Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am looking at setting up a Management vlan, on which I will put all the Management interfaces for my various networkable devices (Firewall Mgmt Interfaces, Server RAC, WAP Mgmt Interfaces, etc).

What are best practices when it comes to accessing that mgmt vlan--For example, as the IT administrator, my workstation is only on the Business network--But if I need to access the firewall through the mgmt interface, should I have a 2nd nic that I use exclusively for the mgmt network? Or should I write ACLs that allow only certain IPs (my workstation) to access the mgmt network?

Does this make any kind of sense?

Thanks for your time--

-Josh

share|improve this question

3 Answers 3

up vote 4 down vote accepted

One way I've seen this setup, which seemed like a reasonable approach was to allow access from a single host to the management LAN and then have anyone need access connect to that device via rdp or ssh and from there on to the management network.

An advantage of this approach is you reduce visibility of the management network in terms of scanning but you're not tied down to accessing from specific hosts as you would be with a multiple nic solution.

Another advantage is that it should allow for easier auditing of what actions are taken on devices in the management LAN, by auditing activity on the gateway host.

Of course securing that host becomes very important, both in terms of authenticating the admins connecting to it and auditing activity.

share|improve this answer
    
What do you mean by "you reduce visibility of the management network in terms of scanning"? A simple pivot (at any layer) could provide scanning as far as I understand it. I think it's best to put all devices in a secure cloud (on public IPs) and manage them over Web Services with SSL/TLS, or perhaps RDP, SSH, or OpenVPN depending on the use cases (but less likely these days). –  atdre Nov 18 '10 at 20:38
    
This can also help provide some defense in depth, as you can restrict access to the network via the management endpoint. –  AviD Nov 21 '10 at 11:15

IP should be enough. If the firewall is good. SSL Connecting to it would be nice though if you go the IP route.

share|improve this answer

Just use Cloud based IaaS services such as Amazon EC2 with Cloudkick and properly protect your Access keys. There's no need to implement or continue using traditional networks or data centers anymore.

share|improve this answer
    
I kinda wanna +1 for humor, but I'm not sure you're joking...? –  AviD Nov 14 '10 at 23:46
    
@AviD: Yeah, my answer is mired in educational sarcasm, as from a curmudgeon pulpit. Sorry about that -- it's going to happen from time to time... –  atdre Nov 15 '10 at 1:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.