How to configure out of band management port by VRF on Cisco router

Most of external router is outside of firewall and you could manage the router thru in-band management, but sometime separated path for control would be perferrred. 

Here is the steps for How to configure out of band management port by VRF on Cisco router

 

Note;

Router IOS must support VRF featuer
Gigabit 0/0 will be isolated management port.

 

Step1 : Define management VRF

Cisco(config)# vrf definition [name of VRF] , in this case "MGT-inf"
Cisco(config-vrf))# address-family ipv4
 

Step2 : Make an own default route

Cisco(config)# ip route vrf MGT-inf 0.0.0.0 0.0.0.0 [Next hop for destinations]

 

Step3 : Apply the VRF

Cisco(config)# int gi0/0
Cisco(config-if)# vrf forwarding MGT-inf ; It will remove pre-existing IP address on the interface gi0/0.
Cisco(config-if)# ip address x.x.x.x y.y.y.y

 

Step4 : Verify 

Cisco# show vrf

Ext-RTR#sh vrf
  Name                             Default RD          Protocols   Interfaces
  MGT-inf                                     ipv4        Gi0/0
 

 

 

Cisco#sh ip route vrf MGT-inf

Routing Table: MGT-inf
Codes: L – local, C – connected, S – static, R – RIP, M – mobile, B – BGP
       D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area
       N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2
       E1 – OSPF external type 1, E2 – OSPF external type 2
       i – IS-IS, su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2
       ia – IS-IS inter area, * – candidate default, U – per-user static route
       o – ODR, P – periodic downloaded static route, H – NHRP, l – LISP
       + – replicated route, % – next hop override

Gateway of last resort is 10.1.1.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 10.1.1.1
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.1.1.0/24 is directly connected, GigabitEthernet0/0
L        10.1.1.10/32 is directly connected, GigabitEthernet0/0