So I can't seem to figure out how to do this.  On an perimeter router I just want to block any incoming SSH traffic to the router except from three internal subnets. Then i also want to authenticate with a local account and not leverage aaa. so the result is not one can directly externally connect to the router via SSH but i can still SSH into our router internally using local accounts.  it seems that i can't selectively block SSH traffic without aaa and I can't login with local account with aaa. This seems to me that this should be very simple to configure.      Current configuration : 5161 bytes ! ! Last configuration change at 21:52:47 UTC Wed Jul 24 2019 by <redact> ! version 15.5 service timestamps debug datetime msec service timestamps log datetime msec service password-encryption no platform punt-keepalive disable-kernel-core ! hostname ISR4431 ! boot-start-marker boot system bootflash:/isr4400-universalk9.03.16.05.S.155-3.S5-ext.SPA.bin boot-end-marker ! ! vrf definition Mgmt-intf ! address-family ipv4 exit-address-family ! address-family ipv6 exit-address-family ! enable secret 5 <redact> ! aaa new-model ! ! ! ! ! ! ! ! aaa session-id common ! ip vrf Internet rd 2:2 ! ip vrf MPLS rd 1:1 ! ! ! ip domain name <redact> ! ! ! ! ! ! ! ! ! subscriber templating multilink bundle-name authenticated ! ! ! ! license udi pid ISR4431/K9 sn <redact> license boot level securityk9 ! spanning-tree extend system-id ! username <redact> access-class 15 secret 8 <redact> username <redact> access-class 15 secret 8 <redact> ! redundancy mode none ! ! ! ! ! ! ! ! interface GigabitEthernet0/0/0 description LAN-VRF-MPLS ip vrf forwarding MPLS ip address 10.92.1.254 255.255.255.0 negotiation auto ! interface GigabitEthernet0/0/1 description LAN-VRF-Internet ip vrf forwarding Internet ip address <redact> negotiation auto ! interface GigabitEthernet0/0/2 description WAN-VRF-MPLS ip vrf forwarding MPLS ip address <redact> <redact> negotiation auto ! interface GigabitEthernet0/0/3 description WAN-VRF-Internet ip vrf forwarding Internet ip address <redact> negotiation auto ! interface GigabitEthernet0 vrf forwarding Mgmt-intf ip address <redact> negotiation auto ! ip forward-protocol nd no ip http server no ip http secure-server ip tftp source-interface GigabitEthernet0/0/0 ip ssh version 2 ! ! ip access-list standard Limit_SSH permit 10.92.1.0 0.0.0.255 permit 10.91.3.0 0.0.0.255 permit 192.168.1.0 0.0.0.255 deny any ! access-list 1 permit 10.92.1.0 0.0.0.255 access-list 1 permit 192.168.1.0 0.0.0.255 access-list 101 deny udp any eq 22 any access-list 101 deny tcp any eq 22 any access-list 101 permit ip any any ! ! ! ! ! control-plane ! ! line con 0 stopbits 1 line aux 0 stopbits 1 line vty 0 4 access-class Limit_SSH out transport input ssh transport output ssh line vty 5 15 access-class Limit_SSH in access-class Limit_SSH out transport input ssh transport output ssh ! ... View more