Access and Management

This objective covers how administrators safely connect to, manage, and configure network equipment, both from inside the office and from remote locations worldwide. It balances user connectivity styles with strict administrative security boundaries.

1. Remote Access Methodologies (VPNs)

Virtual Private Networks (VPNs) create secure, encrypted tunnels over an untrusted network (like the public internet). They generally fall into two deployment architectures:

Site-to-Site VPN

• What it is: Connects two or more entire physical networks together permanently.
• How it works: A dedicated hardware device (such as a firewall or router) at Branch Office A establishes a permanent, encrypted tunnel over the internet to a firewall at Corporate Headquarters.
• User Experience: Individual employees do not need to run any special software. They simply print to a printer or open a file share at headquarters as if the two offices were in the same room.

Client-to-Site VPN (Remote Access)

• What it is: Connects a single, isolated remote user (like an employee working from home) directly to the private corporate network.
• Connection Methods:
  • Client-Based: The user must install a dedicated software application (like Cisco AnyConnect or OpenVPN) on their laptop. The software handles the encryption and connects them to the corporate gateway.
  • Clientless: The user does not install any software. They simply open a standard web browser and navigate to a secure corporate webpage using SSL/TLS. Once they log in, they can access internal web apps, remote desktops, or file shares directly in the browser.

Tunneling Strategies: Split vs. Full

When a remote worker turns on their client-to-site VPN, the administrator dictates how their internet traffic is steered:

• Full Tunnel: All traffic from the user’s laptop, including corporate email, internal database requests, and personal traffic (such as watching a video or checking the news), is first routed through the encrypted VPN tunnel to the corporate headquarters firewall.
  • Pros/Cons: Highly secure because the corporate firewall inspects everything the user does. However, it consumes a massive amount of corporate internet bandwidth and can cause latency for users.
• Split Tunnel: Only traffic explicitly destined for the internal corporate network (e.g., 10.0.0.0/8) is sent through the secure VPN tunnel. Any regular public internet traffic (like browsing a public website) bypasses the VPN completely and goes straight out of the user’s local home internet router.
  • Pros/Cons: Conserves corporate bandwidth and provides a faster browsing experience for the user. However, the company loses visibility and security control over what the employee is doing on the public internet while connected to corporate assets.

2. Device Management Connection Methods

When you need to log into a specific router or switch to change its settings, you can choose from four distinct access styles:

• Console (Command Line – Local): A direct, physical connection. You take a physical laptop, plug a specialized rolling console cable into the dedicated Console Port on the back of the switch, and use terminal software (like PuTTY). This requires zero network configurations or IP addresses to work.
• SSH (Command Line – Remote): Secure Shell allows you to open a remote command-line interface over the network using an IP address on TCP port 22. All traffic, including usernames and passwords, is fully encrypted.
• GUI (Graphical User Interface): Managing a device using a visual web browser interface (typically over HTTPS on Port 443). Instead of typing commands, you click buttons, view charts, and configure settings using visual menus.
• API (Application Programming Interface): Programmatic management. Instead of a human logging in, an automated script or configuration tool (such as an Ansible playbook) sends structured data (such as JSON or XML) directly to the device to update its settings automatically.

3. Administrative Security Boundaries

Jump Box / Jump Host

• What it is: A highly secure, hardened intermediate server hidden within a segregated network zone (such as a DMZ or Screened Subnet).
• How it works: Administrators are strictly blocked from connecting directly to sensitive core servers or switches from their standard workstations. Instead, the admin must first log in to the Jump Box (which often requires Multi-Factor Authentication). Once inside the Jump Box, they can open secondary secure management sessions (via SSH or RDP) to the production infrastructure.
• Why use it: It creates a single, easily audited choke point, keeping production database segments completely isolated from the standard user LAN.

In-Band vs. Out-of-Band (OOB) Management

This defines whether your administrative control traffic travels on the same highway as your regular company data.

• In-Band Management: Managing network devices using the exact same production network paths, cables, and VLANs that regular users use to surf the web or access files.
  • The Catch: If a user initiates a massive file transfer and floods a link, or if a routing loop crashes a switch block, you will lose your management connection to the device, leaving you blind and unable to fix the error remotely.
• Out-of-Band (OOB) Management: Building a completely separate, dedicated, and isolated secondary physical network purely for administration traffic. Every router and switch has its dedicated Console/Management port plugged into an entirely independent OOB switch infrastructure.
  • The Advantage: If the production network experiences a massive broadcast storm, collapses entirely, or is locked down by an attack, the administrator can still connect cleanly via the independent OOB network to reboot devices, change configurations, and restore service safely.

Access & Management Study Matrix

Term / Method	Core Focus / Layer	Primary Exam Identifier / Clue
Site-to-Site	Architecture	Connects entire physical office networks permanently via hardware.
Clientless VPN	Architecture	Remote access via a standard web browser using HTTPS; no client app.
Full Tunnel	Traffic Routing	Routes 100% of remote user traffic through corporate headquarters.
Console Port	Physical Access	Local command-line access requiring a direct cable connection; no IP needed.
Jump Box	Security	A single secure choke-point server is used to reach production zones.
Out-of-Band	Reliability	Dedicated, separate network used to manage hardware during primary network outages.