Hi @Spork Schivag,   To block access to Telnet and SSH, you only need to apply the ACL on the VTY lines. Remove the ACL application from the G0/0/x interfaces.   Is there a way to assign that transceiver to the GigabitEthernet 0/0/1 interface? The only way to do this is change the interface cable physically.   Regards ... View more

Hi @Spork Schivago,   In your case, you could leave the login command alone. The login authentication command is related to AAA authentication, through a RADIUS or TACACS server. As I understand it, the web interface works using a remote connection, so if you block those connections with the ACL on the VTY lines, you are also blocking the interface web.   Regards ... View more

Hi @anna84,   One case:   OSPF( link state) is a much heavier and slower protocol than EIGRP( distance vector) . When a change in the topology occurs, EIGRP only informs the neighbors, but OSPF alters the database of all the routers and proceeds to recalculate the routes with the SPF protocol. The routing updates, therefore, are much larger than in EIGRP.   Regards ... View more

Hi @Spork Schivago,   With your command, you have the login local.   Why is that needed?  The local login command is not necessary for ACLs. This command means that people who connect remotely, must log in locally, having to enter their username and password.   I am a little confused why I had to apply the ACL to the VTY lines and the GigabitEthernet 0/0/0 interface. To block the remote connections, by Telnet or SSH, it is only necessary to apply the ACL in the VTY lines.   Does the VTY lines apply to the local console port on the router itself, the one where I plug an RJ45 to DB9 console adapter into it? No, VTY lines only apply to remote connections, no to the console line.   I am also trying to think what other services there are on the GigabitEthernet 0/0/0 and VTY lines that I should disable. One of the functions of NAT is to provide a certain type of security by preventing external networks from accessing services mounted on private networks. So if you already have NAT configured, it would not be necessary to add ACLs to filter external connections to your internal services. It would only be necessary to block services if they are configured in your border router.   Regards   ... View more

Hi @Spork Schivago,   I'll show you an example of ACL configuration for VTY lines:   access-list 1 permit 192.168.1.0 0.0.0.255 <-this line allows the internal network that you mentioned access-list 1 deny any !     line vty 0 4 access-class 1 in login local   Regards   ... View more