Management plane protection features

A Management Plane Protection (MPP) feature is a security feature that

• restricts the interfaces on which network management packets can enter a device

• lets an operator designate one or more router interfaces as management interfaces, and

• causes only designated management interfaces to accept management traffic destined for the device.

A management plane protection feature is a security mechanism that

• distinguishes inband interfaces from out-of-band interfaces

• enables peer filtering by clarifying the relationship between the control and management planes, and

• supports, enables, and filters management protocols for improved network defense.

An inband management interface is a Cisco IOS XR physical or logical interface that

• processes management packets

• processes data-forwarding packets, and

• processes packets as a shared management interface.

An out-of-band management interface is an interface that

• allows only management protocol traffic to be forwarded or processed

• prevents forwarding or customer traffic from interfering with router management and significantly reduces the possibility of denial-of-service attacks, and

• forwards traffic between out-of-band interfaces, terminates management packets destined for the router, and participates in dynamic routing protocols.

A peer filter is an interface option that

• allows management traffic from a specific peer

• allows management traffic from a range of peers, and

• provides a more specific source restriction than allowing all peers.

A control plane is a collection of route-processor processes that

• runs at the process level

• provides high-level control for most Cisco IOS XR software functions, and

• handles traffic directly or indirectly destined for the router while providing the Control Plane Infrastructure in which MPP operates.

A management plane is a layer of a communication architecture that

• serves as one of three planes responsible for managing network devices

• coordinates functions among the management, control, and data planes, and

• supports device monitoring and command-line interface (CLI) access through management protocols.

The MPP features are management-traffic protection features that

• are disabled by default, along with their management protocols, and are enabled when an interface is configured as inband or out-of-band

• allow management traffic by default only on RP and standby RP Ethernet interfaces and on interfaces manually configured for MPP, while all other interfaces drop management packets destined for the device, and

• support SSHv2, all SNMP versions, Telnet, TFTP, HTTP, and HTTPS, and permit modification or deletion of management interfaces after configuration.