Blocking SSH access to most layer 3 interfaces.

[Nick_Stovall]

By default, enabling SSH enables you to SSH into a switch via any L3 interface on that switch. I'd like to limit access to only one specific IP address on this switch (x670).

The "configure ssh2 access-profile" command is gimped in that it only accepts "source-address" as a match condition in its ACL.

Is my only option here to create an ACL that blocks ssh to each IP address on the switch explicitly, then apply that to each VLAN interface?

[Patrick_Voss]

Nick,

I am not sure I understand your request. It sounds like you want to only allow a switch to SSH into other switches? Regardless the access profile being configured on EVERY switch in the network should only allow the IP-address you put into the ACL.