Management port on internal network on a public facing router

[edugger]

We have some disagreement on what is the best practice for setting up the management port on a cisco router.  Some people say connect it directly to the internal network, bypassing all firewalls.  Some say this could be a vulnerability in case the router ever gets compromised as there would be a direct link to the internal network.  What is best practice?

[balsamovan]

Best practice is hard to determine as every organisation has unique designs and requirements that need to be met.

I suggest you have a read of the following article, it may answer some of your concerns/questions and present you with a better idea on how to proceed further:

https://ltlnetworker.wordpress.com/2015/08/16/management-network-topology-and-asymmetric-routing/

[Mark Malone]

Ye I wouldn't do that , get a separate MGMT switch connect all MGMT ports back to it and have it directly connected to your firewalls in MGMT VDOM and then source all MGMT traffic from the MGMT ports on local routers , that's true oob , isolated from the current prod network
What your doing above you may aswell just use vlans