<div>
For SSH access just create access list and add it to vty interface in inbound direction. 
 
user-interface vty 0 4 
acl 2000 inbound 
 
acl number 2000 name v4-MGMT-SSH 
hardware-count enable 
rule 0 deny fragment 
rule 5 permit source 116.12.xxx.xxx 0.0.0.15 
rule 10 deny 
 
For printer access you can create access list for each IP address range and apply it to specific VLAN 
 
acl number 3000 
rule 10 comment permit access from australia IP address ranges 
rule 10 permit ip source &lt;australia_IP_address_range&gt; destination &lt;printer_IP_address_(range1)&gt; 
rule 20 comment deny access from the res of the world to IP address ranges 
rule 20 deny ip source any destination &lt;printer_IP_address_(range1)&gt; 
rule 10 comment permit any other traffic (or deny if only printers are in those VLANs) 
rule 30 permit ip source any destination any 
 
You can create access-list for every IP address range and apply it to SVI or physical interface which is gateway for specific VLAN (in proper direction). Or you can create ACL for all ranges and apply it to WAN interface in inbound direction, it is your choice.
</div>

<div>
As the recommendation above i am able to lock down https and ssh just allow from my office,but i still can not block other IP access to my printer and just allow from Australia IPs .I try to apply &nbsp;&quot;rule 102 deny&quot; in ACL 3000 found that internal user can not access internet.Please help Thanks. 
 
clock timezone &quot;Kuala Lumpur&quot; add 08:00:00 
# 
&nbsp;firewall enable 
# 
&nbsp;domain default enable system 
# 
&nbsp;dar p2p signature-file flash:/p2p_default.mtd 
# 
&nbsp;port-security enable 
# 
&nbsp;ip http acl 2783 
&nbsp;undo ip http enable 
# 
&nbsp;password-recovery enable 
# 
acl number 2000 
&nbsp;rule 0 deny fragment 
&nbsp;rule 1 permit source 192.168.100.0 0.0.0.255 
&nbsp;rule 5 permit source 116.12.203.xxx 0.0.0.15 
&nbsp;rule 10 deny 
acl number 2001 
&nbsp;rule 0 deny fragment 
&nbsp;rule 1 permit source 192.168.100.0 0.0.0.255 
&nbsp;rule 5 permit source 116.12.203.xxx 0.0.0.15 
&nbsp;rule 10 deny 
acl number 2783 match-order auto 
&nbsp;rule 0 permit 
# 
acl number 3000 
&nbsp;rule 10 permit ip source 59.167.xx.xx 0.0.0.31 destination 192.168.100.0 0.0.0.255 
&nbsp;rule 20 permit ip source 59.167.xxx.xxx 0.0.0.7 destination 192.168.100.0 0.0.0.255 
&nbsp;rule 30 permit ip source 203.5.xx.x 0.0.0.255 destination 192.168.100.0 0.0.0.255 
&nbsp;rule 100 deny ip destination 116.12.203.xxx 0.0.0.15 
&nbsp;rule 101 deny ip destination 192.168.100.0 0.0.0.255 
# 
vlan 1 
# 
domain system 
&nbsp;access-limit disable 
&nbsp;state active 
&nbsp;idle-cut disable 
&nbsp;self-service-url disable 
# 
dhcp server ip-pool 1 
&nbsp;network 192.168.100.0 mask 255.255.255.0 
&nbsp;gateway-list 192.168.100.1 
&nbsp;dns-list 165.21.83.88 165.21.100.88 
# 
user-group system 
&nbsp;group-attribute allow-guest 
# 
local-user netata 
&nbsp;password cipher $c$3$CfYylcGcCTrPs9Eh+VXwpt3DQTBBX+OtrmXWs4RltQ== 
&nbsp;authorization-attribute level 3 
&nbsp;service-type ssh telnet terminal 
&nbsp;service-type web 
# 
cwmp 
&nbsp;undo cwmp enable 
# 
interface Aux0 
&nbsp;async mode flow 
&nbsp;link-protocol ppp 
# 
interface Cellular0/0 
&nbsp;async mode protocol 
&nbsp;link-protocol ppp 
# 
interface NULL0 
# 
interface Vlan-interface1 
&nbsp;ip address 192.168.100.1 255.255.255.0 
&nbsp;firewall packet-filter 3000 inbound 
# 
interface GigabitEthernet0/0 
&nbsp;port link-mode route 
&nbsp;nat outbound static 
&nbsp;nat outbound 2000 
&nbsp;nat server protocol tcp global 116.12.203.55 www inside 192.168.220.229 www 
&nbsp;nat server protocol tcp global 116.12.203.55 lpd inside 192.168.220.229 lpd 
&nbsp;nat server protocol tcp global 116.12.203.55 631 inside 192.168.220.229 631 
&nbsp;nat server protocol tcp global 116.12.203.55 9100 inside 192.168.220.229 9100 
&nbsp;nat server protocol tcp global 116.12.203.66 www inside 192.168.220.232 www 
&nbsp;nat server protocol tcp global 116.12.203.66 lpd inside 192.168.220.232 lpd 
&nbsp;nat server protocol tcp global 116.12.203.66 631 inside 192.168.220.232 631 
&nbsp;nat server protocol tcp global 116.12.203.66 9100 inside 192.168.220.232 9100 
&nbsp;duplex full 
&nbsp;speed 100 
&nbsp;ip address 124.66.142.134 255.255.255.252 
# 
interface GigabitEthernet0/1 
&nbsp;port link-mode bridge 
# 
interface GigabitEthernet0/2 
&nbsp;port link-mode bridge 
# 
interface GigabitEthernet0/3 
&nbsp;port link-mode bridge 
# 
interface GigabitEthernet0/4 
&nbsp;port link-mode bridge 
# 
&nbsp;ip route-static 0.0.0.0 0.0.0.0 124.66.142.133 
# 
&nbsp;dhcp server forbidden-ip 192.168.100.1 192.168.100.9 
&nbsp;dhcp server forbidden-ip 192.168.100.101 192.168.100.254 
# 
&nbsp;dhcp enable 
# 
&nbsp;ssh server enable 
&nbsp;ssh user xxxxxx service-type stelnet authentication-type password 
# 
&nbsp;ip https acl 2001 
&nbsp;ip https enable 
# 
&nbsp;load xml-configuration 
# 
&nbsp;load tr069-configuration 
# 
user-interface tty 12 
user-interface aux 0 
&nbsp;authentication-mode scheme 
user-interface vty 0 4 
&nbsp;acl 2000 inbound 
&nbsp;authentication-mode scheme 
&nbsp;protocol inbound ssh 
# 
return
</div>

<div>
acl number 3000 
rule 102 permit ip source any destination any 
 
you are missing permit any any at the end. By default - last implicit statement in ACL is always 
deny ip source any destination any
</div>

<div>
I try apply rule 102 ,but I still having the issue to block other IP to vlan 1 ,actually i don't want other IP to access the printer except Australia IP
</div>

<div>
I already modify the ACL 3000 is able to blocked other IP now ,just to confirm below configuration internal LAN should don't have issue to access internet right ? because now i am doing remotely ,don't know what will be happen on remote site ,hopefully no interruption for user tomorrow morning . 
 
rule 10 permit ip source 192.168.100.0 0.0.0.255 destination 59.167.xx.xx 0.0.0.31 
&nbsp;rule 20 permit ip source 192.168.100.0 0.0.0.255 destination 59.167.xxx.xxx 0.0.0.7 
&nbsp;rule 30 permit ip source 192.168.100.0 0.0.0.255 destination 203.5.xx.x 0.0.0.255 
&nbsp;rule 40 permit ip source 192.168.100.0 0.0.0.255 destination 116.12.203.xxx 0.0.0.15 
&nbsp;rule 100 deny ip source 192.168.100.0 0.0.0.255 
&nbsp;rule 101 permit ip
</div>

<div>
Last rule permit IP will permit any other network range as source from vlan1. Do you really need that rule? 
Additionally rule 100 deny all traffic as source... If rule 101 is not needed.. 
You can remove both rules and implicit deny will do the trick... 
 
The way you wrote ACL is ... Only traffic from permitted addresses will be able to access VLAN1. 
😆
</div>

<div>
trying to remove the rule 100 then the blocking can not work already.
</div>

<div>
i still remain the rule 100 now and remove 101 ,hopefully not causing user any issue.
</div>

<div>
Removing &nbsp;both 100 and 101 should work. If not leave it as it is.
</div>

<div>
If there is only IP address range that is configured on interface located in that direction... There will be no difference with or without last 2 rules. At least.. That's how it should be. 
;)
</div>

<div>
as I said above ,I try to remove rule 100 and I tested &nbsp;the blocking is not working.
</div>

<div>
removing just 100 will permit all since rule 101 is permit any any (any source to any destination).
</div>

<div>
so now I should remain rule 100 and remove 101 or should remain both ?
</div>

<div>
I am telling you just general rules, but you know your needs. If you are happy with that one.. leave it as it is, this is just small optimization of ACL. There should be no any difference in behavior since rule 100 should block all traffic from that VLAN and rule 101 should never be match. 
 
Just leave it as it is. :) 
It should be OK.
</div>

<div>
today morning all user can not get the IP from Router that cause them no connection ..after I remove rule 100 then all the PC able to get IP from router but is not blocking other IP to printer already. please advice.
</div>

<div>
You need to permit dhcp requests (udp or ip to 192.168.100.1 - since that is your dhcp server - udp is enough, but example is with ip). 
&nbsp;rule 99 permit ip source any destination host 192.168.100.1
</div>

<div>
<div class="content wysiwyg-content">
My superior request me to lock the the IP Address from our HPE MSR 930 Router: 
• &nbsp; &nbsp; &nbsp; Lock down management from Internet to FirstTech IPs only. eg.116.12.xxx.xxx/255.255.255.240 
• &nbsp; &nbsp; &nbsp; Lock down printer ports (NATed from external IPs to Internet ones) to Australia IPs only. &nbsp; 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;eg.These are 3 subnets: 59.167.xx.xx/27 &nbsp;59.167.xx.xx/29 &nbsp;203.5.xx.xx/24 
 
Existing Configuration 
 
# 
&nbsp;version 5.20.106, Release 2516P10 
# 
 
# 
&nbsp;clock timezone &quot;Kuala Lumpur&quot; add 08:00:00 
# 
&nbsp;firewall enable 
# 
&nbsp;domain default enable system 
# 
&nbsp;dar p2p signature-file flash:/p2p_default.mtd 
# 
&nbsp;port-security enable 
# 
&nbsp;ip http acl 2783 
&nbsp;undo ip http enable 
# 
&nbsp;password-recovery enable 
# 
acl number 2000 
&nbsp;rule 1 permit source 192.168.100.0 0.0.0.255 
acl number 2783 match-order auto 
&nbsp;rule 0 permit 
# 
acl number 3000 
# 
vlan 1 
# 
domain system 
&nbsp;access-limit disable 
&nbsp;state active 
&nbsp;idle-cut disable 
&nbsp;self-service-url disable 
# 
dhcp server ip-pool 1 
&nbsp;network 192.168.100.0 mask 255.255.255.0 
&nbsp;gateway-list 192.168.100.1 
&nbsp;dns-list 165.21.83.88 165.21.100.88 
# 
user-group system 
&nbsp;group-attribute allow-guest 
# 
local-user netata 
&nbsp;password cipher $c$3$CfYylcGcCTrPs9Eh+VXwpt3DQTBBX+OtrmXWs4RltQ== 
&nbsp;authorization-attribute level 3 
&nbsp;service-type ssh telnet terminal 
&nbsp;service-type web 
# 
cwmp 
&nbsp;undo cwmp enable 
# 
interface Aux0 
&nbsp;async mode flow 
&nbsp;link-protocol ppp 
# 
interface Cellular0/0 
&nbsp;async mode protocol 
&nbsp;link-protocol ppp 
# 
interface NULL0 
# 
interface Vlan-interface1 
&nbsp;ip address 192.168.100.1 255.255.255.0 
&nbsp;firewall packet-filter 3000 outbound 
# 
interface GigabitEthernet0/0 
&nbsp;port link-mode route 
&nbsp;nat outbound static 
&nbsp;nat outbound 2000 
&nbsp;nat server protocol tcp global 116.12.203.55 www inside 192.168.100.229 www 
&nbsp;nat server protocol tcp global 116.12.203.55 lpd inside 192.168.100.229 lpd 
&nbsp;nat server protocol tcp global 116.12.203.55 631 inside 192.168.100.229 631 
&nbsp;nat server protocol tcp global 116.12.203.55 9100 inside 192.168.100.229 9100 
&nbsp;nat server protocol tcp global 116.12.203.66 www inside 192.168.100.232 www 
&nbsp;nat server protocol tcp global 116.12.203.66 lpd inside 192.168.100.232 lpd 
&nbsp;nat server protocol tcp global 116.12.203.66 631 inside 192.168.100.232 631 
&nbsp;nat server protocol tcp global 116.12.203.66 9100 inside 192.168.100.232 9100 
&nbsp;duplex full 
&nbsp;speed 100 
&nbsp;ip address 124.66.xxx.xxx 255.255.255.252 
# 
interface GigabitEthernet0/1 
&nbsp;port link-mode bridge 
# 
interface GigabitEthernet0/2 
&nbsp;port link-mode bridge 
# 
interface GigabitEthernet0/3 
&nbsp;port link-mode bridge 
# 
interface GigabitEthernet0/4 
&nbsp;port link-mode bridge 
# 
&nbsp;ip route-static 0.0.0.0 0.0.0.0 124.66.xxx.xxx 
# 
&nbsp;dhcp server forbidden-ip 192.168.100.1 192.168.100.9 
&nbsp;dhcp server forbidden-ip 192.168.100.101 192.168.100.254 
# 
&nbsp;dhcp enable 
# 
&nbsp;ssh server enable 
&nbsp;ssh user netata service-type stelnet authentication-type password 
# 
&nbsp;ip https acl 2000 
&nbsp;ip https enable 
# 
&nbsp;load xml-configuration 
# 
&nbsp;load tr069-configuration 
# 
user-interface tty 12 
user-interface aux 0 
&nbsp;authentication-mode scheme 
user-interface vty 0 4 
&nbsp;authentication-mode scheme 
&nbsp;protocol inbound ssh
</div>
</div>

My superior request me to lock the the IP Address from our HPE MSR 930 Router:
•       Lock down management from Internet to FirstTech IPs only. eg.116.12.xxx.xxx/255.255.255.240
•       Lock down printer ports (NATed from external IPs to Internet ones) to Australia IPs only.  
	eg.These are 3 subnets: 59.167.xx.xx/27  59.167.xx.xx/29  203.5.xx.xx/24 

Existing Configuration

#
 version 5.20.106, Release 2516P10
#

#
 clock timezone "Kuala Lumpur" add 08:00:00
#
 firewall enable
#
 domain default enable system
#
 dar p2p signature-file flash:/p2p_default.mtd
#
 port-security enable
#
 ip http acl 2783
 undo ip http enable
#
 password-recovery enable
#
acl number 2000
 rule 1 permit source 192.168.100.0 0.0.0.255
acl number 2783 match-order auto
 rule 0 permit
#
acl number 3000
#
vlan 1
#
domain system
 access-limit disable
 state active
 idle-cut disable
 self-service-url disable
#
dhcp server ip-pool 1
 network 192.168.100.0 mask 255.255.255.0
 gateway-list 192.168.100.1
 dns-list 165.21.83.88 165.21.100.88
#
user-group system
 group-attribute allow-guest
#
local-user netata
 password cipher $c$3$CfYylcGcCTrPs9Eh+VXwpt3DQTBBX+OtrmXWs4RltQ==
 authorization-attribute level 3
 service-type ssh telnet terminal
 service-type web
#
cwmp
 undo cwmp enable
#
interface Aux0
 async mode flow
 link-protocol ppp
#
interface Cellular0/0
 async mode protocol
 link-protocol ppp
#
interface NULL0
#
interface Vlan-interface1
 ip address 192.168.100.1 255.255.255.0
 firewall packet-filter 3000 outbound
#
interface GigabitEthernet0/0
 port link-mode route
 nat outbound static
 nat outbound 2000
 nat server protocol tcp global 116.12.203.55 www inside 192.168.100.229 www
 nat server protocol tcp global 116.12.203.55 lpd inside 192.168.100.229 lpd
 nat server protocol tcp global 116.12.203.55 631 inside 192.168.100.229 631
 nat server protocol tcp global 116.12.203.55 9100 inside 192.168.100.229 9100
 nat server protocol tcp global 116.12.203.66 www inside 192.168.100.232 www
 nat server protocol tcp global 116.12.203.66 lpd inside 192.168.100.232 lpd
 nat server protocol tcp global 116.12.203.66 631 inside 192.168.100.232 631
 nat server protocol tcp global 116.12.203.66 9100 inside 192.168.100.232 9100
 duplex full
 speed 100
 ip address 124.66.xxx.xxx 255.255.255.252
#
interface GigabitEthernet0/1
 port link-mode bridge
#
interface GigabitEthernet0/2
 port link-mode bridge
#
interface GigabitEthernet0/3
 port link-mode bridge
#
interface GigabitEthernet0/4
 port link-mode bridge
#
 ip route-static 0.0.0.0 0.0.0.0 124.66.xxx.xxx
#
 dhcp server forbidden-ip 192.168.100.1 192.168.100.9
 dhcp server forbidden-ip 192.168.100.101 192.168.100.254
#
 dhcp enable
#
 ssh server enable
 ssh user netata service-type stelnet authentication-type password
#
 ip https acl 2000
 ip https enable
#
 load xml-configuration
#
 load tr069-configuration
#
user-interface tty 12
user-interface aux 0
 authentication-mode scheme
user-interface vty 0 4
 authentication-mode scheme
 protocol inbound ssh

HPE MSR 930 Lockdown

A router is a networking device that forwards data packets between computer networks. Routers perform the "traffic directing" functions on the Internet. The most familiar type of routers are home and small office cable or DSL routers that simply pass data, such as web pages, email, IM, and videos between computers and the Internet. More sophisticated routers, such as enterprise routers, connect large business or ISP networks up to the powerful core routers that forward data at high speed along the optical fiber lines of the Internet backbone. Though routers are typically dedicated hardware devices, use of software-based routers has grown increasingly common.

Routers

Networking hardware includes the physical devices facilitating the use of a computer network. Typically, networking hardware includes gateways, routers, network bridges, modems, wireless access points, networking cables, line drivers, switches, hubs, and repeaters. But it also includes hybrid network devices such as multilayer switches, protocol converters, bridge routers, proxy servers, firewalls, network address translators, multiplexers, network interface controllers, wireless network interface controllers, ISDN terminal adapters and other related hardware.

Networking Hardware-Other

Networking is the process of connecting computing devices, peripherals and terminals together through a system that uses wiring, cabling or radio waves that enable their users to communicate, share information and interact over distances. Often associated are issues regarding operating systems, hardware and equipment, cloud and virtual networking, protocols, architecture, storage and management.