Why does this work? Because when you apply an access list to the VTY lines, you don’t need to
specify the Telnet protocol since access to the VTY implies terminal access. You also don’t need
to specify a destination address, since it really doesn’t matter which interface address the user
used as a target for the Telnet session. You really only need to control where the user is coming
from—their source IP address.
To perform this function, follow these steps:
1. Create a standard IP access list that permits only the host or hosts you want to be able to
telnet into the routers.
2. Apply the access list to the VTY line with the access-class command.