What is the difference between the use of ACL in vty view and ssh server command?

Created: Sep 25, 2019 03:47:30Latest reply: Sep 25, 2019 03:54:24 34 1 0 0
  Rewarded Hi-coins: 0 (problem resolved)

Recently, our switch frequently reports login exception logs and alarms.

I know there are two ways to control the access permission of the SSH client.

ssh server acl 2000

and

user-interface vty 0 4

acl 2000 inbound

 

What's the difference between them?

  • x
  • convention:

Featured Answers
Popeye_Wang
Admin Created Sep 25, 2019 03:54:24 Helpful(1) Helpful(1)

Hi Steelblue,

1. The ssh server acl command takes effect only for SSH users. And the acl inbound command takes effect for both telnet and SSH users.

2. The ssh login process is as follows: After the TCP three-way handshake is established and the SSH negotiation is performed, the user name and password are verified. After the authentication succeeds, the vty resource is applied for. After the vty resource is successfully applied for, the user can log in to the device.

Therefore, The acl inbound takes effect when the vty resource is applied for. The ssh server acl takes effect when the tcp is connected.

The SSH service contains multiple login protocols. Some protocols do not need to apply for vty resources. When a TCP connection is established, the user cannot know which protocol to log in to, and the vty authentication process is not performed. Therefore, invalid IP addresses cannot be intercepted in vty mode. Therefore, during network deployment, you are advised to configure the SSH mode to restrict user rights.

  • x
  • convention:

All Answers
Popeye_Wang
Popeye_Wang Admin Created Sep 25, 2019 03:54:24 Helpful(1) Helpful(1)

Hi Steelblue,

1. The ssh server acl command takes effect only for SSH users. And the acl inbound command takes effect for both telnet and SSH users.

2. The ssh login process is as follows: After the TCP three-way handshake is established and the SSH negotiation is performed, the user name and password are verified. After the authentication succeeds, the vty resource is applied for. After the vty resource is successfully applied for, the user can log in to the device.

Therefore, The acl inbound takes effect when the vty resource is applied for. The ssh server acl takes effect when the tcp is connected.

The SSH service contains multiple login protocols. Some protocols do not need to apply for vty resources. When a TCP connection is established, the user cannot know which protocol to log in to, and the vty authentication process is not performed. Therefore, invalid IP addresses cannot be intercepted in vty mode. Therefore, during network deployment, you are advised to configure the SSH mode to restrict user rights.

  • x
  • convention:

Reply

Reply
You need to log in to reply to the post Login | Register

Notice Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " Privacy."
If the attachment button is not available, update the Adobe Flash Player to the latest version!
Login and enjoy all the member benefits

Login and enjoy all the member benefits

Login