When the TPS is initially configured, the default security policy is set to permit any. Once you establish a host IP filter, whether it is a permit or deny, then the default IP filter becomes deny any, the old legal idea of the inclusion of one is to the exclusion of all others). If you are doing this via SSH (not the console), the first thing you must do is a permit rule for the IP address you are on or you will deny your IP access to the management port inadvertently.
"Management interface under attack" This message appears when too much of the traffic sent to the management port wasn't meant for the management IP address - too much broadcast traffic for instance.
NOTE: The TPS must not be under SMS control when doing this. If the device is currently managed, you may use the CLI command “sms unmanage” to temporarily unmanage the TPS. To resume SMS management, use the CLI command “sms manage”. In addition, you must be in the management interface context. At the root command enter “edit” and then “interface mgmt”. After making changes enter “commit” to commit the changes to the running-config and “save-config” to update the start-up config.
| Command | Comment |
| ip-filter (allow|deny) (https|icmp|snmp|ssh|ip) [ip] | Permits or denies communications with the management port from specified IP addresses. |
| tps {running-mgmt} ip-filter allow ip 192.168.1.32/24 | Limit management port access to one host. |
| tps {running-mgmt} ip-filter deny ip 192.168.1.32/24 | Remove host access to management port. |
| tps {running-mgmt} ip-filter allow ip 192.168.1.0/24 | Limit management port access to one subnet. |
| tps {running-mgmt} ip-filter deny ip 192.168.1.0/24 | Remove subnet access to management port. |
| tps {running-mgmt} ip-filter allow default | Restore default action back to "permit any". |