I am attempting to convert telnet/ssh access-profiles from dynamic acls to a static acl with network zones, but when I switch telnet to use this acl, it refuses connections that should be allowed.
Experimenting, it appears that access-profiles don't work with network zones; when I replace the source-zone with the corresponding source-address directives, it works.
X460-24t 16.1.3.6
With network zone (example simplified, the real one contains multiple networks and addresses):
configure access-list network-zone trusted-networks add ipaddress x.x.x.145 255.255.255.255
entry permit-trusted-networks {
if match any {
source-zone trusted-networks;
} then {
permit;
}
}
Connection refusedWith source-address:
entry permit-trusted-networks {
if match any {
source-address x.x.x.145/32;
} then {
permit;
}
}
telnet session telnet4 on /dev/ptyb4
Unauthorized access prohibited!
login: Login timed out!
