access-class [acl] in
Restricts incoming or outgoing Telnet/SSH access to a router line (VTY, AUX, console) by applying an ACL that filters source IP addresses.
Definition: access-class [acl] in is a Cisco IOS line config command. Restricts incoming or outgoing Telnet/SSH access to a router line (VTY, AUX, console) by applying an ACL that filters source IP addresses.
Overview
The `access-class [acl] in` command is a Line Configuration mode command used on Cisco IOS routers and switches to restrict inbound Telnet and SSH access to a specific line, such as VTY, AUX, or console. By applying an access control list (ACL) that filters source IP addresses, this command enhances security by allowing only authorized management hosts to connect to the device. This is critical for protecting network infrastructure from unauthorized administrative access, especially in environments where remote management is necessary.
The command works by referencing a standard or extended ACL (though typically standard ACLs are used for source IP filtering) that is applied to the line in the inbound direction. When a Telnet or SSH session is initiated, the router checks the source IP against the ACL; if permitted, the session proceeds; if denied, the connection is dropped. This command is often used in conjunction with other security measures like SSH encryption, AAA authentication, and login banners.
It is a fundamental tool for network engineers to enforce management plane security. Alternatives include using VRF-aware ACLs or control plane policing (CoPP), but `access-class` is simpler and directly targets line access. In a typical workflow, after configuring IP addresses and basic connectivity, an engineer would define an ACL that permits only specific management hosts (e.g., 192.168.1.0/24) and then apply it to all VTY lines using `access-class 10 in`.
This command is available in all IOS versions and does not require any special privilege level beyond privilege level 15 for configuration. It is important to note that applying an overly restrictive ACL can lock out the administrator, so out-of-band access (console) should always be available as a fallback. The command affects the running configuration immediately, and changes are saved to startup-config with `write memory`.
Understanding this command is essential for CCNA and CCNP candidates as it appears in both exam topics and real-world network hardening tasks.
access-class [acl] inWhen to Use This Command
- Limit remote management access to only specific admin workstations (e.g., 192.168.1.0/24).
- Block all Telnet/SSH access from external networks while allowing internal management.
- Apply different ACLs to different VTY lines for tiered administrative access.
- Temporarily restrict remote access during maintenance windows.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| acl | <1-99> or <1300-1999> or <name> | Specifies the access list number (standard ACL) or name to be applied to the line. Standard ACL numbers range from 1 to 99 and 1300 to 1999. Named ACLs are also supported. Common mistake: using an extended ACL number (100-199) which is not valid for `access-class`; only standard ACLs are allowed. |
Command Examples
Restrict VTY access to a specific subnet
line vty 0 4
access-class 10 inThe command is entered in line configuration mode. 'access-class 10 in' applies ACL 10 to filter incoming Telnet/SSH connections on VTY lines 0-4. No output is generated if successful.
Verify access-class applied to VTY lines
show line vty 0 4 Tty Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns Int
0 VTY - - - - 10 0 0 0/0 -
1 VTY - - - - 10 0 0 0/0 -
2 VTY - - - - 10 0 0 0/0 -
3 VTY - - - - 10 0 0 0/0 -
4 VTY - - - - 10 0 0 0/0 -The 'AccI' column shows the inbound access-class number applied. Here, '10' is listed for all VTY lines, confirming the ACL is active. 'AccO' would show outbound ACL if configured.
Understanding the Output
The 'show line' command displays line parameters. The 'AccI' field indicates the inbound access-class ACL number. If blank or '0', no ACL is applied.
A valid ACL number (1-99, 100-199, 1300-2699) means filtering is active. Verify that the ACL exists and permits desired sources; otherwise, all connections are denied by implicit deny.
Configuration Scenarios
Restrict Telnet/SSH access to VTY lines from a specific management subnet
A network administrator wants to allow remote management of a router only from hosts in the 192.168.10.0/24 subnet. All other Telnet/SSH attempts should be denied.
Topology
Management Host (192.168.10.5) --- 192.168.10.0/24 --- Router (Gi0/0: 192.168.10.1)Steps
- 1.Step 1: Enter global configuration mode: Router> enable, Router# configure terminal
- 2.Step 2: Create a standard ACL that permits the management subnet: Router(config)# access-list 10 permit 192.168.10.0 0.0.0.255
- 3.Step 3: Enter line configuration mode for VTY lines (0-4): Router(config)# line vty 0 4
- 4.Step 4: Apply the ACL inbound to restrict access: Router(config-line)# access-class 10 in
- 5.Step 5: Optionally, configure SSH and login authentication: Router(config-line)# transport input ssh, Router(config-line)# login local
- 6.Step 6: Exit and save configuration: Router(config-line)# end, Router# write memory
! Full IOS config block Router(config)# access-list 10 permit 192.168.10.0 0.0.0.255 Router(config)# line vty 0 4 Router(config-line)# access-class 10 in Router(config-line)# transport input ssh Router(config-line)# login local Router(config-line)# end
Verify: Use `show access-lists` to verify ACL 10 exists and has matches. Use `show line vty 0 4` to confirm access-class is applied. Attempt a Telnet/SSH from a permitted host (should succeed) and from a non-permitted host (should fail).
Watch out: If the ACL does not have an explicit deny statement, an implicit deny all is applied at the end. Ensure the ACL includes all necessary source networks; otherwise, legitimate hosts may be blocked. Also, remember that `access-class` only filters inbound connections; outbound connections are not affected.
Apply access-class to console line for local security
An organization wants to restrict console access to only specific management workstations connected directly to the console port, preventing unauthorized physical access from other devices.
Topology
Console cable from Management PC (192.168.1.100) to Router's console portSteps
- 1.Step 1: Enter global configuration mode: Router> enable, Router# configure terminal
- 2.Step 2: Create a standard ACL that permits only the management PC: Router(config)# access-list 5 permit host 192.168.1.100
- 3.Step 3: Enter line configuration mode for console: Router(config)# line console 0
- 4.Step 4: Apply the ACL inbound: Router(config-line)# access-class 5 in
- 5.Step 5: Exit and save: Router(config-line)# end, Router# write memory
! Full IOS config block Router(config)# access-list 5 permit host 192.168.1.100 Router(config)# line console 0 Router(config-line)# access-class 5 in Router(config-line)# end
Verify: Use `show line console 0` to verify access-class is applied. Attempt to connect via console from the permitted PC (should succeed) and from another device (should fail). Check `show access-lists` for hit counts.
Watch out: Applying `access-class` to the console line filters based on the source IP of the device connected via console cable. However, console connections typically do not have an IP address; the router sees the source IP as 0.0.0.0 or the IP of the management interface if using reverse Telnet. This command is more commonly used on VTY lines. For console, consider using physical security or AAA instead.
Troubleshooting with This Command
When troubleshooting `access-class` issues, the primary symptom is that legitimate users cannot establish Telnet or SSH sessions to the router. The first step is to verify that the ACL is correctly applied to the intended line using `show line vty 0 4` or `show line console 0`. Look for the line 'Access-class: 10 in' in the output; if missing, the command was not applied or was removed.
Next, examine the ACL itself with `show access-lists`. Healthy output shows the permit statement with a match count. If the match count is zero, the ACL may not be matching traffic; check the source IP of the connecting host against the ACL entries.
Common mistakes include using an incorrect wildcard mask (e.g., 0.0.0.255 instead of 0.0.0.0 for a host) or forgetting that the implicit deny at the end of the ACL blocks all other traffic. If the ACL is correct but connections still fail, check if the line is configured to accept the protocol (e.g., `transport input ssh` or `transport input all`). Use `debug telnet` or `debug ip ssh` to see if the connection is being attempted and where it is dropped.
Another diagnostic flow: from the management host, try to telnet to the router's IP; if the connection is refused immediately, the ACL is likely blocking. If it hangs, the issue may be authentication. Also, verify that the router has a route back to the management host; otherwise, the three-way handshake may fail.
Correlate with `show ip interface` to confirm the interface is up and has an IP address. In some cases, the ACL may be applied to the wrong line (e.g., VTY 0-4 vs VTY 5-15). Use `show line` to list all lines and their configurations.
Finally, remember that `access-class` filters inbound connections only; outbound connections from the router are not affected. If you need to restrict outbound Telnet/SSH, use `access-class out` instead. For advanced troubleshooting, consider using control plane policing (CoPP) to rate-limit management traffic, but that is beyond the scope of this command.
CCNA Exam Tips
Remember that 'access-class' is applied to lines (VTY, AUX, console), while 'access-group' is applied to interfaces.
The implicit deny at the end of an ACL will block all traffic not explicitly permitted; always include a permit statement for allowed sources.
CCNA may test that 'access-class' only filters incoming connections when 'in' is specified; 'out' filters outgoing connections (rarely used).
You can apply different ACLs to different VTY line ranges (e.g., VTY 0-4 vs VTY 5-15) for tiered access.
Common Mistakes
Applying 'access-class' to an interface instead of a line — use 'access-group' for interfaces.
Forgetting to create the ACL before applying it, resulting in implicit deny blocking all access.
Using 'access-class' without specifying 'in' or 'out' — defaults to 'in', but best practice is to be explicit.
access-class [acl] in vs line vty 0 4
These commands are often used together, leading to confusion: 'line vty 0 4' enters line configuration mode for remote access, while 'access-class [acl] in' is configured under that mode to restrict incoming connections. One defines the context for configuration; the other applies an access control filter.
| Aspect | access-class [acl] in | line vty 0 4 |
|---|---|---|
| Configuration mode | Line configuration mode | Global configuration mode |
| Scope | Applied to specific lines (e.g., VTY, AUX, console) | Selects VTY lines 0–4 for configuration |
| Function | Restricts inbound Telnet/SSH by source IP via ACL | Enters line configuration sub-mode for VTY lines |
| Precedence | Filter evaluated per line at connection time | Determines which lines are subsequently configured |
| Persistence | Saved in running/startup config under the line | Configuration persists when written to NVRAM |
| Typical use | Applied after line vty to enforce access control | First step to configure remote access parameters |
Use access-class [acl] in when you need to restrict incoming Telnet/SSH sessions to a router line based on source IP addresses.
Use line vty 0 4 when you need to enter line configuration mode to set remote access parameters such as transport input, exec-timeout, or to apply an access-class.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the `access-class` command syntax is identical to classic IOS. However, on some IOS-XE platforms, the line configuration may be under a different hierarchy (e.g., `line vty 0 15`). The output of `show line` may vary slightly, but the command works the same.
For NX-OS (Cisco Nexus switches), the equivalent command is `ip access-group` applied to the management interface (mgmt0) or VRF, but for VTY lines, NX-OS uses `line vty` with `access-class` as well, though the syntax is similar. On Cisco ASA firewalls, there is no direct `access-class` command; instead, you use `http`, `ssh`, or `telnet` commands with ACLs applied to the management interface. For example, `ssh 192.168.1.0 255.255.255.0 management` restricts SSH access.
In IOS-XR (Cisco ASR 9000, etc.), the command is `access-class` under `line template` configuration, but the syntax is different: `access-class ipv4 <acl-name> in`. IOS-XR uses named ACLs only. Behavior differences across IOS versions: In older IOS 12.x, `access-class` only supported numbered ACLs; named ACLs were introduced in later versions.
In IOS 15.x and 16.x, named ACLs are fully supported. Also, in some versions, applying `access-class` to the console line may not filter as expected because console connections do not have IP addresses; this is a known limitation. Always test in a lab environment before deploying to production.
Related Commands
line vty 0 4
Enters line configuration mode for virtual terminal (VTY) lines 0 through 4 to configure remote access settings like Telnet/SSH, ACLs, and timeout parameters.
show access-lists
Displays all configured ACLs or a specific ACL showing each entry with its sequence number, match criteria (permit/deny, protocol, source, destination, ports), and hit count showing how many packets have matched each entry.
show line
Displays line configuration and status information for console, auxiliary, and vty lines, used to verify line settings and monitor user connections.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions