We have CSS11800 switches in a remote data center, and needed to have telnet and ssh access blocked from the Internet, but still allow it from the management port. It's a simple access-list thing, but maybe it'll save time for the next person.acl en...