Management Plane Security

6.1 Management Access Control

Management access must be restricted to explicitly authorized sources, protocols, and methods. The principle of least privilege applies: each administrator should have access only to the commands and interfaces required for their specific role. All management traffic must be isolated from production traffic using a dedicated management VRF and, where possible, a physically separate OOB network.

Management VRF Configuration

All management interfaces and services must be bound to a dedicated management VRF, ensuring that management traffic is completely isolated from production routing. The management VRF must have its own routing table with only the routes necessary for management access (OOB network, AAA servers, NTP servers, syslog servers). No production routes should be present in the management VRF.

! Management VRF Definition
vrf definition MGMT
 rd 65000:999
 address-family ipv4
  exit-address-family
!
! Management Interface Assignment
interface GigabitEthernet0
 vrf forwarding MGMT
 ip address 172.16.1.10 255.255.255.0
 no shutdown
!
! SSH bound to Management VRF
ip ssh source-interface GigabitEthernet0
!
! TACACS+ via Management VRF
ip tacacs source-interface GigabitEthernet0

6.2 AAA Configuration (Authentication, Authorization, Accounting)

AAA provides the framework for controlling who can access the router (authentication), what they can do (authorization), and recording what they did (accounting). All three components must be configured and operational. TACACS+ is the preferred protocol for network device AAA because it separates authentication, authorization, and accounting into independent transactions and supports per-command authorization. RADIUS is acceptable for environments where TACACS+ is not available.

Role-Based Access Control (RBAC) Privilege Levels

6.3 Logging & Monitoring

Comprehensive logging is essential for both security incident detection and post-incident forensics. All security-relevant events must be logged with accurate timestamps, source identification, and sufficient context to reconstruct the sequence of events. Logs must be sent to a remote syslog server in real time and retained for a minimum of 12 months. The router's local log buffer serves only as a short-term backup, not as the primary log store.

6.4 Configuration Hardening Checklist

The following checklist covers all management plane hardening items that must be verified on every router deployment. Each item should be checked against the running configuration and the result documented in the deployment record. Items marked as Critical must be resolved before the device is placed into production service.