Hello Youssef, Thanks for your reply, but I cannot do that (applying it on a Ve -- management interfaces are used for something different), since the VDX is being used as a router. Correct me if I'm wrong, but if I apply an ip access group, all the routed traffic will be impacted by the ACL.
I am just interested in applying such an ACL to the traffic towards the switches itselves... Clément On Fri, 2016-02-26 at 15:15 +0100, Youssef Bengelloun-Zahr wrote: > Dear Clement, > > > I personnally restricted access to the box via an ACL applied directly > under the interface I'm interested in. > > > For instance, for OOB interface : > > interface Management 1/0 > no tcp burstrate > ip icmp unreachable > ip icmp echo-reply > no ip address dhcp > ip address 10.75.1.21/24 > ip access-group AUTHORIZED-V4-SUBNETS-FOR-MANAGEMENT in <==== > ipv6 icmpv6 unreachable > ipv6 icmpv6 echo-reply > no ipv6 address autoconfig > no ipv6 address dhcp > ! > > > I believe it should be the same for the other interfaces. > > > HTH. > > > > 2016-02-26 14:54 GMT+01:00 Clement Cavadore <[email protected]>: > Hi, > > I have a couple of VDX in a fabric which run BGP & so on over > public IP > adresses. They are accessible using SSH on their outband > interface, and > also in inband, and I cannot figure out where we could > restrict it to > some access lists. => I am looking for the equivalent of > "telnet/ssh > access-group XX" in NOS 4.1.x. > > Anyone know that ? > > Thanks ! > -- > Clément Cavadore > > _______________________________________________ > foundry-nsp mailing list > [email protected] > http://puck.nether.net/mailman/listinfo/foundry-nsp > > > > -- > Youssef BENGELLOUN-ZAHR > _______________________________________________ foundry-nsp mailing list [email protected] http://puck.nether.net/mailman/listinfo/foundry-nsp
