Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document.
Note: Even the most advanced machine translation cannot match the quality of professional translators.
Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Separating the Management Port from the Service Plane
This chapter describes how to separate the management port from the service plane to improve management network security.
Context
To improve network security, the device separates the traffic at the service plane and management port by default. That is, unauthorized users cannot access the management port of the device through service interfaces, and attackers cannot attack the management network through the service network.
Procedure
- Separate the traffic at the service plane and management port.
- Add the management interface and service interface to different VPN instances, to separate the traffic at the service plane and management port.
- Add the service interface to VPN instance vpnb.
<HUAWEI> system-view [~HUAWEI] ip vpn-instance vpnb [*HUAWEI-vpn-instance-vpnb] ipv4-family [*HUAWEI-vpn-instance-vpnb-af-ipv4] quit [*HUAWEI-vpn-instance-vpnb] quit [*HUAWEI] interface 10ge 1/0/1 [*HUAWEI-10GE1/0/1] undo portswitch [*HUAWEI-10GE1/0/1] ip binding vpn-instance vpnb [*HUAWEI-10GE1/0/1] commit
After the management interface and service interface are added to different VPN instances, the routes at the service plane and management port are separated.
To configure the separation function on an IPv6 network, run the ipv6-family [ unicast ] command in the VPN instance view.
- Add the service interface to VPN instance vpnb.
