In my company, we have a firewall as an edge device to the internet. Behind this central firewall we have management network. We now have to put a router in front of central firewall, as part of some services from ISP.

This router's interfaces all have public IP addresses and it is accessible from the Internet.

There is no remote management access to the router from the Internet. 

Is it safe to connect the management interface from that router to the management network that resides behind the firewall?

If the router is compromised over it interfaces with public IP addresses, is there a possibility that rest of my management network could be compromised over the management interface? The management switch is located behind the firewall.

I know that management interface of the router is part of its own VRF, but is that enough?

  • 2
    Welcome to Security.Ex! Please, could you post a network diagram to illustrate what your network currently looks like?
    – user173641
    Jun 19, 2018 at 22:47
  • It may also help to have router model and software version. However, this doesn’t sound much different than what many service providers do for management access to their devices. Properly secured, this shouldn’t be an issue.
    – YLearn
    Jul 23, 2018 at 0:20
  • AFAIK, routers only have 2 interfaces and are pretty much like f/w. One port would LAN and other would WAN. Or maybe you are taking about a L3 switch?
    – xandfury
    Apr 13, 2020 at 7:16
  • Block access to the router from anything but the ISP services ...
    – schroeder
    Nov 24, 2023 at 12:12


You must log in to answer this question.

Browse other questions tagged .