deny traffic by vrf - acl?

[Nicholas Richardson]

Hello,

I have a service provider network with multiple public vrfs and some private vpns also.  We liked the design of this it seemed to keep the public routing completely separate from the core routing.  However it seems there is an awkward do to shut, as if we set a public addressed sub-interface for a customer ssh access is available.  We want to keep ssh access around out network, so have filtered out who can access using acl on the vty, say to 10.x.x.x

However we also have some private vpns, so I could quite easily set 10.x.x.x addressing which would allow people to attempt ssh access.

So basically, what is the best way to completely drop all telnet/ssh access to sub-interfaces on a per vrf basis, i.e. if you are in this vrf, regardless of IP, you cannot ever see telnet/ssh ports filtered/closed or otherwise?

Many thanks

Nicholas

[Vaibhava Varma]

Hi Nicholas

If we want to restrict telnet/ssh access on per VRF Sub-Interface basis then we can use an extended access list denying telnet/ssh access on that Sub-Interafce..

E.G)

R1#show access-lists

Extended IP access list 101

    10 deny tcp any any eq telnet (2 matches)

R1#

Hope this provides some insight into your query.

Regards

Varma

[Nicholas Richardson]

Hello,

Many thanks for the reply.  Unfortunately this will restrict telnet through the interface - we want to allow our customers to use any application through our router.  So we can do:

10 deny tcp any 10.x.x.x eq telnet

20 permit ip any any

And apply this to the interface.  However if we give a customer a couple of private vpn to route between, we need a sub-interface which could overlap with this address, so be of security interest, and also presumably is open to spoofing.

What I am looking for, if it exists, is to completely disable telnet/ssh services on an interface, not necessarily by ip access list.

Many thanks

nicholas

[Ivan Krimmel · Accepted solution]

Hi Nicholas,

there're two more options to consider:

1. CoPP/MPP - Management Plane Policing

2. QoS

using the first one, you could restrict access globally, the second one could give you an option to restrict access on a per-(sub)interface basis.

HTH,

Ivan.

[Nicholas Richardson]

Thanks MPP is exactly what I am after!!

Nicholas

[Ivan Krimmel]

Hey Nicholas,

I am happy to help! :)

Cheers,

Ivan.