Protecting your network switches from un-authorized access should be high on everyone’s list these days. It’s clear that an insecure switch is a liability in any network topology. In the vast majority of cases this means at least changing the default username and passwords along with the SNMP community strings. In environments where you need additional access security you can use the Ethernet Routing Switch 8600 Access Policy to restrict administrative access to the switch. This allows you to easily define networks which should have access and what services they should have access to.
In the example below I’m allowing access from the network 10.1.1.0/24 for FTP, HTTP, SNMP(v3), SSH, TELNET and TFTP.
ERS-8610:5# config sys access-policy policy 10 create ERS-8610:5# config sys access-policy policy 10 network 10.1.1.0/24 ERS-8610:5# config sys access-policy policy 10 service ftp enable ERS-8610:5# config sys access-policy policy 10 service http enable ERS-8610:5# config sys access-policy policy 10 service snmpv3 enable ERS-8610:5# config sys access-policy policy 10 service ssh enable ERS-8610:5# config sys access-policy policy 10 service telnet enable ERS-8610:5# config sys access-policy policy 10 service tftp enable ERS-8610:5# config sys access-policy policy 10 snmp-group-add admin snmpv1 ERS-8610:5# config sys access-policy policy 10 snmp-group-add admin snmpv2c ERS-8610:5# config sys access-policy policy 10 snmp-group-add v1v2grp snmpv1 ERS-8610:5# config sys access-policy policy 10 snmp-group-add v1v2grp snmpv2c ERS-8610:5# config sys access-policy policy 10 snmp-group-add readgrp snmpv1 ERS-8610:5# config sys access-policy policy 10 snmp-group-add readgrp snmpv2c ERS-8610:5# config sys access-policy policy 10 enable
Just don’t forget to enable the access policy;
ERS-8610:5# config sys access-policy enable true
You could also use host masks as opposed to network masks if you wish to allow only specific management stations access to the switch.
Cheers!