Sorry for the naive question; a quick reading of the cisco docs doesn't answer this question...

So I've got a router (say for the sake of argument a 4500 running IOS 15.x)

It has interfaces in 3 different subnets --,, and It also has a loopback address of

How do I make it so that SSH / SNMP and other administrative traffic works on the 172 address but doesn't work on the IP addresses I wish to only use for L3 forwarding?

Ideally this can be done by disabling the control plane access to these interfaces not just by using an ACL, but whatever, I don't actually care that much as long as it works...



You can't disable the daemon on a interface. ACL are the way to go. Filtering should be done on the source address, not destination.

Config example:

line vty 0 4
 access-class secure_vty in
 ipv6 access-class secure6_vty in

ip access-list standard secure_vty
 deny any

ipv6 access-list secure6_vty
 deny ipv6 any any

In this config, is your management network where you have your NMS, and you have no ipv6 on the NMS but there is some on the switch, so it has to protected.

Be sure also to disable sshv1 which is enabled by default :

Router(config)# ip ssh version 2
  • So this means the NMS would be able to SNMP walk / ssh any of the IPs on the router? – chris Nov 21 '12 at 17:05
  • @Chris: ssh/vty yes, if the IPs are routed from the NMS. snmp needs its own acl: snmp-server community <communityString> ro <aclNumber>. – petrus Nov 21 '12 at 18:40

Control Plane Policing would be the cleanest implementation

First, create an ACL that MATCHES traffic which you will ultimately drop

ip access-list extended DROP
 permit tcp any host eq 22
 permit tcp any host eq 22
 permit tcp any host eq 22
 permit udp any host eq snmp
 permit udp any host eq snmp
 permit udp any host eq snmp

Next, create a class-map that matches the ACL you created above:

 match access-group name DROP

Next, create a policy-map with action DROP on the desired traffic


Finally, apply the Control plane policing to your control plane

 service-policy input CONTROL_PLANE_POLICING

Any traffic destined for the control plane which does NOT match your access list will PASS (this includes SNMP and SSH traffic destined for the Loopback address)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.