SSH Refused: VTY Transport, RSA Keys and Local Login
A router that pings perfectly and refuses every SSH connection, for three separate reasons. Build the prerequisites in order yourself, live, right below.
Symptom
The router answers ping and refuses every SSH connection. Nothing is wrong with the network path, and three separate things are wrong with the management plane.
Your mission
Prove the cause, then fix it
Format
Guided CLI investigation
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: R1
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
An engineer cannot SSH to R1. The router answers ping, its interface is up, and there is no ACL or firewall in the path. Console access still works, which is the only reason anyone can get in at all.
What you'll practice
- Separate a management-plane failure from a reachability problem
- Read the SSH server state with show ip ssh
- Generate an RSA key pair, and know its hostname and domain-name prerequisites
- Set the vty transport and authentication so SSH can actually log in
1. Ping proves nothing about SSH
ICMP and the SSH server live in completely different parts of the device. A router can be perfectly reachable and still refuse every management connection. You will learn to stop re-testing the path once it is proven and move to the management plane instead.
2. SSH Disabled means no key, not no config
show ip ssh reports the SSH server as disabled until an RSA key pair exists, regardless of what the vty lines say. That single line tells you which half of the problem you are looking at, and it is the first thing to check.
3. The dependency order that trips people up
The key pair is named after the hostname and domain name, so IOS refuses to generate one until both exist. You will hit that rejection deliberately and learn to read it as a prerequisite rather than a failure.
The topology
A single router, R1, reachable at 10.10.10.1 with an engineer's workstation on the same segment. Console access is available throughout.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show ip interface briefshow ip sshshow running-config | section line vtyTopology diagram
Frequently asked
Why does show ip ssh say SSH Disabled when I have configured the vty lines?
Because the vty lines and the SSH server are separate things. The lines control which protocols are accepted on an incoming connection; the server has to exist before there is anything to accept it. IOS starts the SSH server only once an RSA key pair is present, so show ip ssh reports Disabled until you generate one no matter how the lines are configured.
Why does crypto key generate rsa fail with % Please define a domain-name first?
The key pair is labelled with the fully qualified name of the device, hostname plus domain name, so IOS cannot create one until both are set. It is a prerequisite rather than an error in what you typed. Set ip domain-name and run the command again.
Does transport input ssh remove telnet?
Yes. The command replaces the list of accepted protocols rather than adding to it, so transport input ssh means SSH only. That is what you want on a management interface, because telnet carries credentials in clear text. If you genuinely need both during a migration, transport input ssh telnet accepts either, but treat it as temporary.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.