Management VLAN

[jai.s401]

can I have two management vlan for a switch??

Should a management vlan always be default (VLAN 1) ?

[balaji.bandi]

No not necessary, it can be anything, if you are using different VLAN as MGMT, you need to allow them in your Trunk.

[Martin L]

No, you can use whatever you like. Moreover, I think security principles still do not recommend using vlan 1 at all ! I mean do not use vlan 1 for data usage, however, some of control plane protocols will stay and use vlan 1 by default.  Another benefit is TS. To simplify L2 troubleshooting, keep user data out of vlan 1.  

Find doc titled Best Practices for Catalyst 6500/6000 Series and Catalyst 4500/4000 Series on cisco web site to get more info

Regards, ML
**Please Rate All Helpful Responses **

[Joseph W. Doherty]

"can I have two management vlan for a switch??"

Unless you're using a L3 switch, there's only, I believe, one management IP, so unsure how you would have two management VLANs.  On a L3 switch, management can be accomplished against any reachable interface IP, assuming that interface IP doesn't block "management" access.

"Should a management vlan always be default (VLAN 1) ?"

Generally, no.  As @Martin L notes, because Cisco switches often use VLAN 1 for special purposes, it should be avoided, whenever possible.

[jai.s401]

what exactly is a management vlan,
From my understanding, it is a vlan with an SVI for remote access to the switch.
so we can create multiple vlan with SVI of different segment right.

[balaji.bandi]

what exactly is a management vlan,

This is for your Manangment only, that means no other traffic will be using this VLAN, (but you can use other vlan also for management if you do not like to have dedicated Manangment VLAN - it all depends on network)

Manangment VLAN is to manage all the device like SSH/Tenlet any other protoocol, rather mixing with other Data VLAN. to control manner.

so we can create multiple vlan with SVI of different segment right.

VLAN 1 is default normal by Cisco default native. you can create as many as SVI based on the device support.

Hope this make sense ?

[Joseph W. Doherty]

If I recall correctly, a Cisco non-L3 switch doesn't have/support SVIs, but if a manageable switch, it can have/support a management IP.  The latter, I also recall (?) can be assigned to any VLAN on that switch.

The difference with a management IP vs. a SVI, the former is just a host IP, the latter is an L3 interface IP.

As to what a management VLAN is, it's just a VLAN restricted to management purposes, such a telnet/SSH, SNMP, etc., traffic.

As you can generally control what's allow to access a Cisco platform, i.e. a management VLAN should be needed to "protect" the platform, what the management VLAN does is help preclude anyone "snooping" traffic on that VLAN.

[Richard Burts · Accepted solution]

It is an interesting question "what is a management vlan". The simple answer is that the management vlan is used to help you manage the switch. But what does that really mean?

- if you want to remotely access the switch (via telnet or SSH) that is a management function and requires an interface with an IP address, and that becomes your management vlan.

- if you want to use a GUI for the switch that is a management function and requires an interface with an IP address, and that becomes your management vlan.

- if you want the switch to send syslog messages so that you are aware of what is going on with the switch that is a management function and requires an interface with an IP address, and that becomes your management vlan.

- if you have an SNMP server that tracks what is going on with the switch that is a management function and requires an interface with an IP address, and that becomes your management vlan.

- if you want a switch to use NTP to learn time (and possibly to sync with other devices in the network) that is a management function and requires an interface with an IP address, and that becomes your management vlan.

It might be an interesting question about having more than one management vlan. Some layer 2 switches limit you to one active vlan interface with an IP address. So obviously these limit you to a single management vlan. Other layer 2 switches (and all layer 3 switches) allow multiple active vlan interfaces with IP addresses. For these you might have multiple management vlans. It could be possible (though I would not say that it was a particularly good idea) to have one vlan interface used for telnet/SSH, and a separate vlan interface used for GUI, and a separate vlan interface used for syslog, and a separate vlan interface used for SNMP, and a separate vlan interface used for NTP.

As @balaji.bandi points out some organizations will use a separate vlan for management functions and not allow any data traffic in that vlan, but that certainly is not a requirement.

[Joseph W. Doherty]

"Other layer 2 switches . . . allow multiple active vlan interfaces with IP addresses."

Rick, can you describe an actual L2 switch that does?  I'm curious how the switch "maps" multiple management IPs to VLANs.  I presume the switch would somehow config a particular management IP to a particular VLAN.

"For these you might have multiple management vlans. It could be possible (though I would not say that it was a particularly good idea) . . ."

Agree, not generally a good idea.  Don't recall seeing anyone do that (i.e. multiple management VLANs), either.

"As @balaji.bandi points out some organizations will use a separate vlan for management functions and not allow any data traffic in that vlan, but that certainly is not a requirement."

I suspect Balaji didn't mean "any data traffic", but meant no non-management data traffic.  But, if I'm mistaken, Balaji please correct me.

BTW, I have seen management conducted on out-of-band networks, i.e. networks physically different from the networks carrying "normal" traffic.

[balaji.bandi]

Cheers for the correct me here  @Joseph W. Doherty  - 

I suspect Balaji didn't mean "any data traffic", but meant no non-management data traffic.  But, if I'm mistaken, Balaji please correct me.

Again as mentioned depends on the requirement and design.

[jai.s401]

Wow, very clear Explanation..!

Also please clarify that "interface with an IP address" mentioned above need not be an Physical Interface right?

[Richard Burts · Accepted solution]

I am glad that you find my explanation helpful. Yes the interface with an IP address need not be a physical interface and in fact using a physical interface is quite unusual. The usual implementation uses a switch vlan interface (SVI) which is a virtual interface. Thank you for marking this question as solved. This will help other participants in the community to identify discussions which have helpful information. This community is an excellent place to ask questions and to learn about networking. I hope to see you continue to be active in the community.