Hello Clement,
How about this for telnet :
telnet@er01-par01(config)#telnet access-group ?
ASCII string Standard Access List Name
<1-99> Standard IP access list
ipv6 IPv6 Access control list
an this for SSH :
telnet@er01-par01(config)#ip ssh client ?
A.B.C.D IP address
ipv6 IPv6 address
telnet@er01-par01(config)#ip ssh source-interface ?
ethernet Ethernet interface
loopback Loopback interface
pos POS interface
ve Virtual Ethernet interface
telnet@er01-par01(config)#ip ssh st
strict-management-vrf Allow SSH connections only from
management-vrf
Best regards.
2016-02-26 15:21 GMT+01:00 Clement Cavadore <clement@cavadore.net>:
> Hello Youssef,
>
> Thanks for your reply, but I cannot do that (applying it on a Ve --
> management interfaces are used for something different), since the VDX
> is being used as a router.
> Correct me if I'm wrong, but if I apply an ip access group, all the
> routed traffic will be impacted by the ACL.
>
> I am just interested in applying such an ACL to the traffic towards the
> switches itselves...
>
> Clément
>
>
> On Fri, 2016-02-26 at 15:15 +0100, Youssef Bengelloun-Zahr wrote:
> > Dear Clement,
> >
> >
> > I personnally restricted access to the box via an ACL applied directly
> > under the interface I'm interested in.
> >
> >
> > For instance, for OOB interface :
> >
> > interface Management 1/0
> > no tcp burstrate
> > ip icmp unreachable
> > ip icmp echo-reply
> > no ip address dhcp
> > ip address 10.75.1.21/24
> > ip access-group AUTHORIZED-V4-SUBNETS-FOR-MANAGEMENT in <====
> > ipv6 icmpv6 unreachable
> > ipv6 icmpv6 echo-reply
> > no ipv6 address autoconfig
> > no ipv6 address dhcp
> > !
> >
> >
> > I believe it should be the same for the other interfaces.
> >
> >
> > HTH.
> >
> >
> >
> > 2016-02-26 14:54 GMT+01:00 Clement Cavadore <clement@cavadore.net>:
> > Hi,
> >
> > I have a couple of VDX in a fabric which run BGP & so on over
> > public IP
> > adresses. They are accessible using SSH on their outband
> > interface, and
> > also in inband, and I cannot figure out where we could
> > restrict it to
> > some access lists. => I am looking for the equivalent of
> > "telnet/ssh
> > access-group XX" in NOS 4.1.x.
> >
> > Anyone know that ?
> >
> > Thanks !
> > --
> > Clément Cavadore
> >
> > _______________________________________________
> > foundry-nsp mailing list
> > foundry-nsp@puck.nether.net
> > http://puck.nether.net/mailman/listinfo/foundry-nsp
> >
> >
> >
> > --
> > Youssef BENGELLOUN-ZAHR
> >
>
>
>
--
Youssef BENGELLOUN-ZAHR