Is it safe to run out of band network on my vm servers sitting in DMZ

[carl_townshend]

Hi all

A quick question,

I have some vmware sitting in my DMZ on plublic ip addresses, At the moment we have no management to them.

I do not want to put the management addresses on public ip addresses so I dont have to waste them.

is there any way around this ? ie give them a internal address that sits on my DMZ switch with a connection on that VLAN to my LAN, Or is this too Dangerous ?

cheers

Carl

[stubinski]

Hi,

There is no harm in having the management interfaces directly connected to your LAN if they only are used for management purposes (vsphere), and I wouldn't use public IP's for management purposes. 

However, I prefer to keep my DMZ switch network physically separate from my internal LAN so I would either plug the management ports directly into a internal lan switch or create a subinterface and all the ACL's that come with this setup on my firewall and treat it as a higher security level DMZ.