Take the 2-minute tour ×
Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.

how u doing?

Just got a Cisco SF300-24 for studying switch configuration and I'm in doubt about the Management VLAN.

In my conf, I made this VLANs:

Vlan       Name                   Ports               Created by    
---- ----------------- --------------------------- ---------------- 
 1           1                                            D         
 10        DATA              fa9-11,fa21-23               S         
 11        VOIP                                           S         
 12      PRINTERS               fa8,fa20                  S         
 13         SAN               fa6-7,fa18-19               S         
 14    PRIVATE_WIFI             fa5,fa17                  S         
 15     PUBLIC_WIFI             fa4,fa16                  S         
 16        HOUSE              fa2-3,fa14-15               S         
 99        MGMT                 fa1,fa13                  S         
999        NULL           fa12,fa24,gi1-4,Po1-8           S    

The IP address for each vlan follows this scheme: 10.1..201/24.

First, I eliminated the VLAN 1 and create an 999, that's a black hole. Is this a good configuration for security improvement?

Second, I'd like the VLAN 99 to be the Management one, but I still can ping/telnet/ssh and whatsoever from ANY subnet. What should I use to block this kind traffic in other VLANs and make just this one for management?

Thx in advance!

share|improve this question
    
Is this switch layer 2 or layer 3? –  Ron Aug 24 at 21:45
    
It's both. Now it is configured in L3 mode. –  jonatas.baldin Aug 24 at 21:47

2 Answers 2

This is normal behavior for a layer 3 switch, management traffic can be sent to any active Switch Virtual Interface (SVI). If you only want to allow management traffic from a specific vlan/subnet, you could set up ACLs.

A layer 2 switch can be assigned a management IP address, attached to one vlan, called the management vlan. It will only be reachable inside this vlan.

In the case of the SF300, I believe you have to define a management ACL instead of a normal IP ACL if you want to filter management traffic into the switch. Use the management access-list command, and then apply the ACL using management access-class.

share|improve this answer
    
Great answer man! I'm gonna do this later. –  jonatas.baldin Aug 24 at 22:47

On this switch, you define profiles that control who can access the management interface. This is different than most IOS based switches. From the management console, Click

Security > Mgmt Access Method > Profile Rules

And you can control what ports, source addresses, protocols, etc can access the management interface.

share|improve this answer
    
Is this something like ACL? I don't like the web-based inteface, if you know how to do in the CLI I'd be glad. –  jonatas.baldin Aug 24 at 22:23
    
Another point... is just this that is about Management Vlan? Setting up an vlan and allowing the "MGMT" traffic just there? –  jonatas.baldin Aug 24 at 22:23
    
When you say setting up a "Management Vlan," what exactly are you trying to do? –  Ron Aug 25 at 11:42
    
I wanna set a vlan for the switches management, all of them. I mean, I could access SSH JUST in that vlan (this being the only method of access). –  jonatas.baldin Aug 25 at 14:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.