This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject
Help
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

EOS Out-Of-Band Management

EOS Out-Of-Band Management

Anonymous
Not applicable

‎04-19-2016 01:00 PM

In the process of configuring / designing an Out-Of-Band management network in EOS.

Will need to make this as secure as possible so things like SNMP, SSH, Syslog, HTTPS and Netflow for / via NetSight are all done out of band on the management network only. All the switches in use are either S or K series.

My first thoughts are that I would have to do this with Policy and ACL's, but it would be preferential to use a separate VRF.

So my questions are:
  • What would the best why to ago about this in the most secure manner?
  • Perhaps there is a better method in EOS?
  • If I was to use a VRF for management (and my point in using it), is I could then just enable the management protocols on the management VRF and turn them off on the default VRF. (I don't believe its possible, but it would provide the simplest and most secure set-up, perhaps still in conjunction with policy and ACL's)
Many thanks in advance.

0 Kudos
5 REPLIES 5

jeronimo
Contributor III

‎04-28-2016 06:30 PM

Here is a brief KB article, but maybe it is of use to you: https://gtacknowledge.extremenetworks.com/articles/Q_A/Non-Global-VRF-Loopback-IP-not-responding-to-...

What I take from that: Use the global VRF to perform management, and put your production traffic into a VRF that you create additionally.

0 Kudos

Erik_Auerswald
Contributor II

‎04-20-2016 12:59 PM

I do not think that is sufficient.

There are two GTAC Knowledge articles regarding restricting management access:
  1. https://gtacknowledge.extremenetworks.com/articles/How_To/How-To-Configure-an-ACL-on-a-S-K-Series-to...
  2. https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-create-host-access-list-on-S-Series...
As far as I remember any reachable active interface can be used for management unless an ACL restricts access. The host ACL controls access via any interface.
0 Kudos

Curtis_Parish1
New Contributor III

‎04-20-2016 12:13 PM

Question: if you set an ip address on an interface as management and then disable ip-forwarding on that interface does that restrict management access to that address?
0 Kudos

Anonymous
Not applicable

‎04-20-2016 06:32 AM

Thanks for the reply.

Think my plan will be to use a VRF for management and use ACL's either side to stop and control IP traffic for containment, with the use of 'ip host-access' that you have helpfully provided.

Many thanks.
0 Kudos
GTM-P2G8KFN