ISR Router as Easy VPN Server, local usernames restrict management access to device

[ngtransge]

Hello,

I am using 3945E Router as Easy VPN Server, with 15.1 IOS. On router I have bunch on usernames for VPN authentication, I want to restrict Router management access for them(ssh,telnet, http and so on). Is there any way to do it ?

[mvsheik123]

Hi,

You can create access-list with allowed IPs and apply the same for VTY & http config.

hth

MS

[ngtransge]

Hello,

I dont like this solution. I saw one example when it was done with aaa atribute list, and it was working, but on 3945E it is not working.

Here is example :

aaa new-model

!

aaa authentication login ezvpn_users local

aaa authorization network ezvpn_users local

!

aaa attribute list ezvpn_users

attribute type service-type noopt service shell mandatory

!

username user1 password 0 superpasword

username user1 aaa attribute list ezvpn_users

!