Open the lab
[ YOUR LAB FILE ]
Download the starting topology, then work through the lesson in SwitchLab.
- Save the .swlab file without renaming its extension.
- Open SwitchLab. Import and export controls currently require a desktop-width window. On a smaller screen, Tools → Fit brings the topology into view.
- Select Import Sandbox (folder icon), choose the downloaded file, and confirm the device and cable counts below.
- Select a device, then choose Open device on desktop or its name in the bottom bar on smaller screens. Select CLI for switches/routers or Desktop → Terminal for PCs. Enter
enableonly when the prompt ends in >. - Follow this page beside the simulator. Use a free account to export your work. Reimport the original download to restart; export any work you want to keep first.
Prerequisites
- Complete Ethernet, VLAN and IPv4 addressing fundamentals.
Topology
2 devices · 1 links
Scenario
The switch management address is reachable, but secure remote administration is not configured. Enable an SSH-only VTY path and verify authentication from the workstation.
Objectives
- Establish a reachable management address and identifiable switch configuration.
- Prove incorrect-password rejection and successful authenticated SSH command execution.
CCNA blueprint
200-301 v1.1 objectives — this lab covers the following specific skills, not every subtopic in the domain.
- 4.8 — Configure network devices for remote access using SSH.
Starting information
- Admin workstation PC1 is 192.168.99.10/24 on VLAN 1. The switch management SVI is 192.168.99.2/24. No default gateway is needed for this local test.
- Approved hostname: SW1. Isolated lab account: labadmin with password LabAccess42 and privilege 15. These public exercise credentials are not a production password recommendation.
- SSH domain: branch.example; RSA modulus 2048; SSH version 2; VTY lines 0–4 use local authentication and SSH only.
| Host | IPv4 address | Mask | Gateway |
|---|---|---|---|
| PC1 | 192.168.99.10 | 255.255.255.0 | None |
| Device / port | Device / port |
|---|---|
| PC1 / eth0 | SW1 / g0/1 |
Tasks
- Inspect the starting running configuration and test PC1 → 192.168.99.2.
- Apply the approved identity, local account and SSH/VTY configuration.
- Verify the saved running configuration and management reachability.
- From PC1 run
ssh labadmin@192.168.99.2. Enter an incorrect password once and confirm rejection, then enter LabAccess42 and runshow ip sshremotely. Useexitto return to the PC prompt. - Save/export, reload and repeat the authenticated SSH test; an open password prompt alone is not proof of successful login.
Useful commands
show running-config
show ip interface brief
copy running-config startup-configProgressive hints
Hint 1
Separate management-IP reachability from authentication and remote transport configuration.
Hint 2
SSH requires a usable host identity/domain, keys, a local account and VTY settings that allow SSH.
Hint 3
Apply the approved SVI and account first; for SSH use login local and transport input ssh on VTY lines 0–4, then test from PC1.
Verification
- PC1 reaches 192.168.99.2.
- The hostname and approved management/account configuration survive export/reload.
- An incorrect SSH password is rejected and the correct login can execute show ip ssh remotely.
Solution / walkthrough
Show Solution
Use enable only from a > prompt; if already at #, begin with configure terminal.
SW1
Configure only the exercise management baseline. Use the PC for the remote authentication test rather than treating local console output as proof of SSH access.
enable
configure terminal
username labadmin privilege 15 password LabAccess42
ip domain-name branch.example
crypto key generate rsa modulus 2048
ip ssh version 2
line vty 0 4
login local
transport input ssh
end
copy running-config startup-configRun every verification check above after the changes. A saved configuration alone does not prove packet delivery.