SG300-10 - need help with ACL

We recently received a SG300-10 switch and we need assistance in the creation of an access list for SSH access. The switch is running

1.3.0.62 SW version. We want to make sure the SSH access is allowed only from the 192.168.1.0 network. We would also like all attempts to the connected port tcp 22 for SSH. Right, SSH is now accessible from any IP including external (Internet). Here's what we have at the moment. The switch has an IP address of 192.168.1.7.

...

SSH_access extended IP access list

ip permit 192.168.1.0 0.0.0.255 192.168.1.7 0.0.0.0

output

ssh line

exec-timeout 0

output

...

The external (Internet) users can still try and SSH in. Please notify.

You have defined an ip access list. Those who are for routed traffic filtering, is not to control access to the switch itself. What more, it seems that you don't activate it on any interface (via the access-class command), so it has no effect at all.

To control access to the switch itself, you must define a list of management access and activate it with the management access-class command. Unfortunately the syntax of these differs slightly from the standard ACL. For example:

management of the access-list SSH_access

ip-source service permit 192.168.1.0 mask 24 ssh

https service permit

deny

output

management of the access-class SSH_access

allow SSH for the 192.168.1.0 network and HTTPS everywhere, but reject everything else (IE. Telnet or HTTP). Details can be found in ch. 11 "ACL management orders" the CLI Guide 300 series.

HTH

Tilman

Tags: Cisco Support

Similar Questions

  • IOS VPN with NAT need help with ACL?

    What I forget? I have tried other positions, studied bugs known with 12.2 (13) T1, etc. workaround solutions, but perhaps my other choice of configuration interfere with my VPN configuration.

    I can connect, authenticate locally, very well. Stats of Cisco VPN client 3.6.3 show I'm Encrypting traffic on the protected networks, but I can not all traffic through internal hosts once I've connected.

    I removed security tags and replaced all the public IP addresses to fake in hope that someone can point me to what is obvious!

    Thank you very much.

    ----------

    Current configuration: 5508 bytes

    !

    ! 22:24:38 PST configuration was last modified Thursday February 20, 2003 by kevin

    !

    version 12.2

    horodateurs service debug uptime

    Log service timestamps uptime

    encryption password service

    !

    AAA new-model

    !

    AAA authentication login userauthen local

    AAA authorization groupauthor LAN

    AAA - the id of the joint session

    IP subnet zero

    !

    IP domain name mondomaine.fr

    name of the IP-server 199.13.28.12

    name of the IP-server 199.13.29.12

    !

    IP inspect the audit trail

    IP inspect high 1100 max-incomplete

    IP inspect a high minute 1100

    inspect the tcp IP Ethernet_0_1 name

    inspect the IP udp Ethernet_0_1 name

    inspect the IP name Ethernet_0_1 cuseeme

    inspect the IP name Ethernet_0_1 ftp

    inspect the IP h323 Ethernet_0_1 name

    inspect the IP rcmd Ethernet_0_1 name

    inspect the IP name Ethernet_0_1 realaudio

    inspect the IP name smtp Ethernet_0_1

    inspect the name Ethernet_0_1 streamworks IP

    inspect the name Ethernet_0_1 vdolive IP

    inspect the IP name Ethernet_0_1 sqlnet

    inspect the name Ethernet_0_1 tftp IP

    inspect the IP name Ethernet_0_1 http java-list 99

    inspect the name Ethernet_0_1 rtsp IP

    inspect the IP name Ethernet_0_1 netshow

    inspect the tcp IP Ethernet_0_0 name

    inspect the IP name Ethernet_0_0 ftp

    inspect the IP udp Ethernet_0_0 name

    audit of IP notify Journal

    Max-events of po verification IP 100

    !

    crypto ISAKMP policy 3

    BA 3des

    preshared authentication

    Group 2

    ISAKMP crypto nat keepalive 20

    !

    ISAKMP crypto client configuration group vpngroup

    xxxxxxxxx key

    DNS 199.13.28.12 199.13.29.12

    domain mydomain.com

    pool vpnpool

    ACL 110

    !

    !

    Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

    !

    Crypto-map dynamic dynmap 10

    Set transform-set RIGHT

    !

    !

    map clientmap client to authenticate crypto list userauthen

    card crypto clientmap isakmp authorization list groupauthor

    client configuration address map clientmap crypto answer

    10 ipsec-isakmp crypto map clientmap Dynamics dynmap

    !

    MTA receive maximum-recipients 0

    !

    !

    interface Ethernet0/0

    Description connected to the Internet

    IP 199.201.44.198 255.255.255.248

    IP access-group 101 in

    NAT outside IP

    inspect the IP Ethernet_0_0 in

    no ip route cache

    no ip mroute-cache

    Half duplex

    clientmap card crypto

    !

    interface Serial0/0

    no ip address

    Shutdown

    !

    interface Ethernet0/1

    Connected to the private description

    IP 192.168.1.254 255.255.255.0

    IP access-group 100 to

    IP nat inside

    inspect the IP Ethernet_0_1 in

    Half duplex

    !

    IP local pool vpnpool 192.168.2.201 192.168.2.210

    period of translation nat IP 119

    !!

    !! -removed the following line for VPN configuration

    !! IP nat inside source list 1 interface Ethernet0/0 overload

    !! -replaced by the next line...

    IP nat inside source map route sheep interface Ethernet0/0 overload

    IP nat inside source 192.168.1.1 static 199.201.44.197

    IP classless

    IP route 0.0.0.0 0.0.0.0 199.201.44.193 permanent

    IP http server

    7 class IP http access

    local IP http authentication

    !

    access-list 1 permit 192.168.1.0 0.0.0.255

    access-list 5 permit 192.5.41.40

    access-list 5 permit 192.5.41.41

    access-list 5 refuse any

    access-list 7 permit 192.168.1.0 0.0.0.255

    access-list 7 refuse any

    access-list 99 refuse any

    access-list 100 permit udp any eq rip all rip eq

    access-list 100 permit tcp 192.168.1.1 host any eq www

    access-list 100 permit ip 192.168.1.1 host everything

    access list 100 permit tcp host 192.168.1.2 any eq www

    access-list 100 permit ip 192.168.1.2 host everything

    access-list 100 deny ip 192.168.1.253 host everything

    access ip-list 100 permit a whole

    access-list 101 deny host ip 199.201.44.197 all

    access-list 101 permit tcp any host 199.201.44.197 eq 22

    access-list 101 permit tcp any host 199.201.44.197 eq www

    access-list 101 permit tcp any host 199.201.44.197 eq 115

    access-list 101 permit icmp any host 199.201.44.197

    access list 101 ip allow any host 199.201.44.198

    access-list 101 permit tcp any host 199.201.44.197 eq 8000

    access-list 101 permit tcp any host 199.201.44.197 eq 8080

    access-list 101 permit tcp any host 199.201.44.197 eq 9090

    access-list 101 permit udp any host 199.201.44.197 eq 7070

    access-list 101 permit udp any host 199.201.44.197 eq 554

    access-list 110 permit ip 192.168.1.0 0.0.0.255 any

    access-list 115 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

    access-list 115 permit ip 192.168.1.0 0.0.0.255 any

    !

    sheep allowed 10 route map

    corresponds to the IP 115

    !

    Line con 0

    exec-timeout 0 0

    password 7 XXXXXXXXXXXXXXX

    line to 0

    line vty 0 4

    password 7 XXXXXXXXXXXXXXXX

    !

    NTP-period clock 17208655

    source NTP Ethernet0/0

    peer NTP access-Group 5

    NTP 7 use only group-access

    NTP master 3

    NTP 192.5.41.41 Server

    NTP 192.5.41.40 Server

    !

    end

    ----------

    Config looks OK, you should be able to get for each internal host EXCEPT 192.168.1.1 with this configuration. If you do a ' sho cry ipsec his 'you see Pkts Decaps increment, indicating that you see the traffic of the remote client? " Do you not see Pkts Encaps increment, indicating that you send a response réécrirait the client to the internal host.

    For what is 192.168.1.1, because you have this:

    > ip nat inside source 192.168.1.1 static 199.201.44.197

    It substitutes for this:

    > ip nat inside source map route sheep interface Ethernet0/0 overload

    for this host traffic only and therefore back for just this host is always NAT would have even if you don't want it to be. To work around to send traffic to this host through an interface of closure with no NAT enabled on it, that it is NAT would have stops and allows you to connect via VPN. You can see http://www.cisco.com/warp/public/707/static.html for a detailed explanation, but basically, we must add this:

    loopback interface 0

    IP 1.1.1.1 255.255.255.0

    interface ethernet0/1

    Static IP policy route map

    permissible static route map 10

    match address 120

    set ip next-hop 1.1.1.2

    access-list 120 allow host ip 192.168.1.1 192.168.2.0 0.0.0.255

  • I'm suddenly needing help with my browser Firefox (6.0.2)

    Hello
    I'm suddenly needing help with my browser Firefox (6.0.2)

    (OS: I use Windows XP).

    When I open the browser, I don't see is a totally white screen of white, with all the toolbars at the top.

    I know that my physical connections are very good: I have tested the modem, turned the pc market etc and I can also receive/send emails.

    This problem started today, September 8, 2011 and has never happened before.

    Is it a coincidence that Firefox itself to day before I disconnected yesterday evening? Could this be something to do with this particular new update?

    I also noticed that just before I "opened" Firefox, I now get a small box indicating:

    [JAVASCRIPT APPLICATION]
    Handl exc in Ev: TypeError: this oRoot.enable is not a function

    This never appeared before - I hope that it offers a clue has what is wrong.

    The browser not be stuck in Mode safe, said by the way.

    Of course, I can't find solutions to the problem on the internet, I don't physically see all Web sites!
    (A friend sends this request in my name from their pc)

    Any light you can throw on this problem of confusion would be much appreciated. I'd rather not have to uninstall and reinstall Firefox if possible.

    If the only option is to uninstall Firefox and reinstall from your site, I'm also in trouble (I can not see the internet or download).
    In this case, would you be able to send the .exe file as an attachment to my e-mail address? In the affirmative, please let me know and I'll give you more details.

    Thanks in advance.

    One possible cause is security software (firewall) that blocks or limits Firefox or plugin-container process without informing you, possibly after the detection of changes (update) for the Firefox program.

    Delete all rules for Firefox in the list of permissions in the firewall and leave your firewall again ask permission to get full unlimited access to the internet for Firefox and the plugin-container and the update process.

    See:

    Start Firefox in Firefox to solve the issues in Safe Mode to check if one of the extensions of the origin of the problem (switch to the DEFAULT theme: Firefox (Tools) > Add-ons > appearance/themes).

  • Need help with installation on Photosmart C7280 all-in-one

    I had my printer is installed and has been using the printer for 3 wireless laptops in my house.  Now, I can't even find my backup drive, so I have need help with downloading the software to use my printer and also get to use wireless.   I don't know what happened, but the fax for this printer is listed, but not the printer itself.   Help, please!

    Click here to download the software for your printer:

    http://h10025.www1.HP.com/ewfrf/wc/softwareCategory?product=3204785 & LC = on & CC = US & DLC = in & lang = to & CC = US

    has chosen the appropriate operating system that corresponds to your computer and download the full software features.

  • HP laptop: need help with internet and search for things

    whenever I'm on chrome internet explore google ect and go to tab it is says unknown error or no internet connection or anything and just takes me chrome ect. I need help with this im involved in a byod class and my computer won't let me on what whatever usually it just starts out black and white and the seeds I my search request

    Yes it's a Windows 10 and it arrived already installed I'll take the other info now

  • Need help with the installation of an adapter of Palit GeForce 9500GT Super chart - 512 MB in a M2N68 (narrated

    Need help with the installation of an adapter of graphics Super Palit GeForce 9500GT - 512 MB - DDR2 SDRAM in a M2N68 motherboard (narra6). Should I disable the onboard graphics in the bios? When the card is installed, no VGA work outs and the PC does not start. Checked and recontroler implementation of the card in the PCI slot. PC is a desktop HP G5200uk PC. Windows 7 operating system.

    Hello

    The link below is a guige to install a video card in your Pc.  In particular, it seems that you will have to perhaps specify the location of the new card in the bios and save this change before you install the new card - see step 4 in the guide on the link below.  If your new card fits into the PCI Express x 16 slot, you will need to define PCI Express in the bios and save the changes.

    http://support.HP.com/us-en/document/c01700855

    Kind regards

    DP - K

  • need help with my window is in thai and I do not understand to all.how to convert to English?

    need help with my window is in thai and I don't quite understand.
    How to convert to English? I tried for days but still it cannot be changed.
    because I can't read thai... Please help me step by step...

    my pc is touchsmart 9100 windows 7 Professional.

    Not a single word is in English if I go to the "region and language" to change.

    Everthing is in thai in the system.

    Hello

    Where have you bought the PC?

    What is the operating system installed?

    Best regards

    ERICO

  • I need help with an installation failure to interpret and troubleshoot a Setup log.

    Background: A few years ago, many editors of cinema used Final Cut Pro 6 (also contained in Final Cut Studio 2) for their editing projects.  Shared Apple Final Cut X uses a different format that is not compatible with FCP6.  Sometimes, these editors are called to work on a few historical projects that have been published in FCP6 and need this version to run now.

    Starting with OS X Lion, FCP6 would install not in Lion and thereafter.

    According research by Jeremy Johnston as noted on his blog, he discovered that Apple has inserted a file in the folder CoreServices in the Library folder of the system folder that causes versions the version Final Cut Pro X (and other older Apple programs in the same situation) do not settle.  He suggested changes to this file that would seek to prevent interfering with the installation of FCP6 in Lion, many users of final cut PRO 6 were successful in their efforts to install in Lion and work with it.

    Later in a discussion update on installing FCP6 in Mavericks, HawaiianHippie determined that the simplest way to perform the installation of FCP6 was simply copy this file and remove it from the system folder, install FCP6 and then restore the copied file:

    https://discussions.Apple.com/message/26309669#26309669

    I used this method with success to install FCS2 in Yosemite:

    [click on images to enlarge]

    However, in my attempts to install FCS2 in El Capitan, it fails in the last 5% to install the first DVD:

    First of all, I need advice on how to display an extremely large Setup log in this thread (on MacRumors, it is a method to insert a 'code' in a small box that can be the object of a scrollbar if necessary to read all along).  I am unable to find such a method to post here.

    Then once approved, I need help to determine which component is causing the installation to fail and perhaps this element can be omitted from the installation:

    If this element is not required, then maybe FCP6 can be installed successfully without it.  And if that omitted element is necessary, perhaps a manual method to install it can be determined by pacifists.

    It is my goal to help those who need to install and use FCP6 on their new Macs running El Capitan.

    Here is the post on MacRumors with pre-installed Setup log:

    http://forums.MacRumors.com/threads/i-need-help-with-an-installation-failure-to-interpret-and-troubleshoot-an-Installer-log.1954786/#post-22541389

  • Need help with the port forwarding for a XBox remote Streaming

    I have a router R6200v2 and need help with port forwarding.

    I came across this set of instructions for setting up stream port forwarding XBox remotely from anywhere

    http://kinkeadtech.com/2015/07/how-to-stream-Xbox-one-to-Windows-10-from-anywhere-with-Internet/

    I have no idea when it comes to such things and I want to make sure I do it correctly without messing up my existing home network.

    Port Forwarding and triggering Port pages setup look very different from what the guy uses. Can someone walk me through what I do to set up please?

    Hi @varxtis,

    You must enter them in the field for a start external Port and external completion Port. You will need to send individually except for the range of 49000-65000. The steps are as follows.

    1. create a Service name (it could be something else that you cannot use the same service name twice. Ex. XBOX1, XBOX2 and so forth.)

    2. Select the type of service (TCP, UDP or both)

    3 entry 5050 times a start external Port and external endpoints.

    4. Select the IP address of your XBOX.

    5. Select apply.

    6 do the same for other port numbers. To the beach, use 49000 for the external departure Port and for the external completion Port 65000.

    Kind regards

    Dexter

    The community team

  • Need help with network home using Airport extreme

    I need help with my home network.  I'm not very aware when it comes to all things network.  Here's how my network is currently set up.

    Cable modem to Airport Extreme for Gigabit Switch.  Cables come out of the switch to all areas of the House.  I have 2 other extreme airport connected in other rooms of the House directly on the wall that dates back to the switch.  I hope I am explaining that properly.

    My problem is that this seems to have caused some of my connections cable does not work.  When everything is configured, it has worked well.  All connections in the House worked.  Then we have disconnected one of the extreme airport and moved to another location in the House to have the best wifi coverage.  Since that time, a lot of the ethernet wall plugs are not working.  For example, when I plug in my Macbook Pro in making ethernet in my kitchen, it says connected but it has an assigned ip address and cannot connect to the internet.

    Any help you can provide would be great.

    I would like to get the return tech to help you to...

    But it is likely that something (or someone) has tampered with the settings.

    The layout is fine... but you can cause problems with the network by creating a loop.

    This can happen because the AE you moved is connected wrongly... somewhere in the network it is connected to the switch again.

    Or AE is set to expand wireless... It's FAKE... It will loop the network on the back main EI wireless.

    Unplug the two AE you have that function as extensions...

    Turning off everything else... then it works again...

    Do it in this order.

    Modem... Wait 2 min

    AE... Wait 2 min

    Switch.

    Now check that the network is working properly... power of customers in various locations and make sure everything is good.

    If so, then manually reset the two AE of factory and redo their installation.

  • Need help with my Y40-80? power management

    I get message to the center of the Action as follows:

    Compatibility problem between your power management system and Windows

    Your power management system is not compatible with this version of Windows.

    The name of the model of your power management system is ACPI Lenovo compatible virtual controller.

    Can anyone help please. I have windows running Y40-80 8.1 is a clean install of windows 8.1 x 64 all drivers are up to this day, just need help with the question above thank you

    Lenovo today released a new bios update for Y40-80 laptops, I did the update and, so far, the error message that I posted above has not appeared again so set the mite of update of the bios not sure yet, I'll keep up to date on this subject and write again soon

  • I need help with the program of Photos on my macbook pro

    I use a Macbook Pro with OS of Yosemite. I really need help with the Photo program. I never really got the hang of IPhoto and now that it's a new program, I'm really confused. Where can I go to learn this without waiting for the next workshop in a local store?

    Hi, I'm fighting to open same mine, making a new software update

  • Need help with the launching track pack for forza code 4

    Bought new Forza 4 and the lancer Track Pack code does not work, how do I get a code that is generated in the form I've already paid for it. Rank of loads of numbers and sent 10 s of emails but cant seem to get help.

    This is the help I get when the cat to an Ambassador xbox on xbox.com

    Terry wrote:
    Need help with the launching track pack for forza code 4
    The Xbox Ambassador says:
    Location of Ambassador of the community...
    The Xbox Ambassador says:
    Location of Ambassador of the community...
    The Xbox Ambassador says:
    Your question will be answered by an Ambassador of the Xbox. You have been connected to the Ambassador as a user Xbox [3]
    The Xbox Ambassador says:
    Hello
    Terry wrote:
    Hello
    The Xbox Ambassador says:
    Hey
    Terry wrote:
    just to be on the phone to xbox live support and was told to come here
    The Xbox Ambassador says:
    ok\
    The Xbox Ambassador says:
    What is your problem?
    Terry wrote:
    I bought the 4 for forza ansd 360 new sealed Christmas...
    Terry wrote:
    has got 2 codes that accompanies the game but the pack track code does not work
    The Xbox Ambassador says:
    Wow good
    Terry wrote:
    whenever I put in the code it says code redeemed
    The Xbox Ambassador says:
    I think the code is used. You must return to the retailer
    Terry wrote:
    I tried to, but since I already opened the case they will not accept
    The Xbox Ambassador says:
    Oh. No,
    Terry wrote:
    the code had been used or defective as I am the only person who has touched the game once opened, tried to enter the code when it is open
    The Xbox Ambassador says:
    Maybe it was auto bought?
    Terry wrote:
    so, how do I get another code generated track Pack if defective?
    The Xbox Ambassador says:
    I do not know.
    Terry wrote:
    bought the game new, so I get the track pack
    The Xbox Ambassador says:
    Oh. It's bad.
    The Xbox Ambassador says:
    I think that if you Exchange 1 code it will buy it
    Terry wrote:
    car pack code worked, starter pack did not work
    The Xbox Ambassador says:
    Oh.
    The Xbox Ambassador says:
    It's a bad
    The Xbox Ambassador says:
    BTW you have an evolution of the tests?
    Terry wrote:
    Yes, I want to? but more anxious to get a code object generated for this pack
    The Xbox Ambassador says:
    Hey if I help can u give me this game too?
    Terry wrote:
    ?????????????????
    Terry wrote:
    So is it possible to get a code for that time?
    The Xbox Ambassador says:
    Hey
    The Xbox Ambassador says:
    Yes.
    The Xbox Ambassador says:
    you need to contact them
    The Xbox Ambassador says:
    and tell them that the code is used.
    Terry wrote:
    I was told to come here? where can I go to get the code?

    Hi Terryg76,

    ·         What version of the operating system is installed on the computer?

    I suggest you to contact the game manufacturer for more help and information.

  • [Error number: 0x8024400A] Need help with this error... I reinstalled XP SP1 and I can't get an auto update that's simple to install, just get this error every time

    [Error number: 0x8024400A] Need help with this error... I reinstalled XP SP1 and I can't get an automatic update that's simple to install, just get this error at each time HHHHEEEELLLPPPPP! Thank you

    I had the same problem.  But finally found a solution.  If your listing is similar to mine, then keep.  XP Media Center Edition 2005 (sp2).  AMD Athlon 64 x 2 Dual-Core, HP a1630n desktop computer.

    Go to the HP website, search for sp37394-XP sp3 Upgrade utility Microsoft for systems equipped with AMD processors.

    I had the same 0 x 80240036, 0x8024400a error, but realize my problem was really get manually downloaded sp3 and installed without continue loop crashing and not error messages.

  • I still need help with a thumbnail view in video files Real Player XP sp 3

    I still need help with thumbnail view in video files Real Player XP sp 3-Help! Help! Help!

    You will need to contact the support of Real Player, since the problem occurred with their program.

Maybe you are looking for

  • Portege 7200 upgrade to 320 MB memory

    I just upgraded my 7200 to 320MB it's 128 MB, but now Windows XP do not work and both come with the Blue Screen of Death. This happens at different times in the boot sequence and with different patterns.I reformatted the hard drive several times and

  • DeskJet 3510

    Hello, I recently got a 3510 e deskjet all-in-one. the scanner does not work. message arrives and says that the componet scanner is broken. turn, then turn it on again. I tried and still says the same thing. has obtained a new driver for it and alway

  • M1212nf hear a beep after each print job

    I've had my M1212nf for a few years now.  I moved last week.  I plugged it in to my new place and he started printing and scanning very well.  However, he paged now after each print job.  Clues? That someone else has proposed to the Board of Director

  • Kaspersky gave me a blue screen on my vista machine?

    That's what I got after I restarted my computer from a blue screen saying to restart my vista machine.  He has Vista business with sp1 and 2, and it is 32-bit. Any help would be great. Doesen't software must be updated and the only current to run ant

  • Monitor 23xiLED

    Hello, I just bought this monitor for my computer to ol 12yr 23xiLED but I can't get the drivers so that it loads up or software, I now know must Explorer 8 and I don't have that but what about drivers, will not they install anyway? I have to use as