ACL to restirct ssh on Cisco ASR

[mahesh18]

Hi Everyone,

Need to confirm on Cisco ASR which is accessible via management interface

ho ip vrf interfaces
Interface IP-Address VRF Protocol
Gi0 10.x.x.x Mgmt-intf up

But seems all other interface with public ip also responds to ssh request from outside world.

To fix this i can config standard ACL  like

ip access-list standard SSH-ACCESS
 permit 10.1.2.x 0.0.0.255

then under 

line vty 0 15
 access-class SSH-ACCESS in 

or i need

line vty 0 4
 access-class SSH-ACCESS in vrf-also?

This should block login prompt to outside world right?

Regards
Mahesh

[Julio E. Moisa · Accepted solution]

Hi

That is correct, it should work as you expect. 

in vrf-also; it is used if you are going to reach it via any IP into a VRF.

:-)

[mahesh18]

do i need vrf-also in config under vty?

[Julio E. Moisa · Accepted solution]

Hi

That is not required if you are using the global table, but if you are going to reach the device through any IP address into a specific VRF, yes you need to include it. 

Check this link:

https://www.cisco.com/c/en/us/support/docs/ip/telnet/200718-Configure-Telnet-SSH-Access-to-Device-wi.html

:-)

[Reza Sharifi · Accepted solution]

Hi Mahesh,

When you login to the router from the outside (Internet) you are not logging using IP 10.x.x.x

You are most likely using the outside interface on the router with public IP which connects to the provider.

Can you verify?

If yes, you just need an acl in "in" direction on the public interface on the router, so no one can login from outside. Is that what you are trying to do?

Reza

[mahesh18]

Hi Reza,

I am logging into the Router via management network which has vrf and IP in subnet 10.0.0.x
We do not need anyone login prompt for ssh login if someone from outside want to ssh to router
on its public ip address

Regards
Mahesh

[Reza Sharifi · Accepted solution]

Ok, than what you have should work and no need for ACL for vrf.

What confused me was this statement

This should block login prompt to outside world right?
Good Luck
Reza