22	ROUTER AND NETWORK MANAGEMENT

fails and you have no OOB network, then you may be unable to reach the network devices affected by the failure to analyse and potentially repair the fault. In that case, you—the network operator—are at the mercy of your telcos. If you are truly fortunate, the fault may ‘self-heal’. If you are not, you will be required to send an engineer to the site. This is alright if the failure is in the next city. However, if it is in another country, things get challenging.

OOB networks should ideally provide connectivity to both a management network port and to a console port (if they both exist). In addition, some operators attach a modem connected to the PSTN to the auxiliary port of a device so that even the failure of both the main network and the out of band IP network will not prevent access to the device.

3.1.1 MANAGEMENT ETHERNET

This is generally the most convenient route into the device because it provides a normal IP connection over which you can connect using telnet, SSH, FTP, TFTP, etc. It also provides access for network management and monitoring protocols (e.g. SNMP). If there is no management Ethernet, then the only path over which these protocols can be used is via the in-band (customer traffic carrying) network. Opening up these services on publicfacing interfaces leaves the network device more open to attack. Some vendors’ devices actually provide the facility to run services separately on the management Ethernet and on the public interfaces. For example, you may want to turn on SNMP, FTP and SSH on the management Ethernet but only enable SSH on the public interfaces. If this facility is available, use it.

3.1.2 CONSOLE PORT

This is generally the last-resort connection into the device. It provides a connection to the management command line interface (CLI), which is completely independent of TCP/IP. This means that even if the routing protocols and the SSH, telnet, SNMP and FTP daemons all fail, and the router is inaccessible via any other path, the console port should still be available. It is also the only place where it will be possible to watch the entire boot process without being disconnected.

In order to manage several devices in a single location via their respective console ports, it is necessary to use a terminal server or console server. Terminal servers generally have a network connection and a modem port. These two ports allow the operator to have easy telnet connectivity to the terminal server via the OOB network. If, for some reason, the OOB network is inoperable, it is possible to connect a modem to the terminal server and to dial in.

3.1.3 AUXILIARY (AUX) PORT

As an alternative to the console port, the auxiliary port provides a mechanism to connect a modem direct to the network device. If all other paths into the device are blocked,