Simple SSH Access-List Question

[Thomas Reiling]

I am enabling SSH access for all of our Cisco devices and want to restrict access to just the following ip addresses: 192.168.200.1-192.168.200.50.  I forgot the exact access-list configuration to accomplish this.  The subnet is /24 and I don't want the whole subnet - just .1 - .50.

Thank you,

Thomas Reiling

[bmcginn · Accepted solution]

Hi there,

If using ssh make sure you have a domain name, host name and a generated rsa key.  Assuing you've done that, the the following ACL and line vty command will do the trick.  Note that the 1-50 host list is not on a subnet barrier.

To get it exactly

access-list 1 remark ALLOW MANAGEMENT
access-list 1 permit 192.168.200.0 0.0.0.31

access-list 1 permit 192.168.200.32 0.0.0.15

access-list 1 permit 192.168.200.48 0.0.0.1

access-list 1 host 192.168.200.50

access-list 1 deny any log

It would be a good idea to put it on a boundary though, so the following would be much more simpler and easier to read.

access-list 1 remark ALLOW MANAGEMENT
access-list 1 permit 192.168.200.0 0.0.0.63

access-list 1 deny   any log

Apply the access-class on the vty lines and depending on authentication, i'd put something there too.

line vty 0 4
access-class 1 in
transport input ssh

password blahblah

That ought to do it.

good luck!

Brad

[Thomas Reiling]

Thanks a lot!

Thomas

[bmcginn]

Thomas,

You're welcome.

Brad