topic Re: Fabric Engine with Mgmt CLIP and NAT Firewall in ExtremeSwitching (VSP/Fabric Engine)

Fabric Engine with Mgmt CLIP and NAT Firewall

RobertD1 — Fri, 21 Oct 2022 16:10:30 GMT

Hello,

If the general rule is to use CLIP as management interface for Fabric Engine with Segmented Management Interface when using L3 BEB or L3 non-fabric how can a connection be established using a NAT enabled Firewall?

Would we add a Mgmt VLAN and add it to the uplink to the Firewall so that it can be NATd?

I think this is the only option and would allow access to the CPU using a mgmt VLAN. We can have multiple management interfaces after all. With L3 enabled switch the mgmt VLAN would not be accessible from other local VLAN IP interfaces.

Thanks,

Rob

Re: Fabric Engine with Mgmt CLIP and NAT Firewall

Miguel-Angel_RO — Mon, 24 Oct 2022 07:22:25 GMT

Robert,

You either use mgmt VLAN or mgmt CLIP.

If you use CLIP, there is no need to add a VLAN on the firewall, just a route would be needed (+ security policies).

Be carefull with Natting mgmt interface because it is the one used for Radius and XIQ-SE snmp communication.

You can also work with the same mgmgt VLAN for all your switches but again, the NATting could cause trouble with Radius and XIQ-SE snmp communication.

Mig

Re: Fabric Engine with Mgmt CLIP and NAT Firewall

RobertD1 — Mon, 24 Oct 2022 12:40:08 GMT

Thanks Mig