SSH connections to access the appliance CLI can be restricted to trusted IPs only. This configuration ensures that only allowlist IPs can access the appliance CLI.
To configure allowlist IPs on an appliance:
- In the configuration mode, type the command,
set system ssh-allowlist <comma-separated list of IPs and subnets without spaces>
For example,
set system ssh-allowlist 192.168.169.0/24,172.18.78.10
- Enter
saveto save the configuration.
Limitations
When configuring allowlist IPs on an appliance, ensure the following:
- Subnets must be specified in the format
<IP>/<Prefix Length>. For example,192.168.169.0/24or172.18.0.0/16. - Individual allowlisted IPs in the list cannot be the same as IP addresses that are configured on the appliance’s interfaces. Although, allowlisted subnets are allowed to contain IP addresses configured on the appliance’s interfaces.
- Allowlist IPs must not contain the subnet reserved for Netskope appliance’s internal bridge network. By default, the appliance’s internal services use the subnet
172.17.0.0/16. This subnet can be changed using the following command:set system bridge-network <IP subnet>
When specifying a new subnet for the bridge network, use one of the following formats:
<Network Address>/<Netmask>. For example,172.18.78.0/255.255.255.0.<Network Address>/<Prefix Length>. For example,172.18.78.0/24.