CCNA Foundations: Secure Remote Access — Restrict VTY with access-class

Archive lab

Harden SSH access to a production router by allowing only a designated management workstation to connect. You will apply a standard ACL to the router's VTY lines with access-class, verify that the permitted host can SSH in, and confirm that a second host on the same LAN is refused. End-to-end IP forwarding is pre-built with static routes so the focus stays on management-plane control.

Learning objectives

• Build and apply a standard IPv4 ACL to restrict VTY access to a single host
• Bind the ACL to VTY lines with access-class in the inbound direction
• Validate successful SSH from an approved host and refusal from an unapproved host
• Differentiate data-plane reachability (ping works) from management-plane authorization (SSH allowed/denied)

Troubleshooting focus

• If both hosts can SSH in, the ACL isn’t applied to VTY or its logic is too permissive.
• If neither host can SSH, confirm the ACL order and the permitted host IP matches the source address.
• If SSH fails but ping works only from one host, verify default gateway and static routes.
• If SSH never reaches the router, ensure RSA keys exist and VTY transport is SSH-only.