Using Standard or Extended ACL for Telnet Connections

Question

In the picture shown the left bottom router is to be secured from any telnet requests. Now will I use Extended ACL on every router router or can I use the standard ACL just?

Answer 1

Since you want to filter by destination you'll need an extended ACL - a standard ACL can filter by source only.

Putting in on the router itself for inbound on any potentially unwanted interface should be enough.

Answer 2

While the title talks about ACLs, the goal is to secure the router in the bottom-left from telnet requests. Lets assume this is Cisco IOS.

The best way to do that is to....turn off telnet.

The first step to turning off telnet is to turn on ssh and test that it works. Otherwise you will lock yourself out and have to go to the console.

https://www.cisco.com/c/en/us/support/docs/security-vpn/secure-shell-ssh/4145-ssh.html

1) determine how many vty lines your router has by looking at your existing configuration. It could be 5 "line vty 0 4" or 16 (two separate line vty stanzas, but you can configure them both with "line vty 0 15"

2) Enable ssh

ip domain-name yourdomain.but.it.doesnt.really.matter.com
ip ssh version 2
crypto key gen rsa      ! you may get prompted for bits, JesseP suggests at least 2048
line vty 0 15
  transport input telnet ssh      ! compare to existing config first 
end

copy run start

3) Test ssh before disabling telnet!

4) disable telnet

line vty 0 15
  transport input ssh
end
copy run start

Now your router is secured from any telnet requests as instructed. If you want to limit ssh access to your network management subnet you'd add this. Some admins also like to permit their router p2p links address block so they can "bounce" between routers in a network outage.

access-list 23 permit 10.10.10.0 0.0.0.255     ! NMS subnet
line vty 0 15
  access-class 23 in
end
copy run start

Answer 3

Standard ACLs are all that's required, since you only care about defining which hosts are allowed in. The protocol is already defined on the VTY lines. Technically you could use either form, but extended ACLs are just overkill with where you're applying them.

You do not need to add ACLs to the other routers - just the one you want to be restricted.

Also, if you have the ability, I'd seriously consider NOT using Telnet at all, and force users to use SSH.