topic Simple SSH Access-List Question in Network Access Control

Simple SSH Access-List Question

Thomas Reiling — Mon, 11 Mar 2019 01:02:24 GMT

I am enabling SSH access for all of our Cisco devices and want to restrict access to just the following ip addresses: 192.168.200.1-192.168.200.50. I forgot the exact access-list configuration to accomplish this. The subnet is /24 and I don't want the whole subnet - just .1 - .50.

Thank you,

Thomas Reiling

Re: Simple SSH Access-List Question

bmcginn — Thu, 28 Apr 2011 22:24:53 GMT

Hi there,

If using ssh make sure you have a domain name, host name and a generated rsa key. Assuing you've done that, the the following ACL and line vty command will do the trick. Note that the 1-50 host list is not on a subnet barrier.

To get it exactly

access-list 1 remark ALLOW MANAGEMENT
access-list 1 permit 192.168.200.0 0.0.0.31

access-list 1 permit 192.168.200.32 0.0.0.15

access-list 1 permit 192.168.200.48 0.0.0.1

access-list 1 host 192.168.200.50

access-list 1 deny any log

It would be a good idea to put it on a boundary though, so the following would be much more simpler and easier to read.

access-list 1 remark ALLOW MANAGEMENT
access-list 1 permit 192.168.200.0 0.0.0.63

access-list 1 deny any log

Apply the access-class on the vty lines and depending on authentication, i'd put something there too.

line vty 0 4
access-class 1 in
transport input ssh

password blahblah

That ought to do it.

good luck!

Brad

Re: Simple SSH Access-List Question

Thomas Reiling — Thu, 28 Apr 2011 23:07:54 GMT

Thanks a lot!

Thomas

Re: Simple SSH Access-List Question

bmcginn — Fri, 29 Apr 2011 00:39:05 GMT

Thomas,

You're welcome.

Brad