Users Guide

Access Control Lists 731
console(config)#ip access-group squelch-dos-attacks control-
plane
9 Further limit inbound traffic on in-band management ports. Allow only
VLAN 99 SSH and TFTP, no telnet, HTTP, HTTPS, or SNMP. The
management access list actions are performed by the switch firmware in
addition to the access list actions performed by the switching silicon, e.g.,
squelch-dos-attacks. Note that the switch forces TFTP accesses to use the
well-known TFTP port number 69:
console(config)#management access-list mgmt-blocks
console(config-ip-acl)#permit vlan 99 service ssh
console(config-ip-acl)#permit vlan 99 service tftp
console(config-ip-acl)#deny vlan 99
console(config-ip-acl)#permit service any
console(config-ip-acl)#exit
10 Create an in-band Management VLAN (99), assign it to two ports
(gi1/0/47 and gi1/0/48), and add both ACLs and Management ACLs to
ALL ports in global config mode.
console(config)#vlan 99
console(config-vlan99)#exit
console(config)#interface vlan 99
console(config-if-vlan99)#ip address dhcp
console(config-if-vlan99)#exit
console(config)#interface range gi1/0/47-48
console(config-if-Gi1/0/47-48)#switchport access vlan 99
console(config-if-Gi1/0/47-48)#exit
console(config)#management access-class mgmt-blocks
console(config)#line ssh
console(config-ssh)#login authentication default
console(config-ssh)#exit
console(config)#crypto key generate rsa
console(config)#crypto key generate dsa
console(config)#ip ssh server