zNetLaB › Guided labs › Security
Router hardening checklist 32 — banner, secret, timeouts
Security Intermediate 2 devices 6 checked tasks 100 points Plan lab
Scenario — before Udaipur goes live the security team hands you their baseline. Name the router Core-Udaipur; set a login banner (banner motd) that warns of authorised use only; protect privileged mode with an enable secret; turn on service password-encryption; time out idle console and VTY sessions after 10 minutes; and allow only SSH on the VTY lines with a local user. You build it in a browser, type real commands at each device, and every task below is
checked against the running configuration — so you find out it is wrong before anybody else does.
Open this lab in the simulator
The simulator runs in your browser with nothing to install. This lab is part of the full simulator: open it free for 7 days with a new account, then with a plan. It needs an account, which keeps your progress.
The scenario
before Udaipur goes live the security team hands you their baseline. Name the router Core-Udaipur; set a login banner (banner motd) that warns of authorised use only; protect privileged mode with an enable secret; turn on service password-encryption; time out idle console and VTY sessions after 10 minutes; and allow only SSH on the VTY lines with a local user.
Your role: a security engineer. Level: Intermediate Done when: all 6 goals show as passed (100 points).
Network status
Devices: 1 router, 1 PC, cabled as drawn. No Layer 1 or Layer 2 faults: every link is connected and up. Router starts with addresses (G0/0 10.51.1.1/24). Admin-PC is a host with 10.51.1.10/24, gateway 10.51.1.1. Known problems
None: nothing is misconfigured. The network is simply not finished: what the goals list is what you have to build or secure. Goals
The hostname is Core-Udaipur (10 pts) A banner warns of authorised use only (15 pts) Privileged mode is protected by an enable secret (20 pts) Passwords in the configuration are encrypted (15 pts) Console and VTY sessions time out after 10 minutes (20 pts) VTY lines accept SSH only with local login (20 pts) The activity, in order
The hostname is Core-Udaipur Why: This is the task that checks your configuration directly: the line must really be there, not just look right. Verify with: show running-config A banner warns of authorised use only Why: This is the task that checks your configuration directly: the line must really be there, not just look right. Verify with: show running-config Privileged mode is protected by an enable secret Why: This is the task that checks your configuration directly: the line must really be there, not just look right. Verify with: show running-config Passwords in the configuration are encrypted Why: This is the task that checks your configuration directly: the line must really be there, not just look right. Verify with: show running-config Console and VTY sessions time out after 10 minutes Why: This is the task that checks your configuration directly: the line must really be there, not just look right. Verify with: show running-config VTY lines accept SSH only with local login Why: This is the task that checks your configuration directly: the line must really be there, not just look right. Verify with: show running-config Tips
Work in the order given: later goals depend on the earlier ones. After every change, run the verify command before moving on; do not guess. Stuck? Read the verify output first. It names the interface, neighbour or route that is wrong. Common mistake: enable password instead of enable secret (reversible) Common mistake: exec-timeout 0 0 — never times out Common mistake: A banner that welcomes the visitor Why this matters
A new router ships open: no banner, an unprotected enable mode, clear-text passwords and idle sessions that stay logged in. The baseline closes each of those, and every item on it is something an audit asks for by name.
What you will be able to do
Apply a device-hardening baseline
Explain enable secret versus enable password
Set idle timeouts
The network
ISR 2911, PC — 2 devices in all, already cabled.
Fa0 Gi0/0 10.51.1.1/24 Router Admin-PC 10.51.1.10/24 · gw 10.51.1.1 Drawn from this lab: devices, cables, ports and the addresses already set. Device Model Address already set
Router ISR 2911 configure it Admin-PC PC 10.51.1.10 / 255.255.255.0 gw 10.51.1.1
Cabling
Admin-PC Fa0 ↔ Router Gi0/0
What is configured at the start
These are already configured when the lab opens — including, where this is a troubleshooting lab, the fault itself:
Router interface g0/0
ip address 10.51.1.1 255.255.255.0
no shutdown
exit Tasks, and how each one is checked
Every task is decided by reading the live network — a neighbour in FULL, a ping that succeeds, a line in the running configuration — not by looking for a keyword you typed. The same command shows you what the lab sees.
# Task Pts How to verify it yourself
1 The hostname is Core-Udaipur 10 On Router: show running-config contains the line(s) matching hostname Core-Udaipur. 2 A banner warns of authorised use only 15 On Router: show running-config contains the line(s) matching banner motd. 3 Privileged mode is protected by an enable secret 20 On Router: show running-config contains the line(s) matching enable secret. 4 Passwords in the configuration are encrypted 15 On Router: show running-config contains the line(s) matching (?<!no )service password-encryption. 5 Console and VTY sessions time out after 10 minutes 20 On Router: show running-config contains the line(s) matching line con 0 … exec-timeout 10 0. and On Router: show running-config contains the line(s) matching line vty … exec-timeout 10 0. 6 VTY lines accept SSH only with local login 20 On Router: show running-config contains the line(s) matching transport input ssh. and On Router: show running-config contains the line(s) matching line vty … login local.
Stuck? Ask the coach
Tell the coach what you see or what you tried. It gives you a hint, not the answer, the way a senior engineer would. Included with a free trial or any plan.
Ask the coach
Common mistakes
enable password instead of enable secret (reversible)
exec-timeout 0 0 — never times out
A banner that welcomes the visitor
Reference solution
Try it yourself first — the lab checks your work either way. This is one configuration that makes every task pass, device by device:
Router hostname Core-Udaipur
ip domain-name udaipur.lab
username admin secret Adm1n#Pass
crypto key generate rsa modulus 2048
ip ssh version 2
banner motd # Authorised use only. All activity is logged. #
enable secret En@bleS3cret
service password-encryption
line con 0
exec-timeout 10 0
exit
line vty 0 4
exec-timeout 10 0
login local
transport input ssh
exit Where this is examined
CCNA 5.3 device access control; Security+ 4.5.
This lab practises these topics in the zNetLaB certification courses:
Related labs
Where to start
The lessons all guided labs plans
CCNA®, CCNP® and Cisco® are trademarks of Cisco Systems, Inc. zNetLaB is not affiliated with or endorsed by Cisco.