topic Restrict management access to VOSS switches using a firewall in ExtremeSwitching (VSP/Fabric Engine)

Restrict management access to VOSS switches using a firewall

XTRMUser — Tue, 06 Jan 2026 16:59:46 GMT

I'd like to restrict access for management to VOSS switches using a firewall. The firewall rules will not be an issue. I'm running VOSS 8.10.x on all VOSS switches. So they have management CLIP addresses, which are separate from Source IP, and loopback addresses. I'm moving away from ACL's and access-lists, which are on the switches now.

The current code is:

mgmt clip vrf GlobalRouter
ip address 10.10.10.41/32
enable
exit

I noticed there is a reserved vlan (4090) with the management CLIP address on it. Can I use that as part of the solution?

I've tried to find some information on this, but I guess my Google-fu is lacking.

Re: Restrict management access to VOSS switches using a firewall

EF — Wed, 07 Jan 2026 13:39:20 GMT

Try access policy, example:

access-policy 2
access-policy 2 network 10.100.51.0 24
access-policy 2 access-strict
access-policy 2 accesslevel rwa
access-policy 2 ssh
access-policy 2 telnet
access-policy 2 snmpv3
access-policy 2 ftp
access-policy 2 http
access-policy 2 snmp-group readgrp snmpv2c
access-policy 2 snmp-group v1v2grp snmpv2c
access-policy 2 enable

Re: Restrict management access to VOSS switches using a firewall

XTRMUser — Wed, 07 Jan 2026 21:15:23 GMT

I have access-policies in place, as well as filters. But to make it easier on my coworkers, who don't understand access policies and filters, but do understand firewall rules, I'm switching.