EOS Out-Of-Band Management

[Anonymous]

In the process of configuring / designing an Out-Of-Band management network in EOS.

Will need to make this as secure as possible so things like SNMP, SSH, Syslog, HTTPS and Netflow for / via NetSight are all done out of band on the management network only. All the switches in use are either S or K series.

My first thoughts are that I would have to do this with Policy and ACL's, but it would be preferential to use a separate VRF.

So my questions are:

• What would the best why to ago about this in the most secure manner?
• Perhaps there is a better method in EOS?
• If I was to use a VRF for management (and my point in using it), is I could then just enable the management protocols on the management VRF and turn them off on the default VRF. (I don't believe its possible, but it would provide the simplest and most secure set-up, perhaps still in conjunction with policy and ACL's)

Many thanks in advance.

[Erik_Auerswald]

Hi Martin,

I don't think you can disable SNMP, SSH, etc. in a VRF.

To lock down management access you should look into the host ACL ("ip host-access "). You can (and should) use an extended ACL, so you can allow just the interface IP you want to use for management. With a host ACL you need to consider and allow all layer 3 protocols (VRRP, OSPF, BGP, ...) you intend to use.

Erik