On your original list enter, do the following to see what you missed... access-list 199 permit tcp x.x.x.x 0.0.0.255 y.y.y.y 0.0.0.0 eq 22 access-list 199 permit ip x.x.x.x 0.0.0.255 y.y.y.y 0.0.0.0 log
Now try to log in again and it should let you, but now you will have a log of what was missed. I also agree that only using a standard ACL with specif host permits is simpler. Jeff Fitzwater OIT Network Systems Princeton University Tom Storey wrote: >> Hi, >> >> I am trying to filter SSH access on a router from outside by source and >> > destination ip address. To be more clear, the source SSH access is the > outside /24 network x.x.x.x, and the destination SSH IP is one of the > router's ip's. I want to be able to cut the ssh listening on all the ip's > from the router interfaces, and allow it only on one ip. > >> The problem is that if the access list looks like: >> access-list 199 permit tcp x.x.x.x 0.0.0.255 y.y.y.y 0.0.0.0 eq 22 >> it blocks the ssh access for all ip's including y.y.y.y >> > > Try permitting based on IP address only, e.g. > > access-list 199 permit ip x.x.x.x 0.0.0.255 host y.y.y.y > > >> if the access list applied to the vty lines is: >> access-list 199 permit tcp x.x.x.x 0.0.0.255 any eq 22 >> it permits the ssh access to all ip's residing on the router. >> >> Is this a normal behavior of the IOS, to block access to all the ip's, >> > including to the one that is supposed to be allowed? > > Well you are allowing TCP port 22 from x.x.x.x/24 to any destination, which > will be any IP address on the router. But that doesnt neccessarily explain > why the first access list doesnt work. > > Personally Ive never used an extended ACL to control VTY access to a router, > I generally use standard ACLs and permit only a specific set of source > subnets access. It works just fine. > > Is there any compelling reason why SSH should only be allowed to one > particular IP on the router? > > >> Thanks, >> >> Catalin >> >> >> --------------------------------- >> For ideas on reducing your carbon footprint visit Yahoo! For Good this >> > month. > >> _______________________________________________ >> cisco-nsp mailing list [email protected] >> https://puck.nether.net/mailman/listinfo/cisco-nsp >> archive at http://puck.nether.net/pipermail/cisco-nsp/ >> > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
