Cisco 9200 as WAN Switch - ACL and VRF

[chipobhoem]

Quick question and best approach to this. We use Cisco Catalyst 9200 as WAN switch with internal Management connection (on MGMT port of course lol). We plan to use ACL for external and internal SSH access only. Should we have two separate ACL (one for external access and another for internal VRF access) or just use one ACL for both and include "also VRF" on the vty SSH access-list configuration? What is everyone school of thought. Thanks.

[MHM Cisco World]

I dont think you can add more than one Access-list (without vrf aware) under the vty 
so you can add one ACL for user in vrf mgmt to access SW internally 

Line vty 0 4
Access-class acl-1 in vrfname mgmt

and for external use the ACL in interface. 
MHM 

[liviu.gheorghe]

I would go with two access lists. one for the GRT and one for VRF:

line vty 0 4
access-class acl-2 in
access-class acl-1 in vrfname mgmt