Hello Clement, How about this for telnet :
telnet@er01-par01(config)#telnet access-group ? ASCII string Standard Access List Name <1-99> Standard IP access list ipv6 IPv6 Access control list an this for SSH : telnet@er01-par01(config)#ip ssh client ? A.B.C.D IP address ipv6 IPv6 address telnet@er01-par01(config)#ip ssh source-interface ? ethernet Ethernet interface loopback Loopback interface pos POS interface ve Virtual Ethernet interface telnet@er01-par01(config)#ip ssh st strict-management-vrf Allow SSH connections only from management-vrf Best regards. 2016-02-26 15:21 GMT+01:00 Clement Cavadore <[email protected]>: > Hello Youssef, > > Thanks for your reply, but I cannot do that (applying it on a Ve -- > management interfaces are used for something different), since the VDX > is being used as a router. > Correct me if I'm wrong, but if I apply an ip access group, all the > routed traffic will be impacted by the ACL. > > I am just interested in applying such an ACL to the traffic towards the > switches itselves... > > Clément > > > On Fri, 2016-02-26 at 15:15 +0100, Youssef Bengelloun-Zahr wrote: > > Dear Clement, > > > > > > I personnally restricted access to the box via an ACL applied directly > > under the interface I'm interested in. > > > > > > For instance, for OOB interface : > > > > interface Management 1/0 > > no tcp burstrate > > ip icmp unreachable > > ip icmp echo-reply > > no ip address dhcp > > ip address 10.75.1.21/24 > > ip access-group AUTHORIZED-V4-SUBNETS-FOR-MANAGEMENT in <==== > > ipv6 icmpv6 unreachable > > ipv6 icmpv6 echo-reply > > no ipv6 address autoconfig > > no ipv6 address dhcp > > ! > > > > > > I believe it should be the same for the other interfaces. > > > > > > HTH. > > > > > > > > 2016-02-26 14:54 GMT+01:00 Clement Cavadore <[email protected]>: > > Hi, > > > > I have a couple of VDX in a fabric which run BGP & so on over > > public IP > > adresses. They are accessible using SSH on their outband > > interface, and > > also in inband, and I cannot figure out where we could > > restrict it to > > some access lists. => I am looking for the equivalent of > > "telnet/ssh > > access-group XX" in NOS 4.1.x. > > > > Anyone know that ? > > > > Thanks ! > > -- > > Clément Cavadore > > > > _______________________________________________ > > foundry-nsp mailing list > > [email protected] > > http://puck.nether.net/mailman/listinfo/foundry-nsp > > > > > > > > -- > > Youssef BENGELLOUN-ZAHR > > > > > -- Youssef BENGELLOUN-ZAHR
_______________________________________________ foundry-nsp mailing list [email protected] http://puck.nether.net/mailman/listinfo/foundry-nsp
