Access list Allow IP

[hilldamanik]

Dear All Please help me..

how when I only want to allow/permit IP Address xx.xx.xx.xx / 28 (Public IP) on Router
and block all IPs coming from the internet by blocking ssh and telnet?

Please help and thanks

[barnesp]

ip access extended ACL-INTERNET-IN
 deny tcp any x.x.x.x 0.0.0.15 eq 22 23
 permit ip any any

Apply the ACL inbound on your Internet facing interface e.g.

int g0
 ip access-group ACL-INTERNET-IN in

[hilldamanik]

Dear barnesp,

Thank you for the answer.
but I mean I want to block all IP addresses from the internet. and only allow ip ie:11.11.11.16/28

who can access from outside(internet).

Thank's

[barnesp]

Try this

ip access extended ACL-INTERNET-IN
 permit tcp 11.11.11.16 0.0.0.15 host <OUTSIDE-INTERFACE-ADDRESS> eq 22 23
 deny tcp any any eq 22 23
 permit ip any any

First line allows you to manage the router.

Second line denies all other telnet or SSH.

Third line permits all other Internet traffic.

BTW - you should only use SSH as telnet more vunerable to MiM attacks.

[hilldamanik]

Dear barnesp,

Thank you for the help, I will try first.

Thank's

[Masoud Pourshabanian]

If you are going to limit telnet or SSH to the router, this is easier.

access-list 10 permit 11.11.11.16 0.0.0.15  (put your IP instead)
access-list 10 deny  any log

line vty 0 4
 access-class 10 in

If you are going to limit telnet or ssh to your LAN, use barnesp configuration with a little change. You may deny other services using ssh if you use deny deny.

permit tcp 11.11.11.16 0.0.0.15 host <hosts inside your network you want to limit> eq 22 23
deny tcp any <hosts inside your network> eq 22 23
permit ip any any

Masoud

[hilldamanik]

Dear Masoud

I've managed to apply. Thank's very much..

[Ganesh Hariharan]

Dear All Please help me..
how when I only want to allow/permit IP Address xx.xx.xx.xx / 28 (Public IP) on Router
and block all IPs coming from the internet by blocking ssh and telnet?
Please help and thanks

Hello,

If you want to only block SSH and Telnet then better to use simpler way by allowing the required ip for giving access to devices over SSH or Telnet, And apply the acl to line vty by calling access-class.

Ex:- access-list 10 permit 11.11.11.16 0.0.0.15

Implicit deny is always there in acls..

and call this ACL under access class.

switch(config)# line vty 0 15
switch(config-line)# access-class 10 in
switch(config-line)# exit

Hope it Helps..

[hilldamanik]

Dear Ganesh,

I've managed to apply. Thank's very much..