Separating the Management Plane from the Service Plane

To improve network security and prevent unauthorized user attack, the switch separates the management function from the service function by default.

• The management-port isolate enable command enables separation of the management interface to prevent unauthorized users from attacking the packet forwarding service. After the command is run, the switch forbids packet exchange between the management and service interfaces. That is, the packets received by the management interface will not be sent out through a service interface, and the packets received by a service interface will not be sent out through the management interface.

• The management-plane isolate enable command enables separation of the management plane to prevent unauthorized users from attacking the management network through the service network. After the command is run, the switch prevents unauthorized users from accessing the management interface through a service interface. That is, if the destination address of a packet received by a service interface is the management interface address, the user cannot access the switch. The access from the management interface to service interface is not restricted.

The previously mentioned packets are IP and MPLS packets.