Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Management Interface in a Dedicated Instance

Use a dedicated management instance to separate management traffic from the rest of your network.

Why Use a Non-Default VRF Instance?

By default, the management Ethernet interface (usually named fxp0 or em0 for Junos OS, or re0:mgmt-* or re1:mgmt-* for Junos OS Evolved) provides the out-of-band management network for the device. Out-of-band management traffic is not clearly separated from in-band protocol control traffic. Instead, all traffic passes through the default routing instance and shares the default inet.0 routing table. This system of traffic handling gives rise to concerns over security, performance, and troubleshooting. You (the network administrator) can solve these problems by confining the management interface to a dedicated, non-default virtual routing and forwarding (VRF) instance.

Benefits of a Dedicated Management Instance

  • Improved security

  • Management traffic no longer has to share a routing table with other control traffic or protocol traffic

  • Easier to use the management interface to troubleshoot

Note:

  • For Junos OS, the non-default management VRF instance supports only the em0 and fxp0 interfaces. The non-default management VRF instance doesn't support other management interfaces such as em1.

  • The non-default management VRF instance supports the virtual management Ethernet (VME) interface on EX Series devices. The VME interface is used to manage Virtual Chassis. For more information, see Understanding Global Management of a Virtual Chassis

Management Instance Overview

The name of the dedicated management VRF instance is reserved and hardcoded as mgmt_junos; you cannot configure any other routing instance by the name mgmt_junos. Because some applications assume that the management interface is always present in the default inet.0 routing table, the dedicated management VRF instance is not instantiated by default. You need to configure it for it to take effect.

Once you deploy the mgmt_junos VRF instance, management traffic no longer shares a routing table (that is, the default routing table) with other control traffic or protocol traffic in the system. Traffic in the mgmt_junos VRF instance uses private IPv4 and IPv6 routing tables. After you configure mgmt_junos, you cannot configure dynamic protocols on the management interface.

Configure the Management Instance

You must add any static routes that have a next hop over the management interface to the mgmt_junos VRF instance. If needed, you must also configure the appropriate processes or applications to use mgmt_junos. All of these changes must be done in a single commit. Otherwise, the existing sessions might be lost and need to be renegotiated.

Before You Begin: Determine Static Routes

Some static routes have a next hop through the management interface. As part of configuring the mgmt_junos VRF instance, you must add all these static routes to mgmt_junos so they can reach the management interface. Each setup is different. First, you need to identify the static routes that have a next hop through the management interface.

  1. Use the show interfaces interface-name terse command to find the IP address of the default management interface. The default management interface is fxp0 or em0 for Junos OS, or re0:mgmt-0 or re1:mgmt-0 for Junos OS Evolved.

  2. Use the show route forwarding-table command to look at the forwarding table for next-hop information for static routes. Static routes show up as type user. The next hop for any static route that is affected has an IP address that falls under the subnet of the IP address configured for the management interface.

  3. Another way to find the static routes associated with your management network is to use the show route protocol static next-hop <management-network-gateway-address> command.

    Alternatively, simply display the static route portion of the device's configuration. Use the CLI match function to quickly locate all static routes that point to the management network's default gateway.

Enable the Management Instance

Note:

We recommend using the device console port for these operations.

Changing the management instance changes the underlying VRF instance for the management port. If you use SSH, Telnet, or NETCONF, the connection to the device will be dropped when you commit the configuration, and you will have to reestablish it.

If you do use SSH, Telnet, or NETCONF, use commit confirm.

To enable the dedicated management VRF instance:

  1. Configure the mgmt_junos VRF instance.
  2. Configure the management-instance statement.
  3. Add the appropriate static routes to the mgmt_junos VRF instance.

    For how to determine the static routes to change, see Before You Begin: Determine Static Routes.

    If you are using configuration groups, you can set these changes as part of a group:

  4. Commit the configuration.
    If you are using SSH, Telnet, or NETCONF, use commit confirm. Expect to lose, and then have to reestablish, the SSH, Telnet, or NETCONF session.

Configure Processes to Use the Management Instance

Many processes communicate through the management interface. A process must support a management VRF instance to be able to use mgmt_junos. Not all of these processes use mgmt_junos by default unless the management-instance is enabled. You must configure these processes to use mgmt_junos.

The following processes require this additional configuration:

Table 1: Processes You Can Configure to Use the Management VRF Instance

Process

First Release to Support Management VRF

For More Information

Automation scripts

Junos OS Release 18.1R1

Using an Alternate Source Location for a Script

Configuring and Using a Master Source Location for a Script

BGP Monitoring Protocol (BMP)

Junos OS Release 18.3R1

Configuring BGP Monitoring Protocol to Run Over a Different Routing Instance

Network Time Protocol (NTP)

Junos OS Release 18.1R1

ntp

Outbound SSH

Junos OS Release 19.3R1

 Configure Outbound SSH Service

RADIUS

Junos OS Release 18.1R1

Configuring RADIUS Server Authentication

Configuring RADIUS System Accounting

REST API

Junos OS Release 20.3R1

rest

System Logging (syslog)

Junos OS Release 18.1R1 (by default)

Junos OS Release 24.2R1 (when configured)

System Logging and Routing Instances

TACACS+

Junos OS Release 17.4R1

Configuring TACACS+ Authentication

Junos OS Release 18.2R1

Configuring TACACS+ System Accounting

Configuring these processes to use the mgmt_junos VRF instance is optional. If you skip this step, these processes continue to send packets using the default routing instance only.

  1. To update automation scripts from a source using mgmt_junos, configure the following:
    1. Commit, op, or SNMP scripts:
    2. Event scripts:
    3. Juniper Extension Toolkit (JET) scripts:
  2. BMP:
    1. BMP in passive connection mode:
    2. BMP in active connection mode:
  3. NTP service:

    You must also configure at least one IP address on a physical or logical interface within the default routing instance. Ensure that this interface is up so that the NTP service can work with the mgmt_junos VRF instance.

  4. RADIUS:
  5. TACACS+:
  6. The REST API:
  7. System logging:
  8. Outbound SSH:

How to Disable the Management Instance

When you disable the mgmt_junos VRF instance, you must also remove the other configuration changes you made.

  1. Remove the management-instance statement to disable the dedicated management VRF instance.
  2. (Optional) Remove the static routes from the mgmt_junos VRF instance.
  3. (Optional) Remove the configurations for processes that use mgmt_junos. These processes will return to sending packets using the default routing instance. For example, to remove the mgmt_junos configuration for TACACS+ :

Change History Table

Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.

Release
Description
24.2R1
Starting in Junos OS Release 24.2R1, system logging information does not use the dedicated management instance by default when the management-instance statement is configured. You must configure the mgmt_junos VRF instance for system logging to enable it.
18.1R1
Starting in Junos OS Release 18.1R1, system logging uses the dedicated management instance for IPv6-addressed remote hosts and archival sites by default when the management-instance statement is configured.
17.3R1
Starting with Junos OS Release 17.3R1, you can confine the em0 and fxp0 management interfaces to the mgmt_junos VRF instance.
17.3R1
Starting in Junos OS Release 17.3R1, system logging uses the dedicated management routing instance for IPv4-addressed remote hosts by default when the management-instance statement is configured.