CloudLabBox
Try the free demo

HCIA-Datacom lab 14 of 22

Secure remote access with AAA and SSH

Secure remote management the Huawei way. You create local AAA users with the right privilege levels and service types, compare Telnet with SSH (STelnet), get past the router's factory restriction on which interfaces accept logins, transfer files with FTP, and secure the CloudEngine switch with SSH.

Run this lab

It needs Lite: its 3 nodes are set to 4 vCPU and 6,144 MB in total. That fits the free demo too.

In your workspace: Shared, then HCIA-Datacom H12-811 guided labs, then 14 - Secure remote access with AAA and SSH

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 60 minutes
Nodes need
4 vCPU, 6,144 MB
Smallest plan
Lite

The scenario

Northwind's auditors found routers managed over Telnet with one shared account. You'll fix it on R1 and the CloudEngine switch SW1:

  • personal accounts with the least privilege they need;
  • SSH instead of Telnet;
  • an FTP account for configuration backups.

To get the feel of each protocol you'll first see Telnet working, then replace it. R2 plays the network team's workstation: VRP routers include Telnet, STelnet (SSH) and FTP clients.

AccountPasswordLevelServicesDevice
netadminHuawei@12315telnet, sshR1
helpdeskHuawei@1231telnetR1
ftpuserHuawei@12315ftp (directory flash:/)R1
sshadminHuawei@1233ssh (STelnet)SW1

What you’ll practise

  • Create AAA local users with password, privilege level and service type
  • Configure VTY lines for AAA authentication and choose the inbound protocols
  • Enable Telnet, STelnet (SSH) and FTP servers, including the per-interface permit that newer AR releases require
  • Log in with the VRP Telnet, STelnet and FTP clients, and explain why SSH replaces Telnet

The tasks

  • Task 0: Load the starting configuration
  • Task 1: Users on R1
  • Task 2: Telnet, the insecure way
  • Concept: SSH (STelnet) on VRP
  • Task 3: Move R1 to SSH
  • Task 4: FTP for backups
  • Task 5: SSH on the CloudEngine switch

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Secure remote access with AAA and SSH3 nodes, 2 links. Every link is listed as text below the diagram.R1R2SW1GE0/0/0GE0/0/1GE0/0/0GE1/0/1
3 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R2 GE0/0/0 to R1 GE0/0/1
  • R1 GE0/0/0 to SW1 GE1/0/1
Nodes in Secure remote access with AAA and SSH, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Huawei AR1000V routerhuaweiar1k-5.170-V300R022C00SPC100-Auto-update-esn1 vCPU, 2,048 MB
R2Huawei AR1000V routerhuaweiar1k-5.170-V300R022C00SPC100-Auto-update-esn1 vCPU, 2,048 MB
SW1Huawei CloudEngine CE6800huaweice6800-bundled2 vCPU, 2,048 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder HCIA-Datacom H12-811 guided labs.

  3. Open 14 - Secure remote access with AAA and SSH and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More HCIA-Datacom labs

All HCIA-Datacom labs

Related labs in other courses

CloudLabBox is independent of Huawei. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.