We have several L3 switch as core for our sites (central and remotes). These switchs have multiple IPs for vlan routing. These IPs are gateway for vlans. Is it possible to avoid ssh connections for some of these IPs? I just want to be able to connect these switch through one IP (management vlan IP) and avoid all connections from other vlans. We have DELL Force10, procurve and aruba L3. Thanks.
If your switches support (pretty much standard) extended ACLs, you could use something like (eg. Procurve/Aruba 2530)
ip access-list extended "server_in" 1000 permit tcp 10.0.0.2/32 10.0.1.0/24 eq 22 1010 deny tcp 10.0.0.0/24 10.0.1.0/24 eq 22 9999 permit ip any any exit vlan 1010 ip access-group "server_in" vlan-in
on your server-side SVIs/VLANs on ingress with
10.0.0.0/24= client VLAN 1000
10.0.0.2= admin workstation
10.0.1.0/24= server VLAN 1010
This ACL stops all SSH access from the client VLAN to the server VLAN except for the admin workstation and permits anything else.
If the switches don't support the
/xx notation (works with Procurve and Aruba, even newer L2 switches) you'll need to use
deny tcp 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255 eq 22. The
0.0.0.255 isn't the network mask but the wildcard mask, pretty much the inverse.
You can adapt those access rules in a very flexible way. If your network is neatly arranged it's usually pretty easy to implement.
Since you seem to be new to this, keep in mind that ACLs work first fit - the first rule that matches is the one applied - and there's an implicit
deny ip any any at the very end, that's why you need an explicit
9999 permit ip any any (or the like) if you don't want that.