Restric telnet access

nawas · ‎09-29-2009

I have MSFC with tons of vlans in them and I can telnet/ssh to any

vlan by typing telnet x.x.x.x. I want to be able to telnet to only

mgmt interface such as loopback0. What is the best way to achieve this?

Is it possible without the ACL?

Collin Clark · ‎09-29-2009

Take a look at Management Plane Protection.

http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/htsecmpp.html

You'll have to use the feature navigator to see if it's available on your particular switch(es).

Hope that helps.

Mark Yeates · ‎09-29-2009

Nawaz,

Please see the following discussion that that shows how to configure CoPP in the manner that you wish to configure.

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=Network%20Management&topicID=.ee71a02&fromOutline=&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cd49240

HTH,

Mark

nawas · ‎09-29-2009

Thank guys for the quick help. I assume the this will work even if I have Hybrid or native code on my 6500. (Of course MSFC will be IOS)

Collin Clark · ‎09-29-2009

MPP will be IOS only. Currently it is available in T code for routers, but you'll need to check for switches.

Mark Yeates · ‎09-29-2009

Not necessarily, Since CoPP is a relatively new feature it is only available on the newer IOS releases. I don't believe CatOS supports this. What version is your MSFC running?

http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6642/prod_white_paper0900aecd804fa16a.html

Mark