Make vro management more secure

As the most important device in the network layer, the security of a router is a concern of many network administrators. Here I will only talk about how to improve its security from the management perspective. When managing a vrotelnet, we usually use the Telnet command to remotely manage it through the vty port of the vro. This is a security vulnerability. Any client can guess your password, or use a brute-force tool to perform remote cracking. If we only allow remote management of a network segment or an IP address, other machines are not allowed to log on remotely, which greatly enhances the security of the router. The following describes how to configure a Cisco router.
First, create an access control list in global mode:

Router (config) # access-list 3 permit host 192.168.9.17

Only access from the machine 192.168.9.17 is allowed. The implicit condition is that access from other machines is prohibited.

Next, apply this rule to the vty Port:

Router (config) # line vty 0 4

Router (config-line) # access-class 3 in

Apply the rule to vty's 0 ~ Port 4, which can be defined here.

After such configuration, the vro only allows access from the machine 192.168.9.17, and other machines do not have access permissions. However, we are not so flexible in terms of management. We can only use fixed machines for management. Therefore, we should find a balance between management and security so that vrouters are easy to manage and secure, for example, a CIDR block can be managed.