Hello Eric
If you have VRFs configured on your device, then for you to access the VTY management interface from a particular VRF (other than the default one) you must apply the following command:
Router(config-line)# access-class 1 in vrf-also
By default incoming Telnet/SSH connections from interfaces that are part of a VRF instance are rejected. The vrf-also keyword must be applied so that incoming connections from interfaces on other VRFs will be accepted.
Starting from IOS XE 16.8.1 VRF awareness has been added to the access class line feature using the vrfname keyword. Specifically, you can do the following:
Device(config)# line vty 0 4
Device(config-line)# ipv6 access-class acl-name in vrfname vfrA
Note that you cannot use both VRF awareness and vrf-also on the same VTY line, as they are mutually exclusive commands.
More information about VRF awareness can be found at this Cisco documentation:
I hope this has been helpful!
Laz