In this set of videos, we've taken a look
at various ways of accessing a Cisco router
or switch via the console port or the vty
lines with Telnet or SSH and how to identify
some of the mechanisms that are used to control that access.
Well, it's now time in our journey
together to take a look at a lab of troubleshooting,
so let me share with you the topology and the objectives
of what I want us to accomplish together in this hands-on lab.
And here is the task.
We've got R2 in our topology, we've got.
R2 There's also in the topology, R1, R3, and R4, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
R2 There's also in the topology, R1, R3, and R4,
and the objective for this lab is pretty simple.
All we want is R1 to be able to SSH into R2,
but we only want to allow that from the source
address of 1.1.1.1.
So effectively, if R1 sources an SSH session, logging into R2,
we want R1 from that source IP address only to have success.
And that's it, that's the entire lab.
So here's what I'd recommend we do. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here's what I'd recommend we do.
I'd like you to click on the link for the virtual lab
and give this a shot on your own.
Pause me here, give it a shot of getting SSH access on R2
from R1 from that source IP address only,
and everything else should be restricted,
and then you can test it also from R3 and R4
to verify it fails from there.
And give it a shot, and then when you're ready,
go ahead and resume this video, and I
will do the walkthrough of identifying and resolving
the problems of getting SSH working from this source IP
address.
So that's our goal for the lab, and I'll
see you in a few minutes for the walkthrough. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
see you in a few minutes for the walkthrough.
All right, if you're ready, I'm ready.
Let's do this thing.
Let's go ahead and go to R2, first of all,
and I would recommend we just SSH directly to R2 from R2,
and then once that works, we can work our way out.
So we'll do a-- let's see here.
Do show users.
OK, so we are currently on the console.
That's great.
And it seems like we have access.
I'm going to type exit.
Press Enter, and do a show users just to verify.
OK, so we've got access on the console.
No matter what we do, we don't want WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
No matter what we do, we don't want
to lose that because then we'd lose access.
And let's see if we can ssh dash l.
And I guess, do we have any user names?
Hmm, let's see here.
Do show run.
Include user name.
OK, we have Bob, but check that out.
I have no idea what that password is.
So in the lab, the requirement wasn't
to log in as a certain user, so I'm
going to create a user name where I know the password.
Let's do that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's do that.
So user name keith privilege.
And you can go ahead and use your own first name for this
if you'd like, no worries.
It's just a lab so we can practice.
Privilege 15.
And then I'll go ahead and specify the secret is going
to be capital Cisco!23, which I always use for the labs.
Right, now I've got a local user name.
Now let's do a ssh dash login, and we'll log in as keith,
and we'll go ahead and connect to you.
Oh, I should've looked at the IP addresses. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Oh, I should've looked at the IP addresses.
Let me look at the IP address.
Show ip interface brief.
They did target one of the IP addresses on-- the loopback'll
do.
So I'll do a ssh dash l.
Log in as keith, going to 2.2.2.2, an it says,
connection refused by host.
All right, let's do a show run.
Include-- let's do a section line vty,
and let's take a look at the line configuration.
All right, well, a couple of problems.
We have transport input none, and we also
have an access list is controlling access as far as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
have an access list is controlling access as far as
who can log in.
Temporarily, we're going to want an access list eventually
to specify who can log in the source address of 1.1.1.1,
but for testing, I'm going to remove
it to verify that I can log in locally
and verify ssh is working.
All right, let's do that.
Do configt.
I just sneezed.
All right, and line vty 0 through 4,
and we'll say no access class 1 in and transport input, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we'll say no access class 1 in and transport input,
and we want to allow ssh to allow at least that.
All right, let's do a show run, and we'll
do a section line vty.
All right, transport input SSH.
Let's try it again.
We'll do a ssh dash l, and I'm going
to use my first name because that's the user account I
created, and we'll go 2.2.2.2.
Sill connection refused.
All right, well, we're going to troubleshoot this.
Show ip ssh.
And SSH disabled, both version 1 and 2 are disabled, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And SSH disabled, both version 1 and 2 are disabled,
and that means it's probably not set up, so let's do that.
Configt, and we'll create a domain name, ip domain name,
and we'll call it cbt.com, because it needs something
there, and then we'll do a crypto
key generate rsa modulus.
I'll do 1,024.
That'll be fine.
Done.
And now let's go ahead and try--
and we can-- it didn't say version 1 or 2,
so if we wanted to do ip ssh-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so if we wanted to do ip ssh--
if we wanted to force version 2, we could.
There you go, not required.
And let's do a show ip ssh, all right?
And ssh is enabled, version 2, let's try it.
Let's do a ssh dash l, and we'll log in as keith,
and we'll log in.
And we can also specify the version right here,
if we wanted to force version 2, and so dash v and then
2 and then 2.2.2.2. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
2 and then 2.2.2.2.
Password is Cisco exclamation mark 23.
Tada!
All right, I am in.
Now, as far as enable secret, we can go back and set
that from the console as well.
Enable.
Yeah, I don't think there's any little secrets set here,
so we might as well does all.
But we are ssh-ed in.
We can do a show ssh, and boom, we're connected, keith.
We can do a show users, and we are logically WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can do a show users, and we are logically
connected online vty 0.
Fantastic.
Now, that ssh was working, but let's also
take-- let me just show users, verify we're right.
Let's take a look at the aaa stuff going on.
Show-- because if troubleshooting,
we'd want all the pieces that were involved.
In fact, if we did a debug of aaa authentication--
it's not a bad idea.
And then we ssh-ed again, it's going to tell us hopefully
quite a bit.
So when I log on, I'll look, is the default method listed?
All right, that's good to know. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right, that's good to know.
And go-- exclamation mark 123.
All right, so we did a show run, I'll do a section aaa.
If we had some other issues with aaa,
we'd want to know what they were, so--
oh, it's using the local database
by default. That's clever.
So if we were using something else like aaa authentication
log-in method 3--
in fact, let's do that.
Let's go to configt line vty 0 through 4, which is 0 space 4, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's go to configt line vty 0 through 4, which is 0 space 4,
and let's do a login authentication.
And then we'll go ahead and put method 3,
which is going to try tacacs, then radius, then local.
And let's try that ssh again.
Hit the up arrow key a few times.
And the password's Cisco123.
The share of the debugger is showing
us which method it was trying, which
is an important aspect of solving the problem.
So let's type in exit, and if we do a show run, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's type in exit, and if we do a show run,
let's take a look at the running config here, let's
all the pieces.
So we've got aaa new model.
We have a default method of local,
meaning the local database.
We have a method called 1, called--
using no authentication.
We have one using the enable secret,
and we have one method that uses a group of tacacs servers,
then radius.
And then if it can't reach those servers,
use the local database.
And if we go down to the--
here's the user name we've just created.
And if we go down to the very bottom,
here we have our vty line that we just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here we have our vty line that we just
applied that method list, too.
So next, let's go ahead and create an access list
to restrict it to just 1.1.1.1, the source address.
So we'll do a configt, access list.
We'll call it 2 because 1's already in use here.
And we'll say permit and host 1.1.1.1 as a source address.
Then we'll go to line vty 0 to 4 and specify access class.
And the access class we want to use
is number 2, and that's for incoming.
All right. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right.
So if we were to try to ssh again locally,
so this access list, access list 2,
is only going to let R1 from that source IP address go in.
So let's go to R1, do a show ip route,
so I'll make sure we have reachability.
So we'll go over to 2.2.2.2, and we'll
source it from our 1.1.1.1.
OK, how do we do that?
So Telnet, I think you just tack on the word
source with ssh dash l and keith, and we're going 2.2.2.2.
Is there an option for source? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Is there an option for source?
Oh, oh, oh.
All right, yeah, if we don't source it from our loopback 0
address, we're not getting in.
So let's do a configt ip ssh.
I think there's an option for source.
Yeah, there we go, source interface,
and we'll specify a loopback 0.
Do an ssh dash l keith 2.2.2.2, press Enter, and we are in. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Do an ssh dash l keith 2.2.2.2, press Enter, and we are in.
That's fantastic.
We'll supply the password, and we are in.
If we type in who, it's going to show us
right here that we are source from 1.1.1.1.
Fantastic.
The user's Keith, and we came in via line vty 0.
And if we do a show ssh, it'll show us our current ssh users,
and if we do a show ip ssh, it'll
show us what we're willing to do,
which is SSH enabled for version 2.0.
So I hope you enjoyed the lab, as well as the set of videos WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I hope you enjoyed the lab, as well as the set of videos
on troubleshooting aaa on Cisco IOS devices for access,
and I'll see you in the next set of videos.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.