Cisco Systems CCNA 2 manual Restricting virtual terminal access

11.2.6 Restricting virtual terminal access

Standard and extended access lists apply to packets that travel through a router. They are not designed to block packets that originate within the router. By default, an outbound Telnet extended access list does not prevent router initiated Telnet sessions. This type of ACL controls which users can telnet into a remote router. To test this in the labs, have students configure routers and telnet into a remote router to test connectivity. Configure and apply the ACL to the vty lines to deny access. Then test the Telnet again. Here are the commands to configure virtual terminal access:

Rt1(config)#access-list 2 permit 172.16.1.0 0.0.0.255

Rt1(config)#access-list 2 permit 172.16.2.0 0.0.0.255

Rt1(config)#access-list 2 deny any

Here are the commands to apply the access list:

Rt1(config)#line vty 0 4

Rt1(config-line)#login

Rt1(config-line)#passwordsecret

Rt1(config-line)#access-class 2 in

128 - 238 CCNA 2: Routers and Routing Basics v3.1 Instructor Guide – Module 11 Copyright ♥ 2004, Cisco Systems, Inc.