All language subtitles for Free-CCNA-SSH-Day-42-CCNA-200-301-Complete-Course_en

Welcome to Jeremy’s IT Lab. This is a free,\xa0\n

videos, please subscribe to follow along with the\xa0\n

and share the video to help spread this\xa0\n

In this video we will cover SSH, Secure Shell.\xa0\n

and configure them via the CLI. One option\xa0\n

via the console port, which I introduced in an\xa0\n

you to connect to a device remotely, without\xa0\n

SSH is exam topic 4.8, which says you\xa0\n

for remote access using SSH. I won’t\xa0\n

I will take the opportunity to\xa0\n

Here’s what we’ll cover in this video.\xa0\n

last video about Syslog I mentioned\xa0\n

So, I want to take the opportunity to explain\xa0\n

make it more secure. Then I’ll explain the\xa0\n

Layer 2 switches don’t route packets and\xa0\n

can configure a management IP address on them so\xa0\n

Then I will introduce Telnet, which is a\xa0\n

and less-secure. Finally, the main topic of\xa0\n

but the first few topics shouldn’t take too long\xa0\n

a bonus practice question from Boson Software’s\xa0\n

First, console port security. By default,\xa0\n

a Cisco IOS device via the console port.\xa0\n

use a console cable to connect your laptop to\xa0\n

However, you can configure a password on the\xa0\n

configure all settings related to console port\xa0\n

enter a password to access the CLI via the console\xa0\n

configure the console line, use the command\xa0\n

There is only a single console line, so the\xa0\n

only a single console line? It means there can\xa0\n

You can’t have multiple people configuring the\xa0\n

ports. Only one user can connect at a time. Then\xa0\n

But configuring a password isn’t enough,\xa0\n

tells the device to require a user to enter the\xa0\n

That’s it, now a password will be required\xa0\n

I used END and EXIT to terminate the console\xa0\n

and I was asked for a password. I entered the\xa0\n

that the password isn’t displayed as you type it,\xa0\n

Alternatively, you can configure the console\xa0\n

of the configured usernames on the device.\xa0\n

in which we configured a specific password\xa0\n

configurations. First, I created a username,\xa0\n

I once again used LINE CONSOLE 0 to configure\xa0\n

LOCAL. This tells the device to require a user\xa0\n

on the device. So, instead of logging in using\xa0\n

the user will have to use a username and\xa0\n

configuration of R1’s console line. Notice that\xa0\n

is still there, however I changed the login mode\xa0\n

password of ccna can no longer be used. The\xa0\n

So, I logged out of the connection pressed\xa0\n

username and password, not just a password.\xa0\n

That is the EXEC-TIMEOUT command. This will cause\xa0\n

period of inactivity, 3 minutes and 30 seconds\xa0\n

in case you leave your desk but forget\xa0\n

Okay, that’s all for console line security. Now\xa0\n

Routers and Layer 3 switches have IP addresses you\xa0\n

but what about Layer 2 switches? Layer 2 switches\xa0\n

routing table. They aren’t IP routing aware. Their\xa0\n

as you already know. However, you can actually\xa0\n

interface, to allow remote connections to the CLI\xa0\n

For the rest of this video, I’ll use this\xa0\n

and needs to be able to connect to all of the\xa0\n

having to travel to different offices. To allow\xa0\n

here’s how you can configure it. First, configure\xa0\n

multilayer switch. INTERFACE VLAN, followed by the\xa0\n

enable the interface if its shutdown by default.\xa0\n

more step you need to configure to allow a Layer\xa0\n

its local LAN. Use the IP DEFAULT-GATEWAY command\xa0\n

PC2 isn’t in the same LAN, so SW1 can’t\xa0\n

It has to send the traffic to a router, which\xa0\n

It’s like configuring a default route, however\xa0\n

so you have to use this command to\xa0\n

Okay, that’s all the configuration needed\xa0\n

To demonstrate Telnet and SSH,\xa0\n

First up, Telnet. It’s not commonly used today\xa0\n

before looking at SSH. Telnet, teletype network,\xa0\n

a remote host. So instead of plugging your PC\xa0\n

you can connect to the device on a remote\xa0\n

a very old protocol. It has been largely, almost\xa0\n

However SSH was developed in 1995,\xa0\n

Telnet sends data in plain text, no\xa0\n

like Wireshark to capture the traffic, they can\xa0\n

Up top is a Telnet packet sent from R1, inside\xa0\n

the CLI displays when trying to login. I entered\xa0\n

But the password is displayed in plain text,\xa0\n

who is able to capture the traffic like I did\xa0\n

between my device and R1. The username, the\xa0\n

That is definitely not secure, and\xa0\n

Before moving on to Telnet configuration, I want\xa0\n

that’s the device being connected to, R1 in this\xa0\n

23. So, when my device sent the password to R1,\xa0\n

make sure you remember that port number. And\xa0\n

that is connecting, and as I just said the Telnet\xa0\n

Here’s how to configure a device so that\xa0\n

First, you should always configure an enable\xa0\n

You won’t be able to access privileged exec mode\xa0\n

isn’t configured. I also configured a username and\xa0\n

mode. This isn’t necessary, but you can configure\xa0\n

VTY lines of the device. And then use the command\xa0\n

on the VTY lines. There are 16 lines available,\xa0\n

LINE VTY 0 15 means you are configuring all lines,\xa0\n

the VTY lines have the same configuration.\xa0\n

Okay, first I configured LOGIN LOCAL as well as\xa0\n

depends on the device. In this case it was\xa0\n

Okay, next I used the command\xa0\n

This is how you configure what kind of\xa0\n

TRANSPORT INPUT TELNET allows only Telnet\xa0\n

INPUT SSH to allow only SSH connections, or\xa0\n

TRANSPORT INPUT ALL allows all connections,\xa0\n

and SSH. Or, you can configure TRANSPORT INPUT\xa0\n

The device I’m using for this demo defaults to\xa0\n

default to TRANSPORT INPUT ALL. Finally, I applied\xa0\n

will be able to connect to SW1 using Telnet. Note\xa0\n

other devices will still be able to communicate\xa0\n

although the command to apply the ACL to the VTY\xa0\n

ACL to an interface is IP ACCESS-GROUP. And\xa0\n

ACCESS-LIST or IP ACCESS-LIST. Try not\xa0\n

IP ACCESS-GROUP, and\xa0\nACCESS-LIST or IP ACCESS-LIST.

To verify the configuration, I first tried to ping\xa0\n

when I tried to telnet to SW1, I got a message\xa0\n

That’s because of the ACL I applied to SW1’s VTY\xa0\n

So, I did Telnet from PC2, and it worked. Now,\xa0\n

Notice how the VTY line configurations are\xa0\n

The first 5 lines are displayed\xa0\n

I believe this is just a result of the fact that\xa0\n

even if you configure all 16 lines at\xa0\n

config. That’s just a bit of trivia, it doesn’t\xa0\n

So, that was a quick look at Telnet. Finally\xa0\n

SSH, which stands for Secure Shell, was developed\xa0\n

Telnet. By the way, if you’re wondering what\xa0\n

A shell is a computer program which exposes the\xa0\n

other program. So, any time you’re accessing the\xa0\n

revision of SSHv1, was released in 2006. Version\xa0\n

possible. If a device supports both version 1\xa0\n

Note that 1.99 isn’t actually a version of SSH, it\xa0\n

and version 2. SSH provides security features\xa0\n

You’ll learn more about those terms\xa0\n

But for example, here’s an SSH packet\xa0\n

the encrypted packet section, it’s just\xa0\n

Only the SSH server and client have the keys to\xa0\n

the packet on the way to its destination, I\xa0\n

SSH uses TCP port 22. So, remember that\xa0\n

Before configuring SSH, you should make sure that\xa0\n

I used the SHOW VERSION command, and here’s\xa0\n

that I highlighted. IOS images that support SSH\xa0\n

No Payload Encryption, IOS images to countries\xa0\n

And those NPE IOS images do not support\xa0\n

of encryption might be supported, but I would\xa0\n

unfortunately I don’t have access to any NPE IOS\xa0\n

If your device doesn’t support SSH, it will\xa0\n

but disabled. Notice the version is 1.99,\xa0\n

here’s a hint about the first step in configuring\xa0\n

RSA keys are cryptographic keys that are essential\xa0\n

Okay, so after ensuring that the IOS image you’re\xa0\n

keys. The keys are used for data encryption and\xa0\n

do that. First, I configured the domain name\xa0\n

The reason for this is that the FQDN of\xa0\n

By the way, FQDN means Fully Qualified Domain\xa0\n

name. Then I generated the RSA keys. The command\xa0\n

name the keys, SW1.jeremysitlab.com, which\xa0\n

the size of the modulus, the size of the keys. I\xa0\n

Note that you can just use the command CRYPTO KEY\xa0\n

without having to specify it separately\xa0\n

Note that the length must be 768 bits or greater\xa0\n

that length. Greater key lengths are more\xa0\n

After the keys are generated,\xa0\n

indicating that SSH has been enabled. I check SHOW\xa0\n

Now that SSH is enabled, let’s configure it. The\xa0\n

so let’s do a clean configuration of SSH. First,\xa0\n

a username, and an ACL to restrict connections\xa0\n

VERSION 2. This is optional, but recommended\xa0\n

Then once again, use the command LINE VTY\xa0\n

like when configuring Telnet. Then enable local\xa0\n

SSH, only LOGIN LOCAL works, a username is needed.\xa0\n

server, but that’s a topic for another video.\xa0\n

I configured the exec timeout again. This is\xa0\n

default exec timeout, but you can use this\xa0\n

Then I used TRANSPORT INPUT SSH. Best practice\xa0\n

disabling Telnet because it’s less\xa0\n

Just like for Telnet this is optional, but it\xa0\n

Okay, let me summarize the SSH configuration\xa0\n

I didn’t mention this previously because I had\xa0\n

cannot generate its RSA keys without a non-default\xa0\n

the default host name I tried the CRYPTO KEY\xa0\n

please define a hostname other than router. So\xa0\n

key pair again. However I haven’t defined a domain\xa0\n

And that’s the next step in SSH configuration,\xa0\n

IP DOMAIN NAME jeremysitlab.com. Then I try to\xa0\n

So, remember that. To generate the RSA key\xa0\n

and the domain name first. Actually, you can\xa0\n

for the CCNA you just have to know this method.\xa0\n

Then the next step is to configure an\xa0\n

password combination. The order of this step\xa0\n

configuration step, but make sure they are\xa0\n

This isn’t necessary, but it is best practice\xa0\n

configure the VTY lines. The most important one is\xa0\n

then you can do any other VTY line configurations\xa0\n

And that’s it, SSH should be working. From a\xa0\n

followed by the username and IP address, or SSH\xa0\n

practice lab. And make sure you do the practice\xa0\n

But you need to know how to configure\xa0\n

Here’s a summary of the new commands in this\xa0\n

to do some labbing in packet tracer\xa0\n

Unlike Syslog and SNMP, SSH configuration is\xa0\n

purpose of any of these commands,\xa0\n

SLIDE15\nBefore the quiz, here’s a review\xa0\xa0

of what we covered. First, console port security.\xa0\n

console port can access the CLI of the device. So,\xa0\n

Then I introduced the concept of\xa0\n

Layer 2 switches can’t route packets, but\xa0\n

traffic on an SVI, allowing them to respond\xa0\n

Then I introduced Telnet, a protocol that\xa0\n

However, Telnet is old and not secure,\xa0\n

Secure Shell instead when we\xa0\n

Make sure to watch until the end of the\xa0\n

Boson Software’s ExSim, the best practice exams\xa0\n

You issue the crypto key generate rsa command on\xa0\n

of the following might be the cause? Select two.\xa0\n

The answers are A, a host name hasn’t been\xa0\n

configured. The FQDN, fully qualified domain name,\xa0\n

The FQDN consists of the device’s host name\xa0\n

name of Router cannot be used, a host name must be\xa0\n

Which of the following commands would allow\xa0\n

the VTY lines of a device? (select two,\xa0\n

Pause the video now to think about your answers.

The answers are C, TRANSPORT INPUT\xa0\n

C will allow Telnet and SSH, whereas D will\xa0\n

there are protocols outside of Telnet and SSH that\xa0\n

real command, and B, TRANSPORT INPUT NONE, would\xa0\n

You want to allow only 192.168.1.1 to connect to\xa0\n

fulfills that requirement? Pause the\xa0\n

The answer is B. SSH uses TCP port 22. You must\xa0\n

ACCESS-CLASS command to apply it to the VTY\xa0\n

so it is the correct answer.\xa0\nOkay, let’s go to question 4.

Which of the following statements\xa0\n

Pause the video now to think about the answers.

The answers are B, K9 IOS images support SSH, and\xa0\n

for SSHv2. RSA keys are required to enable SSH, so\xa0\n

SSH version, it is used to refer to a device that\xa0\n

SSH does not send data in plain text, it encrypts\xa0\n

do not support cryptographic features like SSH,\xa0\n

A network admin using PC1 is remotely configuring\xa0\n

What is the role of SW1 in this situation?\xa0\n

The answer is B, SSH server. SSH and Telnet use\xa0\n

connected to, SW1 in this case, is the server,\xa0\n

PC1 in this case, is the client.\xa0\n

Now let’s do a bonus practice question\xa0\n

Okay here's today's Boson ExSim practice\xa0\n

incoming VTY connections on a router with the\xa0\n

image but has not yet been configured\xa0\n

In addition, the VTY lines are not yet configured\xa0\n

CRYPTO KEY GENERATE RSA command from global\xa0\n

will you most likely receive? Select the\xa0\n

Please pause the video now, check out the\xa0\n

Okay, let's check. So the important information\xa0\n

is Router1. It does have a K9 IOS image, so that\xa0\n

with a domain name or an RSA key pair. So no\xa0\n

likely receive? The name for the keys will be,\xa0\n

as I said, the name for the key pair is\xa0\n

which requires a host name and a domain name.\xa0\n

B, please define a domain-name first. I think\xa0\n

said you need a host name and a domain name. It\xa0\n

but no domain name yet. C, please create RSA keys\xa0\n

do there, so I don't think that message will\xa0\n

than Router. It already has a non-default host\xa0\n

not need SSH version 2 to create the RSA key\xa0\n

And yes it is. So here is Boson's explanation.\xa0\n

And here's the rest. There are some references\xa0\n

as well as some Cisco documentation\xa0\n

Okay, so that's Boson ExSim for CCNA. These are\xa0\n

CCNA, as well as CCNP and many other\xa0\n

please follow the link in the video description.

There are supplementary materials for this video.\xa0\xa0

There is a flashcard deck to\xa0\n

There will also be a packet tracer practice\xa0\n

That will be in the next video. Sign up for my\xa0\n

and I’ll send you all of the flashcards\xa0\n

Before finishing today’s video I want\xa0\n

To join, please click the ‘Join’ button under the\xa0\n

Brandon, Samil, Aaron, Marcel, Kone, Donald, C\xa0\n

Tshepiso, Justin, Prakaash, Nasir, Erlison,\xa0\n

Funnydart, Velvijaykum, Mark, Yousif, Boson\xa0\n

Sorry if I pronounced your name incorrectly,\xa0\n

is the list of JCNP-level members at the time\xa0\n

you signed up recently and your name isn’t on\xa0\n

Thank you for watching. Please\xa0\n

like the video, leave a comment, and share the\xa0\n

If you want to leave a tip, check the links in the\xa0\n

and accept BAT, or Basic Attention Token, tips\xa0\n