LogoفارسیFA

Hands-On Lab: Configuring SSH Access on a Router

This hands-on lab configures SSH for secure remote management on a router, generating an RSA key pair, requiring local authentication, and restricting VTY lines to SSH only, verifying Telnet access is completely disabled.

SSH ConfigurationRSA Key GenerationTransport Input SSH

~3 min read · Updated Sep 23, 2026

Lab Objective

Configure a router to accept SSH connections for remote management, generate the required RSA key pair, configure local username-based authentication, and restrict the VTY lines to SSH only, verifying Telnet is no longer possible.

Lab Purpose

Telnet transmits all traffic, including passwords, in plaintext, making it trivially interceptable by anyone with access to the network path. SSH encrypts this traffic and should always be used instead in any production environment, discussed earlier in this series regarding device hardening.

Lab Topology

R1 ---- Gi0/0: 192.168.60.1/24

Management PC: 192.168.60.50/24

Task 1: Configure Basic Addressing

Configure R1's interface connecting to the management segment.

Task 2: Set the Hostname and Domain Name

Both are required before RSA key generation can succeed.

Task 3: Generate the RSA Key Pair

Generate a 2048-bit RSA key pair for SSH.

Task 4: Configure Local Authentication and SSH-Only VTY Access

Create a local username and password, then restrict VTY lines to SSH transport only.

Task 5: Verify SSH Access Works

Confirm the management PC can successfully connect via SSH.

Task 6: Verify Telnet Is Blocked

Confirm attempting to Telnet to R1 fails.

Solution and Verification

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip address 192.168.60.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit

R1(config)# hostname R1
R1(config)# ip domain-name example.com

R1(config)# crypto key generate rsa

The name for the keys will be: R1.example.com
How many bits in the modulus [512]: 2048

% Generating 2048 bit RSA keys, keys will be
non-exportable...[OK]

R1(config)# username admin secret AdminSecure2026
R1(config)# line vty 0 15
R1(config-line)# login local
R1(config-line)# transport input ssh

ManagementPC (192.168.60.50)> ssh -l admin 192.168.60.1

Password:
R1>
-- Successful SSH connection

ManagementPC> telnet 192.168.60.1

Trying 192.168.60.1 ...
% Connection refused by remote host
-- Telnet is rejected outright, since
-- "transport input ssh" removed Telnet
-- from the list of permitted protocols
-- entirely, rather than merely deprioritizing it

Key Takeaway

Generating the RSA key pair requires both hostname and domain name to be configured first, since the key is associated with the device's fully qualified domain name — attempting crypto key generate rsa before setting both fails outright, a detail worth remembering when SSH configuration unexpectedly does not work on a freshly initialized device.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring HSRP for IPv6

This hands-on lab configures HSRP for IPv6 between two routers, demonstrating the option to use an automatically generated link-local virtual address rather than manually assigning one, and verifies failover behavior mirrors the IPv4 HSRP lab covered earlier in this series.

Continue

Hands-On Lab: Configuring SVI Autostate Exclude

This hands-on lab configures SVI autostate exclude on a monitoring port within a VLAN, preventing that single inactive port from incorrectly bringing down the SVI for an entire VLAN that still has other active member ports.

Continue

Hands-On Lab: Configuring Private VLANs (PVLANs)

This hands-on lab configures a full Private VLAN structure with a primary VLAN and both isolated and community secondary VLANs, demonstrating fine-grained Layer 2 isolation within a single IP subnet beyond what the simple protected-port feature from an earlier lab can achieve.

Continue

Hands-On Lab: Configuring VLAN Access Control Lists (VACLs)

This hands-on lab configures a VLAN Access Control List using a VLAN access-map to filter traffic within a single VLAN at Layer 2, something a standard router-applied ACL cannot achieve since traffic never leaves the VLAN to reach a routed interface.

Continue

Hands-On Lab: Configuring Storm Control

This hands-on lab configures storm control thresholds on a switch port to limit broadcast and multicast traffic, simulating a broadcast storm and verifying the switch suppresses excess traffic before it can overwhelm the network.

Continue

Hands-On Lab: Configuring PVLAN Edge (Protected Ports)

This hands-on lab configures PVLAN Edge (protected ports) on two access ports within the same VLAN, isolating them from each other at Layer 2 while both retain normal connectivity to an uplink port, demonstrating a lightweight isolation feature that requires no separate VLAN.

Continue
Previous ArticleNext Article