CCNA 200-301 v1.1 reference — Network Access

Device management access

Console, Telnet, SSH, HTTP and HTTPS management access, TACACS+/RADIUS integration and cloud-managed alternatives.

Objective 2.8v1.1 exam target

Access methods

Management access methods

Method	Transport	Security	Use
Console	Serial/USB, direct cable	Physical access only — no network needed	Initial config, recovery when network is dead
Telnet	TCP 23	Cleartext — credentials and session exposed	Never on untrusted networks; lab only
SSH	TCP 22	Encrypted	Standard remote CLI access
HTTP	TCP 80	Cleartext	Avoid; use HTTPS if web management is required
HTTPS	TCP 443	TLS-encrypted	Web GUI management
TACACS+/RADIUS	AAA servers	Centralized authentication/authorization	Device admin auth via a AAA server
Cloud managed	Provider dashboard over HTTPS	Encrypted, centralized	Meraki-style fleets, APs, branch gear

Remote CLI access arrives on vty lines. Secure them deliberately: allow SSH only (transport input ssh), apply an ACL limiting source addresses (access-class), require login, and pair with strong local or AAA credentials.

AAA and cloud-managed access

TACACS+/RADIUS centralize admin login: instead of local passwords on every device, management sessions authenticate against a server. TACACS+ (TCP 49) encrypts the whole payload and supports per-command authorization; RADIUS (UDP 1812/1813) encrypts only the password and is common for network access. Details live in the AAA article — here the point is that management access can and should ride AAA.

Management-plane quick facts

Item	Detail
vty lines	Virtual terminals for remote sessions (vty 0 15 typical)
Console line	`line console 0` — physical, survives network failures
Management VLAN	Dedicated VLAN for device management traffic
OOB management	Dedicated management interface/VRF, separate from production
Cloud-managed	Device phones home to a dashboard — no inbound management needed

Securing and verifying access

Restrict vty access to SSH from an admin subnet

Allow SSH-only management from 192.168.99.0/24 — Privileged EXEC → Line configuration

Cisco IOS / IOS XE

SSH requires hostname, domain name and crypto keys (see the SSH article).

configure terminal
access-list 10 permit 192.168.99.0 0.0.0.255
line vty 0 15
 transport input ssh
 access-class 10 in
 login local
 end

Verify

show line vty 0
show ip ssh
show users

Transport input shows ssh only — telnet attempts are refused.
Connections outside the ACL are denied by access-class.

Changes device configuration.

Choose the access method for a new switch

Scenario: Switch arriving unboxed, then routine administration from a NOC

Day one: console cable — no IP exists yet, so console is the only option.
Bring-up: assign a management IP and enable SSH with a hostname, domain and RSA keys.
Steady state: SSH with access-class restrictions plus AAA for login; disable Telnet and HTTP.

Console for first contact, SSH(+AAA) thereafter, everything else disabled.

Common mistakes

Leaving transport input all — Telnet stays enabled next to SSH.
Managing devices over the user data VLAN — a dedicated management VLAN/VRF limits exposure.
Using HTTP for web management — credentials go cleartext; use HTTPS or none.
Skipping an access-class on vty lines — anyone who can route to the device can attempt login.
Forgetting that console access bypasses network controls — physical security is part of management security.

SSH works from the NOC but not from another subnet

Observation: Admins in a second subnet cannot SSH to the switch.

Hypotheses

access-class ACL doesn't include the new subnet
No route between the subnet and the management VLAN
SSH disabled on the relevant vty range

Check	Indicates
`show run \| section vty` and the applied ACL	The permit list must include the admin subnet.
Ping the management IP from the second subnet	Separates reachability issues from SSH/ACL issues.
`show ip ssh` and vty transport	Confirms SSH is actually offered.

Correction: Widen the ACL or fix the routing — do not remove the restriction to make it 'work'.

SSH succeeds from all authorized subnets only.

On this page

Access methods
AAA and cloud-managed access
Securing and verifying access

Related resources

Practise this topic Source topic 4: Intro to the CLI Practise topic 4 deck Source topic 42: SSH (Secure Shell)Practise topic 42 deck Source topic 48: Security Fundamentals Practise topic 48 deck

Sources

Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
Cisco — Authentication Authorization and Accounting Configuration Guide — reviewed 2026-11-02
Cisco — Configuration Fundamentals Command Reference — reviewed 2026-11-02

Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.