Hi everybody
We are segmenting our networks based on Cat9500 & Cat9600 as the L3 core. We only want management flows to be served by the management VRF and its associated L3 interfaces.
The question is about how to do this for HTTPS access.
For the SSH case, this is a very elegant way to do this:
line vty 0 4
access-class CLI_Access in vrfname mgmt
I cannot find something like this for HTTPS. There is no mention in the manuals about adding a VRF into the 'ip http' section.
Yes, we can apply ACLs for http access, but these are not extended ones. We cannot specify a single destination address (to match the one in the management VRF). Only basic standard ACLs are allowed into this:
ip http access-class ipv4 HTTPS_Access
I can also apply an ACL and access-group for the actual interfaces facing "insecure" VRFs. I simply don't like this solution.
Can you comment if you had this requirement and how you solved it?
Thanks in advance
Enrique
