What interfaces does a Cisco iOS Router allow SSH Console access on?

Question

I am have trouble understanding how Cisco iOS maps console access services like SSH to IP addresses.

Assume the following:

• There are no acls blocking traffic
• There is the typical SSH server declaration

line vty 0 4
 access-class 23 in
 privilege level 15
 login local
 transport input telnet ssh

Given the above, should you expect SSH to be accessible on every interface with an IP address? Is there an interface setting to allow/disalow this? Is it only some types of interfaces (VLAN, loopback, etc.)?

Update: Config

I can ping 192.168.1.230 but I cannot SSH to it. I get no connection accepted; however, I can ping it (it stops pining if i disable FE 8 so pretty sure it is authentic ping).

!
! Last configuration change at 19:08:00 UTC Thu Sep 29 2022 by CDIAdmin
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname IPSecTest1
!
boot-start-marker
boot-end-marker
!
!
logging buffered 51200 warnings
!
no aaa new-model
memory-size iomem 10
service-module wlan-ap 0 bootimage autonomous
!
!
ip cef
!
!
!
!


!
ip dhcp excluded-address 10.10.10.1
!
ip dhcp pool ccp-pool
 import all
 network 10.10.10.0 255.255.255.248
 default-router 10.10.10.1
 lease 0 2
!
!
!
no ip domain lookup
ip domain name ipsectest1
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
license udi pid CISCO891W-AGN-A-K9 sn FTX1819814X
!
!
username XXXXXXX privilege 15 secret 5 XXXXXXXXXXXXXXXXXX
!
redundancy
!
!
!
!
!
ip ssh version 2
!
!
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 2
crypto isakmp key MYPASSWORD address 192.168.210.230
!
!
crypto ipsec transform-set og-trans esp-aes 256 esp-sha-hmac
 mode tunnel
!
!
!
crypto map og-map 10 ipsec-isakmp
 set peer 192.168.210.230
 set transform-set og-trans
 set pfs group2
 match address ipsec-acl
!
!
!
!
!
interface Loopback0
 ip address 10.100.100.1 255.255.255.0
!
interface FastEthernet0
 no ip address
!
interface FastEthernet1
 no ip address
!
interface FastEthernet2
 no ip address
!
interface FastEthernet3
 no ip address
!
interface FastEthernet4
 no ip address
!
interface FastEthernet5
 no ip address
!
interface FastEthernet6
 no ip address
!
interface FastEthernet7
 no ip address
!
interface FastEthernet8
 ip address 192.168.1.230 255.255.254.0
 ip access-group outside-in in
 duplex auto
 speed auto
!
interface GigabitEthernet0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface wlan-ap0
 description Service module interface to manage the embedded AP
 ip unnumbered Vlan1
 arp timeout 0
!
interface Wlan-GigabitEthernet0
 description Internal switch interface connecting to the embedded AP
 no ip address
!
interface Vlan1
 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
 ip address 10.10.10.1 255.255.255.248
 ip tcp adjust-mss 1452
!
interface Async1
 no ip address
 encapsulation slip
!
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip route 0.0.0.0 0.0.0.0 192.168.1.1 name DGW
!
ip access-list extended ipsec-acl
 permit ip host 10.100.100.1 10.200.200.0 0.0.0.255
 permit ip host 10.100.100.2 10.200.200.0 0.0.0.255
ip access-list extended outside-in
 permit ip any any
!
access-list 23 permit 10.10.10.0 0.0.0.7
no cdp run
!
!
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
banner exec ^C
% Password expiration warning.
-----------------------------------------------------------------------

Cisco Configuration Professional (Cisco CP) is installed on this device
and it provides the default username "cisco" for  one-time use. If you have
already used the username "cisco" to login to the router and your IOS image
supports the "one-time" user option, then this username has already expired.
You will not be able to login to the router with this username after you exit
this session.

It is strongly suggested that you create a new username with a privilege level
of 15 using the following command.

username <myuser> privilege 15 secret 0 <mypassword>

Replace <myuser> and <mypassword> with the username and password you
want to use.

-----------------------------------------------------------------------
^C
banner login ^C
-----------------------------------------------------------------------
Cisco Configuration Professional (Cisco CP) is installed on this device.
This feature requires the one-time use of the username "cisco" with the
password "cisco". These default credentials have a privilege level of 15.

YOU MUST USE CISCO CP or the CISCO IOS CLI TO CHANGE THESE
PUBLICLY-KNOWN CREDENTIALS

Here are the Cisco IOS commands.

username <myuser>  privilege 15 secret 0 <mypassword>
no username cisco

Replace <myuser> and <mypassword> with the username and password you want
to use.

IF YOU DO NOT CHANGE THE PUBLICLY-KNOWN CREDENTIALS, YOU WILL
NOT BE ABLE TO LOG INTO THE DEVICE AGAIN AFTER YOU HAVE LOGGED OFF.

For more information about Cisco CP please follow the instructions in the
QUICK START GUIDE for your router or go to http://www.cisco.com/go/ciscocp
-----------------------------------------------------------------------
^C
!
line con 0
 login local
line 1
 modem InOut
 speed 115200
 flowcontrol hardware
line 2
 no activation-character
 no exec
 transport preferred none
 transport input all
 transport output pad telnet rlogin udptn ssh
line aux 0
line vty 0 4
 access-class 23 in
 privilege level 15
 login local
 transport input telnet ssh
line vty 5 15
 access-class 23 in
 privilege level 15
 login local
 transport input telnet ssh
!
!
end

Answer 1

Given the above, should you expect SSH to be accessible on every interface with an IP address?

Unless otherwise restricted, yes.

Is there an interface setting to allow/disalow this?

You can apply an interface ACL to restrict access from certain interfaces.

Is it only some types of interfaces (VLAN, loopback, etc.)?

All interfaces. Using a lookback is recommended in most cases as it is always available.

Answer 2

Absent an ACL that blocks using an interface, you can connect to any router interface that is up and active. Generally, you want to use a loopback address because a loopback interface does not go down unless you specifically shut it down. A physical interface or subinterface tied to a physical interface will go down if the cable is disconnected, or there is some other problem that causes the link to go down such as the other end of the link going down.