Content

| 9.5 |  | Securing Remote Management |
| 9.5.7 |  | Using access lists to restrict remote management |

Restricting vty connections
Remote access to a switch can be controlled using access-lists. The line configuration command access-class ACL-number can be used to limit virtual terminal sessions to those matching a predefined standard or extended access-list.

Restricting web interface connections
Web management interface sessions can be controlled using the global configuration command ip http access-class ACL-number, where ACL-number refers to a standard access list number between 1 and 99. It is not possible to control access to the web management interface using extended access lists.

Restricting specific users
The global configuration command user username access-class ACL-number is used to limit a specific user to traffic patterns defined by an access list. The field ACL-number can refer to a standard access-list in the ranges 1 to 99 or 1300 to 1999, or to an extended access list in the ranges 100-199 or 2000 to 2699. This feature can also be used to control user access to a dial-in access server.

Restricting access to SNMP and NTP processes
Standard access-lists can also be used to control traffic relating to other management processes running on the switch. Access to SNMP community strings can be restricted to read-only, read-write, or view-only according to membership of standard access lists. Access to network time protocol (NTP) processes can also be controlled using standard access-lists.

Further information on configuring related security options is available on CCO.

| Interactive Media Activity Checkbox: Security for Web management Interface After completing this activity, the students will be able to understand security for web management interface.

| Web Links Configuring SNMP Community Strings http://www.cisco.com/en/US/products/ hw/switches/ ps646/products_ configuration_ guide_ chapter09186a00800c6f51.html#xtocid12