First, the essential ideas
- Management plane
- The management plane carries administration and monitoring traffic to or from the device, such as SSH. It differs from data-plane traffic forwarded through the device and control-plane protocols that build forwarding state.
- Hardening and least privilege
- Hardening reduces unnecessary exposure and unsafe settings. Least privilege gives an account only the permissions required for its task; a working login need not imply full administrator access.
- VTY and access class
- Virtual terminal lines accept remote IOS sessions. A VTY access class filters which source addresses may reach those sessions. It is not an interface firewall for all traffic.
- Local user and enable secret
- A local user authenticates against the router's own account database. The enable secret protects entry to a higher privilege level. Two passwords are still two examples of the same knowledge factor.
- Hashing and encryption
- A password hash supports verification without storing a directly recoverable password. Encryption is reversible with its key. Type 7 obfuscation is weak; the lab explicitly selects Type 9 scrypt for local secrets.
- MFA
- Multi-factor authentication combines distinct factor categories: something known, possessed or inherent. A password plus another password is not MFA. Strong recovery and enrollment procedures are part of the design.
- Certificate and private key
- A certificate binds identity information to a public key under an issuer's signature. Authentication also needs proof of the corresponding private key and appropriate validation; copying the public certificate alone is not sufficient.
- Biometric
- A biometric uses a physical or behavioral characteristic. It can activate a protected authenticator but requires privacy, accuracy and alternative-access considerations. A fingerprint is not a replaceable password.
- Recovery path
- A recovery path is an independent authorized way to restore access, such as a protected Console. It must be secured and tested rather than treated as permission to bypass authentication.
- Console and prompt
- Right-click the named GNS3 node and choose Console. IOS > is user EXEC, # is privileged EXEC and (config)# is configuration mode; the Ubuntu shell runs ssh and ping.
Admin1 is permitted to open an SSH session; Guest1 is not. Both remain ordinary IP neighbors of R1. The operator account starts at privilege 1 and uses a separate enable secret for the lab's administrative step. This illustrates permission separation, not centralized AAA or MFA.
See the idea
Same segment, different management permission
Admin1 may reach R1's SSH login; Guest1 must not. Source admission still does not replace user authentication.
Admit Admin1
Admin1's source is permitted through the VTY rule. The SSH host identity and local user credential must still be checked.
What this model leaves out: Logical SSH admission cases, not serial cabling. Each source uses the same Switch1 to reach R1 at 192.0.2.1. Physical links stay up; the protected GNS3 Console is separate. No all-traffic firewall or MFA is shown.
Full visual explanation and references
Admin1 and Guest1 independently reach R1 through Switch1. R1's VTY rule permits Admin1 and excludes Guest1; neither client forwards the other's traffic.
Logical SSH admission cases, not serial cabling. Each source uses the same Switch1 to reach R1 at 192.0.2.1. Physical links stay up; the protected GNS3 Console is separate. No all-traffic firewall or MFA is shown.
- Admit Admin1
Admin1's source is permitted through the VTY rule. The SSH host identity and local user credential must still be checked.
sec.cloudapps.cisco.comwww.cisco.com - Exclude Guest1
Guest1's physical link remains up, but R1 denies its VTY admission. A successful ping does not contradict this terminal-only policy.
sec.cloudapps.cisco.com - Repair and retest
Use R1's protected Console to restore the mistaken source permit. Then test new Admin1 and Guest1 sessions, not just an existing terminal.
sec.cloudapps.cisco.com
One idea at a time
Start with something familiar.
Ask four separate questions: can this host reach the management service, is the session protected, who is the user, and what may that user do? A yes to one does not answer the others.
Why learn this?
A management mistake can lock out the operator who needs to repair it. Narrow changes, an independent Console and positive/negative tests make the effect understandable without weakening credentials to regain access.
An everyday comparison
A visitor may enter a building, show identification and receive a badge for only one room. Admission, identity and permission are separate decisions.
What happens in a network
The source rule, SSH authentication and privilege level serve different purposes. A permitted address does not replace an individual account or a protected session.
Where the comparison stopsAn IP address is not a physical identity badge. Address-based controls have limitations and need other protections; this small lab is not a complete enterprise access design.
Follow one worked example
- Preserve recovery before restricting access.
R1's Console stays open throughout. The learner inventories VTY lines and refuses to proceed if unexpected active management paths remain.
Why: A remote-only recovery plan disappears when the remote rule is wrong.
- Prove the local account works.
Admin1 logs in at privilege 1, verifies that level and deliberately enters privileged EXEC using a separate secret.
Why: A successful SSH handshake alone does not establish the intended authorization level.
- Apply the source boundary.
The VTY access class permits only Admin1. Guest1 can still ping R1 but must not obtain an SSH login prompt.
Why: The source control targets remote terminal access, not every packet or forwarded service.
- Recover a specific rule error.
A wrong permit address prevents a new Admin1 session. The trusted Console restores the intended host and repeats both source tests.
Why: The learner changes the mistaken rule without resetting passwords or disabling SSH identity checks.
Your first small task
Predict whether Guest1's ping must fail after a VTY access class denies its SSH connection. Explain the scope of the control.
Show a hint
Where a rule is attached is as important as the addresses written in it.
Check the expected result
Ping may still work because the VTY access class filters terminal access, not all IP traffic to the router. This lab deliberately checks that distinction.
Pause and explain it in your own words
Does entering an SSH password and then an enable password demonstrate MFA?
Show a hint
Count factor categories, not prompts.
Show the explanation
No. Both are knowledge factors. The lab demonstrates privilege separation with local passwords, not multi-factor authentication.
Short answer
What should you understand today?
Device hardening combines a restricted management path, secure transport, verified identity, appropriate permissions and a recovery plan. A source ACL is not user authentication, SSH encryption is not least privilege, and two passwords are not MFA. Verify both the authorized session and the excluded source before accepting a management change.
Before you begin
Learning targets
- Review Day 45 SSH host identity and Day 46 risk, awareness and physical-access boundaries.
- Use GNS3 2.2.55 with an entitled autonomous C8000v IOS XE 17.12.1a, two Ubuntu 24.04 LTS hosts and a built-in switch.
- Start from a disposable configuration without aaa new-model or existing users, keys or management policy; this is not a production migration.
- Distinguish management, control and data-plane exposure.
- Configure local user and enable secrets with explicit protected storage.
- Restrict SSH to the intended source while preserving a trusted Console.
- Verify user versus privileged EXEC and diagnose a wrong-source ACL fault.
- Compare password policy, MFA, certificates and biometrics with honest implementation boundaries.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
Management plane
The management plane carries administration and monitoring traffic to or from the device, such as SSH. It differs from data-plane traffic forwarded through the device and control-plane protocols that build forwarding state.
Hardening and least privilege
Hardening reduces unnecessary exposure and unsafe settings. Least privilege gives an account only the permissions required for its task; a working login need not imply full administrator access.
VTY and access class
Virtual terminal lines accept remote IOS sessions. A VTY access class filters which source addresses may reach those sessions. It is not an interface firewall for all traffic.
Local user and enable secret
A local user authenticates against the router's own account database. The enable secret protects entry to a higher privilege level. Two passwords are still two examples of the same knowledge factor.
Hashing and encryption
A password hash supports verification without storing a directly recoverable password. Encryption is reversible with its key. Type 7 obfuscation is weak; the lab explicitly selects Type 9 scrypt for local secrets.
MFA
Multi-factor authentication combines distinct factor categories: something known, possessed or inherent. A password plus another password is not MFA. Strong recovery and enrollment procedures are part of the design.
Certificate and private key
A certificate binds identity information to a public key under an issuer's signature. Authentication also needs proof of the corresponding private key and appropriate validation; copying the public certificate alone is not sufficient.
Biometric
A biometric uses a physical or behavioral characteristic. It can activate a protected authenticator but requires privacy, accuracy and alternative-access considerations. A fingerprint is not a replaceable password.
Recovery path
A recovery path is an independent authorized way to restore access, such as a protected Console. It must be secured and tested rather than treated as permission to bypass authentication.
Console and prompt
Right-click the named GNS3 node and choose Console. IOS > is user EXEC, # is privileged EXEC and (config)# is configuration mode; the Ubuntu shell runs ssh and ping.
Protect the management path without confusing the planes
SSH to R1 is management traffic. Routing protocol exchanges maintain control-plane state, while ordinary packets crossing a router use its data plane. These functions interact but need appropriately scoped controls. Disabling unnecessary management services reduces exposure; a VTY access class is one small control, not a complete infrastructure firewall.
- Inspect exactly where a policy is attached.
- Do not claim complete hardening from a single passing SSH test.
Use protected local secrets and limited starting privilege
A local username identifies the operator. The lab selects scrypt explicitly rather than relying on a release-dependent default. A one-way stored secret is different from reversible encryption and weak Type 7 obfuscation. Protect configuration copies anyway: hashes and network details remain sensitive. The account starts at privilege 1, not unrestricted level 15.
- Never publish real secrets or unredacted configurations.
- Use a unique account and revoke access when the operator no longer needs it.
A password policy includes lifecycle and storage
Choose long unique secrets, store them in an approved password manager, avoid default or compromised choices and revoke them on compromise or access changes. Current NIST guidance favors length and compromised-password screening over arbitrary composition rules and periodic changes without cause. Platform syntax and organizational requirements still need review; this IOS exercise does not implement a complete identity-policy engine.
- Separate a teaching placeholder from an actual secret.
- Password transport, stored representation and account lifecycle each need attention.
MFA is about distinct factors, not repeated questions
A knowledge factor is something you know, a possession factor is something you control and an inherent factor relates to a characteristic of you. A password followed by another password does not add a new category. A protected hardware authenticator activated by a PIN can combine possession with knowledge when the full system verifies that design.
- Count factor categories rather than login screens.
- A successful password-only lab is not evidence of MFA enforcement.
Certificates and biometrics need their own checks
A certificate associates identity information with a public key under an issuer's signature. Validation considers trust, intended use, validity time and revocation as required by the system; authentication needs control of the private key. A public certificate is not a secret password. A biometric can activate a protected authenticator, but privacy, error rates and a suitable non-biometric alternative still matter.
- Keep private keys private and validate the intended identity.
- A biometric is not easily replaced after disclosure like a password.
Keep a recoverable baseline and test new sessions
Keep a trusted Console, inventory every VTY range and close unused remote lines. Test a fresh connection after each change; an already established session is not a reliable test of admission policy. In this lab the wrong source permit is repaired from the Console. Do not disable password recovery, erase keys or reset the device to solve that small error.
- Every active remote line needs an explicit reviewed policy.
- Console and hypervisor permissions are part of the management boundary.
Real-world walkthrough
The new source rule excludes the administrator
A fictional operator replaces the intended management workstation address with a mistyped host permit. An existing session can obscure the mistake until a colleague tries a new login. The operator retains Console access and corrects only the rule.
- Record the permitted source, active VTY range and independent recovery path before the change.
- Prove a new Admin1 session works at the intended starting privilege.
- Apply the source restriction and compare Admin1 with Guest1, retaining the actual observations.
- Introduce the one wrong address on the isolated lab, then diagnose it from the Console.
- Restore the exact permit, repeat new-session checks and record that no MFA or all-traffic firewall was configured.
Guided GNS3 lab
One permitted SSH source and a Console recovery
Verify local identity, privilege and a VTY source boundary, then recover a wrong permit address. All runtime outcomes are expected observations, not executed author evidence.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| R1 | GigabitEthernet1 | 192.0.2.1/24 | SSH server on the isolated segment. |
| Admin1 | ens3 | 192.0.2.10/24 | Only permitted remote terminal source. |
| Guest1 | ens3 | 192.0.2.20/24 | Owned negative-test source, not an attacker. |
Set up the lab
- Create exactly four nodes and three cables. Do not attach a Cloud, NAT node or production interface; no gateway is needed.
- Keep R1 Console open. Use a fresh autonomous configuration without aaa new-model; do not remove AAA from an existing device to fit this exercise.
- The executable profile uses VTY 0-4 and disables VTY 5-15. Confirm these ranges exist and no additional usable VTY range is present with show line; otherwise stop for an instructor-reviewed range adaptation or use the paper alternative.
- Choose distinct private OPERATOR_SECRET and ENABLE_SECRET values, each randomly generated alphanumeric and at least 16 characters; replace placeholders before typing and never share the resulting configuration.
- First-use host-key acceptance is restricted to this new disconnected topology after checking node identity and wiring. Production requires an approved independent identity check; stop on unexpected changed-key warnings.
- Paper alternative: trace the source-rule decisions, factor categories and recovery sequence without licensed images. Mark account, SSH and ACL outcomes unmeasured.
Inventory and address R1
In GNS3, right-click R1 and choose Console before typing. Start at > or #. Inspect show line and stop if the required VTY profile does not match before configuring the interface. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
enable
show line
configure terminal
hostname R1
interface GigabitEthernet1
ip address 192.0.2.1 255.255.255.0
no shutdown
endWhat each command means
enable- Enter privileged EXEC (#) from user EXEC (>); use only your authorized lab credentials.
show line- Inventory all console and VTY lines so no extra remote range is silently omitted.
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
hostname R1- Give the fresh router its intended identity.
interface GigabitEthernet1- Select the cable to Switch1 Ethernet0.
ip address 192.0.2.1 255.255.255.0- Assign the isolated management address.
no shutdown- Enable the local cable.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
- What you should see
- The line inventory must match the setup gate, and R1 should own the planned address.
- Why this step matters
- An incomplete line inventory can leave a management path outside the intended policy.
Address Admin1
In GNS3, right-click Admin1 and choose Console before typing. At its Linux shell, configure the declared interface without a default route. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
sudo ip address add 192.0.2.10/24 dev ens3
sudo ip link set ens3 up
ping -c 3 192.0.2.1What each command means
sudo ip address add 192.0.2.10/24 dev ens3- Assign the exact source the VTY policy will permit.
sudo ip link set ens3 up- Enable the cable to Switch1 Ethernet1.
ping -c 3 192.0.2.1- Check basic local reachability before adding a management restriction.
- What you should see
- Three bounded ping attempts should establish or expose a basic path problem.
- Why this step matters
- Separate connectivity problems from later authentication and policy problems.
Address the excluded source
In GNS3, right-click Guest1 and choose Console before typing. At its Linux shell, configure only the owned negative-test endpoint. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
sudo ip address add 192.0.2.20/24 dev ens3
sudo ip link set ens3 up
ping -c 3 192.0.2.1What each command means
sudo ip address add 192.0.2.20/24 dev ens3- Assign a distinct source that the future VTY rule must exclude.
sudo ip link set ens3 up- Enable the cable to Switch1 Ethernet2.
ping -c 3 192.0.2.1- Record basic reachability before SSH admission is restricted.
- What you should see
- Guest1 should be an ordinary reachable neighbor, not a remote administrator.
- Why this step matters
- The negative test uses an authorized classroom host and no attack technique.
Create local identity and SSH
In GNS3, right-click R1 and choose Console before typing. Start at #. Replace both secret placeholders privately and keep the Console active. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
username operator privilege 1 algorithm-type scrypt secret OPERATOR_SECRET
enable algorithm-type scrypt secret ENABLE_SECRET
ip domain name lab.test
crypto key generate rsa modulus 3072
ip ssh version 2
no ip http server
no ip http secure-server
endWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
username operator privilege 1 algorithm-type scrypt secret OPERATOR_SECRET- Create the lab account at user privilege with explicitly scrypt-protected storage.
enable algorithm-type scrypt secret ENABLE_SECRET- Protect the deliberate privileged-EXEC transition with a separate secret.
ip domain name lab.test- Set the local domain used with the hostname for default SSH key naming.
crypto key generate rsa modulus 3072- Generate a fresh 3072-bit RSA host key; stop rather than overwrite an existing key.
ip ssh version 2- Require SSH version 2.
no ip http server- Disable the unused plaintext web-management service.
no ip http secure-server- Disable the unused HTTPS service rather than leave an unreviewed second management path.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
- What you should see
- R1 should have the intended local credentials and SSH identity; no web management is required.
- Why this step matters
- Disabling an unused service is different from claiming its secure variant is inherently unsafe.
Secure the declared line ranges
In GNS3, right-click R1 and choose Console before typing. Start at #. This step assumes the setup's exact VTY inventory and no AAA new-model. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
line console 0
login local
exec-timeout 10 0
line vty 0 4
login local
transport input ssh
exec-timeout 5 0
line vty 5 15
transport input none
endWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
line console 0- Select the protected recovery Console.
login local- Require the local user database on future Console logins.
exec-timeout 10 0- End an idle Console EXEC after ten minutes; retain active recovery access.
line vty 0 4- Select the five remote lines used by this exercise.
login local- Authenticate remote users against the local database.
transport input ssh- Allow only SSH as the incoming remote terminal transport.
exec-timeout 5 0- Set a five-minute idle remote-session timeout.
line vty 5 15- Select the remaining verified VTY range.
transport input none- Disable incoming remote transports on those unused lines.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
- What you should see
- Only the declared VTY 0-4 range should accept SSH, with local authentication.
- Why this step matters
- A common hardening omission is configuring the first range while leaving another range unchanged.
Prove identity and privilege before filtering
In GNS3, right-click Admin1 and choose Console before typing. At the Linux shell, open SSH after verifying the new isolated host identity. Enter secrets only at password prompts. The commands after ssh run inside IOS until exit returns to Linux. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ssh operator@192.0.2.1
show privilege
enable
show privilege
disable
exitWhat each command means
ssh operator@192.0.2.1- Open a new protected session using the local operator account.
show privilege- Verify the starting privilege is 1, rather than assuming a full administrator session.
enable- Request privileged EXEC and enter ENABLE_SECRET only at its prompt.
show privilege- Verify the deliberate transition to privilege 15.
disable- Return to user EXEC after the administrative check.
exit- Close the session so the next test evaluates new admission.
- What you should see
- The account should start at level 1 and enter level 15 only after the separate enable check.
- Why this step matters
- Two knowledge prompts demonstrate privilege separation, not MFA.
Permit only the administrator source
In GNS3, right-click R1 and choose Console before typing. Start at # in the retained Console. Build the complete list before attaching it. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
ip access-list standard MGMT_SOURCES
10 permit host 192.0.2.10
20 deny any
exit
line vty 0 4
access-class MGMT_SOURCES in
end
show access-lists MGMT_SOURCESWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
ip access-list standard MGMT_SOURCES- Create a named source-address list for terminal admission.
10 permit host 192.0.2.10- Permit exactly Admin1 as the intended source.
20 deny any- Explicitly deny all other IPv4 sources after the specific permit.
exit- Return from ACL configuration to global configuration.
line vty 0 4- Select the only remotely enabled lines.
access-class MGMT_SOURCES in- Apply the source list to incoming VTY sessions, not to forwarded traffic.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show access-lists MGMT_SOURCES- Inspect the actual rule order and addresses.
- What you should see
- The displayed policy should permit .10 before denying other sources.
- Why this step matters
- A complete list and explicit attachment make the access boundary auditable.
Verify the permitted source
In GNS3, right-click Admin1 and choose Console before typing. At the Linux shell, make a fresh connection with the same verified host identity; exit IOS after the privilege check. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ssh -o ConnectTimeout=5 operator@192.0.2.1
show privilege
exitWhat each command means
ssh -o ConnectTimeout=5 operator@192.0.2.1- Test new SSH admission from the explicitly permitted host.
show privilege- Confirm the account still begins at its intended user privilege.
exit- Close the test session and return to Linux.
- What you should see
- Admin1 should still authenticate and receive user EXEC.
- Why this step matters
- Source permission is only the first gate; the local credential is still required.
Verify the excluded source and control scope
In GNS3, right-click Guest1 and choose Console before typing. At its Linux shell, attempt one bounded connection only. If an authentication prompt unexpectedly appears, cancel with Ctrl+C and record a failed source-policy check; do not enter credentials. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ping -c 3 192.0.2.1
ssh -o ConnectTimeout=5 -o NumberOfPasswordPrompts=1 operator@192.0.2.1What each command means
ping -c 3 192.0.2.1- Check that basic IP reachability can remain while terminal admission is denied.
ssh -o ConnectTimeout=5 -o NumberOfPasswordPrompts=1 operator@192.0.2.1- Attempt the excluded remote terminal path without brute force or repeated guesses.
- What you should see
- Ping may succeed, but Guest1 must not obtain an SSH login opportunity.
- Why this step matters
- This distinguishes the VTY restriction from a general interface firewall.
Introduce one wrong-source rule
In GNS3, right-click R1 and choose Console before typing. Start at # from the trusted Console only, after closing Admin1's baseline SSH session. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
ip access-list standard MGMT_SOURCES
no 10
10 permit host 192.0.2.99
end
show access-lists MGMT_SOURCESWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
ip access-list standard MGMT_SOURCES- Open the same dedicated lab source list.
no 10- Remove only the intended host permit.
10 permit host 192.0.2.99- Insert the deliberate wrong address; no node owns .99.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show access-lists MGMT_SOURCES- Inspect the changed permit rather than relying on memory.
- What you should see
- The list now excludes Admin1 because only unused .99 is permitted.
- Why this step matters
- The fault is a single admission-rule error; credentials and host keys remain intact.
Observe the new-session failure
In GNS3, right-click Admin1 and choose Console before typing. At the Linux shell, repeat one new connection attempt. Cancel an unexpected password prompt and record it rather than guessing credentials. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ssh -o ConnectTimeout=5 -o NumberOfPasswordPrompts=1 operator@192.0.2.1What each command means
ssh -o ConnectTimeout=5 -o NumberOfPasswordPrompts=1 operator@192.0.2.1- Test whether the wrong source rule blocks this fresh session.
- What you should see
- The new session should be excluded before authentication.
- Why this step matters
- An old session is not a substitute for testing policy on a new connection.
Restore the intended permit
In GNS3, right-click R1 and choose Console before typing. Start at # on the retained Console and reverse exactly the fault. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
configure terminal
ip access-list standard MGMT_SOURCES
no 10
10 permit host 192.0.2.10
end
show access-lists MGMT_SOURCES
show running-config | section line vtyWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC (#); accepted changes affect the running device.
ip access-list standard MGMT_SOURCES- Return to the dedicated lab list.
no 10- Remove the wrong .99 permit.
10 permit host 192.0.2.10- Restore Admin1 as the only permitted source.
end- Return to privileged EXEC (#). This neither saves the configuration nor reverses accepted changes.
show access-lists MGMT_SOURCES- Verify the corrected list and order.
show running-config | section line vty- Inspect enabled, disabled and source-restricted VTY ranges without publishing secrets.
- What you should see
- The intended source should be restored and every verified VTY range accounted for.
- Why this step matters
- Recovery repairs the narrow mistake without broadening access or weakening authentication.
Retest the allowed path
In GNS3, right-click Admin1 and choose Console before typing. At the Linux shell, repeat the baseline login and close the session after the check. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ssh -o ConnectTimeout=5 operator@192.0.2.1
show privilege
exitWhat each command means
ssh -o ConnectTimeout=5 operator@192.0.2.1- Confirm a new authorized session works after restoration.
show privilege- Check that source-rule repair did not change the account's starting privilege.
exit- Close the final remote session.
- What you should see
- Admin1 should regain user EXEC with the original credential and host identity.
- Why this step matters
- A successful recovery includes both admission and unchanged authorization expectations.
Retest exclusion and retire the lab
In GNS3, right-click Guest1 and choose Console before typing. At the Linux shell, perform one final excluded attempt; cancel any unexpected prompt. Then stop all four nodes and revert clean snapshots, keeping only sanitized results. Type each line without the prompt and press Enter. Stop on a syntax error; retain the console for recovery.
ssh -o ConnectTimeout=5 -o NumberOfPasswordPrompts=1 operator@192.0.2.1What each command means
ssh -o ConnectTimeout=5 -o NumberOfPasswordPrompts=1 operator@192.0.2.1- Confirm the restored policy still excludes the non-administrator source.
- What you should see
- Guest1 remains excluded and the disposable credentials are retired with the lab.
- Why this step matters
- Restoring Admin1 must not accidentally grant access to every other source.
Verify
- Require fresh Admin1 SSH success and Guest1 exclusion, with the retained Console available throughout.
- Verify privilege 1 before enable and privilege 15 only after the deliberate secret check; do not call this MFA.
- Inspect all VTY ranges, SSHv2, exact source rules and disabled unused web services.
- Repeat both source tests after fixing .99 to .10 and state IPv6, centralized AAA, certificate enrollment and biometric enforcement are untested.
Troubleshoot
- Both hosts fail before filtering: inspect SSH server, keys, user secrets, link and exact address; do not remove identity checking.
- Guest1 reaches authentication: inspect access-class attachment and every VTY range; a permit entry alone is not an applied policy.
- Admin1 fails after the fault: inspect MGMT_SOURCES from the Console and restore only sequence 10.
- Unexpected key-change warning or platform mismatch: stop for identity or image-profile verification; do not enable insecure algorithms or assume the lab is validated.
GNS3 does not provide Cisco software images. Use Cisco images only when the applicable license or entitlement permits this environment. Do not share or redistribute image files. Cisco Modeling Labs is an official alternative; its supplied reference images are licensed for CML, not automatically for export to GNS3. Use the labeled paper alternative when authorized software is unavailable. No emulator execution is claimed by this lesson.
- Close remote sessions, stop the isolated project and revert disposable snapshots containing credentials and host keys.
- Retain only sanitized observations; never publish secrets, private keys or full configurations.
Practice set
Answer before you reveal
01Why can Guest1 ping but not SSH?
Control attachment determines scope. The lab intentionally uses a working IP neighbor as the excluded terminal source.
02Does a source permit authenticate a person?
The local account still needs valid credentials. Source-based restrictions complement rather than replace identity checks.
03Is Type 7 strong password protection?
Use supported protected secret storage and still protect configuration files. A label saying encrypted does not establish an adequate algorithm.
04Are two passwords MFA?
The separate enable secret limits a transition in this lab but does not add possession or an inherent factor.
05Does a public certificate alone authenticate its holder?
Certificates contain public identity bindings. The system must check the appropriate trust, use and validity conditions.
06Why test a new session after a VTY change?
Closing and reconnecting tests the intended source boundary. Keep the independent Console available before doing so.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- Separate source admission, protected transport, user identity and permission.
- Protect every usable VTY range and retain a secured recovery path.
- Local secrets and configuration backups still need careful handling.
- Two passwords are not two factor categories.
- A narrow management test does not establish complete device hardening.