Strange question. I have my new 9300 pluged into the management port ont he same LAN as my management equipment. I can ping the swtich but itcan't ping back. Thoughts?
@RonTrunk It can't even ping our time server that doesn't have a firewall
Does it have to do with the IP Route on the Mgmt-vrf?
So the switch is connected to the management port on the same switch as my laptop. I can ping the switch from my laptop but I can't ping the laptop from the switch. I can't ping the switch we are connected to either from the new switch
But I can get to the switch through the web interface called out in the manual
@JukEboX No. you don't need to use the management port. You can ssh/telnet just like any other switch. The management port and vrf are used if you want out of band management.
@JukEboX In the network here, we don't use out of band management. So we don't use the management port at all. We ssh just like any other Cisco device.
If you want OOB, you can restrict management access to only the management port, but it doesn't sound like you're doing that.
@JukEboX If your switch carries the management VLAN, then there's no real value to using OOBM.
The whole point of OOBM is to have a separate infrastructure for management. So if your production network were to stop working, you would still have management access.
@JukEboX For example:
I have a switch and router at a remote site.
Management traffic rides the same WAN link as production traffic
There's no point to configuring OOB, because if the WAN goes down, or the router goes down, I've lost access.
If I have a separate connection, say a cellular modem, then it might make sense to configure OOB,
@JukEboX, the other reason for OOBM is security. You can set a device up to only allow access the the management VRF. So there would be no access through the "normal" network.
You can also assign any and all ports to different VRFs. Think of VRFs as the logical division of devices in the same way that VLANs are logical divisions of the network.
Traffic from one VRF will not get shared with other VRFs unless you provide a connection to do so. We have some devices with multiple VRFs that certainly do have cables connecting right back to the same physical device (on a separate VRF).
Each VRF will have it's own mac address table, routing table, etc. Which is why as Ron pointed out, you need to specify the VRF for many commands so the physical device provides you the right information or uses the right resources.
@RonTrunk, I keep finding on our sister sites that classful addressing is not dead. I was once castigated on Super User about that, and now we have this: stackoverflow.com/a/56176124/3745413
