In my company we had firewall as edge device with the internet. Behind this central firewall we have management network. Now we had to put Cisco router in front of central firewall, as part of some services from ISP.
This router have all interfaces with public IP addresses and he is pretty visible on the Internet, therefore more vulnerable.
There is no remote management access to the router from the Internet.
Is it safe to connect mgmt interface from that router to management network that reside behind the firewall?
If router is compromised over interfaces with public IP addresses, is there a possibility that rest of my management network could be compromised over management interface? Because I connected mgmt interface from that router to switch with management network, on which I have a lot of devices. And management switch is located behind the firewall.
I know that mgmt interface of the router is part of its own VRF, but is that enough?