We just setup a ftp server behind the Cisco router 831. We find that we can use SDM to access the router from any public IPs. Can we limit it to a range IPs? From the telnet command lines, I can't tell which is for managing accessing SDM. However, from SDM, there are two rules: SDM_DEFAULT_194 Extended permit HTTPS traffic and SDM_DEFAULT_195 Extended permit HTTP traffic, but can't edit them (see attached). Any suggestions?
no aaa new-model
ip subnet-zero
no ip source-route
ip tcp synwait-time 10
ip domain name cisco.com
ip name-server 4.2.2.1
ip dhcp excluded-address 172.16.5.1 172.16.5.5
!
ip dhcp pool sdm-pool1
network 172.16.5.0 255.255.255.0
default-router 172.16.5.1
!
no ip bootp server
ip cef
ip audit notify log
ip audit po max-events 100
ip ssh time-out 60
ip ssh authentication-retries 2
no ftp-server write-enable
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key 0 MS-mvps address x.x.x.197
crypto isakmp key 0 MS-mvps address 67.173.153.152
!
crypto ipsec transform-set SDM_TRANSFORMSET_1 esp-3des esp-sha-hmac
crypto ipsec transform-set SDM_TRANSFORMSET_2 esp-3des esp-sha-hmac
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
description Tunnel to x.x.x.197
set peer x.x.x.197
set transform-set SDM_TRANSFORMSET_1
match address 100
crypto map SDM_CMAP_1 2 ipsec-isakmp
description Tunnel to 67.173.153.152
set peer 67.173.153.152
set transform-set SDM_TRANSFORMSET_2
match address 103
!
interface Ethernet0
description $FW_INSIDE$$ETH-LAN$
ip address 172.16.5.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip route-cache flow
no cdp enable
!
interface Ethernet1
description $FW_OUTSIDE$$ETH-WAN$
ip address x.x.x.208 255.255.255.224
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip route-cache flow
duplex auto
no cdp enable
crypto map SDM_CMAP_1
!
ip nat inside source route-map SDM_RMAP_2 interface Ethernet1 overload
ip nat inside source static tcp 172.16.5.2 21 interface Ethernet1 21
ip nat inside source static tcp 172.16.5.2 1723 interface Ethernet1 1723
ip nat inside source static tcp 172.16.5.2 3389 interface Ethernet1 3389
ip classless
ip route 0.0.0.0 0.0.0.0 x.x.x.193 permanent
ip http server
ip http authentication local
ip http secure-server
!
logging trap debugging
logging 172.16.5.1
access-list 1 remark SDM_ACL Category=16
access-list 1 permit 172.16.5.0 0.0.0.255
access-list 10 permit 172.16.5.2
access-list 100 remark SDM_ACL Category=4
access-list 100 remark IPSec Rule
access-list 100 permit ip x.x.x.192 0.0.0.31 172.16.5.0 0.0.0.255
access-list 101 permit ip any any
access-list 102 remark SDM_ACL Category=2
access-list 102 remark IPSec Rule
access-list 102 deny ip 172.16.5.0 0.0.0.255 host 67.173.153.152
access-list 102 deny ip x.x.x.192 0.0.0.31 172.16.5.0 0.0.0.255
access-list 102 permit ip 172.16.5.0 0.0.0.255 any
access-list 103 remark SDM_ACL Category=4
access-list 103 remark IPSec Rule
access-list 103 permit ip 172.16.5.0 0.0.0.255 host 67.173.153.152
no cdp run
route-map SDM_RMAP_1 permit 1
match ip address 120
!
route-map SDM_RMAP_2 permit 1
match ip address 102
!
banner login ^CCCAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
login local
no modem enable
transport output telnet
line aux 0
login local
transport output telnet
line vty 0 4
privilege level 15
login local
