free tabbed option on Windows. When you only need a quick connection to a single reachable node, the built-in `ssh` client is already on your machine and is often the fastest path.
# Modern OS: SSH straight in from any terminal
ssh admin@192.0.2.1
# Older IOS/CML node offers only legacy crypto? Re-enable it explicitly:
ssh -o KexAlgorithms=+diffie-hellman-group14-sha1 -o HostKeyAlgorithms=+ssh-rsa admin@192.0.2.1
# Serial console on macOS/Linux (Cisco console defaults = 9600 8N1)
screen /dev/ttyUSB0 9600Frequently asked questions
Why can my Mac's built-in ssh connect to newer devices but refuse to SSH into an older IOS image?
Modern OpenSSH (the ssh client in macOS and Linux) disables the legacy SHA-1 host-key and key-exchange algorithms that old IOS images offer, so the handshake fails before you ever see a password prompt. You can force them per-connection with ssh -oHostKeyAlgorithms=+ssh-rsa -oKexAlgorithms=+diffie-hellman-group14-sha1 user@device, or fix it on the device by setting ip domain-name, running the EXEC command crypto key generate rsa for a 2048-bit key, and enabling SSH version 2. PuTTY and SecureCRT still expose these weaker algorithms in their config, which is often why they connect where the native client won't.
Do I actually need PuTTY or Tera Term for CML, or can I just use the built-in browser console?
CML runs as a virtual appliance inside a hypervisor and ships a browser-based console for every node, so no external emulator is strictly required to reach a device. A native emulator becomes worth it once you want tabbed sessions, local scrollback and per-session logging, or SSH straight to a node's management IP after you address it. Because the nodes are virtual there is no physical serial line involved, so the serial-port strengths that matter on real gear simply don't apply inside CML.
Which emulator is best for the blue rollover console cable on physical switches and routers?
Tera Term has the strongest built-in serial support and is a common pick for console work over a USB-to-serial adapter, though PuTTY and SecureCRT both handle serial fine once you set 9600 8-N-1 and the correct COM port. On Windows, confirm the adapter's COM number in Device Manager first, since a wrong or shifting port is the usual reason a console session opens but shows nothing. This only matters for physical equipment: a CML or other full-VM lab has no serial console to attach to.
Is there a way to type one command into all eight lab nodes at once instead of switching windows?
SecureCRT does this natively with tabbed or tiled sessions and a 'send commands to all sessions' feature, which is its main advantage on large topologies. PuTTY opens one window per session with no built-in broadcast, so people wrap it in SuperPuTTY or MTPuTTY to get tabs and multi-send, while Tera Term can broadcast keystrokes to multiple open windows via its Control menu. Use send-to-all carefully, since a line like no shutdown or an ACL entry is rarely identical across devices with different interface names or addressing.
Which emulator do I use if I'm on Packet Tracer or GNS3 instead of CML?
Packet Tracer has its own built-in CLI terminal, so you don't attach an external emulator at all, and although it is a simulator it can still auto-grade your work inside pre-authored .pka activities. GNS3 and EVE-NG do let you choose an external emulator such as PuTTY, Tera Term, or SecureCRT as the console tool in their preferences. So the emulator skill transfers across platforms, but full-VM options like EVE-NG and physical gear are the ones that lean on an external emulator per session, while CML and Packet Tracer offer a built-in console.
Practice on real Cisco IOS
A fresh, graded Cisco Modeling Labs scenario every day — start with the free sample.