how to set mgmt ip on cisco 9300

[Lalaram Raika]

i have 5 svi on my switch and switch is accessble over all svi ip 

i want to set a single svi for mgmt

can anyone guide please

[Kasun Bandara]

@Lalaram Raika hi, recommended way is to use dedicated management port in your switch. you can add IP address directly to the port and access from management network. normally this port running in different VRF, so its not mixed with other routing tables.

if you need management connectivity as a SVI, you can create new SVI and access it from relevant VLAN.

[Lalaram Raika]

if i create new svi it will also be accesible over all vlan's due to intervlan routing 

alredy i have 5 vlans vlan1, vlan2, 3, 4, 5, and each have svi interface and ip , now my issue is each vlan's user should not access 

right now each vlans user can access my switch using 5 svi ip 

[liviu.gheorghe]

For this you should configure an access list and apply it on the vty lines. For example if VLAN 1, 192.168.1.0/24, is your management VLAN and the config should be:

ip access-list standard VTY_ACL

 permit 192.168.1.0 0.0.0.255

line vty 0 4

 access-class VTY_ACL in

[Lalaram Raika]

[Lalaram Raika]

this not work

[liviu.gheorghe]

From which IP address are you trying to ssh into the switch?

[Kasun Bandara]

looks like you preffer to move with ACL method. share the current ACL you implemented.

[Kasun Bandara]

@Lalaram Raika your understanding is correct.

1. you can use dedicated management for this use case.

2. you can create sperate VRF for new management SVI and use that to enclose management SVI. then new SVI will not be accessible to other VLANs

[Lalaram Raika]

how tell me whole process with cmd please

[balaji.bandi]

You have 2 option you can set using source interface for SSH or use ACL to filter what IP need to have access to switch.

[Lalaram Raika]

can i use svi as source int 

[Richard Burts]

I think that there is some misunderstanding about management interface. The purpose of management interface is to provide an interface where management traffic (access using telnet/SSH/HTTP/HTTPS, or traffic like SNMP, syslog, etc) will not compete with or impact data traffic. 

There is not anything in the config that specifies whether an interface is management or not. And so it is not an issue if users could access your switch using address other than the "management" address. If you want to enforce that management can only access using the management interface, then you will need to implement access lists on all other interfaces that deny incoming traffic of telnet/SSH/HTTP/HTTPS.

[balaji.bandi]

Sure, it does not matter as long as the source interface is up and running and reachable.