Cisco CRS-1 - Carrier Routing System Router - Page 188

Implementing Management Plane Protection on Cisco IOS XR Software
Contents
SC-182
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
OL-20382-01
Contents
• Prerequisites for Implementing Management Plane Protection, page SC-182
• Restrictions for Implementing Management Plane Protection, page SC-182
• Information About Implementing Management Plane Protection, page SC-182
• How to Configure a Device for Management Plane Protection, page SC-184
• Configuration Examples for Implementing Management Plane Protection, page SC-191
• Additional References, page SC-192
Prerequisites for Implementing Management Plane Protection
• You must be in a user group associated with a task group that includes the proper task IDs. The
command reference guides include the task IDs required for each command.
• If you suspect user group assignment is preventing you from using a command, contact your AAA
administrator for assistance.
Restrictions for Implementing Management Plane Protection
The following restrictions are listed for implementing Management Plane Protection (MPP):
• Currently, MPP does not keep track of the denied or dropped protocol requests.
• MPP configuration does not enable the protocol services. MPP is responsible only for making the
services available on different interfaces. The protocols are enabled explicitly.
• Management requests that are received on inband interfaces are not necessarily acknowledged there.
• Both route processor (RP) and distributed route processor (DRP) Ethernet interfaces are by default
out-of-band interfaces and can be configured under MPP.
• The changes made for the MPP configuration do not affect the active sessions that are established
before the changes.
• Currently, MPP controls only the incoming management requests for protocols, such as TFTP,
Telnet, Simple Network Management Protocol (SNMP), Secure Shell (SSH), and HTTP.
• MIB support is not provided.
Information About Implementing Management Plane Protection
Before you enable the Management Plane Protection feature, you should understand the following
concepts:
• Inband Management Interface, page SC-183
• Out-of-Band Management Interface, page SC-183
• Peer-Filtering on Interfaces, page SC-183
• Control Plane Protection Overview, page SC-183
• Management Plane, page SC-183