Configure Telnet

[MikeTomasko]

What is the simpliest way to allow telnet access from the local network, but block telnet from the outside? I have a 2621XM with 2 Fast Ethernet ports. One is hooked to a cable modem and the other is hooked to the LAN (a switch). Thanks!!

[Richard Burts]

Mike

If you want to restrict telnet access so that only devices on the local subnet can telnet to the router then the most simple way to do it is with access-class applied to the vty lines.

Instead of using an access list on interfaces and looking for telnet packets the access-class is applied on the vty lines and is used specifically to control who can telent to (or from) the router. Access class usually is done with standard access lists though it can also be configured with extended access lists. If your local subnet were 172.16.22.0/24 then the implementation would look like this:

access-list 50 permit 172.16.22.0 0.0.0.255

line vty 0 4

access-class 50 in

HTH

Rick

[MikeTomasko]

Thanks for the quick response! I have 3 local subnets. 192.168.0.0/24, 192.168.1.0/24 and 172.16.1.0/24. Would I just need 3 of the accss-list 50 permit statments or can I cover 192.168.0.0 and 192.168.1.0 with 1 statement?

Also, could you explain why it's 0.0.0.255 instead of 255.255.255.0 in the command? thanks!

[sundar.palaniappan · Accepted solution]

You can cover 192.168.0.0/24 & 192.168.1.0/24 with 1 statement. You need another statment to permit 172.16.1.0/24 and thus it can be done in two statements as follows.

Access lists uses wild card mask, opposite of subnet mask, and that's the reason why Rick was asking you to use a mask of 0.0.0.255 instead of 255.255.255.0. An IP and wildcard mask of 172.16.22.0 0.0.0.255 indicates all the bits in the first 3 octets needs to match precisely and it doesn't care about any bits in the last octet. Hence, 172.16.22.0 - 172.16.22.255 match this criteria.

The following config is what you need:

access-list 10 permit 192.168.0.0 0.0.1.255

access-list 10 permit 172.16.1.0 0.0.0.255

line vty 0 4

access-class 10 in

HTH

Sundar

[Richard Burts]

Mike

Sundar gives a correct explanation about subnet masks and wildcard masks. He also shows how to combine two subnets into one statement.

One other note: check your router and verify how many vty lines there are. My example (and Sundar's example) assumed the traditional vty 0 4. But some of the newer versions of IOS have increased the number of vty. Many of the routers I am working with now have vty 0 15. Check how many vty your router has and configure for that. If you configure vty 0 4 but there are more vty than that you leave some of the lines unprotected.

HTH

Rick