Limit switch access (telnet, http)

Question

Situation: c3750 Layer3 switch acting as router for my LAN, with several (more than 40) L3 virtual interfaces.
Target: I want to permit access to the switch only from some L3 interfaces (these with an @IP 10.255.x.x) and deny telnet/http request on other interfaces (with @IP 10.252.x.x). For telnet, I putted on the switch the following commands:
Switch(config)#access-list 101 permit ip any 10.255.0.0 0.0.255.255 log
Switch(config)#access-list 101 deny ip any any log
Switch(config-line)#access-class 101 in
Problem:
- telnet traffic is blocked on ALL interfaces
- if I try a telnet from a PC (10.255.10.100) to the switch (10.255.10.1) I see the following syslog message:
Aug 23 13:36:49: %SEC-6-IPACCESSLOGP: list 101 denied tcp 10.255.10.100(1709) -> 0.0.0.0(23), 1 packet
Why destination IP address is 0.0.0.0?
Second question: how can I activate the same filter on http access (ip http access-class accepts only standard access-lists, therefore I cannot check destination IP address)?

Answer 1

Giovanni,
You access list is producinging unintended results. You list actually says: "If you come from anywhere you can do ip to 10.255.0.0 0.0.255.255". What you probably want is the opposite. Standard access lists are most effective for restricting this type of access because it eliminates this confusion. You don't need extended lists to limit access to vty. The destination is irrelevant because the packet is not getting routed through. On this basis the standard list poses no limitation for your http access control. Standard lists are good for vty, http, snmp-server restrictions. As far as the 0.0.0.0 destination, I do not know why this was stripped out. Probably due to the fact that the packet is destined for the switch.
HTH
Pls rate if helpful!