ACL Question

[dcanady55]

Hello,

I have a router with an interface pointed outside. My goal is to put an ACL in place that blocks all SSH traffic except SSH coming from inside the network. Here is what I came up with. I would then apply this to the VTY lines coming IN. Would this be appropriate for what I'm trying to do or is there a better way?

Thanks for any feedback.

It would be an extended ACL 

permit tcp 10.43.0.0 0.0.255.255 host 69.X.X.X eq 22

deny ip any host 69.X.X.X eq 22

permit ip any any

[asbesi001]

Apply an 'access-group', allowing only your LAN, on the vty line ...

-Brj

[Yandy Ramirez]

A standard access-list would suffice for VTY access-class. There's no need to go overboard with extended ACLs matching protocols.

ip access-list standard vty-in

 permit 10.43.0.0 0.0.255.255

deny any log

!

line vty 0 4 (or last line, that may differ)

 transport input ssh

 access-class vty-in in vrf-also <-- vrf-also is optional, but suggested to have OOB managment