08-26-2014 07:26 AM
ip access-list extended BLOCK permit tcp host 10.10.10.2 any eq 22 deny tcp any any eq 22 (work)
But, ip access-list extended BLOCK permit tcp host 10.10.10.2 host 10.10.10.1 eq 22 deny tcp any any eq 22 (not work) when i apply vty
08-26-2014 09:01 AM
When binding the access-list with an access-class to a router/switch-line, then the destination has to be "any". It's not allowed to have a different destination specified (like your "host 10.10.10.1").