cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
236
Views
0
Helpful
1
Replies

Dedicated managment interface in tiny network?

cssprickman
Level 1
Level 1

We're a very small ISP with one PoP that is getting an ASR-1002X to replace an aging 7206 w/NPE-G2.

I'm trying to wrap my head around how to achieve some separation between management access and customer traffic.  We're basically self-contained in one cabinet at a colo facility, and the only existing "management" network is just a dumb switch connected to the internal interfaces of all the servers - this is used for backend db access, backups, and other "management" tasks, but it is totally isolated from the larger internet.  The VXR currently does not even have an interface on that network.  Our current protection is simply a bunch of ACLs to restrict snmp/ssh to a handful of IPs (admin workstations, monitoring server).

On running through the initial setup of the ASR1K, I noticed that it has a dedicated management interface and that a VRF instance is setup and this interface is placed in that VRF.  That is I assume what's noted in this document:

http://www.cisco.com/c/en/us/support/docs/routers/asr-1000-series-aggregation-services-routers/116093-configure-vrf-00.html

Looking at an older, non-ASR1K specific document, I note that VRFs aren't even discussed:

http://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html

In a small deployment where we don't have a full-on management network, does it make any sense to do anything beyond the recommendations in the second link (ACL management protocols, ACL the control plane, and rate-limit things as appropriate)?

I feel like putting that management interface and a VRF on our current internal network doesn't give me a big win and it makes things all the more fragile/complicated when something goes awry and I need to reach the router.

Any opinions on that?

Lastly, is the Best Practices guide I linked to above current enough?  It was published in 2011, not sure if later versions of IOS introduce any new features that would obsolete that document.

1 Reply 1

sean_evershed
Level 7
Level 7

When the new ASR is installed, will it be possible for a hacker to attack your network through this device? If the answer is yes then they could do a significant amount of damage to both your company and your customers.

Therefore I would suggest as an alternative that you install a small ASA firewall between this router and your internal network. They offer a major stronger form of defence than router ACLs and management VRFs.

Review Cisco Networking for a $25 gift card