Management Plane Protection (MPP) vs Disabling Services
Management Plane Protection (MPP) enhances the security of network devices by managing and controlling the processing of management traffic. Rather than merely disabling services such as HTTP, HTTPS, or Telnet—which still allows a device to receive and process packets before refusing them—MPP entirely blocks unapproved traffic, mitigating potential DoS attacks.
This is shown by comparing the response to a Telnet attempt: Without MPP:
H2#telnet 192.168.2.254 Trying 192.168.2.254 ... % Connection refused by remote host
The device refuses the connection after processing the packet, while with MPP:
H2#telnet 192.168.2.254 Trying 192.168.2.254 ... % Connection timed out; remote host not responding
...the connection attempt simply times out, with no packet processing involved.
MPP is especially useful for protecting services that are enabled by default, and preventing the generation of logs from attempted connections to disabled services. Thus, enabling MPP provides a robust security measure beyond merely disabling protocols.
Take a look at MPP vs ACLs for additional comparisons of other solutions with MPP.
Links
https://networklessons.com/security/management-plane-protection-mpp