CCNA 200-301 v1.1 reference — IP Services

SSH remote access

Configure devices for secure remote access: hostname, domain, keys and vty restrictions, plus verification of SSH sessions.

Objective 4.8v1.1 exam target

Quick Reference Handbook

SSH (TCP 22) is the standard encrypted remote-access protocol. The conventional IOS workflow sets a non-default hostname, an ip domain-name (used to build the key's fully-qualified name), and generates RSA keys (crypto key generate rsa) before enabling SSH — platform specifics vary beyond that.

SSH prerequisite checklist

Requirement	Why
Hostname	Default name is refused/ambiguous in the key label
ip domain-name	Builds the FQDN used in the RSA key pair name
crypto key generate rsa	Without keys the server cannot start
Authentication	local user DB or AAA — vty requires a login method
transport input ssh	Actually restricts vty to SSH; default allows telnet too

Enable SSH-only remote access

Turn on SSH v2 and lock vty to it — Privileged EXEC → Global + line configuration

Cisco IOS / IOS XE

Unique hostname (not the factory 'Router'/'Switch').
Local user account (or AAA) for authentication.

configure terminal
hostname SW1
ip domain-name lab.example
crypto key generate rsa modulus 2048
ip ssh version 2
username admin privilege 15 secret <placeholder-secret>
line vty 0 15
 transport input ssh
 login local
 end

Verify

show ip ssh
show ssh
ssh -l admin <device-ip>

show ip ssh reports SSH enabled, version 2.
show ssh lists active sessions.
Telnet connections are refused (transport input ssh).

Deleting the RSA keys disables the SSH server.
login local needs a local user or it locks you out of vty entirely.

Changes device configuration.

$ show ip ssh (interpreted)

SSH Enabled - version 2.0Server on, restricted to v2.

Authentication timeout: 120 secs; Authentication retries: 3Brute-force hygiene knobs.

show ssh → sessions listed with user, version and cipherActive sessions visible.

On this page

SSH (TCP 22) is the standard encrypted r…
SSH prerequisite checklist
Enable SSH-only remote access
show ip ssh (interpreted)

Handbook sections

Related resources

Practise this topic Source topic 42: SSH (Secure Shell)Practise topic 42 deck

Sources

Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
RFC 4253 — The Secure Shell (SSH) Transport Layer Protocol — reviewed 2026-11-02
Cisco — Configuration Fundamentals Command Reference — reviewed 2026-11-02

Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.