> Hi, > > I am trying to filter SSH access on a router from outside by source and destination ip address. To be more clear, the source SSH access is the outside /24 network x.x.x.x, and the destination SSH IP is one of the router's ip's. I want to be able to cut the ssh listening on all the ip's from the router interfaces, and allow it only on one ip. > > The problem is that if the access list looks like: > access-list 199 permit tcp x.x.x.x 0.0.0.255 y.y.y.y 0.0.0.0 eq 22 > it blocks the ssh access for all ip's including y.y.y.y
Try permitting based on IP address only, e.g. access-list 199 permit ip x.x.x.x 0.0.0.255 host y.y.y.y > if the access list applied to the vty lines is: > access-list 199 permit tcp x.x.x.x 0.0.0.255 any eq 22 > it permits the ssh access to all ip's residing on the router. > > Is this a normal behavior of the IOS, to block access to all the ip's, including to the one that is supposed to be allowed? Well you are allowing TCP port 22 from x.x.x.x/24 to any destination, which will be any IP address on the router. But that doesnt neccessarily explain why the first access list doesnt work. Personally Ive never used an extended ACL to control VTY access to a router, I generally use standard ACLs and permit only a specific set of source subnets access. It works just fine. Is there any compelling reason why SSH should only be allowed to one particular IP on the router? > Thanks, > > Catalin > > > --------------------------------- > For ideas on reducing your carbon footprint visit Yahoo! For Good this month. > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
