Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
649
Views
0
Helpful
2
Replies

iACL on N5K blocking allowed traffic?

Go to solution
aLeffingwell
Level 1
Level 1

‎05-06-2013 11:52 AM - edited ‎03-07-2019 01:12 PM

Hi All,

Here's the base setup:

  • N5K, has a management IP of: 10.132.5.37 - is in the 'management' vrf, and has a default route for that vrf of 10.132.5.1.
    • I can ping hosts in any of the ranges I'm trying to manage the switches from so connectivity is there.
    • I can establish SSH sessions to the N5K as a baseline so - a second verification of connectivity.
  • A dedicated management station sitting at: 10.132.6.145, which is pingable bi-directionally to the mgmt0 interface

Here's what I want to achieve:

  • Allow only a single management workstation to be able to SSH to the N5K for management purposes

Here's how I tried to accomplish it:

  • Create an ACL:
    • conf t
    • ip access-list TEST
    • permit 22 host 10.132.6.145 host 10.132.5.37
    • (permit  22 host 10.132.5.37 host 10.132.6.145 - I feel like this is redundant  and doesn't apply since i'm applying this ACL inbound .. but included  just in case someone were to bring it up and it's not going to hurt  anything)
    • int mgmt0
    • ip access-group TEST in

I  loose connectivity immediately after applying the list.. I noticed  originally that my vPC peer link died with this application, and that  that might be causing the problem, so I added entries to include the  peer link ports, and it worked like a charm.. so .. the problem still  remains why I cannot SSH to the switch with such a basic ACL applied??

Thanks in advance for any insight into this issue!

Kindest Regards,

ALAN

Labels:
0 Helpful
1 Accepted Solution

Accepted Solutions

Go to solution
pille1234
Level 3
Level 3

‎05-06-2013 12:50 PM

You probably meant the peer keep alive link and not the peer link don't you? Else I don't have an explanation why an ACL on your mgmt interface should have an impact on other interfaces.

First, your ACL is wrong. With "permit 22" you allow protocol type 22 and not tcp/22. Try this:

permit tcp host 10.132.6.145 host 10.132.5.37 eq 22

However this will again kill your vPC keep-alives, snmp and whatever else is received on the mgmt interface. If all you want to do is to restrict vty access this could be achieved in an easier way without interfering with other management traffic:

line vty


access-class 100 in
ip access-list 100
10 permit ip host 10.132.6.145 any

Regards

Pille

View solution in original post

0 Helpful
2 Replies 2