Hi there

I am trying to restrict which IP addresses can reach the SSH port on the default cluster management interface…

I first cloned the default-management service-policy to a new policy… I then restrict the service “management-ssh” to a specific range, say 10.0.2.0/24

I then modify the cluster lif and the two node management interfaces, so that they use my new service-policy.

But… I am still able to ssh into the system from 10.10.10.0/24… which makes no sense at all…

If I do the same to the management-https it _does_ work as expected…

The “old” firewall is enabled, and all policies are set to 0.0.0.0/0 (I think this old firewall is depreciated… )

So it there something specific about ssh?

(ONTAP 9.12.1)

Personally I think the “firewall” features are a mess on ONTAP at the moment… also the fact that you can only open up for IP ranges, and not specific IP addresses… so the “best” you can do is /30 I guess? Why not just allow specific IP or even ranges.. like 10.10.10.5, 10.10.10.5-10, and 10.10.20.0/24

Any help or input is appreciated 😊