Table Of Contents

Management Plane Protection Commands on Cisco IOS XR Software

allow

control-plane

inband

interface (MPP)

management-plane

show mgmt-plane

Management Plane Protection Commands on Cisco IOS XR Software

---

This module describes the Cisco IOS XR software commands used to configure management plane protection (MPP).

For detailed information about keychain management concepts, configuration tasks, and examples, see the Implementing Management Plane Protection on Cisco IOS XR Software configuration module.

allow

To configure an interface as an inband interface for a specified protocol or all protocols, use the allow command in management plane protection inband interface configuration mode. To disallow a protocol on an interface, use the no form of this command.

allow {protocol | all}

no allow {protocol | all}

Syntax Description

protocol	Interface configured to allow the following specified protocol's traffic: •HTTP(S) •SNMP (also versions) •Secure Shell (v1 and v2) •TFTP •Telnet
all	Configures the interface to allow all the management traffic that is specified in the list of protocols.

Defaults

By default, no management protocol is allowed on any interface except the management interfaces.

Command Modes

Management plane protection inband interface configuration

Command History

Release	Modification
Release 3.5.0	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

If you permit or allow a specific protocol to an interface, traffic is allowed only for that protocol, and all other management traffic is dropped.

After you configure the interface as inband, the specified (or all) protocol's traffic is allowed on the interface. All other interfaces, which are not configured as inband interfaces, would drop the protocol traffic.

Task ID

Task ID	Operations
system	read, write

Examples

The following example shows how to configure all management protocols for all inband interfaces:

RR/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# control-plane

RP/0/RP0/CPU0:router(config-ctrl)# management-plane

RP/0/RP0/CPU0:router(config-mpp)# inband

RP/0/RP0/CPU0:router(config-mpp-inband)# interface all

RP/0/RP0/CPU0:router(config-mpp-inband-all)# allow all

Related Commands

Command	Description
control-plane	Configures the control plane.
inband	Configures an inband interface or protocol.
interface (MPP)	Configures a specific inband interface or all inband interfaces.
management-plane	Configures management plane protection to allow and disallow protocols.
show mgmt-plane	Displays the management plane.

control-plane

To enter the control plane configuration mode, use the control-plane command in global configuration mode. To disable all the configurations under control plane mode, use the no form of this command.

control-plane

no control-plane

Syntax Description

This command has no arguments or keywords.

Defaults

No default behavior or values

Command Modes

Global configuration

Command History

Release	Modification
Release 3.5.0	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the control-plane command to enter control plane configuration mode.

Task ID

Task ID	Operations
system	read, write

Examples

The following example shows how to enter control plane configuration mode using the control-plane command:

RR/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# control-plane

RP/0/RP0/CPU0:router(config-ctrl)# 

Related Commands

Command	Description
management-plane	Configures management plane protection to allow and disallow protocols.

inband

To configure an inband interface and to enter management plane protection inband configuration mode, use the inband command in management plane protection configuration mode. To disable all configurations under inband configuration mode, use the no form of this command.

inband

no inband

Syntax Description

This command has no arguments or keywords.

Defaults

No default behavior or values

Command Modes

Management plane protection inband configuration

Command History

Release	Modification
Release 3.5.0	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the inband command to enter management plane protection inband configuration mode.

Task ID

Task ID	Operations
system	read, write

Examples

The following example shows how to enter management plane protection inband configuration mode using the inband command:

RR/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# control-plane

RP/0/RP0/CPU0:router(config-ctrl)# management-plane

RP/0/RP0/CPU0:router(config-mpp)# inband

RP/0/RP0/CPU0:router(config-mpp-inband)# 

Related Commands

Command	Description
control-plane	Configures the control plane.
interface (MPP)	Configures a specific inband interface or all inband interfaces.
management-plane	Configures management plane protection to allow and disallow protocols.
show mgmt-plane	Displays the management plane.

interface (MPP)

To configure a specific interface or all interfaces as an inband interface, use the interface command in management plane protection inband configuration mode. To disable all the configurations under interface mode, use the no form of this command.

interface {type instance | all}

no interface {type instance | all}

Syntax Description

type	Interface type. For more information, use the question mark (?) online help function.
instance	Either a physical interface instance or a virtual interface instance as follows: •Physical interface instance. Naming notation is rack/slot/module/port and a slash between values is required as part of the notation. –rack: Chassis number of the rack. –slot: Physical slot number of the modular services card or line card. –module: Module number. A physical layer interface module (PLIM) is always 0. –port: Physical port number of the interface. Note In references to a Management Ethernet interface located on a route processor card, the physical slot number is alphanumeric (RP0 or RP1) and the module is CPU0. Example: interface MgmtEth0/RP1/CPU0/0. •Virtual interface instance. Number range varies depending on interface type. For more information about the syntax for the router, use the question mark (?) online help function.
all	Configures all interfaces to allow for management traffic.

Defaults

No default behavior or values

Command Modes

Management plane protection inband configuration

Command History

Release	Modification
Release 3.5.0	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the interface command to enter management plane protection inband interface configuration mode.

For the instance argument, you cannot configure MgmtEth interfaces as inband interfaces.

Task ID

Task ID	Operations
system	read, write

Examples

The following example shows how to configure all interfaces for MPP:

RR/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# control-plane

RP/0/RP0/CPU0:router(config-ctrl)# management-plane

RP/0/RP0/CPU0:router(config-mpp)# inband

RP/0/RP0/CPU0:router(config-mpp-inband)# interface all

RP/0/RP0/CPU0:router(config-mpp-inband-all)#

Related Commands

Command	Description
allow	Allows a specific protocol on the interface.
control-plane	Configures the control plane.
inband	Configures an inband interface or protocol.
management-plane	Configures management plane protection to allow and disallow protocols.
show mgmt-plane	Displays the management plane.

management-plane

To configure management plane protection to allow and disallow protocols, use the management-plane command in control plane configuration mode. To disable all configurations under management-plane mode, use the no form of this command.

management-plane

no management-plane

Syntax Description

This command has no arguments or keywords.

Defaults

No default behavior or values

Command Modes

Control plane configuration

Command History

Release	Modification
Release 3.5.0	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Use the management-plane command to enter the management plane protection configuration mode.

Task ID

Task ID	Operations
system	read, write

Examples

The following example shows how to enter management plane protection configuration mode using the management-plane command:

RR/0/RP0/CPU0:router# configure

RP/0/RP0/CPU0:router(config)# control-plane

RP/0/RP0/CPU0:router(config-ctrl)# management-plane

RP/0/RP0/CPU0:router(config-mpp)# 

Related Commands

Command	Description
control-plane	Configures the control plane.
inband	Configures an inband interface or protocol.

show mgmt-plane

To display information about the management plane such as type of interface and protocols enabled on the interface, use the show mgmt-plane command in EXEC mode.

show mgmt-plane [interface {type instance}]

Syntax Description

interface	(Optional) Displays all the protocols that are allowed in the specified interface.
type	Interface type. For more information, use the question mark (?) online help function.
instance	Either a physical interface instance or a virtual interface instance as follows: •Physical interface instance. Naming notation is rack/slot/module/port and a slash between values is required as part of the notation. –rack: Chassis number of the rack. –slot: Physical slot number of the modular services card or line card. –module: Module number. A physical layer interface module (PLIM) is always 0. –port: Physical port number of the interface. Note In references to a Management Ethernet interface located on a route processor card, the physical slot number is alphanumeric (RP0 or RP1) and the module is CPU0. Example: interface MgmtEth0/RP1/CPU0/0. •Virtual interface instance. Number range varies depending on interface type. For more information about the syntax for the router, use the question mark (?) online help function.

Defaults

No default behavior or values

Command Modes

EXEC

Command History

Release	Modification
Release 3.5.0	This command was introduced on the Cisco CRS-1 and Cisco XR 12000 Series Router.

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.

Task ID

Task ID	Operations
system	read

Examples

The following sample output displays all the interfaces that are configured as inband interfaces under MPP:

RR/0/RP0/CPU0:router# show mgmt-plane

Management Plane Protection - inband interfaces

        Interface - POS0/5/0/0 

                SSH Allowed

        Interface - POS0/5/0/1

                TELNET Allowed

                ALL Protocols Allowed

Related Commands

Command	Description
management-plane	Configures management plane protection to allow and disallow protocols.