2

I am doing some practice on GNS3 related switch and want to allow SSH from specific VLAN Ex: vlan1

In GNS3 i used router with 16NM ethernet module to emulate switch, so i am using following command to tell allow SSH from only vlan1, it seems not working. Do i need ACL ?

ip ssh source-interface vlan 1

EDIT

I have following cisco config. but its not working

 line con 0
  stopbits 1
 line aux 0
 line vty 5 15
  access-class ALLOW-SSH in
  • Are you wanting to limit SSH on a pure router to coming from a specific subnet? – Ron Maupin Dec 4 '15 at 16:18
  • In short i want to allow SSH from only vlan1 192.168.100.X I have configured many VLAN on switch but wanted to restrict to specific vlan or subnet.. In short allow SSH from my admin network. – Satish Dec 4 '15 at 16:23
  • You didn't show the rest of the required configuration in your edit. For instance, the ACL, the line transport, etc. Also, you are only applying this to lines 5 to 15. are you sure you are getting in on onle of those lines instead of one that isn't included? – Ron Maupin Dec 4 '15 at 16:57
3

You are using the wrong command. ip ssh source-interface command defines the source IP when starting an SSH session from the router. It has no effect on other traffic.

To control who can SSH into your router, you use an ACL and access-class.

ip access-list standard ALLOW-SSH
permit 192.168.100.0 0.0.0.255

line vty 0 15
transport ssh
access-class ALLOW-SSH in
  • Cool!!! thats why i wonder what is going on.. that command sounds like allow SSH from source interface. – Satish Dec 4 '15 at 16:32
  • can you see my updated question, I tried your solution but didn't work.. should i apply access list on line vty 5 15 or 0 15 ? – Satish Dec 4 '15 at 16:55
  • try vty 0 4. Don't forget the transport statement – Ron Trunk Dec 4 '15 at 16:57
  • that works!! 0 4 what is 5 15 vty for? can you explain those number? – Satish Dec 4 '15 at 17:08
  • 2
    There are 5 or 16 (depending on the sw version) possible terminal shell sessions. You could in theory have up to 16 people logged into a router. The numbers allow you to configure them individually or as a range. – Ron Trunk Dec 4 '15 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.