Lab Objective
Configure a standard ACL and apply it to a router's VTY lines using access-class, restricting SSH access to only a designated management subnet, and verify both an authorized and unauthorized connection attempt.
Lab Purpose
Applying an ACL to a physical interface, as done in earlier labs, controls transit traffic passing through the router. Restricting who can manage the router itself requires a different application point entirely — the VTY lines — which access-class targets specifically.
Lab Topology
R1 (SSH already configured for remote access,
as covered earlier in this series)
Trusted management subnet: 192.168.99.0/24
Untrusted subnet: 192.168.35.0/24Task 1: Create a Standard ACL for Management Access
Create numbered ACL 20 permitting only the trusted management subnet.
Task 2: Apply the ACL to the VTY Lines
Apply ACL 20 to all VTY lines using access-class in the inbound direction.
Task 3: Verify Access from the Trusted Subnet
Confirm a management station on 192.168.99.0/24 can successfully SSH into R1.
Task 4: Verify Access Is Blocked from an Untrusted Subnet
Confirm a host on 192.168.35.0/24 cannot SSH into R1.
Solution and Verification
R1(config)# access-list 20 permit 192.168.99.0 0.0.0.255
-- No explicit deny needed, since the implicit
-- deny at the end of every ACL, discussed
-- earlier in this series, already blocks
-- everything not matching this lineR1(config)# line vty 0 15
R1(config-line)# access-class 20 inManagementPC (192.168.99.20)> ssh [email protected]
Password:
R1>
-- Successfully connects from the trusted
-- management subnetUntrustedPC (192.168.35.50)> ssh [email protected]
% Connection refused by remote host
-- The connection attempt is rejected before
-- even reaching the SSH login prompt, since
-- access-class filters at the line level
-- before authentication is ever attemptedR1# show access-lists 20
Standard IP access list 20
10 permit 192.168.99.0, wildcard bits 0.0.0.255 (3 matches)Key Takeaway
Unlike ip access-group, which is applied to a physical interface to filter transit traffic, access-class is applied specifically to the VTY lines to control management access to the device itself — this distinction matters because a permissive interface ACL says nothing about who can actually log into the router, and vice versa, so both must be considered as entirely separate security controls.