Hi,
I have a Cisco ASR 1001-X router running on IOS-XE version 3.16.02.S with Advanced Enterprise license. The platform has multiple BGP connections with hundreds of VLAN interfaces. I would like to restrict SSH and SNMP access on all the interfaces except one.
I have tried to achieve this using control plane policing but its not working as expected and following is the configuration. Also the individual drop command is not found under the policy map class.
I tried VTY acl for SSH but thats not working as well.
ACL on edge interfaces is not an appropriate option in such situation as it blocks those specific ports on all downstream hosts and ACL on all the interfaces is a tedious task.
Any help will be greatly appreciated.
Thank you
ip access-list extended SSH
permit tcp any host 98.1.1.2 eq ssh
ip access-list extended SNMP
permit udp any host 98.1.1.2 eq snmp
class-map match-any SSH
match access-group name SSH
class-map match-any SNMP
match access-group name SNMP
policy-map COPP
class SSH
police cir 32000 bc 1500 be 1500 conform-action drop exceed-action drop violate-action drop
class SNMP
police cir 32000 bc 1500 be 1500 conform-action drop exceed-action drop violate-action drop
control-plane
service-policy input COPP
