Hi,
May I ask if there is any way to deploy my own class-map into the default system-cpp-policy?
I’m trying to restrict SSH connections to only one loopback address, and have all other IPs dropped.
On basic routers, I achieved this using an extended ACL that matches the specific loopback IP and denies the rest.
Then, I created a class-map using that ACL, a policy-map referencing the class-map, and finally applied it to the control-plane.
This worked successfully on an ISR4221/K9.
However, I'm facing issues with the same setup on a WS-C3650-24TS.
So my question is:
Is there any way to edit the default policy-map by adding my own class-map that includes an ACL restricting SSH connections?
Extended IP access list SSH_ONLY_LOOPBACK
10 deny tcp any host <ip address> eq 22
20 permit tcp any any eq 22
