I currently have a requirement to install a cisco catalyst switch in front of my firewall to allow for firewall failover. I would like to be able to manage this switch and would like know what the best pratices are in this type of situation.
The switch is required only for layer 2 traffic infront of the firewalls ( internet side ). in the past i have always left these switches unmanaged on the network side and connected a serial cable to a server for out of band management. However in this instants i cannot use this method and have a requirement for SSH management.
In order to manage the switch i could enable the dedicated management port with an ip for ssh and attach this to my internal network ( by passing my firewall ) my understanding is that this port doesn't participate in switching tasks like a normal switch port does. Would this type of configuration be considered secure ? has it been exploited ?
Alternatively i could assign a public ip to the switch and enable ssh on the vlan attached to the WAN side and manage this via the public IP and secure the switch via ACL's to lock management down to a single IP address.
What is the best practice for this sort of situation is there a best practice guide on how to configure security and maintain management of switches that on the WAN side of your lan ?
Any recommendations or advise would be great.
