4

Say you have used the management-vrf <vrf-name> configuration command on your Brocade device and setup a loopback in that VRF with a IP address from your management network for that remote site. Junior tech comes along and consoles into the device and for some reason disables the loopback interface that is in the managment network. Junior tech then proceeds about his business and then leaves that remote site.

Have you completely lost all ability for remote access to this device? If yes, what would be some recommended backup access methods to said device?

Improve this question
7

Always have at least two different ways to get into a core box remotely. Generally this means in-band and out-of-band. The inband would simply allow your management range to SSH into the box via any available port, while the out-of-band would be a different link via console or ethernet into the management card/fxp port/ etc

Improve this answer
  • Especially if the box is situated in a different site to your NOC, not so much of a problem if you can just send a console wielding tech in to sort it out but if its 200 miles away then definitely get a console server installed. – David Rothera May 29 '13 at 7:05
  • Yes it's not the end of the world if it's geographically close. But some DC's take forever to arrange access (and have no permanent access lists) and getting a NOC there with his laptop and console still can take longer than having an alternative route in if possible – mellowd May 29 '13 at 7:12
2

More than likely, if all you had was inband management access via the management VRF. To combat this, your options are a separate network for Ethernet management connectivity, or investing in serial console terminal servers.

My suggestion is to have remote serial console access (preferably on a separate network, but it's understandable that this may not be feasible due to various reasons) as a backup to inband management at the very minimum.

EDIT: I suppose you could try to get access to the box if it has a routed interface or VE on it, but I'm not sure what your ACL's are on interfaces of that nature. In general, best practices would dictate to deny management/control plane access via data plane ports (unless you don't have dedicated Ethernet management interfaces).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.