Secure Router VTY with ACL: Only Management Host Allowed

Bundle lab

Configure a standard IPv4 ACL and bind it to the VTY lines on the HQ router so only the dedicated management host can SSH to it. Confirm that regular routed traffic between sites is unaffected, and prove both a permitted and a denied management attempt.

Learning objectives

• Build a standard IPv4 ACL that permits a specific management host and denies others
• Apply the ACL correctly to VTY lines using the access-class command
• Maintain end-to-end routed data connectivity while restricting management-plane access
• Verify permitted and denied VTY access from different hosts
• Troubleshoot common ACL and access-class misconfigurations

Troubleshooting focus

• SSH is blocked from every source, MGMT-HOST included: Confirm the permitted host address is exactly 10.10.10.10 and that its permit sits above any broader denies.; Ensure SSH is fully configured: username with secret, ip domain name, RSA key, ip ssh version 2, login local, and transport input ssh.
• ssh admin@10.0.23.1 from USER-HOST still reaches a login prompt: Ensure the deny any is in place. The implicit deny exists, but a stray broader permit shadows it.
• Pings between hosts fail after the change: You may have applied the ACL to a physical interface, or used an extended ACL incorrectly. Remove any interface access-group and keep the control on the VTY lines only.; Validate static routes in each direction; branch defaults point to HQ and HQ has specific routes back to both LANs.