Limit switch access (telnet, http)

[gbonivento]

Situation: c3750 Layer3 switch acting as router for my LAN, with several (more than 40) L3 virtual interfaces.

Target: I want to permit access to the switch only from some L3 interfaces (these with an @ip 10.255.x.x) and deny telnet/http request on other interfaces (with @ip 10.252.x.x). For telnet, I putted on the switch the following commands:

Switch(config)#access-list 101 permit ip any 10.255.0.0 0.0.255.255 log

Switch(config)#access-list 101 deny ip any any log

Switch(config-line)#access-class 101 in

Problem:

- telnet traffic is blocked on ALL interfaces

- if I try a telnet from a PC (10.255.10.100) to the switch (10.255.10.1) I see the following syslog message:

Aug 23 13:36:49: %SEC-6-IPACCESSLOGP: list 101 denied tcp 10.255.10.100(1709) -> 0.0.0.0(23), 1 packet

Why destination IP address is 0.0.0.0?

Second question: how can I activate the same filter on http access (ip http access-class accepts only standard access-lists, therefore I cannot check destination IP address)?

[mmorris11]

Giovanni,

You access list is producinging unintended results. You list actually says: "If you come from anywhere you can do ip to 10.255.0.0 0.0.255.255". What you probably want is the opposite. Standard access lists are most effective for restricting this type of access because it eliminates this confusion. You don't need extended lists to limit access to vty. The destination is irrelevant because the packet is not getting routed through. On this basis the standard list poses no limitation for your http access control. Standard lists are good for vty, http, snmp-server restrictions. As far as the 0.0.0.0 destination, I do not know why this was stripped out. Probably due to the fact that the packet is destined for the switch.

HTH

Pls rate if helpful!

[gbonivento]

Hi Mike,

thanks for your reply, but it doesn't help me. I try to explain my situation a little bit more in details:

- two routing domains on the same switch (vrf active)

- therefore the destination IP address where I initiate the telnet session is important. I want to deny telnet/http in one of these routing domains (the one with IP addressese 10.252.x.x)

Hope it's a little bit more clear ...

[Edison Ortiz]

The destination is shown as 0.0.0.0 because the line vty interface is unnumbered. As Mike mentioned, you can't include a destination IP on an access-class because the vty interface has no ip .

If you want to permit/deny traffic from some L3 interfaces, you need to apply the ACL on those interfaces, not the entire switch as intended with access-class.

Please rate helpful posts.

Thanks