An inband management interface is a Cisco IOS XR software physical or logical interface that processes management packets, as well as data-forwarding packets. An inband management interface is also called a shared management interface.

Out-of-band refers to an interface that allows only management protocol traffic to be forwarded or processed. An out-of-band management interface is defined by the network operator to specifically receive network management traffic. The advantage is that forwarding (or customer) traffic cannot interfere with the management of the router, which significantly reduces the possibility of denial-of-service attacks.

Out-of-band interfaces forward traffic only between out-of-band interfaces or terminate management packets that are destined to the router. In addition, the out-of-band interfaces can participate in dynamic routing protocols. The service provider connects to the router’s out-of-band interfaces and builds an independent overlay management network, with all the routing and policy tools that the router can provide.

The peer-filtering option allows management traffic from specific peers, or a range of peers, to be configured.

A control plane is a collection of processes that run at the process level on a route processor and collectively provide high-level control for most Cisco IOS XR software functions. All traffic directly or indirectly destined to a router is handled by the control plane. Management Plane Protection operates within the Control Plane Infrastructure.

The management plane is the logical path of all traffic that is related to the management of a routing platform. One of three planes in a communication architecture that is structured in layers and planes, the management plane performs management functions for a network and coordinates functions among all the planes (management, control, and data). In addition, the management plane is used to manage a device through its connection to the network.

Examples of protocols processed in the management plane are Simple Network Management Protocol (SNMP), Telnet, HTTP, Secure HTTP (HTTPS), and SSH. These management protocols are used for monitoring and for command-line interface (CLI) access. Restricting access to devices to internal sources (trusted networks) is critical.

The MPP protection feature, as well as all the management protocols under MPP, are disabled by default. When you configure an interface as either out-of-band or inband, it automatically enables MPP. Consequently, this enablement extends to all the protocols under MPP.

If MPP is disabled and a protocol is activated, all interfaces can pass traffic.

When MPP is enabled with an activated protocol, the only default management interfaces allowing management traffic are the route processor (RP) and standby route processor (SRP) Ethernet interfaces. You must manually configure any other interface for which you want to enable MPP as a management interface, using the MPP CLI that follows. Afterwards, only the default management interfaces and those you have previously configured as MPP interfaces will accept network management packets destined for the device. All other interfaces drop such packets.

Note	Logical interfaces (or any other interfaces not present on the data plane) filter packets based on the ingress physical interface.

After configuration, you can modify or delete a management interface.

Following are the management protocols that the MPP feature supports. These management protocols are also the only protocols affected when MPP is enabled.

• SSH, v1 and v2

• SNMP, all versions

• Telnet

• TFTP

• HTTP

• HTTPS

Implementing the MPP feature provides the following benefits:

• Greater access control for managing a device than allowing management protocols on all interfaces.

• Improved performance for data packets on non-management interfaces.

• Support for network scalability.

• Simplifies the task of using per-interface access control lists (ACLs) to restrict management access to the device.

• Fewer ACLs are needed to restrict access to the device.

• Prevention of packet floods on switching and routing interfaces from reaching the CPU.

Perform this task to configure a device that you have just added to your network or a device already operating in your network. This task shows how to configure MPP as an inband interface in which Telnet is allowed to access the router only through a specific interface.

Perform the following additional tasks to configure an inband MPP interface in non-default VRF.

• Configure the interface under the non-default inband VRF.

• Configure the global inband VRF.

• In the case of Telnet, configure the Telnet VRF server for the inband VRF.

Router#configure terminal
Router(config)#control-plane 
Router(config-ctrl)#management-plane 
Router(config-mpp)#inband 
Router(config-mpp-inband)#interface fourHundredGigE 0/0/0/0 
Router(config-mpp-inband-if)#allow telnet peer 
Router(config-telnet-peer)#address ipv4 10.1.0.0/16 
Router(config-telnet-peer)#commit

• FourHundredGigE 0/0/0/0 is configured as an inband interface. Use the interface all command form to configure all interfaces as inband interfaces.

• Telnet protocol is configured on the inband interface. To enable all protocols, use the allow all command form.

Running Configuration

The following is a sample output of show mgmt-plane command for the inband interface fourHundredGigE 0/0/0/0.

Router#show mgmt-plane inband interface fourHundredGigE 0/0/0/0

interface - fourHundredGigE 0/0/0/0
        telnet configured - 
                peer v4 allowed - 10.1.0.0/16

Perform the following tasks to configure an out-of-band MPP interface.

• Configure the interface under the out-of-band VRF.

• Configure the global out-of-band VRF.

• For a specific protocol, configure the protocol VRF server for the out-of-band VRF.

Router#configure terminal
Router(config)#control-plane 
Router(config-ctrl)#management-plane 
Router(config-mpp)#out-of-band  
Router(config-mpp-outband)#vrf target
Router(config-mpp-outband)#interface fourHundredGigE 0/0/0/3 
Router(config-mpp-outband-if)#allow tftp peer 
Router(config-tftp-peer)#address ipv6 33::33 
Router(config-tftp-peer)#commit

• FourHundredGigE 0/0/0/3 is configured as an out-of-band interface, for the VRF target. Use the interface all command form to configure all interfaces as out-of-band interfaces.

• TFTP protocol is configured on the out-of-band interface. To enable all protocols, use the allow all command form.

Running Configuration

The following is a sample output of the show mgmt-plane out-of-band vrf command.

Router#show mgmt-plane out-of-band vrf 

Management Plane Protection - 
        out-of-band VRF - target