Nexus 5000 - Securing MGMT Access

Question

Could anyone comment on whether the capability exists to configure an ACL that protects management access, restricting access to certain source subnets? I want to use inband mgmt access (interface vlan feature)but limit the access by IP. ACLs seem to be only configurable on a per port basis or VLAN mapped basis, not on the VLAN Interface or Line VTY. Thanks in advance to anyone who offers a comment!

Answer 1

Hi Adam,
[edit] This is fixed in 4.1(3)N2(1) with defect CSCta26533.  It is also available in 4.2(1)N1(1).  I just tested this to verify, I was confused earlier as to what version my switches were running.
Here's an exmaple in 4.2(1)N1(1):
Nexus5010(config)# conf t
Nexus5010(config)# ip access-list someACL
Nexus5010(config-acl)# deny ip 192.168.0.0/16 any                      
Nexus5010(config-acl)# permit ip any any
Nexus5010(config-acl)# int mgmt0
Nexus5010(config-if)# ip access-group someACL in
Nexus5010(config-if)# exit
Nexus5010# sh ip access-lists summary
IPV4 ACL someACL
        Total ACEs Configured: 2
        Configured on interfaces:
                mgmt0 - ingress (Router ACL)
        Active on interfaces:
                mgmt0 - ingress (Router ACL)
Also, CSCsq20638 will allow you to put an ACL on VTY lines.  CSCsq20638 slipped the target release since my first answer, but is now committed to the 5.0 train for the Nexus 7000.
When the Nexus 5000 picks up this enhancement sometime in Q4 of 2010.  I can't be specific about a release date since it's under active development, but it should be called 5.0(2)N1(1)
Regarding a VACL, that will work for inband management (SVI / VLAN interface), but not for those managing via MGMT0.
Regards,
John Gill
Message was edited by: johgill