CloudLabBox
Try the free demo

CCNA lab 31 of 46

Secure device management with SSH and VTY access control

Replace a router's shared Telnet password with named accounts, privilege levels and SSH version 2, harden logins against guessing, and allow management only from the management VLAN, then prove it from a Linux admin laptop and from a router that should be refused.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 4,608 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNA 200-301 guided labs, then 31 - Secure device management with SSH and VTY access control

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 55 minutes
Nodes need
5 vCPU, 4,608 MB
Smallest plan
Lite

The scenario

An audit at Ravensworth Insurance found that the branch router R1 accepts Telnet from anywhere with the shared password cisco, and nobody knows who changed what. You'll give every administrator a named account, switch remote access to SSH version 2, make password guessing slow, and allow management only from the management VLAN, where the admin laptop H1 lives.

DeviceInterfaceAddress
R1Gi0/0.10 (users) / Gi0/0.99 (management)10.31.10.1/24 / 10.31.99.1/24
R1Gi0/1 (WAN)10.0.12.1/30
R2Gi0/010.0.12.2/30 (a router that must not manage R1)
S1VLAN 9910.31.99.2/24
PC1VLAN 1010.31.10.10/24
H1VLAN 9910.31.99.10/24 (you set it)

Lab accounts: admin / Cl@ssLab1 (privilege 15), helpdesk / Help@desk55 (privilege 5), enable secret Cl@ssEnable1.

What you’ll practise

  • Compare management access methods and password policy elements
  • Create local users with scrypt secrets and a custom privilege level
  • Enable SSH version 2 and restrict the VTY lines to SSH
  • Harden logins with minimum length, login blocking and timeouts
  • Restrict management access with a VTY access-class and verify it from allowed and denied sources

The tasks

  1. Know your management options
  2. Create named accounts and a help-desk level
  3. Turn on SSH version 2
  4. Lock the VTY lines to SSH and the local users
  5. Make guessing slow
  6. Allow management only from VLAN 99
  7. Watch who is connected

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Secure device management with SSH and VTY access control5 nodes, 4 links. Every link is listed as text below the diagram.R1R2S1PC1H1Gi0/0Gi0/0Gi0/1eth0Gi0/2eth0Gi0/1Gi0/0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to S1 Gi0/0
  • R1 Gi0/1 to R2 Gi0/0
  • S1 Gi0/1 to PC1 eth0
  • S1 Gi0/2 to H1 eth0
Nodes in Secure device management with SSH and VTY access control, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
R2Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
S1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 1,024 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNA 200-301 guided labs.

  3. Open 31 - Secure device management with SSH and VTY access control and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNA labs

All CCNA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.