Cisco RF Gateway 10 Software Configuration Guide

Ethernet Management Interface and Management Vrf

The Cisco RF Gateway 10 automatically places the Fa1 interface on a separate routing domain (or the VRF domain), called the Management VRF. The Fa1 interface cannot be configured on any other routing domain. Also, no other interface can be configured on the Management VRF.

On bootup the Fa1 port assumes the following default configuration:

Caution The Ethernet management port is intended for an out-of-band access only. Like the console port, the Ethernet management port has direct access to critical resources on the Cisco RF Gateway 10. Connecting this port to an in-band network might cause performance degradation and vulnerability to a denial of service attack.

---

How to Use the Ethernet Management Port

Use the Ethernet management port instead of the Cisco RF Gateway 10 console port for network management. When managing a Cisco RF Gateway 10, connect the PC to the Ethernet management port on the Cisco RF Gateway 10 Supervisor Engine.

Note When connecting a PC to the Ethernet management port, you must assign an IP address.

Because the management port is placed in management Vrf, you should be aware of the VRF-related commands required for the following tasks:

• Ping
• TraceRoute
• Telnet
• TFTP
• FTP
• SSH
• SSO Model

Note Commands specific to the Management VRF are mentioned below. All additional configuration necessary to make the feature work should be performed.

Ping

If you want to ping an IP address that is reachable through an fa1 port, enter the following command:

For example:

Type escape sequence to abort.

TraceRoute

For example:

Type escape sequence to abort.

Telnet

If you want to Telnet to a remote Cisco RF Gateway 10 through the Fa1 port, enter the following command:

word—IP address or hostname of a remote system

Following is an example illustrating how to use this command:

TFTP

If you want to use the Fa1 port for TFTP operation, configure the Fa1 port as the source interface for TFTP as follows:

FTP

If you want to use an Fa1 port for an FTP operation, configure the Fa1 port as the source interface for FTP as follows:

SSH

If you want to initiate SSH from the Cisco RF Gateway 10 through the Fa1 port, enter the following command:

For example:

SSO Model

On a redundant chassis, management port behavior differs from that of a standard Ethernet port in that each supervisor engine possesses a management port, and only the port on the active supervisor engine is enabled. The management port on the standby supervisor engine is always disabled; it cannot switch any kind of traffic.

When a switchover occurs, the management port of the standby supervisor engine (now, active) is enabled and can be used to switch traffic, while the management port on the "old" active supervisor engine is disabled.

Note The Cisco IOS configuration for the management port is synchronized between the two supervisor engines. Under Cisco IOS, they possess the same IP address. To avoid address overlapping during a switchover on a redundant chassis, you should assign a different IP address on the management port from the one you assigned to the same port in the ROMMON configuration.

Restrictions for the Ethernet Management Port

Do not point the route to the Ethernet Management VRF interface. Instead, use the management VRF to add routes for the interface.

Use the following command to add routes:

ip route vrf vrf-name prefix mask [ next-hop-address ] [ interface interface-number ] [ global ] [ distance ]

Supported Features on the Ethernet Management Port

The Ethernet management port supports these features:

• Telnet with passwords
• TFTP
• Secure Shell (SSH)
• DHCP-based autoconfiguration
• SNMP (only the ENTITY-MIB and the IF-MIB)
• IP ping
• Interface features

– Speed-autonegotiation

– Duplex mode-autonegotiation

• Cisco Discovery Protocol (CDP)
• IPv4 access control lists (ACLs)
• Routing protocols (RIP, OSPF)

Caution Before enabling a feature on the Ethernet management port, ensure that the feature is supported. If you try to configure an unsupported feature on an Ethernet management port, the feature might not work properly, and the Cisco RF Gateway 10 might crash.

---

Note Effective with Cisco IOS-XE Release 3.2.2SQ, all features that use Fa1 now need to be VRF-aware.

Configuring the Ethernet Management Port

To specify the Ethernet management port, enter fastethernet1.

To disable the port, use the shutdown interface configuration command. To enable the port, use the

no shutdown interface configuration command.

To determine the link status to the PC, you can monitor the LED for the Ethernet management port:

• The LED is green (on) when the link is active.
• The LED is off when the link is down.
• The LED is amber when there is a POST failure.

To display the link status, use the show interfaces fastethernet 1 privileged EXEC command.

Using SNMP to Configure the Ethernet Management Port

The following is an example to show configuration of the Ethernet Management port with the source interface pointing to the management interface:

Configuration Examples for the Ethernet Management Port

This example shows how to display ARP entries related to Management VRF:

This example shows how to display the Cisco Discovery Protocol (CDP) status for the Ethernet Management Interface:

This example shows a sample route entry for the Management VRF:

Restrictions for EtherChannel

If improperly configured, some EtherChannel interfaces are disabled automatically to avoid network loops and other problems. Follow these guidelines and restrictions to avoid configuration problems:

• All Ethernet interfaces on all modules support EtherChannel (maximum of eight interfaces) with no requirement that interfaces be physically contiguous or on the same module.
• Configure all interfaces in an EtherChannel to operate at the same speed and duplex mode.
• Enable all interfaces in an EtherChannel. Disabling an interface in an EtherChannel is treated as a link failure, and its traffic is transferred to one of the remaining interfaces in the EtherChannel.
• An EtherChannel does not form if one of the interfaces is a Switched Port Analyzer (SPAN) destination port.

Note Effective with Cisco IOS-XE Release 3.2.2SQ, only limited Etherchannel functionality using Layer 2 Etherchannel is supported on the Cisco RF Gateway 10.

• For Layer 2 EtherChannels:

– Assign all interfaces in the EtherChannel to the same VLAN, or configure them as trunks.

– If you configure an EtherChannel from trunk interfaces, verify that the trunking mode and the native VLAN is the same on all the trunks. Interfaces in an EtherChannel with different trunk modes or different native VLANs can have unexpected results.

– An EtherChannel supports the same allowed range of VLANs on all the interfaces in a trunking Layer 2 EtherChannel. If the allowed ranges differ for the selected interfaces, they do not form an EtherChannel.

– Interfaces with different Spanning Tree Protocol (STP) port path costs can form an EtherChannel as long they are otherwise compatibly configured. Setting different STP port path costs does not make interfaces incompatible for the formation of an EtherChannel.

• After you configure an EtherChannel, any configuration that you apply to the port channel interface affects the EtherChannel; any configuration that you apply to the physical interfaces affects only the interface you configure.
• Storm Control is an exception to this rule. For example, you cannot configure Storm Control on some of the members of an EtherChannel; Storm Control must be configured on all or none of the ports. If you configure Storm Control on only some of the ports, those ports are dropped from the EtherChannel interface (put in suspended state). You should configure Storm Control at the port channel interface level, and not at the physical interface level.
• A physical interface with port security enabled can join a Layer 2 EtherChannel only if port security is also enabled on the EtherChannel; otherwise the command is rejected.
• You cannot configure an 802.1X port in an EtherChannel.

Configuring EtherChannels on Cisco RF Gateway 10

These sections describe the configuration of the EtherChannel on the Cisco RF Gateway 10:

Configuring the Cisco RF Gateway 10 EtherChannels

To configure Layer 2 EtherChannels, configure the Ethernet interfaces with the channel-group command. This operation creates the port channel logical interface.

Note Cisco IOS software creates port channel interfaces for Layer 2 EtherChannels when you configure Layer 2 Ethernet interfaces with the channel-group command.

To configure Layer 2 Ethernet interfaces as Layer 2 EtherChannels, perform this task for each interface:

This example shows how to configure TenGigabit interface into port channel 1 with mode on :

This example shows how to verify the configuration of port channel interface 1:

These two examples show how to verify the configuration of TenGigabit Ethernet:

This example shows how to verify the configuration of port channel interface 2 after the interfaces have been configured:

Removing the TenGigabit Interface

This example shows how to remove TenGigabit interfaces from port channel 1:

Removing an EtherChannel

Note If you remove an EtherChannel, the member ports are shut down and removed from the channel group.

This example shows how to remove port channel 1: