vty/ssh/passwords

Question 1

What are the 4 steps to enable SSH?

Answer 1

1. configure hostname
2. configure domain name with ‘ip domain-name’
3. generate RSA key pair with ‘crypto key generate rsa’
4. configure a vty line to use SSH with ‘transport input ssh’

Question 2

‘switchport port-security violation restrict’

Answer 2

Port security option discards traffic and increases the security violation counter when unauthorized MAC comes through

Question 3

‘switchport port-security violation protect’

Answer 3

Port security that silently discards traffic and does not increment counter

Question 4

‘switchport port-security violation shutdown’

Answer 4

Port security that enters err-disabled if it receives unauthorized traffic

Question 5

6 steps to setup a device as SSH server?

Answer 5

1) hostname R1
2) ip domain-name
3) crypto key generate rsa
4) username Bill/enable secret
5) line vty 0 4
transport input ssh

Question 6

5 steps to configure a SSH client?

Answer 6

1) hostname R1
2) ip domain-name fqdn.com
3) crypto key generate rsa
4. ip ssh [time-out seconds]
5) line vty 0 4
transport input ssh

Question 7

login local does what?

Where is it configured?

Answer 7

tells the device to require a user to login using one of the configured usernames on the device.

it is configured at the line console level with ‘line console 0’
(config-line)

Question 8

How do you configure a L2 switch with a management IP?

4 steps

Answer 8

put an IP on the SVI, enable it, add default gateway to global config

(if) # interface vlan1
(if) # ip address 192.168.0.6 255.255.255.0
(if) # no shutdown
(config) # ip default-gateway 192.168.0.1

Question 9

What is required first before you can enter privileged exec mode through telnet?

Answer 9

enable secret.

If login local is enabled, a user must also be created with: ()#username jeremy secret password123

Question 10

what does ‘()# line vty 0 15’ do?

Answer 10

selects all the VTY lines for configuration

Question 11

What is the difference between the following commands:

(config-line)# access-class 1 in
()access-list 1 permit host 192.168.0.1
()ip access-list
()ip access-group

Answer 11

access-class : an ACL that applies only to VTY lines
access list : creates a VTY only ACL

(following two ip are not used for VTY?)
ip access-list : applies an ACL to an interface
ip access-group : creates an ACL

Question 12

how do you enable ssh on a vty line?

Answer 12

()# line vty 0 15

(config-line)# transport input ssh

Question 13

what command configures a VTY ACL?

Answer 13

()# access-list 199 permit tcp host 192.168.1.1 any eq 22

Question 14

what command applies a VTY ACL?

Answer 14

(config-line)# access-class 199 in