Have you tried adding the vrf-also switch to your access-class statement? Something like:
line vty 0 4 access-class 10 in vrf-also I'm not sure if this is available on the 4500, but it works on all the gear I have. -saxon On 20 May 2010 07:51, Nemeth Laszlo <[email protected]> wrote: > Hi All, > > I use a C4948 switch with cat4500-entservicesk9-mz.122-53.SG1 IOS. > > I try to use the MGMT ethernet port. The config is: > > interface FastEthernet1 > ip vrf forwarding mgmtVrf > ip address 192.168.2.10 255.255.255.0 > speed auto > duplex auto > > If I telnet to the switch from 192.168.2.1 via the MGMT port without > access-group filter on the VTY, the telnet is working. > > # telnet 192.168.2.10 > Trying 192.168.2.10... > Connected to 192.168.2.10. > Escape character is '^]'. > > User Access Verification > > Username: > > > But if i put a filter to the VTY (now i try a simple "access-list 10 permit > any" ) the telnet doesn't work thru the MGMT port. > > VTY config: > > line vty 0 4 > access-class 10 in > exec-timeout 0 0 > login local > > Telnet output: > > # telnet 192.168.2.10 > Trying 192.168.2.10... > telnet: Unable to connect to remote host: Connection refused > > I tried standard and extended ACL too. > If I logging an extended ACL (permit ip any any log) output i see it: > > *May 20 08:08:15 MET-DST: %SEC-6-IPACCESSLOGP: list 100 permitted tcp > 192.168.2.1(47611) -> 0.0.0.0(23), 1 packet > > But the connection is refused. > > Do anybody have any idea, why doesn't work the telnet thru the MGMT if i use > ACL on the VTY lines? May be SW bug? > > Thanks! > > Laszlo > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
