cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

512
Views
0
Helpful
7
Replies
Highlighted
Beginner

Port-Channel / Security issue

Hello,

 

I have a question considering if is security wise to allow traffic from a user vlan to pass through a port-channel that is used for management traffic. 

 

Can you describe the pros and cons of doing it or not. 

 

Best Regards

John

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
VIP Mentor

Re: Port-Channel / Security issue

Hi
As Joseph has stated makes no difference if its a po , the fact your using a fex as mgmt. platform its not isolated anyway so its inband mgmt. traffic rather than out of band so its all mixing anyway in the 5k where its being processed , trunk , access or po is indifferent to it as its vlan based mgmt. traffic. out of band is obviously more secure as its basically a parallel mgmt. network isolated form data plane of prod traffic but inband works too fine

View solution in original post

7 REPLIES 7
Highlighted
VIP Mentor

Re: Port-Channel / Security issue

Hi

Your MGMT and Production traffic are going to mix on the data plane of the router/switch even though there  isolated on the wire by different vlans , best practice is to have it segregated completely in dedicated mgmt port and switch

 

I have oob implemented but on dedicated switches connected to the firewalls using only their oob ports completly isolating mgmt traffic , although in some cases i have had no choice but to use a vlan in areas where it just was not cost efficient to run extra dedicated cabling and some devices had not got specific mgmt ports , if you do this you should have the fw service the mgmt protocls so there is some form of protection in place , then source all mgmt traffic locally on the device out that particular vlan or mgmt port ,if its a vlan i would use acls on the vlan interface to make sure the traffic is using that vlan only , we specified a acl for in an out traffic under the vlan interfaces on the devices that had no dedicated mgmt ports

 

This doc explains bets [ractice a bit for oob

 

https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/SAFE_RG/SAFE_rg/chap9.html#wp1054536

"The OOB management network is implemented at the headquarters using dedicated switches that are independent and physically disparate from the data network"

 

so is it wise well sometimes it cant be avoided but if you can avoid it do it would be my personal opinion because running mgmt traffic through a vlan is not really oob but budget and other constraints can make that decision for you anyway

Highlighted
Beginner

Re: Port-Channel / Security issue

Hi Mark,

 

We have a couple of FEX2224 just for mgmt traffic in a vpc configuration with 2 Nexus 5596 but there is a need to use a port from one of these mgmt FEX just to allow traffic for a data vlan. 

This port will be an orphan port. 

Will the vpc domain allow this traffic to pass from the port-channel that passes the mgmt traffic?

Highlighted
VIP Mentor

Re: Port-Channel / Security issue

Hi
As Joseph has stated makes no difference if its a po , the fact your using a fex as mgmt. platform its not isolated anyway so its inband mgmt. traffic rather than out of band so its all mixing anyway in the 5k where its being processed , trunk , access or po is indifferent to it as its vlan based mgmt. traffic. out of band is obviously more secure as its basically a parallel mgmt. network isolated form data plane of prod traffic but inband works too fine

View solution in original post

Highlighted
VIP Expert

Re: Port-Channel / Security issue

I'm unaware on any additional security concerns using a port-channel. I.e., using a port-channel, or not, likely doesn't change the security pros and cons.
Highlighted
Beginner

Re: Port-Channel / Security issue

Hi Joseph,

 

So there is vlan isolation in any case as is for vlan hopping if the port is not consider as trunk and not configured to participate in DTP.

 

Am I right?

 

Thanks in advance.

 

Best Regards

John

Highlighted
Beginner

Re: Port-Channel / Security issue

Hi Joseph,

 

So there is vlan isolation in any case.

 

Am I right?

 

Thanks in advance.

 

Best Regards

John

Highlighted
Rising star

Re: Port-Channel / Security issue

Hi John,

Mark has provided great explanation regarding management traffic isolation using OOB mgmt interface.

Basically Port-Channels are used to have redundant links and higher bandwidth. Out of that, they are like individual access or trunk ports. So, if you configured the port-channel interface as a trunk port, it will carry multiple VLANs (one of them could be management vlan) which are isolated networks (and will not talk to each other unless you have a layer3 device.)

HTH,
Meheretab
HTH,
Meheretab
CreatePlease to create content
Content for Community-Ad