Secure Remote Access to Cisco Devices with Logging

Lab Overview

In this lab, I configured secure management access for a network using console and SSH. The configuration includes local authentication, restricted SSH access using an access control list (ACL), management VLANs, NTP synchronization, and centralized logging.

The lab also includes inter-VLAN routing and static routing between the two buildings. The goal is to allow administrators to remotely access the network devices while preventing SSH access from unauthorized networks. All network devices must also be able to reach the NTP and logging servers.

Objectives

The main objective was to configure and secure remote management access to the Cisco network devices.

The lab objectives were to:

• Configure local user accounts for console and SSH authentication.

• Configure console access.

• Configure SSH version 2 for secure remote access.

• Assign management IP addresses using two /25 networks from the 192.168.99.0/24 range.

• Use VLAN 99 as the management VLAN on the network devices.

• Restrict SSH access to the administrators network using a standard ACL.

• Configure a login banner to warn unauthorized users.

• Configure inter-VLAN routing using router sub-interfaces.

• Configure static routes between the two buildings.

• Configure NTP synchronization for the network devices.

• Configure centralized logging using a log server.

• Verify connectivity, routing, SSH access control, NTP, and logging.

The expected result was a network where administrators could securely access the Cisco devices remotely, unauthorized SSH connections were rejected, and device time and logs were managed centrally.

Lab Scenario

The simulated organization has two buildings connected through two routers.

Building A contains the managers and IT departments, while Building B contains the sales, support, and financial departments. Each departmental access switch has a management interface in VLAN 99 so that the switches can be remotely managed.

The administrators network is used as the source network for remote SSH access. An ACL is applied to the VTY lines of the Cisco devices to allow SSH connections only from this network.

The network also contains an NTP server and a log server. All Cisco devices must be able to reach these servers so that their clocks can be synchronized and their system logs can be sent to a central location.

To keep the lab focused on secure device management, only the VLANs, services, routing, and configurations required for these objectives are included.

Topology

                  +------------+              +------------+

                  |  Router-2  |--------------|  Router-1  |

                  +-----+------+              +-----+------+

                        |                            |

                  +-----+------+              +-----+------+

                  |    MLS-2   |              |    MLS-1   |

                  +-----+------+              +-----+------+

                   /    |     \                  /    \

                  /     |      \                /      \

             +------+ +------+ +------+      +------+ +------+

             | SW-2 | | SW-3 | | SW-4 |      | SW-1 | | SW-2 |

             +------+ +------+ +------+      +------+ +------+

IP Addressing and Network Plan

The network uses 192.168.99.0/24 for device management. It is divided into two /25 networks, with one management network for each building.

Purpose                                          Network / Address         Gateway                                                         

Router-to-Router link                  172.16.10.0/30                Router-1: 172.16.10.1, Router-2: 172.16.10.2

Building A Management VLAN   192.168.99.0/25              192.168.99.1

Building B Management VLAN   192.168.99.128/25         192.168.99.129

Administrators VLAN 100           192.168.100.0/24           192.168.100.1

Servers VLAN 200                         192.168.200.0/24           192.168.200.1

The management addresses assigned to the devices are:

Building A:

Router-1: 192.168.99.1/25

MLS-1: 192.168.99.2/25

SW-IT: 192.168.99.3/25

SW-Managers: 192.168.99.4/25

Building B:

Router-2: 192.168.99.129/25

MLS-2: 192.168.99.130/25

SW-Sales: 192.168.99.131/25

SW-Support: 192.168.99.132/25

SW-Financials: 192.168.99.133/25

VLAN 99 is used for device management, VLAN 100 for the administrators network, and VLAN 200 for the server network.

The NTP server uses 192.168.200.5, and the log server uses 192.168.200.6.

Requirements / Environment

I deployed the complete network in Cisco Packet Tracer version 9, which supported the commands and features required for this lab.

I also tested the configurations using real Cisco device images in PNETLab to verify that the commands and configurations worked in real Cisco environment.

Lab Tasks

I configured the network in the following order:

1.   Created local user accounts and privileged authentication.

2.   Configured console access.

3.   Configured hostnames and domain names.

4.   Generated RSA keys and enabled SSH version 2.

5.   Configured SSH timeout and authentication settings.

6.   Created an ACL to allow SSH access only from the administrators network.

7.   Applied the ACL to the VTY lines.

8.   Configured login banners.

9.   Created VLAN 99 and assigned management IP addresses to the devices.

10.  Configured the router-to-router connection.

11.  Configured router sub-interfaces for the required VLANs.

12.  Configured NTP on the Cisco devices.

13.  Configured centralized logging.

14.  Added the required static routes.

15.  Configured the administrators workstation, NTP server, and log server.

16.  Saved the configurations.

17.  Tested connectivity, SSH access control, NTP synchronization, and logging.

Configuration

This section provides the configurations for the devices in the lab and explains the important configuration elements.

The topology contains nine Cisco devices. To keep the documentation focused, repetitive configurations are not explained individually. The remaining device configurations follow the same management, SSH, ACL, NTP, and logging configuration pattern, with changes to hostnames, management IP addresses, VLAN assignments, and interfaces as required.

For reference, the complete startup configurations for the devices are provided separately, which is provided on my GitHub.

Router-1

Router-1 is located in Building A and provides routing between the administrators, server, and management networks. It also provides the connection to Router-2.

en

terminal monitor

conf t

First, I assigned credentials to use for authentication for accessing to devices:

username admin privilege 15 secret 123

username assistant privilege 1 secret 456

enable secret 111

Then I configured console and SSH:

line console 0

 login local

 logging synchronous

 exec-timeout 30 0

 exit

hostname Router-1

ip domain name xco.lan

crypto key generate rsa general-keys modulus 2048

ip ssh version 2

ip ssh time-out 30

ip ssh authentication-retries 3

To make sure only devices from admins network can connect, I used an access list:

ip access-list standard Admins

 permit 192.168.100.0 0.0.0.255

 exit

line vty 0 4

 transport input SSH

 transport output none

 access-class Admins in

 login local

 logging synchronous

 exec-timeout 30 0

 exit

For legal notice and wanning I assigned a login banner:

banner login @

--------------- DISCLAIMER ---------------

Only authorized administrators are allowed

to connect to this device.

------------------------------------------

@

Then I connected the router to its neighbor router:

interface gig0/0/0

 media-type sfp

 ip address 172.16.10.1 255.255.255.252

 no shutdown

 exit

Next, I assigned inter-VLAN routing using sub-interfaces on the router:

interface range gig0/0/1

 no shutdown

 exit

int gig0/0/1.99

 encapsulation dot1q 99

 ip address 192.168.99.1 255.255.255.128

 no shutdown

 exit

interface gig0/0/1.100

 encapsulation dot1q 100

 ip address 192.168.100.1 255.255.255.0

 no shutdown

 exit

interface gig0/0/1.200

 encapsulation dot1q 200

 ip address 192.168.200.1 255.255.255.0

 no shutdown

 exit

Here I added the NTP server and Log server:

ntp server 192.168.200.5

logging host 192.168.200.6

service timestamps log datetime msec

logging trap

The Building B management network is reachable through Router-2. Because Building B uses 192.168.99.128/25, Router-1 uses the following route:

ip route 192.168.99.128 255.255.255.128 172.16.10.2

Finally saved the configurations I made on Router-1:

exit

copy running-config startup-config

MLS-1

MLS-1 is the multilayer switch located in Building A. In this lab, its Layer-3 role is limited to providing a management SVI. The switch uses Router-1 as its default gateway.

The common console, SSH, ACL, banner, NTP, and logging configurations follow the same approach used on Router-1.

en

terminal monitor

conf t

username admin privilege 15 secret 123

username assistant privilege 1 secret 456

enable secret 111

line console 0

 login local

 logging synchronous

 exec-timeout 30 0

 exit

hostname MLS-1

ip domain name xco.lan

crypto key generate rsa general-keys modulus 2048

ip ssh version 2

ip ssh time-out 30

ip ssh authentication-retries 3

Here I configured VLAN 99 as management VLAN on MLS-1, and assign the Router-1 as its default-gateway:

vlan 99

 name Manage

 exit

interface vlan 99

 ip address 192.168.99.2 255.255.255.128

 no shutdown

 exit

ip default-gateway 192.168.99.1

ip access-list standard Admins

 permit 192.168.100.0 0.0.0.255

 exit

line vty 0 4

 transport input SSH

 transport output none

 access-class Admins in

 login local

 logging synchronous

 exec-timeout 30 0

 exit

banner login @

--------------- DISCLAIMER ---------------

Only authorized administrators are allowed

to connect to this device.

------------------------------------------

@

ntp server 192.168.200.5

logging host 192.168.200.6

service timestamps log datetime msec

logging trap

Then I created the VLANs that access switches in building A are providing services on.

vlan 100

 name Admins

vlan 200

 name Servers

 exit

interface range gig1/0/1-3

 switchport mode trunk

 exit

exit

copy running-config startup-config

SW-IT

Switches configurations in this scenario is focused on remote access configurations, not VLANs and devices connected to them. This helps to keep the scenario clean and focused.

en

terminal monitor

conf t

username admin privilege 15 secret 123

username assistant privilege 1 secret 456

enable secret 111

line console 0

 login local

 logging synchronous

 exec-timeout 30 0

 exit

hostname SW-IT

ip domain name xco.lan

crypto key generate rsa general-keys modulus 2048

ip ssh version 2

ip ssh time-out 30

ip ssh authentication-retries 3

vlan 99

 name Manage

 exit

interface vlan 99

 ip address 192.168.99.3 255.255.255.128

 no shutdown

 exit

ip default-gateway 192.168.99.1

ip access-list standard Admins

 permit 192.168.100.0 0.0.0.255

 exit

line vty 0 4

 transport input SSH

 transport output none

 access-class Admins in

 login local

 logging synchronous

 exec-timeout 30 0

 exit

banner login @

--------------- DISCLAIMER ---------------

Only authorized administrators are allowed

to connect to this device.

------------------------------------------

@

ntp server 192.168.200.5

logging host 192.168.200.6

service timestamps log datetime msec

logging trap

vlan 100

 name Admins

vlan 200

 name Servers

 exit

interface gig0/1

 switchport mode trunk

 exit

Since the access switch-1 is being used both by Administrators and Servers, but using different VLANs for each, I divided the interfaces and dedicate each section to different VLANs:

interface range fast0/1-12

 switchport mode access

 switchport access vlan 100

 exit

interface range fast0/13-24

 switchport mode access

 switchport access vlan 200

 exit

exit

copy running-config startup-config

Testing & Verification

After completing the configuration, I verified connectivity, routing, SSH access control, NTP synchronization, and centralized logging.

Connectivity and Routing

I used ping tests from the administrators network to verify connectivity to network devices, routers, and servers.

The devices responded successfully, confirming that the required VLANs, management addresses, and routes were functioning as expected.

NTP Verification

The following commands were used to verify that devices can reach to NTP server successfully and can synchronize their time:

show ntp status

Clock is synchronized, stratum 2, reference is 192.168.200.5

nominal freq is 250.0000 Hz, actual freq is 249.9990 Hz, precision is 2**24

reference time is EE0E7E81.00000288 (0:14:57.648 UTC Thu Aug 27 2026)

clock offset is 16.00 msec, root delay is 31.00  msec

root dispersion is 10.78 msec, peer dispersion is 0.12 msec.

loopfilter state is 'CTRL' (Normal Controlled Loop), drift is - 0.000001193 s/s system poll interval is 4, last update was 16 sec ago.

show ntp associations

address     ref clock   st when   poll   reach  delay  offset    disp

*~192.168.200.5 127.127.1.1 1  4  16 377 22.00  4.00      0.12

 * sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured

show clock

0:15:20.426 UTC Thu Aug 27 2026

Centralized Logging Verification

The configured logging destination was verified with:

show logging

*Mar 01, 00:00:10.000:  %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 192.168.200.6 port 514 started - CLI initiated

I then checked the logging server and confirmed that messages from the network devices were being received.

SSH Access-Control Verification

To verify that the ACL was restricting remote management access, I attempted to connect to a network device from an unauthorized network:

ssh -l admin 192.168.99.130

% Connection refused by remote host

The connection was rejected because the source network was not permitted by the Admins ACL.

I then performed the same test from the administrators network:

ssh -l admin 192.168.99.132

Password:

SW-Support>en

Password:

SW-Support#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

SW-Support(config)#

The successful login confirmed that SSH access was available from the authorized administrators network.

Results

The lab successfully configured secure Cisco device management between two connected buildings.

In this project, 9 Cisco devices were configured with management IP addresses, local user accounts, console access, SSH version 2, login banners, and restricted VTY access. The SSH ACL allowed remote access only from the administrators network. Connections from unauthorized networks were rejected.

The network devices could communicate with the required networks and servers. Their clocks were synchronized with the NTP server, and their system messages were sent to the central logging server. These settings provide a useful way to manage and monitor the network securely.

Resources

The network was simulated in Cisco Packet Tracer 9, where all required configurations were tested and verified. The configurations were also tested using real Cisco device images in PNETLab.

The startup configurations and the project file are provided on my GitHub for reference.