In my company, we have a firewall as an edge device to the internet. Behind this central firewall we have management network. We now have to put a router in front of central firewall, as part of some services from ISP.
This router's interfaces all have public IP addresses and it is accessible from the Internet.
There is no remote management access to the router from the Internet.
Is it safe to connect the management interface from that router to the management network that resides behind the firewall?
If the router is compromised over it interfaces with public IP addresses, is there a possibility that rest of my management network could be compromised over the management interface? The management switch is located behind the firewall.
I know that management interface of the router is part of its own VRF, but is that enough?