NTC/362: Fundamentals of Networking

 NTC/362: Fundamentals of Networking

Q: A local user (Bob) has been created on the switch and the following output is from the same switch:

1. SW1#show crypto key mypubkey rsa
2. % Key pair was generated at: 04:04:02 UTC Mar 2 2012
3. Key name: http://SW1.example.com
4. Storage Device: not specified
5. Usage: General Purpose Key
6. Key is not exportable.
7. Key Data:
8. 30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 009A57C6
9. 78938149 5740DCE8 4C29BF0B 6A75E3A2 30899991 14C2F5CE 5EE96D32 3BD16F27
10. ADB93E31 76EE584F AEE9B437 D52C31A1 38655F4B B44EF4AD 7D9BF6C4 585F0AE2
11. EF1D526E 6D45BB2C E16733CE DDDB3385 9D41A234 2A2F2FB4 D018623E 1315AB88
12. 30FEC410 61701A3A 35B7FBBE 366CA098 E4FE207B 77AAA99F 6BC1E440 99020301 0001
13. % Key pair was generated at: 04:04:03 UTC Mar 2 2012
14. Key name: http://SW1.example.com.server
15. Temporary key
16. Usage: Encryption Key
17. Key is not exportable.
18. Key Data:
19. 307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00B39B93 1CA95CF8
20. 53A6C686 DB890DB9 884007E4 F9DCB7D0 27240DE0 2A25307D 73075C87 8885B335
21. 32F60805 3EDB7CB2 07CFA030 DBC14A83 AF2BA323 2E1BAF23 8ADEC75E 48276E3F
22. B47CF339 2ED49D6D B939793E F7080D9E E9F4BE52 2D99A0D1 3B020301 0001
23. SW1#

Bob has an IP address on his computer, and can ping the interface of the switch. SSH is enabled on the vty lines, but the user Bob cannot log in to the switch via SSH? What needs to be added to the configuration?

A: Require local authentication.

Explanation: Local authentication on the vty lines is not default and is required for SSH to work. The switch must be reconfigured to use one of two user authentication methods that require both a username and password: one method with the usernames and passwords configured on the switch, or the other with the usernames and passwords configured on an external server called an authentication, authorization, and accounting (AAA) server.

Password length requirements would not cause SSH to work or not to work, because they are a systemwide parameter. An RSA key pair already exists, based on the output of the show commands. The IP domain name has been set; otherwise, the key pair would not have been allowed to be created. The user was trying to connect to the switch over the local VLAN, so a default gateway would not be required for this connection to work.