ssh refused when assigning vrf forwarding to vlan interface

[Sueco]

hey,

I have a pair of 9500 running stackwise working fine but when i assigned the vlan interface to a vrf it starts to refuse my SSH attempt.

When i remove the ACL from the vty it works again. I have tried both standard and extendet ACLs but with same results.

Since its the XE version i cant use commands like "ssh server vrf X".

Anyone with experience about this problem and knows how to solve the configuration? 

[balaji.bandi · Accepted solution]

Hope this is SSH coming in using VRF aware right, not going out using VRF ?

how does your configuration looks like on the device.

check VRF aware config for reference :

https://www.cisco.com/c/en/us/support/docs/ip/telnet/200718-Configure-Telnet-SSH-Access-to-Device-wi.html

[Joshqun Ismayilov]

@Sueco 

Could you associate the vty lines with the same VRF as your VLAN interface to ensure SSH sessions are handled within the correct routing context?

#line vty 0 4
#vrf forwarding MY_VRF ! Replace MY_VRF with your VRF name
#access-class SSH-ACL in ! Apply your ACL here
#transport input ssh

Thanks!

[EminaBrkanic · Accepted solution]

Under line vty and access-class cmd, add vrf-also keyword. 

access-class acl_name in vrf-also

regards

[Richard Burts]

It is not central to the main question in the OP. But I will respond to this part of it: " I have tried both standard and extendet ACL".  When configuring access controls using access-class for the vty, there is little advantage in using extended acl. Extended acl allows you to specify destination address, mask, and protocol. But when applied in access-class the destination address and mask must be any any, and access-class already processes any valid access protocol. So you are better off to just use standard acl for access-class.

[Sueco]

Thanks for all good input and advises! 

As @balaji.bandi and @EminaBrkanic mentioned the solution for me was to add the vrf-also command after the vty access-list.