A vehicle includes a gateway controller configured to interface a diagnostic port to a vehicle communication network. In response to a perimeter alarm system being in an armed state, transfer of messages from the diagnostic port to the vehicle communication network is inhibited. A change session diagnostic request received from the diagnostic port is transferred to the vehicle communication network in response to vehicle speed being less than a threshold and an ignition switch begin in a run position. The transfer of the change session diagnostic request is otherwise inhibited unless intended for a module designated for reprogramming keys.