topic RE: How i can enable access list using only mac address to ssh login in ExtremeSwitching (Other)

How i can enable access list using only mac address to ssh login

Adnan — Mon, 17 Jul 2017 10:07:00 GMT

Hello

i would like to enable access list using mac address of certain PC

i am asking because i used the same code of access list using only ip address

i used this code

entry AllowManagementIP { if match any { ethernet-source-address F8:A7:BC:E0:D1:AE; } then { permit; } } and it didnt work still eny pc can login using ssh i did refresh policy cammand still the same problem

RE: How i can enable access list using only mac address to ssh login

AnonymousM — Mon, 17 Jul 2017 11:03:00 GMT

Do you have any deny rule in there as well?

RE: How i can enable access list using only mac address to ssh login

Adnan — Mon, 17 Jul 2017 11:16:00 GMT

No i dont have , i think i dont need it because i used this code for ipaddress and it work fine
if i have to have deny rule could you write for me the full cammand

RE: How i can enable access list using only mac address to ssh login

AnonymousM — Mon, 17 Jul 2017 11:34:00 GMT

you could just try to use

else {
deny;
}

after your then expression

RE: How i can enable access list using only mac address to ssh login

Adnan — Mon, 17 Jul 2017 12:03:00 GMT

entry AllowManagementIP { if match any { ethernet-source-address F8:A7:BC:E0:D1:AE; } then { permit; } else {
deny;
} }

it gives me Error
error policy has else clause , which can be used only in clear flow rules

RE: How i can enable access list using only mac address to ssh login

AnonymousM — Mon, 17 Jul 2017 12:16:00 GMT

OK. Try to add a deny all at the bottom of the policy

RE: How i can enable access list using only mac address to ssh login

AnonymousM — Mon, 17 Jul 2017 12:17:00 GMT

Myabe just a "deny;" would be enough. Didn't play with policy files for quite some time. 😉

RE: How i can enable access list using only mac address to ssh login

Adnan — Mon, 17 Jul 2017 12:21:00 GMT

entry AllowManagementIP { if match any { ethernet-source-address F8:A7:BC:E0:D1:AE; } then { permit; } else {
deny all;
} }

Error again: attribiute deny should not have any arguments , "all " is invalid

RE: How i can enable access list using only mac address to ssh login

AnonymousM — Mon, 17 Jul 2017 12:55:00 GMT

As I said. Leave the "all" away.

RE: How i can enable access list using only mac address to ssh login

Adnan — Mon, 17 Jul 2017 13:03:00 GMT

entry AllowManagementIP { if match any { ethernet-source-address F8:A7:BC:E0:D1:AE; } then { permit; }
deny ;
} }

Error again what should i do !!

RE: How i can enable access list using only mac address to ssh login

AnonymousM — Mon, 17 Jul 2017 13:09:00 GMT

There is one brace to much at the bottom

RE: How i can enable access list using only mac address to ssh login

Adnan — Mon, 17 Jul 2017 13:12:00 GMT

i pasted here wrong but in the cli it's correcct 🙂

RE: How i can enable access list using only mac address to ssh login

AnonymousM — Mon, 17 Jul 2017 13:15:00 GMT

entry DenyAllIngress{
if {
} then {
deny;
}
}

RE: How i can enable access list using only mac address to ssh login

Adnan — Mon, 17 Jul 2017 13:21:00 GMT

entry AllowManagementIP { if match any { ethernet-source-address F8:A7:BC:E0:D1:AE; } then { permit; } }entry DenyAllIngress{
if {
} then {
deny;
}
}

still can login with other pc

RE: How i can enable access list using only mac address to ssh login

AnonymousM — Mon, 17 Jul 2017 13:23:00 GMT

Did you assign the policy to the ingress port?

RE: How i can enable access list using only mac address to ssh login

Adnan — Mon, 17 Jul 2017 13:26:00 GMT

i am using it to ssh login

using this cammand

config ssh2 access-profile ssh2-acl

RE: How i can enable access list using only mac address to ssh login

AnonymousM — Mon, 17 Jul 2017 13:30:00 GMT

Did you enable ssh2 to use the access-profile?
enable ssh2 access-profile ssh2-acl

RE: How i can enable access list using only mac address to ssh login

Adnan — Mon, 17 Jul 2017 13:33:00 GMT

yes and still can login with other pc

RE: How i can enable access list using only mac address to ssh login

AnonymousM — Mon, 17 Jul 2017 13:36:00 GMT

Hm....that's strange. You should log a case with GTAC and have them look into the switch. I am sure it is just a small thing that needs to be changed. They could have a remote session with you and figure it out.

RE: How i can enable access list using only mac address to ssh login

Adnan — Mon, 17 Jul 2017 14:02:00 GMT

my switches are X250e-48pt i update the firmware from 12.5.4.5 to 15.3.5.2 and i install ssh moudel to install ssh is it related or something

and thanks for help

Best