Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

I need to reconfigure the ACL that controls inbound SSH on the vty of Cisco devices. If I write an NCM script to delete the entire ACL, will it kill the NCM's SSH session to the Cisco device? If so, can this be done with the NCM script using TFTP?

steve30022

EXISTING Nexis Switch CONFIG:

line vty 0 4

access-group 57 in

ip access-list 57

10 permit tcp 10.10.10.10 eq any eq 22

20 permit tcp 10.20.20.20 eq any eq 22

etc, etc,

Question about the NCM script is: Can I write this way " no ip access-list 57" and then rewrite the ACL with all new IP addresses?

Or will that kill the NCM's SSH session to the Cisco switch? If it will kill the SSH session, can NCM push the config changes via tftp instead?

If tftp is not an option, I'll just push a new ACL# with the desired config, change the access-group# under line vty, then delete ACL 57, rewrite it, and then change the vty access-group back to 57.

Find more posts tagged with

Accepted answers

All comments

John.W.521

I have changed my vty ACL the way you're suggesting without any issues. However, I still get nervous about anything in a job that could potentially kill my remote logins, so I typically change it by removing the access class from my vty lines, delete then re-create the new acl, then add the access class back to the vty lines. It basically looks like this:

line vty 0 4

No ip access-class XXX

exit

no ip access-group extended XXX

ip access-group extended XXX

10 permit tcp 10.10.10.10 eq any eq 22

20 permit tcp 10.20.20.20 eq any eq 22

line vty 0 4

ip access-class XXX

shyde

It can kill the NCM SSH session.

Deleting the access-list will not.

When you add the access-list configuration back is when you may lose access.

The end of the access-list will be an implicit deny, so if the first permit added is not the one which allows access for the ssh session from Solarwinds this will be a problem. If it is the first permit there will be no problem.

As noted by John.W.521 the safest/best method is to remove the access-class command from the vty session at the start of the script and add it back as the last step of the script. I believe as well you have a typo in your config original post example. access-group instead of access-class. ip access-group is used to apply ACLs to different sections of configuration I have not seen anything but access-class on IOS or NX-OS for applying ACL to the line vty.

Also of note on Nexus OS you can send multiple commands in a single ssh command to the device see https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/nx-os-software/200714-Nexus-NX-OS-tips-and-tricks.html

superfly

^^ This is what I do as well. Safest way.