Access list to limit SSL to management Interfaces

[swinney23]

I've not had much experience with access lists and from what I've researched you can screw things up rapidly if not done correctly. Which is why i'm here.

I've been charged with creating an access to deny SSL to management ports for everything except a small list of IP's.

An example would be great but any help with links to the proper documentation would be awesome as well.

Thanks in advance for the help

[Seb Rupik]

Hi there,

What you need is an ACL applied to your VTY lines, which permits traffic only from hosts in your management subnet. Something like:

!
access-list 10 permit <mgmt_subnet_id> <netmask>
!
line vty 0 15
  access-class 10 in
  transport input ssh
  transport output ssh
!

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/12-4t/sec-data-acl-12-4t-book/sec-cntrl-acc-vtl.html#GUID-FB4108B9-4435-43D2-83FC-9E9FB75F079F

cheers,

Seb.

[user1024]

By SSL do you mean you have the http server enabled on the router and you want to limit access via http? If so, you will need ip http access-class <access-list-number>