Denying and Permitting Access to a Terminal LineDell Networking recommends applying only standard access control lists (ACLs) to deny and permit access to VTY lines.• Layer 3 ACLs deny all traffic that is not explicitly permitted, but in the case of VTY lines, an ACL with no rules does not deny traffic.• You cannot use the show ip accounting access-list command to display the contents of an ACL that is applied only to aVTY line.• When you use the access-class access-list-name command without specifying the ipv4 or ipv6 attribute, both IPv4 aswell as IPv6 rules that are defined in that ACL are applied to the terminal. This method is a generic way of configuring accessrestrictions.• To be able to filter access exclusively using either IPv4 or IPv6 rules, use either the ipv4 or ipv6 attribute along with the access-class access-list-name command. Depending on the attribute that you specify (ipv4 or ipv6), the ACL processes eitherIPv4 or IPv6 rules, but not both. Using this configuration, you can set up two different types of access classes with each classprocessing either IPv4 or IPv6 rules separately.To apply an IP ACL to a line, Use the following command.• Apply an ACL to a VTY line.LINE modeaccess-class access-list-name [ipv4 | ipv6]NOTE: If you already have configured generic IP ACL on a terminal line, then you cannot further apply IPv4 or IPv6specific filtering on top of this configuration. Similarly, if you have configured either IPv4 or IPv6 specific filtering on aterminal line, you cannot apply generic IP ACL on top of this configuration. Before applying any of these configurations,you must first undo the existing configuration using the no access-class access-list-name [ipv4 | ipv6]command.Example of an ACL that Permits Terminal AccessExample ConfigurationTo view the configuration, use the show config command in LINE mode.Dell(config-std-nacl)#show config!ip access-list standard myvtyaclseq 5 permit host 10.11.0.1Dell(config-std-nacl)#line vty 0Dell(config-line-vty)#show configline vty 0access-class myvtyaclDell(conf-ipv6-acl)#do show run acl!ip access-list extended testdenyseq 10 deny ip 30.1.1.0/24 anyseq 15 permit ip any any!ip access-list extended testpermitseq 15 permit ip any any!ipv6 access-list testv6denyseq 10 deny ipv6 3001::/64 anyseq 15 permit ipv6 any any!Dell(conf)#Dell(conf)#line vty 0 0Dell(config-line-vty)#access-class testv6deny ipv6Dell(config-line-vty)#access-class testvpermit ipv4Dell(config-line-vty)#show cline vty 0Management 81
