68 BigIron RX Series Configuration Guide53-1002253-01Restricting remote access to management functions4Restricting remote access to the device to specific VLAN IDsYou can restrict management access to a device to ports within a specific port-based VLAN.VLAN-based access control applies to the following access methods:• Telnet access• Web management access• SNMP access• TFTP accessBy default, access is allowed for all the methods listed above on all ports. Once you configuresecurity for a given access method based on VLAN ID, access to the device using that method isrestricted to only the ports within the specified VLAN.VLAN-based access control works in conjunction with other access control methods. For example,suppose you configure an ACL to permit Telnet access only to specific client IP addresses, and youalso configure VLAN-based access control for Telnet access. In this case, the only Telnet clientsthat can access the device are clients that have one of the IP addresses permitted by the ACL andare connected to a port that is in a permitted VLAN. Clients who have a permitted IP address butare connected to a port in a VLAN that is not permitted still cannot access the device throughTelnet.Restricting Telnet access to a specific VLANTo allow Telnet access only to clients in a specific VLAN, enter a command such as the following.BigIron RX(config)# telnet server enable vlan 10The command configures the device to allow Telnet management access only to clients connectedto ports within port-based VLAN 10. Clients connected to ports that are not in VLAN 10 are deniedmanagement access.Syntax: [no] telnet server enable vlan Restricting Web management access to a specific VLANTo allow Web management access only to clients in a specific VLAN, enter a command such as thefollowing.BigIron RX(config)# web-management enable vlan 10The command configures the device to allow Web management access only to clients connected toports within port-based VLAN 10. Clients connected to ports that are not in VLAN 10 are deniedmanagement access.Syntax: [no] web-management enable vlan Restricting SNMP access to a specific VLANTo allow SNMP access only to clients in a specific VLAN, enter a command such as the following.BigIron RX(config)# snmp-server enable vlan 40The command configures the device to allow SNMP access only to clients connected to ports withinport-based VLAN 40. Clients connected to ports that are not in VLAN 40 are denied access.Syntax: [no] snmp-server enable vlan
