I have a switch outside our firewall open to the Internet. It is a newer 3650 switch. I have an ACL assigned to the vty interface that should restrict management traffic to it. I found it went into quiet mode because someone was doing a dictionary attack against it. They attackers were using http authentication built into the switch for management to launch the attack. I had to turn off http and https server to block them. My question is why was the ACL not blocking this dictionary attack?
BTW, some other vendors work differently. One that comes to mine, you apply an ACL to the loopback interface, and it controls what goes to the device's management.
