Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have configured a couple of VLANs on a Cisco Catalyst switch with IOS, i will put all the ports that clients is connected to, into these VLANs. I want to configure the native VLAN [vlan 1] as management VLAN so i can use a telnet client to connect to the switch.

How can i block all but one specific IP-address to telnet into the switch? As i understand vlan 1 has many task regarding different protocols and i do not want to break that but only allow one specific IP-address to connect to the switch with a telnet client [actually the gateway ip address of the switch].

share|improve this question
IOS or CatOS? Version? – pehrs Apr 17 '10 at 9:29
I forgot to mention that i the post. It is IOS – cha789 Apr 17 '10 at 9:31
It's bad form to use VLAN 1 for anything but a parking vlan for unused ports. – Zypher Apr 17 '10 at 18:01

You can apply an ACL just to management access. For instance:

! replace x.x.x.x with the IP to permit
access-list 1 permit host x.x.x.x

! some switches range from 0 to 15 instead of 0 to 4, adjust as necessary
line vty 0 4
 access-class 1 in

This applies standard access list 1 to just inbound access on virtual terminals (which includes telnet and ssh access), irrespective of VLAN. You can use a more sophisticated access-list if needed. Chopper3 provided a good link for that.

share|improve this answer

I'd suggest you use an ACL - they can be quite complex to setup but HERE is Cisco's guide on how to.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.