The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The Cisco ASR 920 Series Router has one Gigabit Ethernet Management Ethernet interface on each Route Switch Processor.
The purpose of this interface is to allow users to perform management tasks on the router; it is basically an interface that should not and often cannot forward network traffic but can otherwise access the router, often via Telnet and SSH, and perform most management tasks on the router. The interface is most useful before a router has begun routing, or in troubleshooting scenarios when the interfaces are inactive.
The following aspects of the Management Ethernet interface should be noted:
The Gigabit Ethernet Management port is always GigabitEthernet0.
The port can be accessed in configuration mode like any other port on the router.
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#interface gigabitethernet0
Router(config-if)#On the router, IP addresses can be configured in ROMmon (the IP_ADDRESS= and IP_SUBNET_MASK= commands) and through the use of the IOS command-line interface (the ip address command in interface configuration mode).
Assuming the IOS process has not begun running on the router, the IP address that was set in ROMmon acts as the IP address of the Management Ethernet interface. In cases where the IOS process is running and has taken control of the Management Ethernet interface, the IP address specified when configuring the Gigabit Ethernet 0 interface in the IOS CLI becomes the IP address of the Management Ethernet interface. The ROMmon-defined IP address is only used as the interface address when the IOS process is inactive.
For this reason, the IP addresses specified in ROMmon and in the IOS CLI can be identical and the Management Ethernet interface will function properly.
The Gigabit Ethernet Management interface is automatically part of its own VRF. This VRF, which is named “Mgmt-intf,” is automatically configured on the router and is dedicated to the Management Ethernet interface; no other interfaces can join this VRF. Therefore, this VRF does not participate in the MPLS VPN VRF or any other network-wide VRF.
Placing the management ethernet interface in its own VRF has the following effects on the Management Ethernet interface:
The Management Ethernet interface VRF supports both IPv4 and IPv6 address families.
Because users can perform most tasks on a router through the Management Ethernet interface, many tasks can be done by accessing the router through the Management Ethernet interface.
The VRF configuration for the Management Ethernet interface is viewable using the show running-config vrf command.
This example shows the default VRF configuration:
Router# show running-config vrf
Building configuration...
Current configuration : 351 bytes
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
(some output removed for brevity)
To see detailed information about the Management Ethernet VRF, enter the show vrf detail Mgmt-intf command.
Router# show vrf detail Mgmt-intf
VRF Mgmt-intf (VRF Id = 4085); default RD <not set>; default VPNID <not set>
Interfaces:
Gi0
Address family ipv4 (Table ID = 4085 (0xFF5)):
No Export VPN route-target communities
No Import VPN route-target communities
No import route-map
No export route-map
VRF label distribution protocol: not configured
VRF label allocation mode: per-prefix
Address family ipv6 (Table ID = 503316481 (0x1E000001)):
No Export VPN route-target communities
No Import VPN route-target communities
No import route-map
No export route-map
VRF label distribution protocol: not configured
VRF label allocation mode: per-prefix
To set a default route in the Management Ethernet Interface VRF, enter the following command
ip route vrf Mgmt-intf 0.0.0.0 0.0.0.0 next-hop-IP-address
The IP address of the Management Ethernet port is set like the IP address on any other interface.
Below are two simple examples of configuring an IPv4 address and an IPv6 address on the Management Ethernet interface.
Router(config)# interface GigabitEthernet 0
Router(config-if)# ip address
A.B.C.D A.B.C.D
Router(config)# interface GigabitEthernet 0
Router(config-if)# ipv6 address X:X:X:X::X
Telnetting can be done through the VRF using the Management Ethernet interface.
In the following example, the router telnets to 172.17.1.1 through the Management Ethernet interface VRF:
Router# telnet 172.17.1.1 /vrf Mgmt-intf
Pinging other interfaces using the Management Ethernet interface is done through the VRF.
In the following example, the router pings the interface with the IP address of 172.17.1.1 through the Management Ethernet interface.
Router# ping vrf Mgmt-intf 172.17.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.17.1.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 msTo copy a file using TFTP through the Management Ethernet interface, the ip tftp source-interface GigabitEthernet 0 command must be entered before entering the copy tftp command because the copy tftp command has no option of specifying a VRF name.
Similarly, to copy a file using FTP through the Management Ethernet interface, the ip ftp source-interface GigabitEthernet 0 command must be entered before entering the copy ftp command because the copy ftp command has no option of specifying a VRF name.
Router(config)# ip tftp source-interface gigabitethernet 0
Router(config)# ip ftp source-interface gigabitethernet 0
To allow the software clock to be synchronized by a Network Time Protocol (NTP) time server over the Management Ethernet interface, enter the ntp server vrf Mgmt-intf command and specify the IP address of the device providing the update.
The following CLI provides an example of this procedure.
Router(config)# ntp server vrf Mgmt-intf 172.17.1.1
To specify the Management Ethernet interface as the source IP or IPv6 address for logging purposes, enter the logging host ip-address vrf Mgmt-intf command.
The following CLI provides an example of this procedure.
Router(config)# logging host <ip-address> vrf Mgmt-intf
To specify the Management Ethernet interface as the source of all SNMP trap messages, enter the snmp-server source-interface traps gigabitEthernet 0 command.
The following CLI provides an example of this procedure:
Router(config)# snmp-server source-interface traps gigabitEthernet 0
The IP domain name assignment for the Management Ethernet interface is done through the VRF.
To define the default domain name as the Management Ethernet VRF interface, enter the ip domain-name vrf Mgmt-intf domain command.
Router(config)# ip domain-name vrf Mgmt-intf cisco.com
To specify the Management Ethernet interface VRF as a name server, enter the ip name-server vrf Mgmt-intf IPv4-or-IPv6-address command.
Router(config)# ip name-server vrf Mgmt-intf
IPv4-or-IPv6-address To group the Management VRF as part of a AAA server group, enter the ip vrf forward Mgmt-intf command when configuring the AAA server group.
The same concept is true for configuring a TACACS+ server group. To group the Management VRF as part of a TACACS+ server group, enter the ip vrf forwarding Mgmt-intf command when configuring the TACACS+ server group.
Router(config)# aaa group server radius hello
Router(config-sg-radius)# ip vrf forwarding Mgmt-intf
outer(config)# aaa group server tacacs+ hello
Router(config-sg-tacacs+)# ip vrf forwarding Mgmt-intf
To ensure an access control list (ACL) is attached to vty lines that are and are not using VRF, use the vrf-also option when attaching the ACL to the vty lines.
Router(config)# line vty 0 4
Router(config-line)# access-class 90 in vrf-also
Feedback