In-band vs out-of-band management
In-band management uses the same network infrastructure that carries production traffic — SSH, Telnet, HTTPS, and SNMP sessions travel over the same interfaces and VLANs as user data. If the network is congested or down, management access may be unavailable. Most networks use in-band management for its simplicity and cost.
Out-of-band (OOB) management uses a dedicated separate network — typically a console server connected to device console ports, or a dedicated management network accessed through a separate interface. When the production network fails, OOB still provides access. A Management VRF (with a dedicated management interface) is a software-based form of OOB that separates management traffic at the routing level without requiring separate physical infrastructure.
Best practice: use in-band management for routine tasks and OOB for emergency access when the production network is unreachable. The management plane — the traffic used to control network devices — should be isolated from the data plane where possible.
Console, SSH, Telnet, and HTTP/HTTPS
Console port access is physical — requires a rollover cable (or USB) connected to the device's console port. Console access is always available as long as the device is powered, regardless of network connectivity. Console is the primary method for initial configuration and disaster recovery. Default settings: 9600 baud, 8 data bits, no parity, 1 stop bit (9600 8N1).
SSH (Secure Shell) is the standard for remote CLI access. SSH version 2 encrypts all traffic including credentials. Configuration requires: a hostname, domain name, RSA key pair (`crypto key generate rsa`), and VTY lines configured for SSH (`transport input ssh`). SSH uses TCP port 22.
Telnet transmits everything in plaintext — passwords, commands, all output. Telnet should never be used on production networks accessible over untrusted links. It's useful only in isolated lab environments. Telnet uses TCP port 23.
HTTP and HTTPS provide GUI-based management. HTTPS (TCP 443) encrypts the management session; HTTP (TCP 80) does not. Cisco devices support web-based configuration via HTTPS — IOS uses `ip http secure-server` to enable HTTPS. On IOS-XE, the web UI is increasingly capable. For exam purposes: always prefer HTTPS over HTTP, SSH over Telnet.
TACACS+ vs RADIUS for AAA
Both TACACS+ and RADIUS provide centralized authentication, authorization, and accounting (AAA) for network device access. The key differences between them are architectural and functional.
TACACS+ (Terminal Access Controller Access Control System Plus) is a Cisco-proprietary protocol that uses TCP port 49. It separates authentication, authorization, and accounting into independent processes, which allows granular control — you can authorize specific commands per user or group. All TACACS+ traffic (including the body of the packet) is encrypted. This makes TACACS+ the preferred choice for network device administration.
RADIUS (Remote Authentication Dial-In User Service) uses UDP (ports 1812/1813). It combines authentication and authorization into a single process (the Access-Accept reply includes authorization attributes). Only the password is encrypted in the request; the rest of the packet is cleartext (though later extensions added more encryption). RADIUS is the standard for network access control (802.1X, VPN, wireless authentication).
For CCNA: TACACS+ = device administration (encrypts everything, separates A/A/A, TCP). RADIUS = network access (users connecting to the network via 802.1X or VPN, UDP).
Cloud-based management
Cloud-managed networking centralizes configuration and monitoring in a cloud platform. Cisco Meraki is the primary cloud-managed solution tested on CCNA: switches, wireless APs, security appliances, and cameras are all managed through a web dashboard. Devices phone home to the Meraki cloud; administrators never need CLI access.
Cisco DNA Center (now Catalyst Center) is an on-premises controller for enterprise networks running Cisco IOS-XE and IOS-XR. It provides intent-based networking: you describe desired policies and DNA Center configures the network automatically. It uses REST APIs and is the centerpiece of Cisco's Software-Defined Networking enterprise strategy.
Cloud management trade-offs: cloud management simplifies operations but introduces dependency on internet connectivity and a third-party cloud. On-premises controllers (DNA Center) keep management local but require more infrastructure. For CCNA, understand the conceptual differences between traditional CLI management, on-premises controllers, and cloud management.