Restrict VTY SSH access to only MGMT VLAN and loopback

Question

For the sake of the fact that i'm not allowed to share actual configuration, every posted config below is made up or altered.

We have more than 250 locations spread over our country. All locations have a fiber optic connection and the minimal speed is 100 Mbit up/down. Everything is connected via MPLS and our main location does all VRF routing, where four Cisco ASA 5585-X Firewalls, check traffic flowing between the VRFs. Our main location also holds our 40 Gbit up/down internet connection.

All locations have all VRFs and routing tables are aggregated down to only the default route using a IP prefix list.

Every main router on each location holds the layer 3 VLANs.

With the below configuration example: Would it be possible to restrict VTY access to all layer 3 VLANs except the MGMT VLAN and loopback? Every location needs to be able to access the MGMT VLAN and loopback, but VTY access should be blocked to any other SVI.

Location Configuration:

-- truncated --

ip routing

ip vrf MGMT
rd 1:10
route-target export 1:10
route-target import 1:10

ip vrf VRF01
rd 1:1
route-target export 1:1
route-target import 1:1

ip vrf VRF02
rd 1:2
route-target export 1:2
route-target import 1:2

ip vrf VRF03
rd 1:3
route-target export 1:3
route-target import 1:3

ip vrf VRF04
rd 1:4
route-target export 1:4
route-target import 1:4

no errdisable detect cause gbic-invalid
errdisable recovery cause all
errdisable recovery interval 120

spanning-tree mode rapid-pvst
spanning-tree extend system-id
spanning-tree loopguard default
spanning-tree portfast bpduguard default
spanning-tree portfast default
spanning-tree vlan 1-4094 priority 0

auto qos srnd4

udld aggressive

interface Loopback0
description ROUTER ID
ip vrf forwarding MGMT
ip address 172.29.0.254 255.255.255.255

vlan 200
name LOCAL_MGMT

vlan 101
name VRF01

vlan 102
name VRF02

vlan 103
name VRF03

vlan 104
name VRF04

vlan 301
name DATA

vlan 302
name VoIP

vlan 303
name WIFI

-- interfaces truncated --


interface Vlan200
description LOCAL_MGMT
ip vrf forwarding MGMT
ip address 172.29.0.1 255.255.255.128
no shut

interface Vlan101
description VRF01
ip vrf forwarding VRF01
ip address 10.29.0.2 255.255.255.248
no shut

interface Vlan102
description VRF02
ip vrf forwarding VRF02
ip address 10.29.0.10 255.255.255.248
no shut

interface Vlan103
description VRF03
ip vrf forwarding VRF03
ip address 10.29.0.18 255.255.255.248
no shut

interface Vlan104
description VRF04
ip vrf forwarding VRF04
ip address 10.29.0.26 255.255.255.248
no shut

interface Vlan110
description MGMT
ip vrf forwarding MGMT
ip address 10.29.0.250 255.255.255.248
no shut

interface Vlan801
 description DATA
 ip vrf forwarding VRF01
 ip address 172.16.0.1 255.255.255.0
 ip helper-address 172.30.1.10
no shut

interface Vlan802
 description VoIP
 ip vrf forwarding VRF01
 ip address 172.16.1.1 255.255.255.0
 ip helper-address 172.30.1.10
no shut

interface Vlan803
 description WIFI
 ip vrf forwarding VRF01
 ip address 172.16.2.1 255.255.255.0
 ip helper-address 172.30.1.10
no shut

ip prefix-list default seq 5 permit 0.0.0.0/0
ip prefix-list default seq 10 deny 0.0.0.0/0 le 32

router bgp 65331
bgp router-id 172.29.0.254 
bgp log-neighbor-changes

address-family ipv4 vrf MGMT
redistribute connected
neighbor 10.29.0.249 remote-as XXXXX
neighbor 10.29.0.249 password -- removed --
neighbor 10.29.0.249 timers 10 30
neighbor 10.29.0.249 activate
neighbor 10.29.0.249 prefix-list default in
exit-address-family

address-family ipv4 vrf VRF01
redistribute connected
neighbor 10.29.0.1 remote-as XXXXX
neighbor 10.29.0.1 password -- removed --
neighbor 10.29.0.1 timers 10 30
neighbor 10.29.0.1 activate
neighbor 10.29.0.1 prefix-list default in
exit-address-family

address-family ipv4 vrf VRF02
redistribute connected
neighbor 10.29.0.9 remote-as XXXXX
neighbor 10.29.0.9 password -- removed --
neighbor 10.29.0.9 timers 10 30
neighbor 10.29.0.9 activate
neighbor 10.29.0.9 prefix-list default in
exit-address-family

address-family ipv4 vrf VRF03
redistribute connected
neighbor 10.29.0.17 remote-as XXXXX
neighbor 10.29.0.17 password -- removed --
neighbor 10.29.0.17 timers 10 30
neighbor 10.29.0.17 activate
neighbor 10.29.0.17 prefix-list default in
exit-address-family

address-family ipv4 vrf VRF04
redistribute connected
neighbor 10.29.0.25 remote-as XXXXX
neighbor 10.29.0.25 password -- removed --
neighbor 10.29.0.25 timers 10 30
neighbor 10.29.0.25 activate
neighbor 10.29.0.25 prefix-list default in
exit-address-family

no ip http server
no ip http secure-server

-- truncated --

line con 0
 exec-timeout 480 0
line vty 0 4
 exec-timeout 480 0
 transport input SSH
line vty 5 15
 exec-timeout 480 0
 transport input SSH

If there's anything else needed, please comment.

Answer 1

Based on what you have explained in Chat, it sounds like you could use a jump box for this. Basically, you set up one or more devices (network devices or servers) with static IP addresses and strong security. These devices are allowed by ACL to access all the other devices. You first connect to them through the security, then you are allowed to connect from them to any of your other devices.

We use TACACS+ and jump boxes with a two-factor authentication. Trying to connect directly to a network device is refused because you can only connect through one of the jump boxes (we have several scattered around so that there is redundancy and one does not get overloaded). We must also use the two-factor authentication from the jump box to the network devices for extra security. Using something like SecureCRT that has tabs and makes it easy to clone the connection to the jump box in other tabs helps ease the burden when you need to connect to multiple devices at the same time.