CCNA: Console and VTY Line Hardening

Bundle lab

Harden the console and VTY lines on a single Cisco IOS router so idle sessions close automatically and every access path requires authentication. You will configure login local on both console and VTY, set 5-minute exec timeouts, enable logging synchronous on the console, and restrict VTY to SSH. Verification uses show outputs; grading evaluates the deterministic running-config.

Learning objectives

• Require authentication on the console with login local tied to a local user database
• Enforce exec-timeout 5 0 on both console and VTY lines to close idle sessions
• Prevent log messages from interrupting console input with logging synchronous
• Restrict remote access to SSH only with transport input ssh on VTY
• Explain how these controls reduce risk of unattended or unauthenticated access

Troubleshooting focus

• If exec-timeout is not exactly 5 0, the grader will not pass; confirm minutes and seconds.
• login local must be under both line console 0 and line vty 0 4; setting it only in one place is insufficient.
• transport input ssh must appear on VTY; leaving Telnet enabled (or transport input all) does not meet requirements.
• logging synchronous must be configured under line console 0 (not globally).
• Ensure a local username with secret exists so login local works; otherwise you can lock yourself out.