CCNA Foundations: SSH & Device Hardening — Secure the Management Plane

Archive lab

CCNA exam domain: Security Fundamentals

Harden a single-site management LAN by replacing insecure Telnet with SSH-only access on the router. You will generate RSA keys, define a domain name, create a local admin user with a secret, force SSHv2, and restrict VTY lines to SSH with local login. Validate success from an admin workstation and confirm Telnet is refused. The topology is intentionally simple: one router, one access switch, and two hosts on a dedicated management VLAN.

Learning objectives

• Build a complete SSHv2 management plane on a Cisco IOS router
• Create and secure local credentials with an encrypted secret
• Generate RSA keys and set a device domain name for SSH
• Lock VTY lines to SSH only with local authentication
• Validate SSH connectivity from a management host and confirm Telnet is refused

Troubleshooting focus

• If SSH fails immediately, verify that RSA keys exist and that an ip domain name is configured before key generation.
• If prompted for a password on Telnet, VTY may still allow Telnet. Restrict transport to SSH only on lines 0–4.
• If SSH prompts never appear, confirm reachability: host IP, VLAN membership on the switch ports, and the router interface state.
• If login fails on SSH, ensure a local username with a secret exists and VTY uses 'login local'.
• If SSH connects but shows protocol warnings, confirm 'ip ssh version 2' is set to enforce v2.