A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
R1(config)# line vty 0 4R1(config-line)# exec-timeout 10 0R1(config-line)# transport input sshR1(config-line)# logging synchronousR1(config-line)# exitR1(config)# access-list 20 permit 10.10.20.0 0.0.0.255R1(config)# access-list 20 deny any logR1(config)# line vty 0 15R1(config-line)# access-class 20 in
That config hardens VTY access in four ways. `exec-timeout 10 0` disconnects idle sessions after 10 minutes. `transport input ssh` allows only SSH (no Telnet). `logging synchronous` prevents log messages from interrupting your typing. And `access-class 20 in` restricts who can even connect — only hosts in 10.10.20.0/24.
The AUX port is the forgotten attack surface. It's still active on many routers even when nothing is connected. An attacker with physical access can plug into AUX and get a prompt if it's not disabled. Best practice: `line aux 0` then `no exec` and `transport input none`.
! Disable unused servicesno ip http serverno ip http secure-serverno service tcp-small-serversno service udp-small-serversno ip fingerno ip bootp serverno cdp run! SSH-only VTY with ACLline vty 0 15transport input sshexec-timeout 10 0access-class 20 inlogging synchronouslogin local! Disable AUXline aux 0no exectransport input none! Console hardeningline console 0exec-timeout 10 0logging synchronouslogin local! Enable SSHip domain-name corp.example.comcrypto key generate rsa modulus 2048ip ssh version 2ip ssh time-out 60ip ssh authentication-retries 3
Every line reduces attack surface. Disable services you don't use (HTTP, finger, bootp, CDP). Enforce SSH over Telnet. Set idle timeouts. Restrict access with ACLs. The principle is simple: if you don't need a feature, disable it. Every open port is a potential vulnerability.
Harden VTY access on a lab router: allow only SSH, set exec-timeout to 5 minutes, restrict access to 10.10.20.0/24, and require local authentication. Verify by attempting a Telnet connection (should fail) and an SSH connection from outside the allowed subnet (should fail).
Secure device access is about reducing attack surface. SSH-only, ACLs on VTY, disable unused services, harden timeouts. Apply least privilege with custom privilege levels. Next lesson goes deep on SSH configuration.
Finish the lesson once you have worked through the material. This awards ★ 15 XP.