Deny telnet to a specific VLAN
I created the following ACL and applied it to the VLAN interface on the core switch. Will it effectively block telnet to all the devices on the VLAN throughout the LAN?
IP access list DENY-TELNET
10 deny tcp any any eq telnet log
20 permit ip any any
interface Vlan13
ip access-group DENY-TELNET in
Sorry about the delay in answering, I wanted to confirm by checking it out. I believe it will but you'll have to confirm in testing it with a real endpoint. I put an IP address on the SVI and tried to directly telnet to it with your configuration and it shows a deny matched:
interface Vlan13
ip address 192.168.13.3 255.255.255.0
ip access-group DENY_TELNET in
!
ip classless
ip http server
ip http secure-server
!
!
ip access-list extended DENY_TELNET
deny tcp any any eq telnet log
permit ip any any
!
--More--
NYCORE1(config-if)#do show access-list
Extended IP access list DENY_TELNET
10 deny tcp any any eq telnet log (2 matches) <------HERE YOU GO!
20 permit ip any any (5 matches)
NYCORE1(config-if)#
With no other responses, I've marked this as solved.
