Securing VTY
Now that telnet is working, it’s a good idea to restrict which hosts have access to your router’s VTY lines. The general rule is to only allow the PC’s on your private network access to the router. Why? Because later on, when your router is connected to the Internet, it will prevent anyone on the Internet from gaining access to it.
In the Cisco IOS you control access to your router with an ACL. An ACL is a powerful
IOS tool that allows you to secure your router using a combination of IP addresses and protocols. In simple terms, an ACL is a list of rules that either permits or denies a host (or group of hosts) access to another host (or group of hosts) through your router. It’s a filter.
After you create your ACL, it’s applied to a VTY line or Ethernet interface, and you specify whether it’s filtering incoming or outgoing traffic.
I’ll go into more detail about ACLs later in this chapter. For now, let’s look at the ACL for telnet line by line in Listing 2-4.
Listing 2-4. How to Secure VTY (Telnet) with an ACL lab-r1(config)# ip access-list standard VTY-ACL lab-r1(config-std-nacl)# permit 192.168.1.0 0.0.0.255 lab-r1(config-std-nacl)# exit lab-r1(config)# line vty 0 4 lab-r1(config-line)# access-class VTY-ACL in
CHAPTER 2 ■ CONFIGURING YOUR ROUTER 29
Step 1: Create and Name Your ACL
The first thing you do is create and name your ACL. The name “VTY-ACL” is used in
Listing 2-4. You can use any name that makes sense to you, but it’s a good idea to use a name that will remind you of what the ACL is used for. The command for this is lab-r1(config)# ip access-list standard VTY-ACL
Notice from the following output that the prompt has changed to (config-std-nacl), indicating that you are in ACL configuration mode. The following is the prompt for a standard named ACL: lab-r1(config-std-nacl)# Now that you’ve named and created your ACL,