Goldfish Networks wordmark
BeginnerPublished 2026-07-04

Enable Secret and Password Encryption on R1

Bundle lab

Harden privileged access on a single IOS router by configuring a hashed enable secret, creating a local admin user with privilege 15 and a secret, and enabling service password-encryption. Verify that privileged access requires the secret and that the running-config contains no cleartext passwords.

Track
Est. time
30 minutes
Difficulty
Beginner
Topics

Learning objectives

  • Explain the difference between enable password (plaintext) and enable secret (hashed).
  • Configure a local admin account with privilege 15 using a secure secret.
  • Enable service password-encryption to obfuscate any remaining plaintext line passwords.
  • Verify that the running-config stores the enable secret as a hash and contains no cleartext passwords.

Troubleshooting focus

  • If enable still accepts a simple password, verify you used 'enable secret', not 'enable password'.
  • If 'show run' displays cleartext passwords, confirm 'service password-encryption' is present.
  • If you cannot reach the router from ADMIN, verify interface Ethernet0/0 is up/up with 10.0.0.1/24 and the ADMIN default route points to 10.0.0.1.
  • If the username does not work later in the series for SSH, verify you used 'username <name> secret <pw>' and not the plaintext 'password' variant.

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Study this topic

Free guides, a command cheat sheet, and graded practice for this lab's topic.

Learn Device Security & SSH

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.