Procurve Management & untagged default VLAN

[Ian Vaughan]

Hi,
I will soon be implementing some new VLANs and wanted to have someone sanity check my thinking.
I want to introduce a Management VLAN, say VLAN101, that all of the IP addresses that I will put on my switches can live on. In order to make my life easier in the future I've read that I should really make this the untagged VLAN on any dot1q uplinks back to the core.

So I guess my question is, am I right in thinking that all I have to do on the uplinks between switches is change the untagged VLAN1 at each end to tagged and make sure that VLAN101 is added as untagged on the interfaces or trunk-groups at each end?

Many thanks
Ian

[Michael_Breuer · Accepted solution]

Hi Ian,

I have never heard that the management VLAN should be untagged on the uplinks. Basically there is no need to untag the management VLAN. Independant of the tagging state all other mangement traffic (like LLDP, STP, ..) will work.

My best practice rules:
1) Keep VLAN 1 untagged, no user traffic in this, all unused port in VLAN 1
2) All other VLANs tagged
3) Dedicated VLAN for management (VLAN ID >1)

Cheers,

Michael

[Ian Vaughan]

OK,
Thanks for that. I'll plan for the MGMT VLAN to be tagged and I'll move the used ports off VLAN 1 so that the default only has unused ports in it.

Cheers
Ian

[Shadow13]

you can make anyother vlan as management vlan by issuing the command
management-vlan VLAN-ID

that way vlan 1 will not be the management vlan and the other vlan will take the role

[Ian Vaughan]

I wasn't entirely sure what to do with the "official" management-vlan so I just left it as it was. I thought that it might stop us getting onto the switch remotely from our desktops on another vlan and didn't have time to test so erred on the side of caution.

Made a load of new VLANs, trunks & trunk groups and connected up the new Vsphere servers so feeling a bit more at home on the Procurve now.

Cheers for your help.
Ian

[Michael_Breuer]

Hi Ian,

indeed: If you use the command "management-vlan " the switch will behave in the followin manner:
1) it is not possible to access the switch from any other VLAN.
2) It is also forbidden to route between the MGMT-VLAN to any other VLAN.
3) All other IP addresses on the switch except the IP address of the MGMT-VLAN are not accessible anymore.

So I recommend to define a dedicated VLAN for management IP addresses of the switch but not to use the command because it is very restrictive.

For the weekend I recommend the following reading ;-)
http://www.procurve.com/docs/rnd/pdfs/Hardening_ProCurve_Switches_White_Paper.pdf

Cheers,

Michael

[Ian Vaughan]

Many thanks for the doc I'll take a look when I get chance.
Back on Cisco's tomorrow with a stack of 3750's and a brace of ASA's to start looking at.
Cheers
Ian

[Ian Vaughan]

Problem solved - thanks to the guys above