Most of external router is outside of firewall and you could manage the router thru in-band management, but sometime separated path for control would be perferrred.
Here is the steps for How to configure out of band management port by VRF on Cisco router
Note;
Router IOS must support VRF featuer
Gigabit 0/0 will be isolated management port.
Step1 : Define management VRF
Cisco(config)# vrf definition [name of VRF] , in this case "MGT-inf"
Cisco(config-vrf))# address-family ipv4
Step2 : Make an own default route
Cisco(config)# ip route vrf MGT-inf 0.0.0.0 0.0.0.0 [Next hop for destinations]
Step3 : Apply the VRF
Cisco(config)# int gi0/0
Cisco(config-if)# vrf forwarding MGT-inf ; It will remove pre-existing IP address on the interface gi0/0.
Cisco(config-if)# ip address x.x.x.x y.y.y.y
Step4 : Verify
Cisco# show vrf
Ext-RTR#sh vrf
Name Default RD Protocols Interfaces
MGT-inf
Cisco#sh ip route vrf MGT-inf
Routing Table: MGT-inf
Codes: L – local, C – connected, S – static, R – RIP, M – mobile, B – BGP
D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area
N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2
E1 – OSPF external type 1, E2 – OSPF external type 2
i – IS-IS, su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2
ia – IS-IS inter area, * – candidate default, U – per-user static route
o – ODR, P – periodic downloaded static route, H – NHRP, l – LISP
+ – replicated route, % – next hop override
Gateway of last resort is 10.1.1.1 to network 0.0.0.0
S* 0.0.0.0/0 [1/0] via 10.1.1.1
10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 10.1.1.0/24 is directly connected, GigabitEthernet0/0
L 10.1.1.10/32 is directly connected, GigabitEthernet0/0