Concept Guide
Denying and Permitting Access to a Terminal Line
Dell EMC Networking recommends applying only standard access control lists (ACLs) to deny and permit access to VTY lines.
• Layer 3 ACLs deny all trac that is not explicitly permitted, but in the case of VTY lines, an ACL with no rules does not deny trac.
• You cannot use the show ip accounting access-list command to display the contents of an ACL that is applied only to a
VTY line.
• When you use the access-class access-list-name command without specifying the ipv4 or ipv6 attribute, both IPv4 as
well as IPv6 rules that are dened in that ACL are applied to the terminal. This method is a generic way of conguring access
restrictions.
• To be able to lter access exclusively using either IPv4 or IPv6 rules, use either the ipv4 or ipv6 attribute along with the access-
class access-list-name command. Depending on the attribute that you specify (ipv4 or ipv6), the ACL processes either
IPv4 or IPv6 rules, but not both. Using this conguration, you can set up two dierent types of access classes with each class
processing either IPv4 or IPv6 rules separately.
To apply an IP ACL to a line, Use the following command.
• Apply an ACL to a VTY line.
LINE mode
access-class access-list-name [ipv4 | ipv6]
NOTE: If you already have congured generic IP ACL on a terminal line, then you cannot further apply IPv4 or IPv6
specic ltering on top of this conguration. Similarly, if you have congured either IPv4 or IPv6 specic ltering on a
terminal line, you cannot apply generic IP ACL on top of this conguration. Before applying any of these congurations,
you must rst undo the existing conguration using the no access-class access-list-name [ipv4 | ipv6]
command.
Example of an ACL that Permits Terminal Access
Example Conguration
To view the conguration, use the show config command in LINE mode.
DellEMC(config-std-nacl)#show config
!
ip access-list standard myvtyacl
seq 5 permit host 10.11.0.1
DellEMC(config-std-nacl)#line vty 0
DellEMC(config-line-vty)#show config
line vty 0
access-class myvtyacl
DellEMC(conf-ipv6-acl)#do show run acl
!
ip access-list extended testdeny
seq 10 deny ip 30.1.1.0/24 any
seq 15 permit ip any any
!
ip access-list extended testpermit
seq 15 permit ip any any
!
ipv6 access-list testv6deny
seq 10 deny ipv6 3001::/64 any
seq 15 permit ipv6 any any
!
DellEMC(conf)#
DellEMC(conf)#line vty 0 0
DellEMC(config-line-vty)#access-class testv6deny ipv6
DellEMC(config-line-vty)#access-class testvpermit ipv4
DellEMC(config-line-vty)#show c
line vty 0
Management
85