Network Fundamentals · Topic 5 of 6
Management, Data and Control Planes and Common Port Values
Learn the management, control and data planes of a network device, and the common port numbers for SSH, Telnet, HTTP, HTTPS, NETCONF and other protocols.
- 5 min
- The data plane forwards traffic, the control plane builds the tables and the management plane configures the device.
- Routing protocols and spanning tree belong to the control plane.
- SSH, SNMP, NETCONF and RESTCONF belong to the management plane.
What it is
A network device does three separate jobs, called planes, and each protocol listens on a well known port.
The data plane forwards traffic, the control plane decides how to forward it, and the management plane lets people and tools configure and monitor the device. Port numbers tell a host which service a packet is for.
Both ideas appear in automation questions, because APIs and CLI sessions use the management plane, and firewalls filter by port.
How it works
The planes are separate so that each can be built, protected and scaled on its own.
The data plane
The data plane, or forwarding plane, moves user traffic through the device. It looks up the destination, applies rules such as an access list or NAT, and sends the packet out of the right interface.
It must be fast, so it often runs in dedicated hardware. Examples of its work are switching a frame, routing a packet and encrypting traffic.
The control plane
The control plane decides how traffic should be forwarded. It builds the tables that the data plane uses.
- Routing protocols such as OSPF and BGP exchange routes.
- Spanning tree decides which links are active.
- ARP and neighbour discovery build address tables.
- The result is the routing table, or the forwarding table, which the data plane uses.
Control plane traffic is usually addressed to the device itself.
The management plane
The management plane is how administrators and tools reach the device to configure, monitor and troubleshoot it.
- CLI over SSH or Telnet
- SNMP
- NETCONF, RESTCONF and other APIs
- Syslog and telemetry that the device sends out
- Web interfaces
Comparing the planes
| Plane | Job | Examples |
|---|---|---|
| Data | Forward user traffic | Switching, routing, NAT, access lists |
| Control | Decide where traffic goes | OSPF, BGP, spanning tree, ARP |
| Management | Configure and monitor | SSH, SNMP, NETCONF, RESTCONF |
Where SDN and controllers fit
In software defined networking, the control plane can move from each device to a central controller, which tells the devices what to do. The data plane stays on the device. Cisco controllers also give you a management plane API for many devices at once.
Protecting the planes
The management plane needs the strongest protection, because it gives full control. Use SSH and not Telnet, restrict who can connect, and use strong authentication. The control plane should be protected from floods and from false routing updates.
Common port values
A port number is a 16 bit value that identifies a service on a host. A TCP or UDP header carries a source and a destination port.
| Service | Port | Transport | Notes |
|---|---|---|---|
| SSH | 22 | TCP | Secure remote CLI |
| Telnet | 23 | TCP | Clear text remote CLI |
| HTTP | 80 | TCP | Web, no encryption |
| HTTPS | 443 | TCP | Web and REST APIs, with TLS |
| NETCONF over SSH | 830 | TCP | Model driven configuration |
| RESTCONF | 443 | TCP | Uses HTTPS |
| DNS | 53 | UDP and TCP | Name resolution |
| DHCP | 67 and 68 | UDP | Server and client |
| NTP | 123 | UDP | Time |
| SNMP | 161 and 162 | UDP | Requests and traps |
| TFTP | 69 | UDP | Simple file transfer |
| FTP | 20 and 21 | TCP | Data and control |
| SMTP | 25 | TCP | Mail between servers |
| Syslog | 514 | UDP | Log messages |
Port ranges
Ports 0 to 1023 are well known ports. Ports 1024 to 49151 are registered ports. The higher range, 49152 to 65535, is used for temporary ports that clients pick for their own side of a connection.
Ports and automation
When an automation script cannot connect, the port is a good first check. NETCONF needs TCP 830 open.
RESTCONF and most REST APIs use 443. A device may also run its API on a different port, so read the documentation.
$ nc -zv 192.0.2.1 830
$ curl -k -I HOST_ADDRESSThe nc -zv command tests whether a TCP port accepts connections. Some tools check the same thing in other ways.
Remember the pairs: SSH 22 with Telnet 23, and HTTP 80 with HTTPS 443. NETCONF over SSH is 830.
What to remember for the exam
Seven facts cover this topic.
- The data plane forwards traffic, the control plane builds the tables and the management plane configures the device.
- Routing protocols and spanning tree belong to the control plane.
- SSH, SNMP, NETCONF and RESTCONF belong to the management plane.
- SSH is TCP 22, Telnet is TCP 23, HTTP is TCP 80 and HTTPS is TCP 443.
- NETCONF over SSH uses TCP 830.
- DNS is 53, NTP is 123, DHCP is 67 and 68, and SNMP is 161 and 162.
- Telnet sends data in clear text, so SSH is the secure choice.
Common mistakes
Four mistakes are typical.
Mixing up the control plane and the data plane. The control plane decides, and the data plane forwards.
Calling an API part of the data plane. API calls to the device belong to the management plane.
Using Telnet because it is easier. Passwords cross the network in clear text.
Forgetting that ports can be changed. A service may use a non default port, so check the configuration.
Leaving Telnet or plain HTTP enabled on the management plane exposes credentials. Turn them off where you can.
Check yourself
Work through these three questions.
Which plane builds the routing table?
The control plane.
Which plane do SSH, SNMP and NETCONF belong to?
The management plane.
What are the default ports for SSH, HTTPS and NETCONF over SSH?
SSH uses TCP 22, HTTPS uses TCP 443, and NETCONF over SSH uses TCP 830.
Topic 5 of 6 in Network Fundamentals
Test yourself on Network Fundamentals
The full Cisco CCNA 200-901 DEVASC question bank has 808 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.