Content

| 9.4 |  | Basic Security |
| 9.4.6 |  | In-band management |

In-band management options include the following:

- Virtual terminal (vty) ports used for remote terminal access
- Web interface (HTTP) used for remote monitoring and control
- Trivial File Transfer Protocol (TFTP)
- Network-management protocols (SNMP) and software such as CiscoWorks

Unencrypted virtual terminal console sessions can be established using Telnet. Encrypted virtual terminal console sessions can be established using a secure shell (SSH) client. Using encrypted communications for virtual terminal console sessions wherever possible provides better security for network devices.

Cisco IOS devices can be configured to allow remote monitoring and control functions through a normal web browser using HTTP. The web interface is inherently insecure, and should be disabled if possible, especially in large networks with sophisticated users.

A TFTP server can be used to load a common configuration script onto Cisco IOS devices. This can be used as an efficient mechanism to manage a large number of network devices. Access to the TFTP server implicitly provides console access to a large number of IOS devices in the network at the same time. Because of this, the TFTP server must be secured and managed appropriately to prevent accidental or malicious misconfiguration of any shared configuration scripts.

Cisco IOS devices support monitoring and management functions provided by simple network management protocol (SNMP). Because SNMP was not originally designed with built-in security, using SNMP should be restricted to monitoring functions wherever possible.

Additional control over these in-band management options can be done using a management VLAN and access-lists. Use of the advanced in-band management features is covered later in this module.

| Interactive Media Activity Checkbox: Direct Access to Cisco Devices After completing this activity, the students will be able to understand direct access to Cisco devices.