Hands-On Lab: Configuring SSH Access on a Router

Lab Objective

Configure a router to accept SSH connections for remote management, generate the required RSA key pair, configure local username-based authentication, and restrict the VTY lines to SSH only, verifying Telnet is no longer possible.

Lab Purpose

Telnet transmits all traffic, including passwords, in plaintext, making it trivially interceptable by anyone with access to the network path. SSH encrypts this traffic and should always be used instead in any production environment, discussed earlier in this series regarding device hardening.

Lab Topology

R1 ---- Gi0/0: 192.168.60.1/24

Management PC: 192.168.60.50/24

Task 1: Configure Basic Addressing

Configure R1's interface connecting to the management segment.

Task 2: Set the Hostname and Domain Name

Both are required before RSA key generation can succeed.

Task 3: Generate the RSA Key Pair

Generate a 2048-bit RSA key pair for SSH.

Task 4: Configure Local Authentication and SSH-Only VTY Access

Create a local username and password, then restrict VTY lines to SSH transport only.

Task 5: Verify SSH Access Works

Confirm the management PC can successfully connect via SSH.

Task 6: Verify Telnet Is Blocked

Confirm attempting to Telnet to R1 fails.

Solution and Verification

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip address 192.168.60.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit

R1(config)# hostname R1
R1(config)# ip domain-name example.com

R1(config)# crypto key generate rsa

The name for the keys will be: R1.example.com
How many bits in the modulus [512]: 2048

% Generating 2048 bit RSA keys, keys will be
non-exportable...[OK]

R1(config)# username admin secret AdminSecure2026
R1(config)# line vty 0 15
R1(config-line)# login local
R1(config-line)# transport input ssh

ManagementPC (192.168.60.50)> ssh -l admin 192.168.60.1

Password:
R1>
-- Successful SSH connection

ManagementPC> telnet 192.168.60.1

Trying 192.168.60.1 ...
% Connection refused by remote host
-- Telnet is rejected outright, since
-- "transport input ssh" removed Telnet
-- from the list of permitted protocols
-- entirely, rather than merely deprioritizing it

Key Takeaway

Generating the RSA key pair requires both hostname and domain name to be configured first, since the key is associated with the device's fully qualified domain name — attempting crypto key generate rsa before setting both fails outright, a detail worth remembering when SSH configuration unexpectedly does not work on a freshly initialized device.