Got it

What is the difference between the use of ACL in vty view and ssh server command?

Created: Sep 25, 2019 03:47:30Latest reply: Sep 25, 2019 03:54:24 160 1 0 0
  Rewarded HiCoins: 0 (problem resolved)

Recently, our switch frequently reports login exception logs and alarms.

I know there are two ways to control the access permission of the SSH client.

ssh server acl 2000

and

user-interface vty 0 4

acl 2000 inbound

 

What's the difference between them?

  • x
  • convention:

Featured Answers
Popeye_Wang
Admin Created Sep 25, 2019 03:54:24 Helpful(1) Helpful(1)

Hi Steelblue,

1. The ssh server acl command takes effect only for SSH users. And the acl inbound command takes effect for both telnet and SSH users.

2. The ssh login process is as follows: After the TCP three-way handshake is established and the SSH negotiation is performed, the user name and password are verified. After the authentication succeeds, the vty resource is applied for. After the vty resource is successfully applied for, the user can log in to the device.

Therefore, The acl inbound takes effect when the vty resource is applied for. The ssh server acl takes effect when the tcp is connected.

The SSH service contains multiple login protocols. Some protocols do not need to apply for vty resources. When a TCP connection is established, the user cannot know which protocol to log in to, and the vty authentication process is not performed. Therefore, invalid IP addresses cannot be intercepted in vty mode. Therefore, during network deployment, you are advised to configure the SSH mode to restrict user rights.

View more
  • x
  • convention:

All Answers
Popeye_Wang
Popeye_Wang Admin Created Sep 25, 2019 03:54:24 Helpful(1) Helpful(1)

Hi Steelblue,

1. The ssh server acl command takes effect only for SSH users. And the acl inbound command takes effect for both telnet and SSH users.

2. The ssh login process is as follows: After the TCP three-way handshake is established and the SSH negotiation is performed, the user name and password are verified. After the authentication succeeds, the vty resource is applied for. After the vty resource is successfully applied for, the user can log in to the device.

Therefore, The acl inbound takes effect when the vty resource is applied for. The ssh server acl takes effect when the tcp is connected.

The SSH service contains multiple login protocols. Some protocols do not need to apply for vty resources. When a TCP connection is established, the user cannot know which protocol to log in to, and the vty authentication process is not performed. Therefore, invalid IP addresses cannot be intercepted in vty mode. Therefore, during network deployment, you are advised to configure the SSH mode to restrict user rights.

View more
  • x
  • convention:

Comment

You need to log in to comment to the post Login | Register
Comment

Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " Privacy."

My Followers

Login and enjoy all the member benefits

Login

Huawei Enterprise Support Community
Huawei Enterprise Support Community
Block
Are you sure to block this user?
Users on your blacklist cannot comment on your post,cannot mention you, cannot send you private messages.
Reminder
Please bind your phone number to obtain invitation bonus.