This article provides information on how to secure access to the in-band management interface via IPv4 on EX-series switches.

How to secure access to the in-band management interface via IPv4 on EX-series switches.

To secure the management interface via IPv4, a firewall filter has to be configured. The sample configuration is as follows:

user@switch>show firewall family inet filter inband-manage 
term allowfromint {
     from {
        source-address {
            192.168.0.0/24;
            192.168.253.0/24;
            192.168.252.0/24;
            202.60.64.236/32;
            }
      }
      then accept;
      }
term blockext {
     from {
       destination-port [ ssh telnet snmp snmptrap http https 830 ];
     }
     then {
       discard;
     }
}
term default {
     then accept;
}

{master:0}[edit]
user@switch# show interfaces lo0 
unit 0 {
    family inet {
      filter {
         input inband-manage;
      }
    }
}

bne:~# nmap 202.60.90.1
Not shown: 1673 closed ports
PORT STATE SERVICE
22/tcp filtered ssh
23/tcp filtered telnet
80/tcp filtered http
161/tcp filtered snmp
162/tcp filtered snmptrap
443/tcp filtered https
830/tcp filtered unknown
MAC Address: 00:23:9C:0C:C8:80 (Unknown)

Nmap finished: 1 IP address (1 host up) scanned in 1.921 seconds

2025-06-26: Minor, non-technical update

2012-05-29: Article created