Question

A network engineer is hardening a Catalyst 9300 switch. Corporate policy requires that only the management subnet 10.50.10.0/24 be permitted to reach the device management plane, and that any denied management attempt be recorded for the SOC. The engineer has already configured SSHv2. Which additional configuration correctly restricts and logs remote management access to the VTY lines?

Accepted Answer

Create a standard ACL permitting 10.50.10.0/24 with a trailing 'deny any log' entry, then apply it under line vty 0 15 using 'access-class' inbound

Answer

Create an extended ACL permitting TCP from 10.50.10.0/24 to the device with a final 'deny ip any any log' entry, then apply it to a physical interface with 'ip access-group' inbound

Answer

Apply the standard ACL to line vty 0 15 using 'access-class' outbound so only the management subnet can be reached from the switch

Answer

Configure 'management-interface' under the VTY lines and reference the management subnet with 'permit 10.50.10.0 0.0.0.255' without any logging keyword