Brocade BigIron RX Series Configuration Guide - Manual (Page 137)

BigIron RX Series Configuration Guide 59
53-1002484-04
Restricting remote access to management functions
3
BigIron RX(config)# access-list 10 permit host 10.10.11.254
BigIron RX(config)# access-list 10 permit host 192.168.2.254
BigIron RX(config)# access-list 10 permit host 192.168.12.254
BigIron RX(config)# access-list 10 permit host 192.64.22.254
BigIron RX(config)# access-list 10 deny any
BigIron RX(config)# telnet access-group 10
BigIron RX(config)# ssh access-group 10
BigIron RX(config)# web access-group 10
BigIron RX(config)# snmp-server community private rw 10
In this example, a Layer 3 VLAN is configured as a remote-access management VLAN and a router
interface. The IP address specified for the router interface becomes the management IP address
of the VLAN.
Restricting remote access to the device to specific
IP addresses
By default, a device does not control remote management access based on the IP address of the
managing device. You can restrict remote management access to a single IP address for the
following access methods.
• Telnet access
• Web Management access
• SNMP access
In addition, if you want to restrict all three access methods to the same IP address, you can do so
using a single command.
The following examples show the CLI commands for restricting remote access. You can specify only
one IP address with each command. However, you can enter each command ten times to specify
up to ten IP addresses.
NOTE
You cannot restrict remote management access using the Web management interface.
Restricting Telnet access to a specific IP address
To allow Telnet access to the device only to the host with IP address 209.157.22.39, enter the
following command.
BigIron RX(config)# telnet client 209.157.22.39
Syntax: [no] telnet client <ip-addr> | ipv6 <ipv6-addr>
Restricting SSH access to a specific IP address
To allow SSH access to the device only to the host with IP address 209.157.22.39, enter the
following command.
BigIron RX(config)# ip ssh client 209.157.22.39
Syntax: [no] ip ssh client <ip-addr> | ipv6 <ipv6-addr>