Lab Objective:
The objective of this lab exercise is for you to learn and understand how to enable SSH access to a device—in this case, a Cisco router.
Lab Purpose:
It’s never a good idea to permit Telnet access to network devices, especially in corporate settings. SSH is a secure way to connect to network devices. In order to configure SSH, you need to:
- Create a hostname.
- Create a domain name.
- Generate a crypto key.
Lab Tool:
Packet Tracer
Lab Topology:
Please use the following topology to complete this lab exercise:
Lab Walkthrough:
Task 1:
Drag two routers onto the canvas. I don’t point this out in the labs because I presume you know this from reading your theory books, but connecting routers together requires a crossover cable (because we aren’t using a switch). I used 1941 models for this lab, but for most of the others I used 1841 models (which have Fast Ethernet interfaces).
Configure the hostnames on routers Router0 and Router1 as illustrated in the topology. You must always answer no at the start because the routers will drop into a question-and-answer mode in an attempt to self-configure. I’ll use R0 and R1 as hostnames. Here is how you do it on Router0: repeat the tasks on the other router, but give the hostname as R1.
— System Configuration Dialog —
Continue with configuration dialog? [yes/no]: no
Press RETURN to get started!
Router>enable
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname R0
R0(config)#
Task 2:
Add an IP address to each Ethernet interface and ‘no shut’ them in order to bring them up.
R0(config)#interface g0/0
R0(config-if)#ip address 192.168.1.1 255.255.255.0
R0(config-if)#no shut
%LINK-5-CHANGED: Interface GigabitEthernet0/0, changed state to up
Over to Router1:
R1(config)#interface g0/0
R1(config-if)#ip address 192.168.1.2 255.255.255.0
R1(config-if)#no shut
%LINK-5-CHANGED: Interface GigabitEthernet0/0, changed state to up
R1(config-if)#end
Make sure you can ping across the link.
R1#ping 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 0/0/0 ms
Task 3:
Secure Router1 so that it accepts SSH incoming connections. We need to set a domain name and generate keys. As options, we have set retries for the password to 2 attempts and a timeout of 60 seconds if there is no activity.
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#ip domain-name 101labs.net
R1(config)#crypto key generate rsa
The name for the keys will be: R1.101labs.net
Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.
How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys, keys will be non-exportable…[OK]
R1(config)#ip ssh time-out 60
R1(config)#ip ssh authentication-retries 2
R1(config)#line vty 0 15
R1(config-line)#transport input ssh
R1(config-line)#password cisco
R1(config-line)#end
Next you can go to the router Telnet lines. There are 16 available lines on most Cisco devices, numbered 0 to 15 inclusive. You need to permit incoming SSH connections on these and ‘transport input ssh’ above does this.
R1#show ip ssh
SSH Enabled – version 1.99
Authentication timeout: 60 secs; Authentication retries: 2
R1#
Task 4:
Connect to Router1 from Router0 using SSH. You should be prompted for the password, which, as you can see above, is ‘cisco’. You can add a username for the connection, which I’ve done here. Use the letter ‘l’ below after ‘ssh’ not the number 1.
R0#ssh -l paul 192.168.1.2
Open
Password:
R1>
You can quit the session by holding down the Ctrl + Shift + 6 keys at the same time, then letting go and pressing the X key.
Task 5:
Attempt to telnet from Router0 to Router1 to check that the connection is refused.
R0#telnet 192.168.1.2
Trying 192.168.1.2 …Open
[Connection to 192.168.1.2 closed by foreign host]
R0#
Notes:
Almost any model of router will do for this lab. Just make sure you connect the routers with a crossover cable because we aren’t using a switch in this lab. Ensure you have watched the video on how Packet Tracer works at www.101labs.net/resources.
