Default GW IP address shared with management interface IP: any securirty implications?

Question

Building out separate VLAN for management interfaces. The proposition is to use Default GW IP address as a management interface for network device. Any security concerns?

Answer 1

Generally, the accepted best practice for management interfaces is to segregate them into their own VLAN and apply filtering so that only certain whitelisted (read jump boxes) are authorized to communicate with devices via the management interface.

The security concern is that many times management interfaces have:

• Known vulnerabilities (e.g., HP SMH which seems to have a new one every week)
• Weak or default passwords
• Few controls to prevent bruteforce attacks (e.g., fail2ban, lockout windows, etc)
• Devastating impact availability if compromised.