C3750 management interface

[jmprats]

By default you can manage the switch using the ip address of any vlan interface defined in the switch. How can i canfigure a single management interface?

Thanks

[Jonathancert_2]

If you are referring to remote or out of band management, placing the applicable interface in a VRF should suffice.   There are probably more options but this my first thought.  Not sure if an ACL on the line vty's would fit your need.

Jonathan,

[Latchum Naidu]

Hi,

I would request you to put a standard access-list like below and apply to the line vty so that you can access the switch only from the permit IP's.

access-list 23 permit 10.10.10.1
access-list 23 permit 10.10.10.100
access-list 23 permit 10.10.20.59

line vty 0 4
access-class 23 in
transport input ssh

Please rate the helpfull posts.
Regards,
Naidu.

[cadet alain]

Hi,

just configure this:

int vlan x

ip address x.x.x.x

then verify it is up/up with sh ip int br | i Vlan

if you are accessing the switch from a different subnet and your switch is doing L2 only then configure a default-gateway:

ip default-gateway x.x.x.x

if it is doing L3 then  you must have a route to this subnet: verify with sh ip route

Regards.

Alain.

[jmprats]

Yes, I know I can put an access-list in the vty. But with that I can only filter the source IP (not destination IP in the router). So those IPs can connect to every L3 interface in the switch to manage it.

I want to say to the router which is his management interface and in which vlan it is. It sounds unbelievable
cisco don't allow to do that.

You can change your ip, but you can't change the vlan you are in. So i think is not secure enough to filter with source ip

Thanks

[cadet alain]

Hi,

why don't you configure radius authentication on the vty lines this way only people having the correct credentials will be able to login.

Yes, I know I can put an access-list in the vty. But with that I can  only filter the source IP (not destination IP in the router). So those  IPs can connect to every L3 interface in the switch to manage it.

those IPs will be src IPs not destinations?  I don't understand what you mean?

Regards.

Alain.

[chucktranhpb]

You can apply ACL's to each SVI to deny telnet and SSH. It could be a pain if you have a lot but it will accomplish your goal.