VTY Access Class: Locked Out of Management
Management access to the router is refused from the admin subnet. Diagnose the vty policy and fix it yourself, live, right below.
Symptom
The router is reachable, but every management session is refused. Trace both VTY admission controls and restore SSH from the correct subnet.
Your mission
Prove the cause, then fix it
Format
Guided CLI investigation
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: R1
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
An administrator on 10.0.99.0/24 can ping R1 but every SSH session is refused. The VTY lines have an access-class and an explicit transport policy left from an older management design.
What you'll practice
- Read VTY line configuration and identify referenced ACLs
- Explain access-class as a management-plane source control
- Evaluate a standard ACL wildcard against the administrator subnet
- Distinguish source admission from protocol admission
- Restore SSH without reopening Telnet
The topology
A management workstation in 10.0.99.0/24 reaches one router over an otherwise healthy routed path. The fault is entirely in the router's VTY admission policy.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show running-config | section line vtyshow access-listsTopology diagram
Frequently asked
Why does ping work while SSH is refused?
Ping proves routed IP reachability to an interface. The VTY access-class and transport input commands are separate management-plane controls evaluated only when a remote terminal session arrives.
Why are there two fixes?
The stale ACL rejects the administrator's source and transport input telnet rejects the SSH protocol. Either condition alone is enough to block the session.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.