cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

line vty access-list SSH port

adamgibs7
Frequent Contributor
Frequent Contributor

Dears,

I m trying to restrict the VTY access by an extended access-list , whenever I specify the extended access-list with source and destination and port number on a VTY lines, it doesn't work, when I remove the port number it works fine, what is missing from me.

2 ACCEPTED SOLUTIONS

Accepted Solutions

If you think about it one of the features of putting ACL on line vty (access-class) is that it controls access no matter which interface of the device was used for access. So it is really not checking destination address, which is equivalent to permit any for the destination.

 

If you get into something like control plane policing you can create policies that control based on destination address. But as long as you are using ACL on vty I would not ever expect that an extended access list specifying destination would work.

 

HTH

 

Rick

HTH

Rick

View solution in original post

6 REPLIES 6

mattjones03
Beginner
Beginner

Hi,

 

here is a similar post that may assist you further;

 

https://supportforums.cisco.com/t5/lan-switching-and-routing/access-list-on-line-vty/td-p/1252237

 

Thanks for both of you,

 

I made a writing in the post instead of destination address I have written a port number ( ssH) hence when I enter a destination it was not working.

 

I have been to these post's before posting hence they were very old so I thought lets put it again to see if anything as changed in the new IOS architecture but still I m getting the same replies,

 

so  u both are confirming that no solution has been still for the destination address in the ext ACL when applied to the VTY lines.

 

thanks

If you think about it one of the features of putting ACL on line vty (access-class) is that it controls access no matter which interface of the device was used for access. So it is really not checking destination address, which is equivalent to permit any for the destination.

 

If you get into something like control plane policing you can create policies that control based on destination address. But as long as you are using ACL on vty I would not ever expect that an extended access list specifying destination would work.

 

HTH

 

Rick

HTH

Rick

Dears,

 

+5 to all 3 of you.

 

thanks

You are welcome. Thank you for the helpful vote and for marking this question as solved.

 

HTH

 

Rick

HTH

Rick
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: