Examkin

Question

Difficulty: Very hardSSH Secure Remote Access Configuration and Verification

A network administrator is troubleshooting remote access on a branch gateway router (Branch-GW). SSH version 2 has been configured, but remote management attempts over SSH fail immediately with a transport layer connection error, whereas Telnet connections are unexpectedly accepted. The administrator collects the following configuration and status outputs from the router:

text
Branch-GW# show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 60 secs; Authentication retries: 3
Device Mode: SSH Server
RSA Key size: 2048 bits

Branch-GW# show running-config | section line vty
line vty 0 4
access-class MGMT-ACCESS in
login local
transport input telnet
line vty 5 15
access-class MGMT-ACCESS in
login local
transport input telnet

Which configuration change must be applied to Branch-GW to resolve the connection issue and enforce secure SSH access on all VTY lines?

  1. Execute transport input ssh under line vty 0 15 to allow inbound SSH sessions.Answer
  2. B
    Add permit any to the MGMT-ACCESS access list because standard ACLs block SSH transport negotiation by default.
  3. C
    Re-execute crypto key generate rsa modulus 512 to reset the key length for SSH version 2 compatibility.
  4. D
    Change login local to login under line vty 0 15 to permit public-key authentication.

Answer

Execute transport input ssh under line vty 0 15 to allow inbound SSH sessions.
The output from 'show running-config' demonstrates that all virtual terminal lines (vty 0 15) are configured with 'transport input telnet'. This restricts incoming management traffic strictly to Telnet (TCP port 23) and causes the router to reject incoming SSH (TCP port 22) connection requests at the line level. Changing the setting to 'transport input ssh' permits SSH inbound sessions.

Step-by-Step Solution

1
Analyze 'show ip ssh' verification output
SSH v2 is active and an RSA key of 2048 bits has been properly generated.
Verifies that global SSH preconditions (hostname, domain name, RSA key pair generation) are fully met.
2
Inspect VTY line configuration under 'show running-config'
'transport input telnet' is explicitly binding VTY lines 0 through 15 to accept only unencrypted Telnet traffic.
Even when SSH service is enabled globally, Cisco IOS VTY lines refuse incoming SSH transport connections if SSH is omitted from transport input.
3
Identify the required CLI configuration command
Navigate to 'line vty 0 15' and issue 'transport input ssh' (or 'transport input ssh telnet').
Re-enables inbound SSH connections across all virtual terminal lines.

Key Concept

VTY Line Transport Protocol Binding
Rate this question

Topics

SSH Secure Remote Access Configuration and Verification

More questions from this topic