LESSON PURPOSE Build a practical understanding of how administrators securely access, identify, authenticate to, and manage Cisco network devices locally and remotely. The lesson establishes the management-plane foundation required for initial setup, day-to-day operations, troubleshooting, and secure administration. |
Lesson Overview
Routers, switches, wireless controllers, and other network devices must be reachable and securely manageable before configuration or troubleshooting can begin. This lesson explains the difference between local console access and remote management, how a management IP address provides IP reachability, and why SSH is preferred over insecure clear-text methods. It also introduces local user authentication, VTY access, AAA concepts, in-band versus out-of-band management, session protection, and the verification commands used to confirm management access.
Learning Objectives
• Explain the purpose of the management plane and distinguish management traffic from normal user/data traffic.
• Compare local console access with remote management access and identify when each method is used.
• Describe in-band and out-of-band (OOB) management and the operational advantages of a dedicated management path.
• Configure and verify a management IP address on a router interface, switch SVI, or dedicated management interface as appropriate.
• Explain the purpose of the console, VTY, and legacy AUX access methods on Cisco devices.
• Configure secure remote CLI access using SSH, including hostname/domain prerequisites, local users, RSA keys, VTY settings, and SSH version 2.
• Explain why Telnet is insecure and why encrypted management protocols should be preferred.
• Configure and verify local usernames, privilege levels, enable secret, login controls, and basic session timeout settings.
• Describe the role of AAA and how TACACS+ and RADIUS can centralize administrator authentication, authorization, and accounting.
• Use common verification and troubleshooting commands such as show ip interface brief, show users, show line, show ip ssh, ping, traceroute, and show running-config.
Suggested Study Flow
- Understand management-plane reachability and recovery paths.
- Learn direct console access first.
- Compare Telnet and SSH, then build a complete SSH configuration.
- Add HTTPS web management and restrict who can reach management services.
- Enable AAA and understand method lists before adding TACACS+ or RADIUS.
- Finish with cloud management, verification, troubleshooting, and an end-to-end lab.
1. Management Plane Fundamentals
The management plane is the part of a network device used by administrators and management systems to configure, monitor, and troubleshoot the device. Management traffic is different from user traffic: it includes CLI sessions, web sessions, AAA requests, logging, telemetry, SNMP, API calls, and software-management communication. Because compromise of the management plane can provide administrative control of the device, management access should be treated as a high-value security boundary.
1.1 In-Band vs Out-of-Band Management
|
Method |
Path |
Requires Production IP? |
Typical Use |
|
In-band |
Uses the production IP network |
Yes |
SSH, HTTPS, SNMP, APIs, AAA |
|
Out-of-band |
Uses a separate physical/management path |
No or separate mgmt network |
Console server, dedicated management interface, emergency access |
In-band management is convenient because it uses the existing network, but it depends on routing, VLANs, ACLs, and upstream connectivity. Out-of-band management is designed to remain available when the production data path is broken, making it especially useful during initial deployment and outages.
1.2 Management IP Addressing on a Layer 2 Switch
A Layer 2 switch needs an SVI (Switch Virtual Interface) for IP-based management. The SVI does not make the switch a router; it simply gives the switch an IP address in a management VLAN. The switch also needs a default gateway if the administrator is on another subnet.
Layer 2 switch management example
|
vlan 99 name MANAGEMENT ! interface Vlan99 description Management SVI ip address 10.10.99.11 255.255.255.0 no shutdown ! ip default-gateway 10.10.99.1 |
|
Important For a Layer 3 switch with ip routing enabled, use routing (for example, a default route) rather than relying on ip default-gateway. |
Verification
|
show ip interface brief show interfaces vlan 99 show vlan brief show ip default-gateway ping 10.10.99.1 |
2. Console Access - Direct Local Management
The console port provides direct terminal access to the device. It is normally used during first-time setup, recovery, or when the IP network is unavailable. A console session does not require an IP address, VLAN, routing table, DNS, or default gateway. This makes it the most reliable recovery path, but it also means physical security matters because a person with console access may obtain privileged control of the device.
2.1 How the Console Line Works
The console line is represented by line console 0 on Cisco IOS/IOS XE.
Authentication can use a simple line password, the local username database, or AAA.
Idle timeout and synchronous logging are line-level settings.
Console access is not encrypted over the physical cable; security comes from physical control and authentication.
2.2 Recommended Lab Configuration
|
username breakglass privilege 15 secret StrongLocalSecret ! line console 0 login local exec-timeout 10 0 logging synchronous |
login local tells the console line to authenticate users against locally configured usernames. exec-timeout 10 0 disconnects an idle session after ten minutes. logging synchronous causes unsolicited log messages to be redisplayed cleanly instead of disrupting the command being typed.
2.3 Older Line-Password Method
Exam/lab example only
Verification
3. Telnet and…