200-301 - IP Services (10% of the exam) - Section 4.8
Configure network devices for remote access using SSH and describe the capabilities and function of TFTP and FTP in the network.
Secure remote management by enabling SSH on the VTY lines - generating an RSA key, setting a hostname and domain, creating a local user, and forcing transport input ssh - instead of cleartext Telnet. Describe how TFTP and FTP move IOS images and configuration files to and from network devices, and where each fits for backup, upgrade, and restore.
SSH remote accessVTY linesTelnet vs SSHTFTPFTP file transfer
Practice question for this objective
lock_openFree sampleIP Serviceseasy
A junior engineer wants R1 to accept inbound SSH version 2 sessions on its VTY lines. R1 currently has its factory hostname, no domain name, no crypto keys, and no local users. Which set of steps brings SSH up so that an administrator can log in with a local account?
Router> show running-config | include hostname
hostname Router
Router> show ip ssh
SSH Disabled - version 1.99
%Please create RSA keys to enable SSH.
AGenerate an RSA key of at least 768 bits and apply transport input ssh on the VTY lines, leaving the default hostname and skipping the domain name and local user
BSet a hostname and ip domain-name, create a local username, then apply login local and transport input telnet on the VTY lines without generating any key
CSet a hostname and ip domain-name, generate a 256-bit RSA key, create a local username, then apply login local and transport input ssh on the VTY lines
DSet a hostname and ip domain-name, generate an RSA key of at least 768 bits, create a local username, then apply login local and transport input ssh on the VTY linescheck_circle Correct
Configure SSH on Cisco VTY lines, recognising the hostname, domain name, RSA key, local user and transport input ssh requirements. SSH on IOS depends on an RSA key pair whose label is derived from the hostname and ip domain-name, so both must be non-default before key generation; the key must be at least 768 bits to support SSH version 2. The VTY lines then need login local to check the local username and transport input ssh to accept only SSH.
Why A is wrong: crypto key generate rsa fails while the hostname is the default Router and no ip domain-name is set, because the key label is built from both; without a local user and login local an administrator also has no credentials to present.
Why B is wrong: transport input telnet permits Telnet rather than SSH, and with no RSA key generated SSH cannot start at all, so this configuration leaves the device reachable only by clear-text Telnet.
Why C is wrong: Every other step here is right, but a 256-bit modulus is below the 768-bit minimum that SSH version 2 needs, so IOS will not bring SSH version 2 up on a key that small.
Why D is correct: The RSA key needs a non-default hostname and a domain name to form its label, the key must be at least 768 bits for SSH version 2, and the VTY lines need login local with transport input ssh so local credentials are checked and only SSH is accepted.
Answers that look right on this material and are not. Each one is a distractor from a different question in the 200-301 bank for this domain.
Both the Telnet and the SSH attempt connect, because transport input ssh enables SSH while leaving Telnet available as the IOS default
errorWhy it is wrong: transport input ssh replaces the permitted protocol list rather than adding to a default; once it is set, Telnet is no longer in the list, so the assumption that Telnet stays available is wrong.
Add the command ip ssh version 2 in global configuration and leave the 512-bit key and transport input telnet unchanged
errorWhy it is wrong: Forcing version 2 cannot run on a 512-bit key because version 2 requires at least 768 bits, and transport input telnet still blocks SSH on the VTY lines, so neither problem is actually fixed.
An obtained certificate from an external certificate authority must be installed on the switch so the SSH server can present a trusted identity.
errorWhy it is wrong: This is tempting by analogy with HTTPS, but SSH on Cisco devices uses a locally generated RSA key pair for its host keys and does not require any CA-issued certificate to operate.