CCNA: SSH Access Fundamentals on R1

Free preview — the first lab of Device Hardening: SSH, AAA & Secure Access

Bring up secure remote management (SSH) on a single Cisco IOS router using a dedicated management LAN. You will configure the deterministic set of running-config lines that enable SSH with a local admin account, restrict VTY to SSH, and verify from a Linux workstation. RSA key generation is performed as an exec step and is not graded; the grading focuses on the presence of the configuration lines that make SSH functional and secure.

Learning objectives

• Enable SSH on a Cisco IOS router using only the necessary management-plane configuration lines
• Create and secure a local administrator account with privilege 15 and an enable secret
• Restrict remote access to SSH only and authenticate using the local user database
• Verify SSH service readiness from configuration and test an SSH login from a Linux host

Troubleshooting focus

• If SSH fails to start, confirm both a non-default hostname and an ip domain name are configured; both are required to generate RSA keys
• If the SSH connection is refused or prompts for a password repeatedly, verify line vty 0 4 has transport input ssh and login local
• If you can ping R1 but SSH still fails, ensure you have generated RSA keys with crypto key generate rsa
• If you log in but land at low privilege, check the configured username privilege level and the need to use enable (and that an enable secret exists)
• If DNS lookups slow down CLI, confirm you typed the correct SSH command (ssh admin@10.0.0.1) rather than a bare hostname that triggers DNS

Topology