Restrict VTY - SSH access to a specific IP

[chrissnop]

Hello guys, how to restrict VTY access to a specific IP?

For example:

- Allow access from the private or local network

- Allow access from a specific Public IP

Is this doable?

I'm following this link: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configurat...

But I can only do from the command below:

Router(config)# access-list 1 permit 172.16.0.0 0.0.255.255
Router(config)# line vty 5 10

Is the above command sufficient enough to restrict vty access?

Thanks for any help. :)

[Jonathan Unger]

Hi There,

You are almost all of the way there. You have already have your access list, now you just need to apply it to the VTY lines with the following commands (as listed in the link you posted in this section).

line vty 015

access-class 1 in

The "access-class 1 in" command links your access list to the ACL you created earlier.

I would recommend configuring all of the VTY lines (0 to 15) with one command so they are all consistent.

You can add a specific public IP address to your access list with the following command:

access-list 1 permit host x.x.x.x

Does that answer your question?

[chrissnop]

So it will be something like this:

Router(config)#access-class 1 in

Router(config)#line vty 0 15

Router(config)#access-list 1 permit 172.16.0.0 0.0.255.255

Router(config)#access-list 1 deny any

Do I need to set the deny? or no need? I don't want other IPs to connect.

Thank you. 

[Jonathan Unger · Accepted solution]

Hi Chris,

Make sure to enter the vty line config mode (line vty 015) before applying the access-class command.

Here is an example of the whole thing put together (access-list and vty line config).

router1(config)#access-list 1 permit 172.16.0.0 0.0.255.255
router1(config)#line vty 0 15
router1(config-line)#access-class 1 in

There is an implicit deny at the end of every ACL so there is no need to manually set a deny entry (although it won't break anything if you do add a deny entry at the end).

[chrissnop]

Hi Jonathan, thank you.

I will try it out and update this post.

[ddesai]

thanks but following command does not work

access-list 110 deny tcp PUBLIC IP host switch ip eq 22