Management Network Best Practice

[Mokhalil82]

Hi

I am designing a new network for one of our offices, that will consist of a router that connects into the ISP, then on the LAN side the router connects into the core switch which has all the access switches branching off it.

                     Router

                          |

                Core Switch

                |                  |

         Access Sw    Access Sw

To ensure best practices are followed, I am trying to decide how to setup the management network.

Initial thoughts were just to have a management subnet and assign all devices an IP from that subnet, so management traffic travels on the same links as other traffic.

I am also considering connecting a management switch to the router, which will be separate from all other traffic and then this switch will only have management links to all devices, which allows me to perform maintenance on the network remotely without worrying about getting disconnected if I shut down a certain port. 

Any advice will be appreciated

[Mark Malone · Accepted solution]

Hey this is just an option take from it what you want its just the way I have seen some done , have as you said separate switch connecting into direct mgmt ports on separate mgmt. subnet and if its remote office connect up a serial console switch backdoor gsm as well for lights out access, connect your mgmt. switch to a small firewall , have all mgmt. traffic on each device sourced from specific mgmt. interface ntp/syslog/netflow/tacacs  etc and use default gateway as fw to process it, use vrfs under the l3 device mgmt. interfaces where possible , that way your mgmt. traffic is secured on separate network from prod traffic as much as can be.Anyway that might be overkill for such a small network above but if its highly critical traffic you should try cover it as much as possible

[Mokhalil82]

Thanks Mark, that's the sort of info I was after from someone who has seen or experienced management setups. I have done some research into it today and the option are now clearer.