1

enter image description here

In the picture shown the left bottom router is to be secured from any telnet requests. Now will I use Extended ACL on every router router or can I use the standard ACL just?

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 15, 2019 at 3:33

3 Answers 3

3

Since you want to filter by destination you'll need an extended ACL - a standard ACL can filter by source only.

Putting in on the router itself for inbound on any potentially unwanted interface should be enough.

1

While the title talks about ACLs, the goal is to secure the router in the bottom-left from telnet requests. Lets assume this is Cisco IOS.

The best way to do that is to....turn off telnet.

The first step to turning off telnet is to turn on ssh and test that it works. Otherwise you will lock yourself out and have to go to the console.

https://www.cisco.com/c/en/us/support/docs/security-vpn/secure-shell-ssh/4145-ssh.html

1) determine how many vty lines your router has by looking at your existing configuration. It could be 5 "line vty 0 4" or 16 (two separate line vty stanzas, but you can configure them both with "line vty 0 15"

2) Enable ssh

ip domain-name yourdomain.but.it.doesnt.really.matter.com
ip ssh version 2
crypto key gen rsa      ! you may get prompted for bits, JesseP suggests at least 2048
line vty 0 15
  transport input telnet ssh      ! compare to existing config first 
end

copy run start

3) Test ssh before disabling telnet!

4) disable telnet

line vty 0 15
  transport input ssh
end
copy run start

Now your router is secured from any telnet requests as instructed. If you want to limit ssh access to your network management subnet you'd add this. Some admins also like to permit their router p2p links address block so they can "bounce" between routers in a network outage.

access-list 23 permit 10.10.10.0 0.0.0.255     ! NMS subnet
line vty 0 15
  access-class 23 in
end
copy run start
2
  • 1
    There's a reason nobody recommends 1024-bit keys anymore. You should consider upgrading to at least 2048-bit.
    – Jesse P.
    Jul 19, 2019 at 0:41
  • Agreed Jesse. Incorporated into the answer with attribution. Jul 19, 2019 at 0:45
0

Standard ACLs are all that's required, since you only care about defining which hosts are allowed in. The protocol is already defined on the VTY lines. Technically you could use either form, but extended ACLs are just overkill with where you're applying them.

You do not need to add ACLs to the other routers - just the one you want to be restricted.

Also, if you have the ability, I'd seriously consider NOT using Telnet at all, and force users to use SSH.

2
  • Is it better performance wise to use a standard ACL instead of an extended one?
    – Nakrule
    Jul 11, 2019 at 9:06
  • @Nakrule No difference that I'm aware of or can find details of. If there is any, it would be negligible in this regard since it's not filtering general traffic - just Telnet and SSH requests for management access.
    – Jesse P.
    Jul 11, 2019 at 11:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.