blocking ssh and other management protocols

[V98Cubes]

I have a cat6500 running IOS and have a public facing vlan. This vlan has my web server hanging off of it. I need to block using an ACL ssh and other management traffic but allow all other traffic in. Can I get some assistance on setting up an inbound ACL to block this type of traffic. I have had a number of ssh brute force hits lately.

Thanks,
V

 

[imbadatthis]

personally I wouldn't block SSH access.

aaa authentication login default local
security authentication failure rate 10 log
login block-for 60 attempts 4 within 30
login delay 3

line vty 0 16
 timeout login response 300
 logging synchronous
 transport input ssh

I use a radius server for authentication, however I changed above code to use a local username with full access which you can create using:

username NOTROOT privilege 15 password 0 SOMESECURE

also you can run a command from global exec called:

autosecure

however if you really want to block JUST ssh:

access-list 101 deny tcp any any eq ssh
access-list 101 permit tcp any any
access-list 101 permit udp any any
access-list 101 permit icmp any any 
interface vlan XXX
ip access-group in 101

We must go always forward, not backward
always up, not down and always twirling twirling towards infinity.

 

[V98Cubes]

Thanks for your response. I have sshe enabled on my vty ports with a rsa ket enabled. The vlan I want to block this traffic on is on a vlan which faces the public. It has a web server on it along with a few other devices offering services to the public. I am trying to block ssh telnet etc from being used as a possible hack into these devices. So I started with:

access-list 112 deny ip 10.0.0.0 0.255.255.255 any log
access-list 112 deny ip 127.0.0.0 0.255.255.255.any log
access-list 112 deny 192.168.0.0 0.0.255.255 any log
access-list 112 deny tcp any any eq telnet log
access-list 112 deny any any eq 22 log
access-list 112 deny tcp any any 161 log
access-list 112 deny udp any any eq 22 log
access-list 112 deny udp any any eq snmp log
access-list 112 deny udp any any eq 23 log
access-list 112 permit any any log