IOS 15 and VTY ACL problem

[Bela Mareczky]

Dear Community!

We have recently installed a C2951 router running 15.0(1) IOS version. However, we have a problem configuring VTY ACL. While trying to login to the router via SSH, the VTY ACL has some matches regarding the SSH client IP address, but the router refuses the SSH connection when the "VTY_ACL" standard named ACL is configured on line vty (marked with red color). If no VTY ACL has assinged to the router line vty, the SSH connection is OK.

The current configuration seems to be OK, see below:

...

[There is some AAA configuration, including TACACS+ and finally the local auth at the end of the sequence list.)

...

line vty 0 4

access-class VTY_ACL in

timeout login response 10
transport preferred none
transport input ssh
transport output ssh
!

ip access-list standard VTY_ACL
permit [host IP]
permit [subnet range] 0.0.0.255
!

Could someone help us to solve this problem? Does anybody have any experience about this issue?

Thanks in advance!

Best Regards,

Belabacsi

[spremkumar]

Hi

Are you doing the ssh from the permitted subnet block ?

have you enabled logs in the router to check the syslogs to see what's exactly happening when you try to ssh?

regds

[Bela Mareczky]

Dear spremkumar!

Thanks for Your help, sorry for late answer. The problem is still exists: the VTY_ACL permits the source IP address originating SSH connection, and the ACL has permit matches...

We have tried to upgrade IOS image to v15-T release, but no luck :-( We have configured another router running IOS v15 also, but it is the same...

Do You have any experience about this issue?

Thanks and BR

Belabacsi

[Bela Mareczky]

Dear spremkumar!

Thanks for Your help, resolved :-)

The problem was that, in IOS v15 the per-VRF ACL configuration requires the "in vrf-also" parameter.

!

line vty 0 4
access-class VTY_ACL in vrf-also
timeout login response 10
transport preferred none
transport input ssh
transport output ssh
!

Regards,

Belabacsi

Budapest, Hungary

[wzhang · Accepted solution]

Hi,

What you see is the correct behavior. This was a problem in earlier versions of IOS (allowing ssh even without the "vrf-also" option) that we had corrected in 15.0(1)M and later, please see:

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsv86113

Thanks,

Wen