CCNA 200-301 v1.1 reference — IP Services

SSH remote access

Configure devices for secure remote access: hostname, domain, keys and vty restrictions, plus verification of SSH sessions.

Objective 4.8v1.1 exam target

Quick Reference Handbook

Prerequisites

SSH (TCP 22) is the standard encrypted remote-access protocol. The conventional IOS workflow sets a non-default hostname, an ip domain-name (used to build the key's fully-qualified name), and generates RSA keys (crypto key generate rsa) before enabling SSH — platform specifics vary beyond that.

SSH prerequisite checklist

Requirement	Why
Hostname	Default name is refused/ambiguous in the key label
ip domain-name	Builds the FQDN used in the RSA key pair name
crypto key generate rsa	Without keys the server cannot start
Authentication	local user DB or AAA — vty requires a login method
transport input ssh	Actually restricts vty to SSH; default allows telnet too

Why `crypto key generate rsa` failed the first time

Symptom: '% Please define a domain-name first'

The key label is built as hostname.domain — both parts must exist.
Set hostname, then ip domain-name, then generate keys.
After keys exist, ip ssh version 2 and the vty restrictions complete it.

Order matters: hostname → domain → keys → SSH version → vty restrictions.

Configuration and verification

Enable SSH-only remote access

Turn on SSH v2 and lock vty to it — Privileged EXEC → Global + line configuration

Cisco IOS / IOS XE

Unique hostname (not the factory 'Router'/'Switch').
Local user account (or AAA) for authentication.

configure terminal
hostname SW1
ip domain-name lab.example
crypto key generate rsa modulus 2048
ip ssh version 2
username admin privilege 15 secret <placeholder-secret>
line vty 0 15
 transport input ssh
 login local
 end

Verify

show ip ssh
show ssh
ssh -l admin <device-ip>

show ip ssh reports SSH enabled, version 2.
show ssh lists active sessions.
Telnet connections are refused (transport input ssh).

Deleting the RSA keys disables the SSH server.
login local needs a local user or it locks you out of vty entirely.

Changes device configuration.

$ show ip ssh (interpreted)

SSH Enabled - version 2.0Server on, restricted to v2.

Authentication timeout: 120 secs; Authentication retries: 3Brute-force hygiene knobs.

show ssh → sessions listed with user, version and cipherActive sessions visible.

Common mistakes

Generating keys before setting hostname/domain — command fails or produces a mislabeled key.
Forgetting transport input ssh — Telnet stays enabled alongside SSH.
Using password instead of secret — weak reversible encryption.
Leaving SSH v1 enabled — always pin ip ssh version 2.
Configuring SSH but no user — vty login local has nothing to authenticate against.

SSH connection refused after config

Observation: Device answers pings; SSH connections refuse immediately.

Hypotheses

Keys never generated (SSH server not running)
vty still on transport input telnet or none
access-class ACL blocking the source

Check	Indicates
`show ip ssh`	Server enabled + version — settles whether SSH runs at all.
`show running-config \| section vty`	Transport and access-class reality vs intent.
Try SSH from a directly-connected host	Splits ACL/routing issues from server issues.

Correction: Generate keys, fix transport input, or adjust the ACL.

show ssh lists the session and the login succeeds.

On this page

Prerequisites
Configuration and verification

Related resources

Practise this topic Source topic 42: SSH (Secure Shell)Practise topic 42 deck

Sources

Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
RFC 4253 — The Secure Shell (SSH) Transport Layer Protocol — reviewed 2026-11-02
Cisco — Configuration Fundamentals Command Reference — reviewed 2026-11-02

Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.