Explain the management, control and data planes with examples.
Show the answer
Say this first
The data plane forwards transit traffic using tables that are already built: FIB, adjacency, ACLs, QoS, usually in hardware. The control plane builds those tables: OSPF, BGP, STP, ARP, LACP running on the CPU. The management plane is how people and tools operate the box: SSH, SNMP, NETCONF, syslog, the API.
Go deeper
Side by side
| Plane | Job | Examples | Runs on |
|---|---|---|---|
| Data (forwarding) | Move packets that pass through the device | FIB lookup, MAC table lookup, ACL match, NAT, QoS marking | ASICs or the fast software path |
| Control | Decide where packets should go and build the tables | OSPF, BGP, IS-IS, STP, ARP, LACP, LLDP | Route processor CPU |
| Management | Configure and monitor the device | SSH, SNMP, NETCONF, RESTCONF, syslog, NTP | Route processor CPU |
Why the split matters
- Protection. The CPU is small compared to the ASICs. A flood of traffic aimed at the router itself (punted traffic) can starve OSPF and BGP. Control plane policing (CoPP) rate limits what reaches the CPU.
- SDN. Classic SDN moves the control plane off the box into a central controller. Most modern controllers keep a distributed control plane on the devices and centralize policy and management instead.
- Resilience. With NSF/SSO, the data plane keeps forwarding on the old FIB while the control plane restarts.
Quick test
A ping through R1 is data plane. A ping to R1 is punted to the CPU and answered there. An OSPF hello is control plane. An SSH login is management plane.
They will ask next
Is NTP control plane or management plane?
Usually classed as management plane: it keeps the device clock right for logs, certificates and authentication. Some vendors group it with control plane services in their CoPP templates. Say which view you take and why.
What happens to forwarding if the control plane crashes?
Hardware keeps forwarding with the last FIB it was given until neighbors time out. Without graceful restart the neighbors drop the adjacency after the dead or hold timer and route around the box. With NSF/SSO or graceful restart they keep using it while the control plane recovers.
Traps
- Calling ARP or STP data plane. They build forwarding state, so they are control plane.
- Forgetting that management traffic and control traffic both hit the same CPU, which is why CoPP exists.