SSH Access within vpn-instance

[philclarke100]

Hi,

I've got an MSR router, and have configured my management address within a vpn-instance.  Although telnet works fine, ssh does not - i've obviously enabled ssh server itself, added to vty line, and confirmed acls are correct, and its successfully authenticating against tacacs, just ssh doesnt work

is there something i need to do to bind ssh into the vpn-instance or something?

Many Thanks

[Ivan_B]

Hi @philclarke100 !

You don't need to bind SSH server to a vpn-instance. I suspect the issue is not in the binding...
Couple of questions:

- In the list of the configuration steps performed you didn't mention the first one - generating local key pairs, did you do that step?
- Did you test SSH server without ACL applied and outside vpn-instance?
- Just to double-check to ensure I got you right - you can successfuly establish telnet connection to the same management IP address of the routers' interface bound to vpn-instance, can't you?

[philclarke100]

Hi

Thanks very much for your reply.  I got it sorted in the end (atlhough i'm a little confused as to why, and will do some further investigations)

the fix was adding the vpn-instance within my VTY ACL.... previously it was just the source subnet alone, but this was working for telnet, just not ssh which seems odd.  My config is essentially as below, telnet worked with rule 5 configured, but ssh didnt work until i added rule 10.  I would have thought that telnet would not have worked either in the first instance with this being the case...

interface LoopBack1
ip binding vpn-instance <vpn-instance>
ip address y.y.y.y. 255.255.255.255

acl basic x

rule 5 permit source x.x.x.x

rule 10 permit vpn-instance <instance> source x.x.x.x