Shaqxify
The suggestion from @balaji.bandi for option 2 looks logical but unfortunately it will not work as you want. When using access-class the normal practice is to use standard access list, which identifies the originating device IP address. When you use an extended access list for access-class inbound it ignores the destination address that you have specified (treats is as any). So you would not be able to limit access attempts to only the one interface address using access-class with extended access list..
The first part of your requirement is easy - you can limit access to the 2 source addresses using access-class on the vty which would use a standard access list, as was suggested in previous responses. The second part where you want to control which address is used for access is not easy. We do not know what model of switch or what version of code you are running so we are not sure which alternatives you could use.
1) Perhaps something like Control Plane Policing could be used to control remote access in a way that achieves both of your requirements.
2) Use an extended access list specifying both the source address and destination address for SSH. The logic might be something like this:
- You would need entries to permit each of the source addresses to the single destination address that you want.
- You would then need entries to deny any source to each of the L3 interface addresses on the switch for SSH.
- These parts of the access list would need to be applied to every L3 interface on the switch. If a L3 interface already has an inbound access list applied then this logic needs to be added to the existing acl and preferably would be the very first statements in the acl (you want to be sure that existing acl entries would not permit the access that you are trying to deny).
If a L3 interface does not already have an inbound access list applied then you need to create an access list with this logic and then a permit any for all other traffic.
HTH
Rick
