Defining another management interface

The management interface is used for remote access to the Web UI and CLI, and for other management traffic (such as NTP, SNMP, and syslog). The default management interface is ether1. You can define a different interface (such as ether2) for remote access to the Web UI and CLI. Reasons for doing so include:

A private IP address is defined for ether1, so remote users cannot reach it. You could use ether1 for the connection between a Central Management System appliance and its managed appliances, and define an accessible IP address for the ether2 interface.
You want to use one network for Web UI and CLI traffic, and another network for other management traffic.

By default, listen interface constraints are enabled on the appliance. This means only interfaces that meet the following criteria can accept HTTP/HTTPS requests (for Web UI access) and SSH connections (for CLI access).

The interface must be in the listen interface list. By default, only ether1 is in this list.
The interface must meet the eligibility requirements listed in Prerequisites.

The system prevents remote users from being locked out of the system when the criteria are not met by at least one interface. If no interface meets the criteria, listen interface constraints are not enforced, and all viable interfaces are open and can accept HTTP/HTTPS requests and SSH connections.

Examples

The appliance uses the default configuration (listen interface constraints are enabled and ether1 is in the listen interface list). You configure a static IPv4 or IPv6 address for the ether1 and ether2 interfaces and bring them up. Remote users do not have access to the system over ether2, because it was not added to the listen interface list. You then shut down the ether1 interface, and ether2 (the only viable interface) immediately becomes accessible, because the listen interface constraints are no longer enforced.

You add ether2 to the listen interface list, but both ether1 and ether2 use DHCP to obtain IPv4 addresses or DHCPv6 to obtain IPv6 addresses. Because neither interface meets the IPv4 or IPv6 static IP address requirement listed in Prerequisites, the listen interface constraints are no longer enforced. All viable interfaces, including ether1 and ether2, become accessible.

Prerequisites

Operator or Admin access.
The appropriate management port is connected to the network switch or router.
Eligibility requirements:
- The interface exists and is running.
- DHCP and zeroconf are disabled on the interface (for IPv4), or IPv6 is enabled on both the interface and the system (for IPv6).
- The interface has an IPv4 or IPv6 address:
  - IPv4: At least one static nonzero IPv4 address is available to be assigned to the interface.
  - IPv6: A static IPv6 address is available to assign to the interface, or the address can be obtained dynamically through Stateless Address Autoconfiguration (SLAAC) or DHCPv6.

Defining another management interface using the CLI

Use the commands in this section on an appliance that enforces listen interface constraints to define a management interface other than ether1, and add it to the listen interface list so it can accept HTTP/HTTPS requests and SSH connections.

To define another management interface:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Assign an IP address to the other interface:
```
hostname (config) # interface <interfaceName> ip address <ipAddress> <mask>
```
where:
- <ipAddress> is the IPv4 or IPv6 address of the interface.
- <mask> is the IPv4 mask length prefixed by a slash (for example, /24) or an IPv4 netmask (for example, 255.255.255.0), or the IPv6 mask length prefixed by a slash (for example, /48).
(For IP routing) Set the static route for the interface:
```
hostname (config) # ip route <networkPrefix> <mask> <gatewayIP> <interfaceName>
```
where:
- <networkPrefix> is the IPv4 or IPv6 network prefix specifying the network.
- <mask> is the IPv4 mask length prefixed by a slash (for example, /24) or a netmask (for example, 255.255.255.0), or the IPv6 mask length preceded by a slash (for example /48)
- <gatewayIP> is the IPv4 or IPv6 address of the gateway or next-hop device.
- <interfaceName> is the name of the management interface.
(For Web UI access): Add the interface to the listen interface list for HTTP/HTTPS requests:
```
hostname (config) # web server listen interface <interfaceName>
```
(For CLI access): Add the interface to the listen interface list for SSH connections:
```
hostname (config) # ssh server listen interface <interfaceName>
```

Verify your changes:

hostname (config) # show web
hostname (config) # show ssh server

Save your changes:
```
hostname (config) # write memory
```

Note
This procedure assigns a static IPv4 or IPv6 address to the interface. SLAAC or DHCPv6 can instead automatically assign the IPv6 address.

Example

The following example configures ether2 as the management interface on the acme-1 appliance. It then adds ether2 the listen interface list.

acme-1 (config) # interface ether2 ip address 10.1.2.3 /24
acme-1 (config) # web server listen interface ether2
acme-1 (config) # ssh server listen interface ether2
acme-1 (config) # show web
Web User Interface server:
   Web interface enabled:          yes
   HTTP enabled:                   yes
   HTTP port:                      80
   HTTP redirect to HTTPS:         yes
   HTTPS enabled:                  yes
   HTTPS port:                     443
   HTTPS protocols:                TLSv1
   HTTPS minimum protocol version: TLSv1
   HTTPS cipher list:              compatible
   HTTPS certificate name:         system-self-signed
   HTTPS CA chain name:

   Listen enabled: yes
   Listen Interfaces:
      Interface: ether1
      Interface: ether2
      Interface: lo 
   ...

acme-1 (config) # show ssh server
SSH server configuration:
   SSH server enabled:          yes
   Minimum protocol version:    2
   TCP forwarding enabled:      yes
   X11 forwarding enabled:    no
   Audit log file transfers:  yes
   Cipher list:   compatible
   Minimum key length:     1024 bits
   Client Alive Interval:    0
   Client Alive Count Max   3
   SSH server ports:        22
   
   Interface listen enabled:  yes
   Listen Interfaces:
      Interface: ether1
      Interface: ether2
...

Important
Listen interface constraints are enabled on the system by default. However, if the Listen enabled line in the show web command output is no, use the web server listen enable command to enable constraints for HTTP/HTTPS requests. If the Interface listen enabled line in the show ssh server command output is no, use the ssh server listen enable command to enable constraints for SSH connections.