Dell Brocade DCX, Configuration Manual, Page: 138 / 1436

66 BigIron RX Series Configuration Guide
53-1001810-01
Restricting remote access to management functions
4
NOTE
The ro parameter indicates that the community string is for read-only (“get”) access. The rw
parameter indicates the community string is for read-write (“set”) access.
The <standard-acl-name> | <standard-acl-id> parameter specifies which ACL will be used to filter
incoming SNMP packets.
The <standard-acl-id> parameter specifies the number of a standard ACL, 1 – 99.
The <standard-acl-name> parameter specifies the standard access list name.
NOTE
When snmp-server community is configured, all incoming SNMP packets are validated first by their
community strings and then by their bound ACLs. Packets are permitted if no filters are configured
for an ACL.
Configuring hardware-based remote access filtering on the device
The following is an example of configuring the device to perform hardware filtering for Telnet
access.
BigIron RX(config)# vlan 3 by port
BigIron RX(config-vlan-3)# untagged ethe 3/1 to 3/5
BigIron RX(config-vlan-3)# router-interface ve 3
BigIron RX(config-vlan-3)# exit
BigIron RX(config)# interface ve 3
BigIron RX(config-ve-1)# ip address 10.10.11.1 255.255.255.0
BigIron RX(config-ve-1)# exit
BigIron RX(config)# access-list 10 permit host 10.10.11.254
BigIron RX(config)# access-list 10 permit host 192.168.2.254
BigIron RX(config)# access-list 10 permit host 192.168.12.254
BigIron RX(config)# access-list 10 permit host 192.64.22.254
BigIron RX(config)# access-list 10 deny any
BigIron RX(config)# telnet access-group 10 vlan 3
BigIron RX(config)# ssh access-group 10 vlan 3
BigIron RX(config)# web access-group 10 vlan 3
BigIron RX(config)# snmp-server community private rw 10 vlan 3
In this example, a Layer 3 VLAN is configured as a remote-access management VLAN and a router
interface. The IP address specified for the router interface becomes the management IP address
of the VLAN.
Restricting remote access to the device to specific IP addresses
By default, a device does not control remote management access based on the IP address of the
managing device. You can restrict remote management access to a single IP address for the
following access methods:
•
Telnet access
•
Web Management access
•
SNMP access
In addition, if you want to restrict all three access methods to the same IP address, you can do so
using a single command.