In-band Management Configuration

Enabling In-band Management in an Instance

Use the following CLI syntax to enable in-band management in an instance:

set inband-management instance <instance-name>

Attribute Description

<instance-name>

Routing instance name in which in-band management has to be enabled. All the IFLs in this instance will be enabled with in-band management service after executing this command

The following example configures the management instance in which in-band management will be enabled:

set inband-management instance management

The following example shows in-band management in an instance:

    "rtbrick-config:inband-management": {
      "instance": [
        {
          "name": "management",
        }
      ]
    }

api  To access the RESTCONF API that corresponds to this CLI, click here.

Enabling In-band Management Services

Syntax:

set inband-management instance <instance-name> <service> <true/false>

Attribute Description `

<instance-name>`

Routing instance name in which in-band management has to be enabled. All the IFLs in this instance will be enabled with in-band management service after executing this command

<service>

Specifies the supported services to enable: apigw, ctrld, ntp, snmp, ssh, tacacs, telnet. By enabling any of these services, hosts reachable via the physical interface in the inband instance can access the services.

<true | false>

A true value enables the service. A false value disables the service.

Example: Enabling In-band Management Services

    "rtbrick-config:inband-management": {
      "instance": [
        {
          "name": "management",
          "ssh": "true",
          "ctrld": "true"
        }
      ]
    }

Enabling API Gateway (APIGW) Service

To access the APIGW service running in the RtBrick Host, this service has to be enabled in in-band management.

Syntax:

set inband-management instance <name> apigw [false | true]

Attribute Description

<instance-name>

Routing instance in which in-band management is enabled.

<true | false>

A true value enables the APIGW service; a false value disables it.

Example: Enabling APIGW In-band Management Services

    "rtbrick-config:inband-management": {
      "instance": [
        {
          "name": "management",
          "apigw": "true",
        }
      ]
    }

Enabling CTRLD Service

To access the CTRLD service running on the RtBrick Host, enable the CTRLD service in in-band management.

Syntax:

set inband-management instance <name> ctrld [false | true]

Attribute Description

<instance-name>

Routing instance in which in-band management is enabled.

<true | false>

A true value enables the CTRLD service; a false value disables it.

Example: Enabling CTRLD In-band Management Services

    "rtbrick-config:inband-management": {
      "instance": [
        {
          "name": "management",
          "ctrld": "true",
        }
      ]
    }

Enabling NTP service

To access the NTP service running in the RtBrick Host, this service has to be enabled in in-band management.

Syntax:

set inband-management instance <name> ntp [false | true]

Attribute Description

<instance-name>

Routing instance in which in-band management is enabled.

<true | false>

A true value enables the NTP service; a false value disables it.

Example: Enabling NTP In-band Management Services

    "rtbrick-config:inband-management": {
      "instance": [
        {
          "name": "management",
          "ntp": "true",
        }
      ]
    }

Enabling SNMP service

To access the Simple Network Management Protocol (SNMP) service running in the RtBrick Host, this service has to be enabled in in-band management.

Syntax:

set inband-management instance <name> snmp [false | true]

Attribute Description

<instance-name>

Routing instance in which in-band management is enabled.

<true | false>

A true value enables the SNMP service; a false value disables it.

Example: Enabling SNMP In-band Management Services

    "rtbrick-config:inband-management": {
      "instance": [
        {
          "name": "management",
          "snmp": "true",
        }
      ]
    }

Enabling SSH service

To access the ssh service running in the LXC container hosting RBFS, ssh service has to be enabled.

Syntax:

set inband-management instance <name> ssh [false | true]

Attribute Description

<instance-name>

Routing instance in which in-band management is enabled.

<true | false>

A true value enables the SSH service; a false value disables it.

Example: Enabling SSH In-band Management Services

    "rtbrick-config:inband-management": {
      "instance": [
        {
          "name": "management",
          "ssh": "true",
        }
      ]
    }

Enabling TACACS Service

To access the TACACS service running on the RtBrick Host, enable the TACACS service in in-band management.

Syntax:

set inband-management instance <name> tacacs [false | true]

Attribute Description

<instance-name>

Routing instance in which in-band management is enabled.

<true | false>

A true value enables the SSH service; a false value disables it.

Example: Enabling TACACS In-band Management Services

    "rtbrick-config:inband-management": {
      "instance": [
        {
          "name": "management",
          "tacacs": "true",
        }
      ]
    }

Enabling Telnet Service

To access the Telnet service running in the LXC container hosting RBFS, enable the Telnet service.

Syntax:

set inband-management instance <name> telnet [false | true]

Attribute Description

<instance-name>

Routing instance in which in-band management is enabled.

<true | false>

A true value enables the SSH service; a false value disables it.

Example: Enabling Telnet In-band Management Services

    "rtbrick-config:inband-management": {
      "instance": [
        {
          "name": "management",
          "telnet": "true",
        }
      ]
    }

Enabling Connection Tracking

You can enable connection tracking in in-band management. It installs dynamic ACLs for all connections and packets initiated by the device and ensures that response packets are not dropped by the hardware.

Syntax:

set inband-management instance <instance-name> connection-tracking true

Attribute Description

<instance-name>

Routing instance name in which in-band management has to be enabled.

true

Enables all in-band management services.

Example: Enabling Connection Tracking in In-band Management

"rtbrick-config:inband-management": {
    "instance": [
      {
        "name": "default",
        "connection-tracking": "true"
      }
    ]
  }

Enabling LIX1 Service

You can use this command to enable or disable the lix1 service, which handles Lawful Interception X1 control-plane management directly over the in-band network.

set inband-management instance <name> lix1 [false | true]

Attribute

Description

<instance-name>

Specifies the routing instance where the in-band lix1 service is enabled.

<true | false>

Setting this attribute to true enables the "lix1" service, while setting it to false disables the service.

Example: Enabling the "lix1" service in inband management

    "rtbrick-config:inband-management": {
      "instance": [
        {
          "name": "default",
          "lix1": "true",
        }
      ]
    }

Enabling All Services in In-band Management

Enabling this service will allow access to all services running in LXC/RtBrick Host. Once this service is enabled, packets that don’t hit any of the other acls/services in RBFS are redirected to LXC/RtBrick Host.

Syntax:

set inband-management instance <instance-name> all true

Attribute Description

<instance-name>

Routing instance name in which in-band management has to be enabled.

true

Enables all in-band management services.

Example: Enabling all In-band Management Services

    "rtbrick-config:inband-management": {
      "instance": [
        {
          "name": "management",
          "all": "true",
        }
      ]
    }

Enabling In-band Management for a Specific Source

You can enable in-band management services (as mentioned in the previous sections). It will expose this service to all the sources which are reachable via in-band service.

The in-band management source-prefix-list option supports various prefix ranges such as /16, /24, and /32. It can support a prefix list with any IPv4 prefixes.

To restrict this to specific source prefixes, source-prefix-list has to be enabled using the following command.

By configuring this, the hosts having IPs in the mentioned source prefix list only can access this service.

Syntax:

set inband-management instance <instance-name> source-prefix-list <source-prefix-list-name>

Attribute Description

<instance-name>

Routing instance name in which in-band management has to be enabled.

<source-prefix-list-name>

Specifies the name of the source prefix-list which is configured with set forwarding-options prefix-list command. For details of configuring prefix-list, refer to Configuring Prefix Lists section in the ACL User Guide.

Example: Enabling source prefix list in In-band Management Services

    "rtbrick-config:inband-management": {
      "instance": [
        {
          "name": "management",
          "source-prefix-list": "source-prefix1"
        }
      ]
    }

The following example configuration enables multiple prefix lists for in-band management.

set inband-management instance inband-vrf ssh true
set inband-management instance inband-vrf source-prefix-list rtbrick-p1
set forwarding-options prefix-list rtbrick-p1 ipv4-prefix 198.51.100.0/24
set forwarding-options prefix-list rtbrick-p1 ipv4-prefix 203.0.113.0/24
set forwarding-options prefix-list rtbrick-p1 ipv4-prefix 192.0.2.1/32
set instance inband-vrf address-family ipv4 unicast
set instance inband-vrf address-family ipv6 unicast
"rtbrick-config:inband-management": {
      "instance": [
        {
          "name": "inband-vrf",
          "ssh": "true",
          "source-prefix-list": "rtbrick-p1"
        }
      ]
    },
    "rtbrick-config:forwarding-options": {
      "prefix-list": [
        {
          "prefix-list-name": "rtbrick-p1",
          "ipv4-prefix": [
            {
              "ipv4-prefix": "198.51.100.1/24"
            },
            {
              "ipv4-prefix": "203.0.113.0/24"
            },
            {
              "ipv4-prefix": "192.0.2.1/32"
            }
          ]
        }
      ]
    },
    "rtbrick-config:instance": [
      {
        "name": "inband-vrf",
        "address-family": [
          {
            "afi": "ipv4",
            "safi": "unicast"
          },
          {
            "afi": "ipv6",
            "safi": "unicast"
          }
        ]
      }
    ],

The following example shows configuring an IPv6 address for inband connectivity, specifically using a /128 address prefix on the inband interface.

set interface lo-0/0/4 unit 1
set interface lo-0/0/4 unit 1 ipv6-admin-status up
set interface lo-0/0/4 unit 1 mpls-admin-status up
set interface lo-0/0/4 unit 1 instance inband
set interface lo-0/0/4 unit 1 address
set interface lo-0/0/4 unit 1 address ipv4 192.1.4.1/32
set interface lo-0/0/4 unit 1 address ipv6 fd00:192:1:4::1/128
{
  "rtbrick-config:interface": [
    {
      "name": "lo-0/0/4",
      "description": "ip2vrf-vrf Instance loopback interface",
      "unit": [
        {
          "unit-id": 1,
          "ipv6-admin-status": "up",
          "mpls-admin-status": "up",
          "instance": "inband",
          "address": {
            "ipv4": [
              {
                "prefix4": "192.1.4.1/32"
              }
            ],
            "ipv6": [
              {
                "prefix6": "fd00:192:1:4::1/128"
              }
            ]
          }
        }
      ]
    }
  ]
}

Setting Loopback-Only Interfaces of SSH Service

By default, you both loopback and non-loopback interfaces are available for In-band Management services. When loopback-only is set to true, management protocols such as SSH, CTRLD, and other management services can be accessed only through loopback interfaces that belong to the in-band management instance. Non-loopback interface addresses are not used for management access.

Syntax:

set inband-management instance <name> loopback-only true

The following table provide the command options and descriptions.

Attribute Description

instance <name>

Name of the instance.

loopback-only true

Inband management access is available only through loopback interfaces that belong to the in-band management instance.

The following example configures the in-band management instance 'default' to allow management access only through loopback interface addresses. When loopback-only is set to true, non-loopback interface addresses are excluded from in-band management access.

set inband-management instance default loopback-only true
{
  "rtbrick-config:inband-management": {
    "instance": [
      {
        "name": "default",
        "loopback-only": "true"
      }
    ]
  }
}