ip ssh source-interface command N9K

[jenas85921]

Dear All,

I need help to restrict SSH access to my Nexus device only through the mgmt0 port.

I don't use tacacs and I don't find thée "ip ssh source-interface" command on the device.

Any idea, please ?

[Mark Malone]

Hey

ye its not on some 7ks and 5ks as well not sure why the 3ks have it , but what you can do is lock it to an acl on the vty port so only certain users subnets etc can access , the same below can be done for the mgmt0 interface

From bets practice 7k below same problem no source there the options they give

http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/best_practices/cli_mgmt_guide/cli_mgmt_bp/connect.html

..............................

An access class should be applied to the VTY port to increase security by restricting SSH and Telnet access to specific source and destination IP addresses. An access class configured on the VTY port is applicable when using an in-band or out-of-band management strategy. An access-class is configured per traffic direction, in applies to inbound sessions and out applies to outbound sessions.

Statistics can be enabled with the access list statistics per-entry. The following example illustrates a basic policy that permits SSH traffic from a specific subnet to all IP addresses configured in the current VDC. All traffic is permitted if an access-class is applied to the VTY port and the associated access-list is deleted from the configuration.

n7000(config)# ip access-list vty-acl-in

n7000(config-acl)# permit tcp x.x.x.x/24 any eq 22

n7000(config)# line vty

n7000(config-line)# ip access-class vty-acl-in in

[jenas85921]

Thank you Mark Malone.

But I just want authorize the mgtm0 IP interface without filter source address.

So, I think the below configuration is better :

ip access-list vty-acl-in
permit tcp any x.x.x.x/32 eq 22

line vty
ip access-class vty-acl-in in

What do you think about ?

[Mark Malone · Accepted solution]

Hey Yes whatever way works for you thats just an example above from the doc as an alternative, but if you are using the physical mgmt port i would apply it there too

[jenas85921]

Ok. Thank you Mark Malone