Enabling Management Access Based on a Port-based VLAN

You can restrict management access so that only devices with ports in a specific port-based VLAN have access. Clients connected to ports that are not in the VLAN are denied management access. VLAN-based access control works in conjunction with other access control methods.

The following considerations apply to port-based VLAN access control.

• As in a switched network, the TACACS+ server and the SSH client should be in the same VLAN.
• If the TACACS+ server and the SSH client are not in the same VLAN, the response expected from the TACACS+ server should be sent in the same VLAN as configured by the tacacs-server enable vlan command. With this configuration, the TACACS+ server can be in a different VLAN and still allow SSH connections in a routed network.
• The tacacs-server enable vlan command should not be configured in a network that uses dynamic routing because the TACACS+ server response might be routed on any path.

The following example allows TACACS+ server management access only to clients in VLAN 10.

device# configure terminal
device(config)# tacacs-server enable vlan 10