300-410 Question 244
Select 3A network administrator is unable to remotely manage a Cisco router through SSH. Upon investigating, they find that the router is reachable via ping, but SSH attempts fail. Which two steps should the administrator take to troubleshoot and resolve this issue?
- A
Verify that the SSH service is enabled on the router using the command 'show ip ssh'.
- B
Check the access control lists (ACLs) applied to the vty lines to ensure SSH traffic is permitted.
- C
Ensure that the router's hostname and domain name are configured, as they are required for SSH key generation.
- D
Verify that the Telnet service is enabled as a fallback for remote access.
- E
Check whether the SSH client is using the correct username and password to authenticate.
Show answer and explanation
Correct answers: A, B, C
Explanation
To troubleshoot SSH issues on a Cisco router, the administrator must ensure that SSH is enabled, check ACLs that might block SSH traffic, and confirm that required configurations like hostname and domain name are in place for RSA key generation. These steps address common misconfigurations that could prevent SSH access, making options 1, 2, and 3 correct. Telnet should not be used as a fallback due to security concerns, and authentication issues are not indicated in the scenario.
- A. Correct.
Verifying the SSH service status using the 'show ip ssh' command ensures that SSH is enabled and properly configured on the router. If SSH is not enabled, remote management via SSH will fail.
- B. Correct.
Access control lists (ACLs) applied to the vty lines could block SSH traffic. Checking and updating the ACLs to allow SSH is a critical troubleshooting step.
- C. Correct.
SSH requires a hostname and domain name to generate the RSA keys. If these are not set, SSH will not function properly, making this a necessary verification step.
- D. Incorrect.
Enabling Telnet is not recommended as a fallback because it transmits data in plaintext and is considered insecure. The focus should remain on troubleshooting SSH.
- E. Incorrect.
While the SSH client credentials are important, the problem described is more related to the router's configuration and not authentication issues.