Dell PowerConnect B-FCXs, Configuration Manual

Page: 1180 / 1494

1138 PowerConnect B-Series FCX Configuration Guide
53-1002266-01
Restricting remote access to management functions
32
•
Using ACLs to restrict Telnet, Web Management Interface, or SNMP access
•
Allowing remote access only from specific IP addresses
•
Allowing Telnet and SSH access only from specific MAC addresses
•
Allowing remote access only to clients connected to a specific VLAN
•
Specifically disabling Telnet, Web Management Interface, or SNMP access to the device
The following sections describe how to restrict remote access to a Dell PowerConnect device using
these methods.
Using ACLs to restrict remote access
You can use standard ACLs to control the following access methods to management functions on a
Dell PowerConnect device:
•
Telnet
•
SSH
•
Web management
•
SNMP
Consider the following to configure access control for these management access methods.
1. Configure an ACL with the IP addresses you want to allow to access the device.
2. Configure a Telnet access group, SSH access group, Web access group, and SNMP community
strings. Each of these configuration items accepts an ACL as a parameter. The ACL contains
entries that identify the IP addresses that can use the access method.
The following sections present examples of how to secure management access using ACLs. Refer
to
Chapter 16, “Configuring Rule-Based IP Access Control Lists (ACLs)” for more information on
configuring ACLs.
Using an ACL to restrict Telnet access
To configure an ACL that restricts Telnet access to the device, enter commands such as the
following.
PowerConnect(config)#access-list 10 deny host 209.157.22.32 log
PowerConnect(config)#access-list 10 deny 209.157.23.0 0.0.0.255 log
PowerConnect(config)#access-list 10 deny 209.157.24.0 0.0.0.255 log
PowerConnect(config)#access-list 10 deny 209.157.25.0/24 log
PowerConnect(config)#access-list 10 permit any
PowerConnect(config)#telnet access-group 10
PowerConnect(config)#write memory
Syntax: telnet access-group <num>
The <num> parameter specifies the number of a standard ACL and must be from 1 – 99.
The commands above configure ACL 10, then apply the ACL as the access list for Telnet access.
The device allows Telnet access to all IP addresses except those listed in ACL 10.
To configure a more restrictive ACL, create permit entries and omit the permit any entry at the end
of the ACL.