Lab Objective:
The objective of this lab exercise is for you to learn and understand how to enable SSH access to a device—in this case, a Cisco router.
Lab Purpose:
It’s never a good idea to permit Telnet access to network devices, especially in corporate settings. SSH is a secure way to connect to network devices.
Lab Tool:
Packet Tracer
Lab Topology:
Please use the following topology to complete this lab exercise (note that we use crossover cables to connect PCs to routers):
Lab Walkthrough:
Task 1:
Configure the hostnames on router Router1 as illustrated in the topology. You must always answer ‘no’ at the start because the routers will drop into a question-and-answer mode in an attempt to self-configure. I’ll use R1 as the hostname.
— System Configuration Dialog —
Continue with configuration dialog? [yes/no]: no
Press RETURN to get started!
Router>enable
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname R1
R1(config)#
Task 2:
Add an IP address to each Ethernet interface and ‘no shut’ the router interface in order to bring them up. Ensure you can ping across the link. Your router may have a gigabit interface, so feel free to configure it as yours does.
R1(config)#interface fastethernet 0/0
R1(config-if)#ip address 192.168.1.2 255.255.255.0
R1(config-if)#no shut
%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
R1(config-if)#end
R1#
%SYS-5-CONFIG_I: Configured from console by console
R1#ping 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 0/0/0 ms
Task 3:
Secure Router1 so that it accepts SSH incoming connections. We need to set a domain name and generate keys. As options, we have set the password retries to 2 and the timeout to 60 seconds if there is no activity.
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#ip domain-name 101labs.net
R1(config)#crypto key generate rsa
The name for the keys will be: R1.101labs.net. Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.
How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys, keys will be non-exportable…[OK]
R1(config)#ip ssh time-out 60
R1(config)#ip ssh authentication-retries 2
R1(config)#line vty 0 15
R1(config-line)#transport input ssh
R1(config-line)#password cisco
R1(config-line)#end
Next, you can go to the router’s Telnet lines. There are 16 available lines on most Cisco devices numbered 0 to 15 inclusive. You need to permit incoming SSH connections on these.
R1#show ip ssh
SSH Enabled – version 1.99
Authentication timeout: 60 secs; Authentication retries: 2
R1#
Task 4:
Connect to Router1 from your PC using SSH. You should be prompted for the password, which, as you can see above, is ‘cisco’. You can add a username for the connection, which I’ve done here by using the -l switch (lowercase letter L).
You can quit the session by typing exit at the command prompt.
Task 5:
Attempt to Telnet from the PC to Router1 to check that the connection is refused.
R1(config)#Enable password cisco123
Notes:
Almost any router model will do for this lab. Just make sure you connect them with a crossover cable because we aren’t using a switch in this lab. Ensure you have watched the lab on how Packet Tracer works on www.101labs.net/resources.
