Difference between console port and dedicated management port

[Clay Plaga]

Can someone explain what the difference is between the console port and the dedicated management port(fa0) , on a Cisco 2960s switch.

Thank You.

[Leo Laohoo]

Console port:  Requires a dedicated console cable.  This means you have to have physical access to the appliance. 

Management Port:  Remote access only.  You can't run normal data traffic on this.  

[Clay Plaga]

Thank You for the information, I think I understand it now. The console port is for out of band management & configuration. The dedicated management port is for remote out of band management & configuration.

I have a Cisco 2960s switch that I did the basic configuration on. The administrative IP address & subnet mask is configured on vlan 1, gi1/0/1. I also have it configured for SSH remote login, and it's is working. I have to move the management connection to the dedicated management port(fa0). Do I have to put the management port on a vlan to assign an administrative ip address?  How do I configure the dedicated management with an IP address, subnet mask & default gateway? I have never done this before.

Thank You very much.

[Leo Laohoo]

Thank You for the information, I think I understand it now. The console port is for out of band management & configuration. The dedicated management port is for remote out of band management & configuration.

Console port is NOT an "out of band management" or OoBM because you can't assign an IP address on it (unless you've got a console server).  This means you can't telnet/SSH into a console port.  Console port is an "up close and personal" port:  You need to have physical access to the appliance in order to use the console port. 

Management port is an OoBM port.  

[Clay Plaga]

Thank you for the help. I think that I have not explained myself very well.

1. I know that the console port is for switch configuration when you have physical access to the switch.

2. I know that can not telnet/SSH into the console port.

3. I am using gi1/0/1 on vlan 1 on the cisco 2960s for my telnet/SSH connection, and I can connect to the switch.

4. I need to change the management port that I'm using now(gi1/0/1), to the dedicated management port(fa0) for remote management. Can I use the dedicated management port(fa0) for remote SSH? If I can do that, I'm just not sure what the commands are.

I guess what I'm asking is, can I use the dedicated management port(fa0) for a remote SSH connection, and how do I do that?

Thank You very much.

[Leo Laohoo]

4. I need to change the management port that I'm using now(gi1/0/1), to the dedicated management port(fa0) for remote management. Can I use the dedicated management port(fa0) for remote SSH? If I can do that, I'm just not sure what the commands are.

Of course, you can. 

Firstly, for SSH, the IOS used must support crypto. 

Next, configure an IP address on the Fa0 interface.  Make sure the IP address is totally different to the management VLAN of your switch.  

Finally, "point" where telnet/ssh goes to:  ip tftp interface f0

[Clay Plaga]

Thank You for the information.

Yes, I already have SSH configured with crypto set. When I set the IP for fa0, do I have to assign the interface to a vlan, and do I have to add the gateway as well?

How do I "point" where the telnet/SSH goes to? I don't understand what you mean by that.

Thank You.

[Leo Laohoo]

When I set the IP for fa0, do I have to assign the interface to a vlan, and do I have to add the gateway as well?

No you don't.  The IP Address of Fa0 has to be unique.  This is the concept of Out of Band Management.  It's like saying you're entire production network is on the 10.0.0.0/8 subnet but your OoBM network is running on the 192.168.0.0/16 subnet.

How do I "point" where the telnet/SSH goes to?

Use the command "ip tftp interface f0".  

[Clay Plaga]

Thank You. I think I have all the information that I need to try it. I'm going to be doing this configuration on 2960s and I've never done this before. Just one last question.

What does the "ip tftp interface f0" command actually do?

Thanks.

[Jon Marshall]

Clay

That command tells the switch to use fa0 for tftp when you download or upload configs.

However it won't tell telnet/ssh anything.

If you want to telnet or ssh to the management port from an IP address not in the same subnet as the management port IP the switch needs a default gateway set using the "ip default-gateway <IP address>" command.

I have never used the management port so I can't say for sure the switch will use this default gateway but it should as long as there are no other L3 interfaces up on the switch.

Jon

[Clay Plaga]

What do you mean by "L3 interfaces up on the switch"? Do you mean a connection to a router, which is a layer 3 device? No, right now there is nothing connected to the switch except Gi1/0/1 which is the interface that I am using for the management interface through SSH. I am logged in to the switch right now through SSH. I want to change it to the dedicated management interface fa0. Gi1/0/1 is on vlan 1. IP address 192.168.0.149. SM 255.225.254.0. Default gateway, 192.168.1.1. I'm on a /23 network. I think I'm just going to call the Cisco TAC center and have them show me how to do this, because I'm more confused that I was when I first started. I do appreciate you trying to help me.

Thanks

[Jon Marshall]

L3 interface is any port with an IP address assigned to it or a "interface vlan x" with an IP address assigned to it which it sounds like you have.

If you assign an IP to the management port then you can connect to the management port if your PC is on the same IP subnet.

If it isn't then the 2960 needs to have a default gateway set to know where to send the packets to.

If you already have a default gateway then you may need to change it ie. the default gateway would have to be in the same IP subnet as the IP you assign to the management interface unless you are always going to connect from the same IP subnet as the management interface which I doubt you are.

So the default gateway would be an IP from the same subnet as the IP on the management interface and it would be on a L3 device that routes for the vlans.

If you are currently logged onto the switch and you want to assign an IP from the same IP subnet as is currently on your vlan interface it may not let you do that.

I say may not because like I say I haven't used the management port and as it does not pass user traffic it may let you do it.

If the switch is in the same building as you it's worth a try, worst that can happen is you have to go to the switch and log in via the console port to change things.

Jon

[Soon Kwan Kwon]

Hi all!!

I have a question about configuration.

Can I configure using management port?

Regards,

SK.

[Joseph W. Doherty]

Usually.  For example you might define an explicit IP on the interface or use a DHCP IP.

[Leo Laohoo]

Management port don't use "default-gateway" because there-is-only-one-way-out of the management port.