Dell S6000-ON, Configuration Manual

Page: 75 / 1080

Terminal Lines
You can access the system remotely and restrict access to the system by creating user profiles.
Terminal lines on the system provide different means of accessing the system. The console line (console)
connects you through the console port in the route processor modules (RPMs). The virtual terminal lines
(VTYs) connect you through Telnet to the system. The auxiliary line (aux) connects secondary devices
such as modems.
Denying and Permitting Access to a Terminal Line
Dell Networking recommends applying only standard access control lists (ACLs) to deny and permit
access to VTY lines.
• Layer 3 ACLs deny all traffic that is not explicitly permitted, but in the case of VTY lines, an ACL with
no rules does not deny traffic.
• You cannot use the
show ip accounting access-list
command to display the contents of an
ACL that is applied only to a VTY line.
• When you use the
access-class access-list-name
command without specifying the
ipv4
or
ipv6
attribute, both IPv4 as well as IPv6 rules that are defined in that ACL are applied to the terminal.
This method is a generic way of configuring access restrictions.
• To be able to filter access exclusively using either IPv4 or IPv6 rules, use either the
ipv4
or
ipv6
attribute along with the
access-class access-list-name
command. Depending on the attribute
that you specify (
ipv4
or
ipv6
), the ACL processes either IPv4 or IPv6 rules, but not both. Using this
configuration, you can set up two different types of access classes with each class processing either
IPv4 or IPv6 rules separately.
To apply an IP ACL to a line, Use the following command.
• Apply an ACL to a VTY line.
LINE mode
access-class access-list-name [ipv4 | ipv6]
NOTE: If you already have configured generic IP ACL on a terminal line, then you cannot further
apply IPv4 or IPv6 specific filtering on top of this configuration. Similarly, if you have configured
either IPv4 or IPv6 specific filtering on a terminal line, you cannot apply generic IP ACL on top of
this configuration. Before applying any of these configurations, you must first undo the existing
configuration using the
no access-class access-list-name [ipv4 | ipv6]
command.
Example of an ACL that Permits Terminal Access
Example Configuration
To view the configuration, use the
show config
command in LINE mode.
Dell(config-std-nacl)#show config
!
ip access-list standard myvtyacl
seq 5 permit host 10.11.0.1
Dell(config-std-nacl)#line vty 0
Dell(config-line-vty)#show config
line vty 0
access-class myvtyacl
Dell(conf-ipv6-acl)#do show run acl
!
Management
75