management vlan

[Brad_199]

wondering what the general concensus is with regard to the management vlan.

is it too restrictive?
how do you access your switches?

[paulgear]

I've used the management VLAN in a campus environment, where every building was connected via Gigabit fibre, and every VLAN was available wherever we wanted.  In that scenario, we used a management VLAN and only the management server and a couple of other devices were allowed on that VLAN.

If i were managing switches in a widely-distributed WAN, i wouldn't bother with the management VLAN, and would use "ip authorized-managers" instead.

[Brad_199]

interesing, thanks paulgear.

it seems very restrictive but I guess it does depend on your setup.

I just wanted to see what others use........thanks

[Arimo]

Hi

It doesn't really depend. It is restrictive, on purpose. The idea is that you can only access the device management with a client on the same VLAN / Subnet. No traffic will be routed in or out of that VLAN.

[paulgear]

Interestingly, the management VLAN still makes it into the OSPF LSDB unless you filter it explicitly, even though the switch can't route to or from it. (At least, it does on my 3400cl on firmware M.10.76.)