TechKnowSurge
Cisco CCNA 5.6 Cisco CCNA 4.8 Cisco CCNA 2.8
TechKnowSurge Catalog Videos DEMO: Secure VTY Ports
VideoNetworkFree

DEMO: Secure VTY Ports

Named ACLs applied to VTY lines control which IP addresses can establish SSH or Telnet sessions on a Cisco device. This approach differs from interface-based ACLs and uses the access-class command instead of access-group.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Securing administrative access to Cisco switches and routers requires a different ACL application method than standard traffic filtering. While interface-based ACLs control traffic flowing between networks, VTY line ACLs restrict which hosts are permitted to initiate SSH or Telnet management sessions to the device itself. This distinction is fundamental to network device hardening and is a common requirement in enterprise and security-focused environments. The configuration begins with creating a named ACL in global configuration mode, where meaningful names such as SSH-ACL provide immediate clarity about the policy's purpose. Once the permit and deny statements are defined, the ACL is applied within line VTY configuration mode using the access-class command followed by the ACL name and the in keyword. The access-class command is specific to VTY lines and replaces the access-group command used on interfaces, reflecting that the policy governs session initiation rather than routed traffic. With this configuration in place, only hosts whose source IP addresses match a permitted entry in the ACL can successfully open a management session to the device. All other source addresses are implicitly denied, effectively locking down remote administrative access to a defined set of trusted endpoints. This technique is an essential component of a layered security strategy for any managed network infrastructure.

What you'll learn

What's covered

ACLs on VTY Lines

Aligned to

Cisco CCNA
5.6 Configure and verify access control lists
4.8 Configure network devices for remote access using SSH
2.8 Describe network device management access

Key terms

Access Control List
ACL
A set of rules that defines which users or systems are granted or denied access to a resource.
Secure Shell
SSH
A cryptographic network protocol that provides secure remote login and command execution over an unsecured network.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
VTY Lines
VTY
Virtual terminal lines on a Cisco device that allow multiple simultaneous remote management sessions over a network connection.
access-class
A Cisco IOS command used to apply an ACL to VTY lines to restrict remote access based on source IP address, used in place of 'ip access-group' which applies ACLs to interfaces.
Named ACL
An access control list identified by a descriptive name instead of a number, created using the ip access-list standard command on a Cisco router.

Transcript

We've talked about standard ACLs and how to apply them to interfaces to block traffic going to other networks. But in this case, let's say we actually want to block traffic from logging into a VTY, or logging into a session on one of our devices. That's going to look a little different, so let's go over the commands to be able to create that security.

Previously we were on our demo laptop and we were trying to access this network over here. We were blocking certain IPs while allowing other IPs. But in this case, maybe we just want to stop people from being able to log into this switch, while allowing certain other IP addresses to log into it.

The commands

So what are the commands to do that? First of all, since I'm blocking the SSH access, the VTY access, to this device right here, that's the device I'm going to need to be on for this next set of commands. I'm going to use essentially the same ACL as I used before, but we're going to apply it to the VTY lines on this device.

So let's jump onto this device. Here we are. I'm going to get into global configuration mode, and I'm going to take the same set of commands that we've been working with to create this ACL. So we're creating my ACL — or maybe we actually want to rename this. Once again, the advantage of a named ACL is for it to give some insight into what it's using, so let's do SSH ACL. I'm going to copy this right here, I'm going to paste it onto here, and now it's entered into this machine. I'll exit out of there.

Next we'll get into this line vty, so line vty 0 15. We'll get into that, and I'm going to apply access-class, my ACL — we do need to change that, because we changed the name. Notice the IP is not at the beginning of this like it was in our last one, and instead of list it uses class, so it's a little different than when we're applying it to an interface. So we're going to paste this into here.

The result

Now the way this is set up, from this demo laptop I'd be able to SSH into this device as long as it's coming from 10.1.10.34. I have 10.1.10.35 on this machine as well, and I would not be able to SSH into this machine from that IP address. So that is how we lock down access to this.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →