itnetworking
Search / GitHub Start with lab 1

PTL-0053 Network Security

Secure Management Network Design

Design, implement, and verify enterprise management plane security using dedicated management VLAN segmentation, cryptographic SSHv2 access, and VTY access-class filtering on Cisco IOS routers and switches. Isolate infrastructure management interfaces from user data subnets and enforce strict administrative access controls.

Level
Advanced
Time
75 min
Packet Tracer
8.2+
Simulator
Tested in Packet Tracer
You configure
R1-Edge, SW-Access, SW-Core
Last reviewed
On this page

FILES Packet Tracer topology

Download starter file

starter.pkt, 100 KB. Open it in Cisco Packet Tracer 8.2+. Install Packet Tracer.

Solution / reference file

The completed topology with every task configured. Try the lab first and use this to check your work or when you are stuck.

Download solution file

completed.pkt, 100 KB.

File checksums (SHA-256)
starter.pkt
d08af5c62393bf376de5f9ba194fcca1a74cab8792832bd29cbe5c936511aca3
completed.pkt
5a5ad79dc0021ef5932a0ec660c4237e197da9020e732818e7839b0324a98937

Part of BSIT Networking Curriculum Learning Path (step 55 of 56) and CCNA-Aligned Topical Study Path (step 55 of 56).

Learning Objectives#

  • Architect and enforce a dedicated out-of-band management network design separating management and user data planes.
  • Configure isolated Switched Virtual Interfaces (SVIs) on dedicated Management VLAN 99 with default gateway reachability.
  • Enforce cryptographic SSHv2 device management and disable plaintext Telnet on all router and switch VTY lines.
  • Implement standard and extended access control lists restricting administrative access to authorized management stations.
  • Diagnose and remediate management plane vulnerabilities including default VLAN 1 exposure and missing VTY access-class filters.

Prerequisites#

Topology#

Secure Management Network Design Topology Diagram
Secure Management Network Design Topology Diagram
                           [ R1-Edge ]
                       (Cisco 2911 Router)
                         Gi0/0 (802.1Q Trunk)
                                 |
                                 | Trunk (VLANs 10, 99)
                                 |
                         Gi0/1 (802.1Q Trunk)
                           [ SW-Core ]
                      (Catalyst 2960-24TT)
                      SVI VLAN 99: 192.168.99.2
                                 |
                         Gi0/2 (802.1Q Trunk)
                                 |
                         Gi0/1 (802.1Q Trunk)
                          [ SW-Access ]
                      (Catalyst 2960-24TT)
                      SVI VLAN 99: 192.168.99.3
                        /              \
                Fa0/10 /                \ Fa0/24
         (Access VLAN 10)            (Access VLAN 99)
                     /                    \
              [ User-PC ]            [ Admin-PC ]
            Standard Client        Authorized Admin
            192.168.10.10/24       192.168.99.10/24

Addressing Table#

Device Name Interface IP Address Subnet Mask Default Gateway Function / Connected To
R1-Edge Gi0/0 Unnumbered Unnumbered N/A Trunk to SW-Core Gi0/1
R1-Edge Gi0/0.10 192.168.10.1 255.255.255.0 N/A Gateway for User Data Subnet (VLAN 10)
R1-Edge Gi0/0.99 192.168.99.1 255.255.255.0 N/A Gateway for Management Subnet (VLAN 99)
SW-Core Gi0/1 Trunk N/A N/A Trunk to R1-Edge Gi0/0
SW-Core Gi0/2 Trunk N/A N/A Trunk to SW-Access Gi0/1
SW-Core VLAN 99 192.168.99.2 255.255.255.0 192.168.99.1 Core Switch Management SVI
SW-Access Gi0/1 Trunk N/A N/A Trunk to SW-Core Gi0/2
SW-Access Fa0/10 Access (VLAN 10) N/A N/A Access Port for User-PC
SW-Access Fa0/24 Access (VLAN 99) N/A N/A Access Port for Admin-PC
SW-Access VLAN 99 192.168.99.3 255.255.255.0 192.168.99.1 Access Switch Management SVI
User-PC FastEthernet0 192.168.10.10 255.255.255.0 192.168.10.1 Standard User Workstation
Admin-PC FastEthernet0 192.168.99.10 255.255.255.0 192.168.99.1 Authorized Administrator Station

Lab Tasks#

  1. Analyze Baseline Vulnerabilities: Investigate the initial topology to verify default VLAN 1 management exposure, enabled Telnet services, and unrestricted inter-VLAN reachability from user hosts.
  2. Implement Dedicated Management VLAN: Create VLAN 99 across SW-Core and SW-Access, assign management SVIs, configure the default gateway, and place Admin-PC into VLAN 99.
  3. Hardening Device Cryptography and Transport: Configure RSA keys (1024 bits), set domain names, configure local administrative credentials (admin / Cisco12345!), enable ip ssh version 2, and enforce transport input ssh on all VTY lines.
  4. Deploy VTY Access-Class Filtering: Construct standard ACL 99 on each network infrastructure device permitting only Admin-PC (192.168.99.10) to initiate management sessions.
  5. Apply Router Data-Plane Filter: Apply extended ACL USER_FILTER on R1-Edge subinterface GigabitEthernet0/0.10 blocking all user traffic destined for 192.168.99.0/24.
  6. Verify Security Enforcement: Confirm that Admin-PC establishes SSH sessions to all devices while User-PC cannot ping or reach management interfaces, and verify Telnet connections are rejected.

Configuration Walkthrough#

Task 1: Migrate Switch Management to Dedicated VLAN 99#

On SW-Core:

SW-Core# configure terminal
SW-Core(config)# vlan 10
SW-Core(config-vlan)# name User_Data
SW-Core(config-vlan)# vlan 99
SW-Core(config-vlan)# name Management
SW-Core(config-vlan)# exit
SW-Core(config)# interface vlan 1
SW-Core(config-if)# no ip address
SW-Core(config-if)# shutdown
SW-Core(config-if)# exit
SW-Core(config)# interface vlan 99
SW-Core(config-if)# ip address 192.168.99.2 255.255.255.0
SW-Core(config-if)# no shutdown
SW-Core(config-if)# exit
SW-Core(config)# ip default-gateway 192.168.99.1

On SW-Access:

SW-Access# configure terminal
SW-Access(config)# vlan 10
SW-Access(config-vlan)# name User_Data
SW-Access(config-vlan)# vlan 99
SW-Access(config-vlan)# name Management
SW-Access(config-vlan)# exit
SW-Access(config)# interface vlan 1
SW-Access(config-if)# no ip address
SW-Access(config-if)# shutdown
SW-Access(config-if)# exit
SW-Access(config)# interface vlan 99
SW-Access(config-if)# ip address 192.168.99.3 255.255.255.0
SW-Access(config-if)# no shutdown
SW-Access(config-if)# exit
SW-Access(config)# ip default-gateway 192.168.99.1
SW-Access(config)# interface FastEthernet0/24
SW-Access(config-if)# switchport mode access
SW-Access(config-if)# switchport access vlan 99
SW-Access(config-if)# spanning-tree portfast

Task 2: Configure SSHv2 and Cryptographic Hardening#

On R1-Edge, SW-Core, and SW-Access:

hostname <Device-Name>
ip domain-name enterprise.local
crypto key generate rsa modulus 1024
ip ssh version 2
username admin secret Cisco12345!
enable secret Class12345!

access-list 99 remark Permit Only Authorized Admin Station
access-list 99 permit host 192.168.99.10
access-list 99 deny any

line vty 0 4
 login local
 transport input ssh
 access-class 99 in

Task 3: Enforce Perimeter Filtering on Router#

On R1-Edge:

R1-Edge# configure terminal
R1-Edge(config)# ip access-list extended USER_FILTER
R1-Edge(config-ext-nacl)# remark Deny User Subnet from Accessing Management Plane
R1-Edge(config-ext-nacl)# deny ip 192.168.10.0 0.0.0.255 192.168.99.0 0.0.0.255
R1-Edge(config-ext-nacl)# remark Permit All Other User Traffic
R1-Edge(config-ext-nacl)# permit ip 192.168.10.0 0.0.0.255 any
R1-Edge(config-ext-nacl)# exit
R1-Edge(config)# interface GigabitEthernet0/0.10
R1-Edge(config-subif)# ip access-group USER_FILTER in
R1-Edge(config-subif)# end
R1-Edge# copy running-config startup-config

Verification#

1. Management Subnet Reachability#

From Admin-PC, verify full management plane reachability:

ping 192.168.99.1
ping 192.168.99.2
ping 192.168.99.3

All ping commands should complete with 0% packet loss.

2. Cryptographic SSH Access#

From Admin-PC, connect to router and switches using SSH:

ssh -l admin 192.168.99.1
ssh -l admin 192.168.99.2
ssh -l admin 192.168.99.3

Enter password Cisco12345! when prompted. Each connection must establish successfully.

3. User Subnet Isolation Verification#

From User-PC, verify gateway reachability on the data plane:

ping 192.168.10.1

Result: 0% packet loss.

From User-PC, attempt to probe or reach the management subnet:

ping 192.168.99.1
ping 192.168.99.2
ping 192.168.99.3

Result: Request timed out (100% loss) due to USER_FILTER on R1-Edge.

4. Telnet Rejection#

From Admin-PC, attempt to connect using plaintext Telnet:

telnet 192.168.99.1
telnet 192.168.99.2

Result: Connection refused / closed immediately because transport input ssh disables port 23.

Troubleshooting#

Symptom Probable Cause Diagnostic Command Remediation
Admin-PC cannot ping switch management IP Switch missing default gateway or VLAN 99 not active show ip default-gateway and show vlan brief on switch Configure ip default-gateway 192.168.99.1 and verify VLAN 99 in database
SSH connection fails: Connection refused RSA keys not generated or transport input ssh missing show ip ssh and show run | section line vty Generate 1024-bit RSA key and set transport input ssh
Admin-PC SSH connection immediately closes access-class 99 in blocks Admin-PC IP show access-lists 99 Verify Admin-PC IP (192.168.99.10) is permitted in ACL 99
User-PC can still ping management IPs USER_FILTER not bound to subinterface show ip interface Gi0/0.10 | include access list Apply ip access-group USER_FILTER in under Gi0/0.10

Key Takeaways#

  • Out-of-band or segregated management networks are essential to prevent data plane users from eavesdropping, attacking, or exhausting management interfaces.
  • Management SVIs should never reside on default VLAN 1; a dedicated non-default VLAN (such as VLAN 99) should be provisioned across all switches.
  • Cryptographic protocols (SSHv2) with strong RSA keys (at least 1024 bits) must replace legacy plaintext protocols (Telnet).
  • Dual-layer protection—VTY access-class filtering on devices and edge ACLs at router subinterfaces—provides defense-in-depth against unauthorized access attempts.

References#

Files and Validation Status#

Reference configurations

Final device configurations from the solution. Like the solution file, these give the answers away.

R1-Edge R1-Edge.txt, 1.6 KB 
Building configuration...

Current configuration : 1577 bytes
!
version 15.1
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname R1-Edge
!
!
!
enable secret 5 $1$mERr$q70rzGWFvn3ubJe9cZ91a1
!
!
!
!
!
!
ip cef
no ipv6 cef
!
!
!
username admin secret 5 $1$mERr$qvQ4xEW18PRaHS0uXVe8v.
!
!
license udi pid CISCO2911/K9 sn FTX15242ECN-
!
!
!
!
!
!
!
!
!
!
!
ip ssh version 2
no ip domain-lookup
ip domain-name enterprise.local
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface GigabitEthernet0/0
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
 ip access-group USER_FILTER in
!
interface GigabitEthernet0/0.99
 encapsulation dot1Q 99
 ip address 192.168.99.1 255.255.255.0
!
interface GigabitEthernet0/1
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface GigabitEthernet0/2
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface Vlan1
 no ip address
 shutdown
!
ip classless
!
ip flow-export version 9
!
!
ip access-list extended USER_FILTER
 remark Deny User Subnet from Accessing Management Plane
 deny ip 192.168.10.0 0.0.0.255 192.168.99.0 0.0.0.255
 remark Permit All Other User Data Traffic
 permit ip 192.168.10.0 0.0.0.255 any
access-list 99 remark Permit Only Admin-PC
access-list 99 permit host 192.168.99.10
access-list 99 deny any
!
banner motd ^C Authorized Access Only - R1-Edge Management Gateway ^C
!
!
!
!
line con 0
 exec-timeout 15 0
 logging synchronous
!
line aux 0
!
line vty 0 4
 access-class 99 in
 login local
 transport input ssh
!
!
!
end

Download R1-Edge.txt

SW-Access SW-Access.txt, 2.1 KB 
Building configuration...

Current configuration : 2050 bytes
!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname SW-Access
!
enable secret 5 $1$mERr$q70rzGWFvn3ubJe9cZ91a1
!
!
!
ip ssh version 2
no ip domain-lookup
ip domain-name enterprise.local
!
username admin secret 5 $1$mERr$qvQ4xEW18PRaHS0uXVe8v.
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
interface FastEthernet0/1
 shutdown
!
interface FastEthernet0/2
 shutdown
!
interface FastEthernet0/3
 shutdown
!
interface FastEthernet0/4
 shutdown
!
interface FastEthernet0/5
 shutdown
!
interface FastEthernet0/6
 shutdown
!
interface FastEthernet0/7
 shutdown
!
interface FastEthernet0/8
 shutdown
!
interface FastEthernet0/9
 shutdown
!
interface FastEthernet0/10
 switchport access vlan 10
 switchport mode access
 spanning-tree portfast
!
interface FastEthernet0/11
 shutdown
!
interface FastEthernet0/12
 shutdown
!
interface FastEthernet0/13
 shutdown
!
interface FastEthernet0/14
 shutdown
!
interface FastEthernet0/15
 shutdown
!
interface FastEthernet0/16
 shutdown
!
interface FastEthernet0/17
 shutdown
!
interface FastEthernet0/18
 shutdown
!
interface FastEthernet0/19
 shutdown
!
interface FastEthernet0/20
 shutdown
!
interface FastEthernet0/21
 shutdown
!
interface FastEthernet0/22
 shutdown
!
interface FastEthernet0/23
 shutdown
!
interface FastEthernet0/24
 switchport access vlan 99
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet0/1
 switchport trunk allowed vlan 10,99
 switchport mode trunk
!
interface GigabitEthernet0/2
 shutdown
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan99
 ip address 192.168.99.3 255.255.255.0
!
ip default-gateway 192.168.99.1
!
banner motd ^C Authorized Access Only - SW-Access Access Switch ^C
!
!
!
access-list 99 remark Permit Only Admin-PC
access-list 99 permit host 192.168.99.10
access-list 99 deny any
line con 0
 logging synchronous
 exec-timeout 15 0
!
line vty 0 4
 access-class 99 in
 login local
 transport input ssh
line vty 5 15
 login
!
!
!
!
end

Download SW-Access.txt

SW-Core SW-Core.txt, 1.8 KB 
Building configuration...

Current configuration : 1730 bytes
!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname SW-Core
!
enable secret 5 $1$mERr$q70rzGWFvn3ubJe9cZ91a1
!
!
!
ip ssh version 2
no ip domain-lookup
ip domain-name enterprise.local
!
username admin secret 5 $1$mERr$qvQ4xEW18PRaHS0uXVe8v.
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
interface FastEthernet0/1
!
interface FastEthernet0/2
!
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
!
interface GigabitEthernet0/1
 switchport trunk allowed vlan 10,99
 switchport mode trunk
!
interface GigabitEthernet0/2
 switchport trunk allowed vlan 10,99
 switchport mode trunk
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan99
 ip address 192.168.99.2 255.255.255.0
!
ip default-gateway 192.168.99.1
!
banner motd ^C Authorized Access Only - SW-Core Management Switch ^C
!
!
!
access-list 99 remark Permit Only Admin-PC
access-list 99 permit host 192.168.99.10
access-list 99 deny any
line con 0
 logging synchronous
 exec-timeout 15 0
!
line vty 0 4
 access-class 99 in
 login local
 transport input ssh
line vty 5 15
 login
!
!
!
!
end

Download SW-Core.txt

Verification guide

Device models, cabling, expected show output and negative tests for this lab: Verification Guide: PTL-0053 (Secure Management Network Design).

  • Network Security
  • Management Plane
  • SSH
  • VTY Hardening
  • Access Control Lists
  • Segmentation
  • Cisco IOS
  • Cisco Packet Tracer

This page is generated from labs/network-security/secure-management-network-design/README.md in the repository. Corrections go there.

Search

Type at least two letters, for example OSPF, DHCP relay or VLAN.