This is a “grey” area…the official statement from Cisco is that you are only allowed to run Cisco IOS on Cisco hardware, not on emulators. They kinda turn a blind eye to GNS3/dynamips though.
I guess the closest thing to make it “legal” is to buy the hardware, grab the IOS image from it and run it in GNS3. There’s only two problems:
- Most used hardware is used for labs so there's a big chance it doesn't come up with the original IOS image. Most people download the latest advanced enterprise IOS image they can find and put it on their flashcards.
- Not all IOS images work well in GNS3.
Personally I use Cisco’s VIRL nowadays. It’s legal, has support for IOS, L2 IOS, IOS XE/XR and the ASA.