1.6.2 Lab - Configure Basic Router Settings

You're staring at a fresh router prompt. Even so, Router> blinks back at you, patient and empty. Also, no interfaces up. No passwords. But no hostname. Just factory defaults and a whole lot of potential Worth keeping that in mind..

If you're working through the 1.m. 2 lab — configure basic router settings — you're not just checking boxes on a grading rubric. Skip the fundamentals here, and you'll pay for it later. Day to day, you're building the foundation every network engineer relies on, whether they're managing a branch office or a global backbone. Even so, 6. Usually at 2 a.when something breaks.

Let's walk through what actually matters, why the steps exist, and where people trip up Not complicated — just consistent..

What Is the 1.6.2 Lab

This lab shows up in Cisco's CCNA curriculum, typically under the "Introduction to Networks" or "Routing and Switching Essentials" modules. The exact numbering varies by version, but the content is consistent: take a router from out-of-the-box state to a minimally secure, manageable, and documented configuration.

You'll configure:

• A hostname
• Privileged access security (enable secret)
• Console and VTY line passwords
• A message-of-the-day banner
• Basic interface addressing
• The configuration register (sometimes)
• And critically — saving the config so it survives a reload

It's not flashy. No routing protocols. No ACLs. No VLANs. But every single production router you'll ever touch starts here Not complicated — just consistent..

Why This Lab Exists

Cisco includes it because bad habits form fast. Students who skip the banner, reuse weak passwords, or forget copy run start carry those habits into real gear. The lab forces repetition until the basics become muscle memory.

Why It Matters / Why People Care

You might wonder: Does the hostname really matter? Can't I just use IP addresses to identify devices?

Technically, yes. Practically, no.

Imagine troubleshooting a network with twelve routers all named Router. In practice, your show cdp neighbors output becomes useless. Still, your monitoring tool shows twelve identical devices. Now, your logs are meaningless. You'll waste hours correlating timestamps and interfaces just to figure out which box is which.

At its core, where a lot of people lose the thread.

Same with passwords. A router with no enable secret is a router anyone with physical access can own in thirty seconds. No VTY password? That's remote access wide open. That's why no banner? You've lost legal standing to prosecute unauthorized access in many jurisdictions.

These aren't academic exercises. They're operational hygiene.

The Real-World Stakes

• Change management: A proper hostname and banner make audit trails readable.
• Security compliance: PCI-DSS, HIPAA, NIST — all require unique device identification and access control.
• Troubleshooting speed: When show ip interface brief shows Gig0/0 up with an IP, you know which router you're on instantly.
• Disaster recovery: Saved configs mean a replacement router becomes productive in minutes, not hours.

How It Works (Step by Step)

Let's break down each task. I'll assume you're in a Packet Tracer, physical lab, or CML environment with a single router and console access.

1. Enter Privileged EXEC Mode

Router> enable
Router#

No password yet — that's the point. You're in privileged mode (also called enable mode) where configuration happens.

2. Enter Global Configuration Mode

Router# configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#

The prompt changes. You're now modifying the running configuration — the active config in RAM. Nothing is saved to NVRAM yet.

3. Set the Hostname

Router(config)# hostname R1
R1(config)#

Immediate feedback. The prompt updates. Pick a naming convention and stick to it: R1, NYC-CORE-01, BRANCH-ATL-RTR. Now, consistency scales. Chaos doesn't.

Pro tip: Avoid spaces, special characters, or overly cute names. Router-Main-Floor-3 looks fine until you're scripting against it with Ansible.

4. Secure Privileged Access

R1(config)# enable secret class
R1(config)#

enable secret uses a salted MD5 hash (type 5) or SHA-256 (type 8/9 on newer IOS). Never use enable password — it stores a reversible weak hash (type 7) or plaintext. enable secret overrides enable password if both exist.

Common mistake: Typing enable password class instead. You've just set a useless password. Verify with show run | include enable.

5. Secure Console Access

R1(config)# line console 0
R1(config-line)# password cisco
R1(config-line)# login
R1(config-line)# exit
R1(config)#

line console 0 targets the physical console port. login tells the router to actually prompt for the password. Without login, the password exists but isn't enforced.

Real talk: In production, you'd use AAA with TACACS+ or RADIUS. Local passwords are a fallback. But for this lab, local is what's tested.

6. Secure Remote Access (VTY Lines)

R1(config)# line vty 0 4
R1(config-line)# password cisco
R1(config-line)# login
R1(config-line)# transport input ssh
R1(config-line)# exit
R1(config)#

VTY 0–4 covers five simultaneous Telnet/SSH sessions. So telnet sends credentials in cleartext. Still, transport input ssh disables Telnet — critical. If your IOS supports it, transport input ssh is non-negotiable The details matter here. Turns out it matters..

Heads up: Some older IOS versions default to transport input telnet ssh. Explicitly setting SSH only is safer Which is the point..

7. Configure the MOTD Banner

R1(config)# banner motd $ Authorized Access Only! $
R1(config)#

The delimiter ($ here) can be any character not in the message. In practice, the banner displays before the login prompt. Legal teams love this. It establishes "no expectation of privacy" and "authorized use only" — helpful if you ever need to involve law enforcement.

Don't write "Welcome to R1.And " That's not a warning. Write something that holds up in court.

8. Configure Interfaces

This varies by topology. Typical lab setup:

R1(config)# interface gigabitethernet 0/0
R1(config-if)# ip address 192.168.1.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# description Link to Switch1
R1(config-if)# exit
R1(config)#

Key points:

• no shutdown brings the interface up (administratively). Without it, the interface stays administratively down.
• description isn't required but saves your sanity later. show interface description becomes a map. Because of that, - IPv6? Add ipv6 address 2001:db8:1::1/64 and ipv6 enable if the lab asks.

9. Save the Configuration

R1(config)# end
R1# copy running-config startup-config
Destination filename [startup-config]? 
Building configuration...
[OK]
R1#

end (or Ctrl+Z) exits to privileged EXEC. copy running-config startup-config

is the gold standard. If you reboot the router without this step, every command you just typed vanishes into the ether.

Pro-tip: You can use the shorthand wr (write memory) to achieve the same result. It’s faster, but copy run start is the technically correct, full-command version.

Summary Checklist

Before you finish your lab, run through this quick mental checklist to ensure your device is actually secure:

1. Is the secret set? (show running-config | include enable secret)
2. Is the console protected? (show running-config | include line con 0)
3. Are VTY lines restricted to SSH? (show running-config | include transport input)
4. Is there a legal banner? (show running-config | include banner motd)
5. Is the config saved? (show startup-config)

Conclusion

Securing a Cisco device is a layered process. You start with the most powerful access level (Privileged EXEC), move to physical access (Console), secure the network access (VTY), and finally, establish the legal boundaries (Banner).

While these steps represent the foundational "bread and butter" of network administration, remember that real-world security is much deeper. In practice, once you master these basics, your next steps should be learning AAA (Authentication, Authorization, and Accounting), implementing ACLs (Access Control Lists), and hardening the management plane against more sophisticated attacks. For now, however, you have successfully transformed a wide-open device into a secured, functional node in your network Worth keeping that in mind..