AOS-CX Switch Simulator

 View Only
last person joined: yesterday 

Expand all | Collapse all

How to apply access restriction for ssh in Aruba CX

This thread has been viewed 38 times
  • 1.  How to apply access restriction for ssh in Aruba CX

    Posted Oct 22, 2021 02:30 AM
    Dear All,

    On cisco there is a command to restrict access to telnet / ssh. created from ACL then applied in line vty.

    like the following command:

    ip access-list standard TELNET
    permit 10.10.26.0 0.0.0.255
    permit 10.11.4.0 0.0.0.255
    permit 10.12.9.0 0.0.0.255
    permit 10.13.87.0 0.0.0.63
    permit 10.14.18.64 0.0.0.31

    line vty 0 4
    access-class TELNET in
    authorization commands 15 telnet
    authorization exec telnet
    logging synchronous
    login authentication telnet

    For Aruba CX, I want to apply access management in the default vrf so that it can be reached from the network link (don't use Management)

    How to apply access restriction for ssh in Aruba CX as per above scenario?

    Big Thanks,
    GIBS

    ------------------------------
    Luthfi Naufal Gibrani
    ------------------------------


  • 2.  RE: How to apply access restriction for ssh in Aruba CX

    EMPLOYEE
    Posted Oct 22, 2021 02:47 AM
    Hello Luthfi!

    In ArubaCX you need to perform following steps:

    1. Enable SSH for VRF default (since you don't want to use VRF mgmt)
    switch(config)# ssh server vrf default​

    2. Create an ACL that will protect the Control-plane of the switch:
    switch(config)# access-list ip CONTROLPLANE
    switch(config-acl-ip)# 05 comment ALLOW SSH AND SNMP ON ADMIN SUBNET, BLOCK ALL OTHERS
    switch(config-acl-ip)# 10 permit tcp 10.10.0.0/24 any eq 22
    switch(config-acl-ip)# 20 permit udp 10.10.0.0/24 any eq 161
    switch(config-acl-ip)# 30 permit udp 10.10.0.0/24 any eq 162
    switch(config-acl-ip)# 40 deny tcp any any eq 22 count
    switch(config-acl-ip)# 50 deny udp any any eq 161 count
    switch(config-acl-ip)# 60 deny udp any any eq 162 count
    switch(config-acl-ip)# 990 comment ALLOW ANYTHING ELSE
    switch(config-acl-ip)# 1000 permit any any any​


    3. Apply the ACL to the default VRF:

    switch(config)# apply access-list ip CONTROLPLANE control-plane vrf default


    I recommend you to check Aruba CX Hardening Guide - https://www.arubanetworks.com/techdocs/AOS-CX/10.07/PDF/AOS-CX_10-07_hardening.pdf , it's got a lot of useful configuration details how to secure your switches.

    Hope this helps!




    ------------------------------
    Ivan Bondar
    ------------------------------



  • 3.  RE: How to apply access restriction for ssh in Aruba CX

    Posted Oct 25, 2021 06:57 AM
    Dear Ivan,

    Thank you very much for your advice.. i will try it.

    Regards,
    Luthfi

    ------------------------------
    Luthfi Naufal Gibrani
    ------------------------------