Management Ethernet Interface

The Cisco 8500 Series Catalyst Edge Platform have one Gigabit Ethernet Management Ethernet interface.

Gigabit ethernet management interface

A management interface is a router interface that

  • allows users to perform management tasks on the router,

  • typically does not, and often cannot, forward network traffic,

  • provides access to the router, often via Telnet and SSH for most management operations, and

  • is especially useful before the router has begun routing or when the SPA interfaces are inactive during troubleshooting scenarios.

These aspects of the Management Ethernet interface should be noted:

  • IPv4, IPv6, and ARP are the only routed protocols supported for the interface.

  • The Ethernet Management Interface cannot be used as a Lawful Intercept MD source interface.

  • The Management Ethernet interface is part of its own VRF. This is discussed in more detail in the Gigabit Ethernet Management Interface VRF.

IP Address in ROMmon and the management ethernet port

On the Cisco 8500 Series Catalyst Edge Platform, IP addresses can be configured in ROMmon (the IP_ADDRESS= and IP_SUBNET_MASK= commands) and through the use of the IOS command-line interface (the ip address command in interface configuration mode).

Assuming the IOS process has not begun running on the Cisco 8500 Series Catalyst Edge Platform, the IP address that was set in ROMmon acts as the IP address of the Management Ethernet interface.

In cases where the IOS process is running and has taken control of the Management Ethernet interface, the IP address specified when configuring the Gigabit Ethernet 0 interface in the IOS CLI becomes the IP address of the Management Ethernet interface. The ROMmon-defined IP address is only used as the interface address when the IOS process is inactive.

For this reason, the IP addresses specified in ROMmon and in the IOS CLI can be identical and the Management Ethernet interface will function properly in single RP configurations.

Gigabit ethernet management interface VRF

The Gigabit Ethernet Management interface is automatically part of its own VRF. This VRF, which is named “Mgmt-intf,” is automatically configured on the Cisco 8500 Series Catalyst Edge Platform and is dedicated to the Management Ethernet interface; no other interfaces can join this VRF. Therefore, this VRF does not participate in the MPLS VPN VRF or any other network-wide VRF. The Mgmt-intf VRF supports loopback interface.

Placing the management ethernet interface in its own VRF results in these effects on the Management Ethernet interface:

  • Many features must be configured or used inside the VRF, therefore, the CLI may differ for certain Management Ethernet functions on the Cisco 8500 Series Catalyst Edge Platform compared to the Management Ethernet interfaces on other routers.

  • This configuration prevents transit traffic from traversing the router. Because all built-in ports and the Management Ethernet interface are automatically assigned to different VRFs, no transit traffic can enter the Management Ethernet interface and leave a built-in port, nor travel in the opposite direction.

  • The interface security is improved. Because the Mgmt-intf VRF has its own routing table, only routes that are explicitly entered by a user can be added to the routing table of the Management Ethernet interface.

The Management Ethernet interface VRF supports both the IPv4 and IPv6 address families.

Common ethernet management tasks

You can complete most router tasks by accessing the router through the Management Ethernet interface.

This section covers tasks that might be common or somewhat tricky on the Cisco 8500 Series Catalyst Edge Platform. It is not intended as a comprehensive list of all tasks that can be done using the Management Ethernet interface.

This section describes common processes.

View the VRF configuration

The VRF configuration for the Management Ethernet interface is viewable using the show running-config vrf command.

This example shows the default VRF configuration:


Router#show running-config vrf
Building configuration...
Current configuration : 351 bytes
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!

(some output removed for brevity)

View detailed VRF information for the management ethernet VRF

To see detailed information about the Management Ethernet VRF, enter the show vrf detail Mgmt-intf command: 


Router#show vrf detail Mgmt-intf

Set a sefault route in the management ethernet interface VRF

To set a default route in the Management Ethernet Interface VRF, enter this command

ip route vrf Mgmt-intf 0.0.0.0 0.0.0.0 next-hop-IP-address

Set the management ethernet IP address

The IP address of the Management Ethernet port is set like the IP address on any other interface.

Below are two simple examples of configuring an IPv4 adress and an IPv6 address on the Management Ethernet interface.

IPv4 Example


Router(config)# interface GigabitEthernet 0
Router(config-if)# ip address
A.B.C.D A.B.C.D

IPv6 Example

Router(config)# interface GigabitEthernet 0
Router(config-if)# ipv6 address X:X:X:X::X

Copy using TFTP or FTP

To copy a file using TFTP through the Management Ethernet interface, the ip tftp source-interface GigabitEthernet 0 command must be entered before entering the copy tftp command because the copy tftp command has no option of specifying a VRF name.

Similarly, to copy a file using FTP through the Management Ethernet interface, the ip ftp source-interface GigabitEthernet 0 command must be entered before entering the copy ftp command because the copy ftp command has no option of specifying a VRF name.

TFTP Example

Router(config)# ip tftp source-interface gigabitethernet 0

FTP Example

Router(config)# ip ftp source-interface gigabitethernet 0

NTP server

To allow the software clock to be synchronized by a Network Time Protocol (NTP) time server over the Management Ethernet interface, enter the ntp server vrf Mgmt-intf command and specify the IP address of the device providing the update.

This CLI provides an example of this procedure.

Router(config)# ntp server vrf Mgmt-intf 172.17.1.1

SYSLOG Server

To specify the Management Ethernet interface as the source IP or IPv6 address for logging purposes, enter the logging host <ip-address> vrf Mgmt-intf command.

This CLI provides an example of this procedure.

Router(config)# logging host <ip-address> vrf Mgmt-intf

Domain name assignment

The IP domain name assignment for the Management Ethernet interface is done through the VRF.

To define the default domain name as the Management Ethernet VRF interface, enter the ip domain-name vrf Mgmt-intf domain command. 

Router(config)# ip domain-name vrf Mgmt-intf cisco.com

DNS service

To specify the Management Ethernet interface VRF as a name server, enter the ip name-server vrf Mgmt-intf IPv4-or-IPv6-address command. 

Router(config)#ip name-server vrf Mgmt-intf
IPv4-or-IPv6-address

RADIUS or TACACS+ server

To group the Management VRF as part of a AAA server group, enter the ip vrf forward Mgmt-intf command when configuring the AAA server group.

The same concept is true for configuring a TACACS+ server group. To group the Management VRF as part of a TACACS+ server group, enter the ip vrf forwarding Mgmt-intf command when configuring the TACACS+ server group.

RADIUS server group configuration


Router(config)#aaa group server radius hello
Router(config-sg-radius)#ip vrf forwarding Mgmt-intf

TACACS+ server group example


Router(config)#aaa group server tacacs+ hello
Router(config-sg-tacacs+)#ip vrf forwarding Mgmt-intf

VTY lines with ACL

To ensure an access control list (ACL) is attached to vty lines that are and are not using VRF, use the vrf-also option when attaching the ACL to the vty lines. 

Router(config)# line vty 0 4
Router(config-line)# access-class 90 in vrf-also