350-401 Question 236
Single answerAn administrator is configuring device access control on a Cisco router to ensure secure remote management. They decide to use an access-class to limit Telnet and SSH access to the router based on IP addresses. After applying the configuration shown below, the administrator is unable to access the router via SSH from their workstation. What is the most likely issue?
Router(config)# access-list 10 permit 192.168.1.0 0.0.0.255 Router(config)# line vty 0 4 Router(config-line)# access-class 10 in Router(config-line)# transport input ssh telnet
- A
The access-class is incorrectly applied to the VTY lines.
- B
The access list does not include the administrator's workstation IP address.
- C
The transport input command is missing the 'all' keyword.
- D
The access-class command is not supported for SSH access.
Show answer and explanation
Correct answer: B
Explanation
The access-class command is used to control access to the VTY lines based on the source IP address. In this scenario, the access list (ACL 10) only permits the 192.168.1.0/24 network, but the administrator's workstation IP may not be included in this range. This would prevent the router from allowing SSH access from the workstation. To resolve the issue, the administrator should verify that their workstation's IP address matches the permitted range in the access list.
- A. Incorrect.
The access-class command is correctly applied to the VTY lines, so this is not the issue.
- B. Correct.
If the administrator's workstation IP address is not included in the access list, the router will block SSH access, making this the most likely cause of the issue.
- C. Incorrect.
The 'transport input' command is correctly configured to allow both SSH and Telnet, so this is not the issue.
- D. Incorrect.
The access-class command is supported for both Telnet and SSH access, so this is not the issue.