Office engineers can SSH to a Catalyst 9800, and the NOC subnet cannot. A management access restriction on the controller includes the office subnet and omits the NOC. What is missing?
Select an answer to reveal the explanation.
Short Explanation
The office is on the list and the NOC is not, so the controller is doing what you told it. Add the NOC subnet to that management restriction. A guest passphrase does not open SSH.
Full Explanation
A management access restriction limits which sources can open SSH or the GUI. The office subnet is permitted and the NOC subnet is not, which matches who can connect and who cannot. Add the NOC subnet to that restriction. A guest passphrase authenticates wireless guests. It does not open SSH for every subnet that can route to the controller. An RF profile sets radio parameters. Channel utilization does not permit or deny SSH. Monitor mode changes an access point. It does not edit the controller's management access list or add a subnet. The restriction is a source list. The office subnet is on it and the NOC subnet is not, which is why only the office can open SSH. Exam caveat: permitting the NOC subnet is not the same as routing. If the NOC still cannot connect after the restriction includes it, the path or the firewall is the next place to look. Read the live result after the change, not only the object you edited. Operational check: add the NOC subnet, try SSH from a NOC address, and confirm an address outside both subnets is still refused.