0

I have a Cisco 3750 switch and I want to modify the allow/deny IP addresses that can access it in ssh and "enable" mode. Not sure how, and googling is nearly impossible to get this info it seems.

1 Answer 1

1

As far as i know you cannot set permissions for enable mode based on IP Address.

At very least you could control which IPs are allowed to connect to your switch by SSH/Telnet using ACLs, but once they are connected in user mode they are already connected, so they can invoke the enable privileged mode (of course they should know the password to go further...).

To control SSH access based on IP Address using ACL, the approach would be something like :

ip access-list extended Manage-SSH
permit tcp host 192.168.1.10 host 0.0.0.0 eq 22
permit tcp host 192.168.1.11 host 0.0.0.0 eq 22
deny ip any any log

line vty 0 4
access-class Manage-SSH
transport input ssh

EDIT :

How would I add an IP to allow list, and deny all else, or delete an IP from the allow list already there?

For all this you will have to enter config mode and then edit the ACL :

R1#conf terminal
R1(config)#ip access-list extended Manage-SSH

Then, from here :

  • To allow a new ip (192.168.1.12) :

    R1(config-ext-nacl)#permit tcp host 192.168.1.12 host 0.0.0.0 eq 22
    R1(config-ext-nacl)#end
    
  • To delete an ip (192.168.1.12) just prefix the command with no :

    R1(config-ext-nacl)#no permit tcp host 192.168.1.12 host 0.0.0.0 eq 22
    R1(config-ext-nacl)#end
    
  • Deny all else : Already answered if my original answer.

    You need to end your ACL with :

    deny ip any any log
    

    This means that what is not explicitely permitted with previous permit... command will be denied.


EDIT 2 :

Regarding comments we had, here is a test case.

We are going to :

  1. Create a new allowed access in access-list Manage-SSH
  2. Remove this permission from access-list Manage-SSH

Create :

R1#conf terminal
R1(config)#ip access-list extended Manage-SSH
R1(config-ext-nacl)#permit tcp host 192.168.1.12 host 0.0.0.0 eq 22
R1(config-ext-nacl)#end
R1#show access-lists
Extended IP access list Manage-SSH
    permit tcp host 192.168.1.12 host 0.0.0.0 eq 22
R1#

Delete :

R1#conf terminal
R1(config)#ip access-list extended Manage-SSH
R1(config-ext-nacl)#no permit tcp host 192.168.1.12 host 0.0.0.0 eq 22
R1(config-ext-nacl)#end
R1#show access-lists
Extended IP access list Manage-SSH
R1#

The access-list is now empty.

Now do the same on your ACL 115 (replace Manage-SSH by 115 in all commands) but warning !! Seems that you don't really know what you are doing, so go carefully if we are talking about a live switch.

13
  • My previous tech did it and it allowed only my home office and data center to access the switch. However, I'm looking to whitelist one more IP and not sure how. Is there a way to View what is currently allowed and denied?
    – user124171
    Apr 5, 2014 at 19:40
  • @Chad run show access-lists to display ACLs and permissions for each
    – krisFR
    Apr 5, 2014 at 20:17
  • Thank you. So could I trouble you for two basic examples? How would I add an IP to allow list, and deny all else, or delete an IP from the allow list already there?
    – user124171
    Apr 6, 2014 at 20:22
  • @Chad Ok, i've edited my answer. Do not hesitate to post the output of show access-lists if you want me to be more precise regarding your case.
    – krisFR
    Apr 6, 2014 at 21:14
  • Thank you, I will try this. One question though, what is the "0.0.0.0" and "eq" and "22" mean? I'm guessing 22 is ssh port, naturally but the other two I'm not sure what they are.
    – user124171
    Apr 7, 2014 at 18:42

You must log in to answer this question.