October 14, 2026
Telnet and SSH Access Control Lab
Goal: Block Telnet from R1 to R2 and allow SSH. Allow both Telnet and SSH from R2 to R1. The routers connect through a switch.
By Oluwalana Oyewole
1 min read
Example values: R1 = 192.168.12.1, R2 = 192.168.12.2, and R2's switch-facing interface = GigabitEthernet0/0. Replace these with your actual values. Both switch ports should be in the same VLAN for this lab.
1 Configure remote access on both routers
Use the console. Run this on both routers, changing hostname R1 to hostname R2 on R2. Replace YOUR_PASSWORD with your login password. Skip RSA key generation if suitable keys already exist.
configure terminal hostname R1 ip domain-name lab.local username labadmin privilege 15 secret YOUR_PASSWORD crypto key generate rsa modulus 2048 ip ssh version 2 line vty 0 4 login local transport input telnet ssh end
login local uses the local username and password. privilege 15 takes the user directly to the # prompt without an enable password. Apply the VTY settings to any other VTY lines you use.
2 Block Telnet from R1 on R2
Use an extended ACL because it can match TCP ports. A prefix list cannot distinguish Telnet from SSH.
configure terminal ip access-list extended R1-TO-R2 10 deny tcp host 192.168.12.1 host 192.168.12.2 eq 23 20 permit tcp host 192.168.12.1 host 192.168.12.2 eq 22 30 permit ip any any exit interface GigabitEthernet0/0 ip access-group R1-TO-R2 in end
Port 23 is Telnet; port 22 is SSH. The ACL checks packets entering R2. The final permit allows other traffic, including replies when R2 starts a session to R1. Keep both transports enabled on the VTY lines so the ACL controls the Telnet block.
I did all of this on the new sandbox launched by https://pingmynetwork.com/dashboard