We have several L3 switch as core for our sites (central and remotes). These switchs have multiple IPs for vlan routing. These IPs are gateway for vlans. Is it possible to avoid ssh connections for some of these IPs? I just want to be able to connect these switch through one IP (management vlan IP) and avoid all connections from other vlans. We have DELL Force10, procurve and aruba L3. Thanks.
-
4I think you have to configure some sort of an access list to filter ssh traffic coming in and apply that access list on the vlan interfaces– Soulimane MammarFeb 9 at 16:43
Add a comment
|
1 Answer
If your switches support (pretty much standard) extended ACLs, you could use something like (eg. Procurve/Aruba 2530)
ip access-list extended "server_in"
1000 permit tcp 10.0.0.2/32 10.0.1.0/24 eq 22
1010 deny tcp 10.0.0.0/24 10.0.1.0/24 eq 22
9999 permit ip any any
exit
vlan 1010 ip access-group "server_in" vlan-in
on your server-side SVIs/VLANs on ingress with
10.0.0.0/24= client VLAN 100010.0.0.2= admin workstation10.0.1.0/24= server VLAN 1010
This ACL stops all SSH access from the client VLAN to the server VLAN except for the admin workstation and permits anything else.
If the switches don't support the /xx notation (works with Procurve and Aruba, even newer L2 switches) you'll need to use deny tcp 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255 eq 22. The 0.0.0.255 isn't the network mask but the wildcard mask, pretty much the inverse.
You can adapt those access rules in a very flexible way. If your network is neatly arranged it's usually pretty easy to implement.
Since you seem to be new to this, keep in mind that ACLs work first fit - the first rule that matches is the one applied - and there's an implicit deny ip any any at the very end, that's why you need an explicit 9999 permit ip any any (or the like) if you don't want that.
