Examkin

Question

Difficulty: MediumSSH Secure Remote Access Configuration and Verification

A network administrator is deploying SSHv2 on a newly installed Cisco IOS branch gateway router named BR-GW01. Place the required CLI configuration tasks in the correct logical execution sequence from initial global configuration mode to final line security binding.

  1. 1Configure a non-default hostname using 'hostname BR-GW01' and set the IP domain name using 'ip domain name enterprise.net'.
  2. 2Generate general-purpose RSA keys using 'crypto key generate rsa modulus 1024'.
  3. 3Explicitly enforce SSH version 2 using 'ip ssh version 2'.
  4. 4Create a local authentication account using 'username admin privilege 15 secret CiscoPass123!'.
  5. 5Enter VTY line configuration mode, bind local authentication using 'login local', and restrict inbound traffic using 'transport input ssh'.

Answer

The correct operational sequence to configure SSHv2 on Cisco IOS is: 1) Set hostname and domain name to construct the FQDN, 2) Generate RSA keys with at least 768 bits modulus (e.g., 1024 bits), 3) Enforce SSH version 2 globally, 4) Create local user credentials, and 5) Configure line VTY for local login and SSH transport input.
The correct sequence follows the mandatory dependency hierarchy of Cisco IOS SSHv2 configuration. First, an FQDN must exist by defining a non-default host name and IP domain name. Second, an RSA key pair of at least 768 bits (1024 bits in this case) must be generated, which enables the SSH daemon. Third, 'ip ssh version 2' explicitly locks SSH to version 2. Fourth, local user credentials must be created in global configuration mode. Finally, virtual terminal lines (line vty) must be configured with 'login local' to use the local user database and 'transport input ssh' to restrict incoming traffic strictly to SSH.

Step-by-Step Solution

1
Set Hostname and Domain Name
Defines the Fully Qualified Domain Name (FQDN) for the device (BR-GW01.enterprise.net).
Cisco IOS cannot generate RSA keys without an established FQDN because the key pair name is derived directly from the host name and domain name.
2
Generate RSA Cryptographic Key Pair
Creates the public/private RSA key pair and automatically enables the SSH server process.
An RSA modulus size of 768 bits or greater (such as 1024 or 2048 bits) is strictly required to support SSH version 2 operations.
3
Specify SSH Version 2
Globally locks SSH operations to version 2 only.
By default, Cisco IOS supports both SSH v1.5 and v2 upon key generation. Forcing version 2 eliminates vulnerability to v1 protocol negotiation downgrades.
4
Create Local User Credentials
Populates the local database with an administrative user account.
SSH connection attempts require user authentication; creating a local account provides local database verification when AAA is not using remote RADIUS/TACACS+ servers.
5
Bind Authentication and Transport Restrictions to Line VTY
Configures 'login local' and 'transport input ssh' on virtual terminal lines.
This step ensures inbound remote management connections require local username/password verification and explicitly blocks unencrypted protocols like Telnet.

Key Concept

Cisco IOS SSHv2 Configuration Dependencies and Deployment Sequence
Rate this question

Topics

SSH Secure Remote Access Configuration and Verification

More questions from this topic