Hello,
I have a service provider network with multiple public vrfs and some private vpns also. We liked the design of this it seemed to keep the public routing completely separate from the core routing. However it seems there is an awkward do to shut, as if we set a public addressed sub-interface for a customer ssh access is available. We want to keep ssh access around out network, so have filtered out who can access using acl on the vty, say to 10.x.x.x
However we also have some private vpns, so I could quite easily set 10.x.x.x addressing which would allow people to attempt ssh access.
So basically, what is the best way to completely drop all telnet/ssh access to sub-interfaces on a per vrf basis, i.e. if you are in this vrf, regardless of IP, you cannot ever see telnet/ssh ports filtered/closed or otherwise?
Many thanks
Nicholas
