SSH Restriction using object-group under Access-list

[NarendraSharma]

I want to restrict SSH to a certain subnet

example: Source Subnet: 192.168.X.X/24

Object-Group network SSH_USERS

192.168.X.X 255.255.255.0

Destination Management Subnet : 10.10.X.X/24

Object-Group network MGMT_VLAN

10.10.x.x 255.255.255.0

i am using object group for source and destination subnets and calling them under the access list but 

ip access-list extended SSH

permit tcp object-group SSH_USERS object-group MGMT_VLAN eq 22

line vty 0 15

access-group SSH in

but once i apply this i am unable to SSH the device.

Let me know if there is any issue with the config

[Mark Elsen]

    - @NarendraSharma                        >....access-group SSH in
                                                    Use       access-class  SSH in

 M.

[NarendraSharma]

Hi Mark,

My bad, I used access-class SSH in instead of access-group in

Still the issue is persisting. I am unable to SSH

[Mark Elsen]

  - @NarendraSharma             Start with making a restriction based on one network only :
                                                   ip access-list standard SSH_USERS
                                                          permit 192.168.1.0 0.0.0.255

                                                          line vty 0 15
                                                          access-class SSH_USERS in
                                                          transport input ssh

  M.

[NarendraSharma]

@Mark Elsen I have already tried this method, this method is working fine.

I was trying to achieve the same using object groups so in future if i can add extra subnets or host it will be easier.

Is there a way?

[charliemak · Accepted solution]

When you apply an access list to a vty (by using the access-class command), the access list must be a numbered access list, not a named access list.

Reference:
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/12-4t/sec-data-acl-12-4t-book/sec-cntrl-acc-vtl.html