Even with SSH and strong passwords, anybody who can reach the router can try to log in. A standard ACL applied to the vty lines with access-class decides which source addresses may even open a session. Other connections are refused before a login prompt appears.
| Command | Where | Does |
|---|---|---|
access-list 10 permit host 10.1.1.10 | Global | The admin PC (and the implicit deny drops the rest) |
access-class 10 in | line vty 0 4 | Only sources permitted by ACL 10 may connect |
In NetLab
▶ R1 R1>enable R1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)#access-list 10 permit host 10.1.1.10 R1(config)#line vty 0 4 R1(config-line)#access-class 10 in R1(config-line)#end *Mar 1 00:00:06.000: %SYS-5-CONFIG_I: Configured from console by console ▶ PC2 student@PC2:~$ ssh admin@10.1.1.1 ssh: connect to host 10.1.1.1 port 22: Connection refused ▶ ADMIN NetLab Windows-style command prompt. Type help to see the commands. C:\Users\student>ssh -l admin 10.1.1.1 Warning: Permanently added '10.1.1.1' (RSA) to the list of known hosts. admin@10.1.1.1's password: R1#exit Connection to 10.1.1.1 closed. ▶ R1 R1#show access-lists 10 Standard IP access list 10 10 permit 10.1.1.10 (1 match)
Common mistake:
ip access-groupon an interface filters traffic through the router on that interface.access-classon the vty lines filters only sessions to the router, from any interface. For management access, access-class is the right tool.
Tip: An access-class with a typo in the ACL number (an ACL that doesn't exist) permits everybody. Check with
show access-lists.