Secure-Access Troubleshooting Capstone: SSH VTY Fix

Bundle lab

Advanced secure-access capstone, run as a fault hunt. A hardening change was rolled back badly overnight: the edge router is reachable but the management plane is wide open in several different ways at once, and an SSH key cannot even be generated. You get symptoms and the required end state — no fault list. Everything is on one device, so the work is knowing which pieces of a management-plane build depend on each other rather than hunting across a topology.

Learning objectives

• Audit a router's management plane from its running configuration, with no list of what was changed
• Know why SSH cannot be enabled without a hostname and a domain name
• Distinguish line-password authentication from local-user authentication, and why the difference matters
• Spot a disabled session timeout as a security fault rather than a convenience
• Restore secure access without falling back to Telnet or weakening the crypto

Troubleshooting focus

• SSH negotiation fails or is refused despite IP reachability
• Login method does not reference the intended authentication source
• Service readiness gaps: RSA keys not present or SSH service not enabled
• Line authentication behavior differs from expectations due to VTY configuration