Mgmt-intf vrf

[alxzed]

I am trying to deploy brand new ISR 4331 routers with 16.9r and 16.10 code on them. My vManage template is very basic, just VPN 0 configuration, hostname, etc. When I try to push templates, it gives me a weird error message as per below. When I preview the config, I don't see Mgmt-intf vrf being removed in the preview though. Is this a bug or something? How do I prevent this from happening?

<error-message unknown:lang="en">inconsistent value: Device refused one or more commands</error-message>
<error-info>
<severity xmlns="http://cisco.com/yang/cisco-ia">error_cli</severity>
<detail xmlns="http://cisco.com/yang/cisco-ia">
<bad-cli>
<bad-command> no vrf forwarding Mgmt-intf</bad-command>
<error-location>4</error-location>
<parser-response>
% Management interface VRF can not be changed.
</parser-response>
</bad-cli>
</detail>
</error-info>

[David Aicher · Accepted solution]

Can you try adding vpn512 to your template?  

the default behavior is to delete running configurations that exist on the ISR but are not specified in the template.   this causes some issues with certain default configurations that exist and cannot be removed.  adding vpn512 to your template will satisfy the check for existing configurations that do not match. 

[alxzed]

I just added a dummy vpn512 config and it doens't complain anymore. This is weird, most of sites won't have dedicated management interface on ISRs. I would like to just leave them default and unconfigured. Do I just shut them down and add a dummy IP for all site ISRs?

[David Aicher]

yes exactly.   at least for now you will have to use the workaround.   You don't need to do anything special here you can shutdown the interface or just don't connect it.   it is in a unique vrf so if you are required to put in ip address in the template it can be whatever you want and it won't affect other vrfs or global if it overlaps.  

[rudimocnik]

I have the same issue on ASR1002-HX. The error message is the same even after I add VPN 512 and an interface inside. Is there a different workaround for ASR?

[rudimocnik]

Ah ASR already had a dedicated Gigabitethernet0 interface in Mgmt-intf vrf so I used that and it went through.

[premathilakatharindu]

I also had this issue with ISR 4321 router and after adding a vpn 512 interface template (GigabitEthernet0) issue was fixed.

Regards,

Tharindu.