IP Services // Lesson 08

SSH Remote Access.

Configure IOS for authenticated, encrypted remote CLI access and verify the VTY path.

SSH v2RSA keysLocal userVTYManagement ACL
01 // Mental model

Start with the big picture.

A hostname and domain name support RSA key generation for the SSH server.

CCNA focus: If SSH fails, separate transport reachability, TCP/22 filtering, server/key status and authentication. Avoid enabling Telnet as a shortcut.
02 // Building blocks

Know what each part does.

01

Identity

A hostname and domain name support RSA key generation for the SSH server.

02

Authentication

A local user database or central AAA verifies the administrator.

03

VTY policy

The virtual terminal lines specify login method and allowed transports.

04

Reachability and restriction

A management IP path must work, and an ACL can restrict trusted source networks.

03 // Compare and recognise

Read the clues.

ItemWhat to remember
crypto key generate rsaCreates the key pair used by the SSH server.
ip ssh version 2Selects SSH version 2.
login localUses the local username database on the VTY lines.
transport input sshRejects Telnet on those lines and accepts SSH.
04 // Secure IOS configuration

Secure IOS configuration.

R1(config)# hostname R1
R1(config)# ip domain-name baznetic.local
R1(config)# username admin privilege 15 secret StrongSecret
R1(config)# crypto key generate rsa modulus 2048
R1(config)# ip ssh version 2
R1(config)# line vty 0 4
R1(config-line)# login local
R1(config-line)# transport input ssh
R1# show ip ssh
R1# show users

Read the example from top to bottom, then verify the resulting state. Configuration is only complete when the output matches the intended design.

05 // Exam and troubleshooting

Turn facts into a method.

  • Creates the key pair used by the SSH server.
  • Selects SSH version 2.
  • Uses the local username database on the VTY lines.
  • Rejects Telnet on those lines and accepts SSH.
Exam checkpoint: If SSH fails, separate transport reachability, TCP/22 filtering, server/key status and authentication. Avoid enabling Telnet as a shortcut.
06 // Check yourself

SSH Remote Access quiz.

1. What key type is commonly generated for IOS SSH service?

2. What does transport input ssh do?

3. What does login local reference?

4. Which TCP port does SSH normally use?

5. What should restrict which source networks may manage the device?

Score: 0 / 5