Got it

Configuring ACL to restrict user login failure

Created: Feb 29, 2020 09:19:28Latest reply: Feb 29, 2020 09:21:46 495 1 0 0 0
  Rewarded HiCoins: 0 (problem resolved)

Hi all,

On the USG9520 firewall, access the user's NMS network through the out-of-band management port of the main control board, and deploy an ACL in the VTY view on the firewall to restrict some IP addresses from logging in to the device, but the allowed IP addresses in the ACL's rule list also cannot log in to the firewall, the interface has been properly configured with service-manage.

Software Version: V500R001C30SPC100


2. Some key configurations are as follows:

#

acl number 2077 // Allow some IP addresses to log in to the firewall

  rule 5 permit source 218.15.240.0 0.0.0.31

  rule 10 permit source 14.119.127.0 0.0.0.255

  rule 15 permit source 192.168.1.0 0.0.0.255

  rule 100 deny

#

interface GigabitEthernet0 / 0/0 // Outband network management interface configuration

  description TO_ZH-HZ-8905_GE2 / 1_MGMT

  ip binding vpn-instance default

  ip address 14.x.x.38 255.255.255.252

  service-manage https permit

  service-manage ping permit

  service-manage telnet permit

#

user-interface vty 0 4 // vty view calls acl to restrict login

  acl 2077 inbound

  authentication-mode aaa

  protocol inbound all

#

Please help me, Thanks!


Featured Answers
jason_hu
Admin Created Feb 29, 2020 09:21:46

Hi ster,

Because the out-of-band management interface of the USG9520 main control board is bound to the default VPN instance by default, common ACL rules do not take effect. Therefore, you need to add the VPN-instance keyword when creating and configuring an ACL. The correct ACL configuration is as follows:

#

acl number 2077 vpn-instance default

  rule 5 permit source 218.15.240.0 0.0.0.31

  rule 10 permit source 14.119.127.0 0.0.0.255

  rule 15 permit source 192.168.1.0 0.0.0.255

  rule 100 deny

#

user-interface vty 0 4 // vty view calls acl to restrict login

  acl 2077 inbound

  authentication-mode aaa

  protocol inbound all

#

If you have any problems, please post them in our Community. We are happy to solve them for you!


View more
  • x
  • convention:

All Answers

Hi ster,

Because the out-of-band management interface of the USG9520 main control board is bound to the default VPN instance by default, common ACL rules do not take effect. Therefore, you need to add the VPN-instance keyword when creating and configuring an ACL. The correct ACL configuration is as follows:

#

acl number 2077 vpn-instance default

  rule 5 permit source 218.15.240.0 0.0.0.31

  rule 10 permit source 14.119.127.0 0.0.0.255

  rule 15 permit source 192.168.1.0 0.0.0.255

  rule 100 deny

#

user-interface vty 0 4 // vty view calls acl to restrict login

  acl 2077 inbound

  authentication-mode aaa

  protocol inbound all

#

If you have any problems, please post them in our Community. We are happy to solve them for you!


View more
  • x
  • convention:

Comment

You need to log in to comment to the post Login | Register
Comment

Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " User Agreement."

My Followers

Login and enjoy all the member benefits

Login

Block
Are you sure to block this user?
Users on your blacklist cannot comment on your post,cannot mention you, cannot send you private messages.
Reminder
Please bind your phone number to obtain invitation bonus.