how u doing?

Just got a Cisco SF300-24 for studying switch configuration and I'm in doubt about the Management VLAN.

In my conf, I made this VLANs:

Vlan       Name                   Ports               Created by    
---- ----------------- --------------------------- ---------------- 
 1           1                                            D         
 10        DATA              fa9-11,fa21-23               S         
 11        VOIP                                           S         
 12      PRINTERS               fa8,fa20                  S         
 13         SAN               fa6-7,fa18-19               S         
 14    PRIVATE_WIFI             fa5,fa17                  S         
 15     PUBLIC_WIFI             fa4,fa16                  S         
 16        HOUSE              fa2-3,fa14-15               S         
 99        MGMT                 fa1,fa13                  S         
999        NULL           fa12,fa24,gi1-4,Po1-8           S    

The IP address for each vlan follows this scheme: 10.1..201/24.

First, I eliminated the VLAN 1 and create an 999, that's a black hole. Is this a good configuration for security improvement?

Second, I'd like the VLAN 99 to be the Management one, but I still can ping/telnet/ssh and whatsoever from ANY subnet. What should I use to block this kind traffic in other VLANs and make just this one for management?

Thx in advance!

  • Is this switch layer 2 or layer 3?
    – Ron Trunk
    Commented Aug 24, 2014 at 21:45
  • It's both. Now it is configured in L3 mode. Commented Aug 24, 2014 at 21:47
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Commented Jan 5, 2021 at 17:15

2 Answers 2


This is normal behavior for a layer 3 switch, management traffic can be sent to any active Switch Virtual Interface (SVI). If you only want to allow management traffic from a specific vlan/subnet, you could set up ACLs.

A layer 2 switch can be assigned a management IP address, attached to one vlan, called the management vlan. It will only be reachable inside this vlan.

In the case of the SF300, I believe you have to define a management ACL instead of a normal IP ACL if you want to filter management traffic into the switch. Use the management access-list command, and then apply the ACL using management access-class.


On this switch, you define profiles that control who can access the management interface. This is different than most IOS based switches. From the management console, Click

Security > Mgmt Access Method > Profile Rules

And you can control what ports, source addresses, protocols, etc can access the management interface.

  • Is this something like ACL? I don't like the web-based inteface, if you know how to do in the CLI I'd be glad. Commented Aug 24, 2014 at 22:23
  • Another point... is just this that is about Management Vlan? Setting up an vlan and allowing the "MGMT" traffic just there? Commented Aug 24, 2014 at 22:23
  • When you say setting up a "Management Vlan," what exactly are you trying to do?
    – Ron Trunk
    Commented Aug 25, 2014 at 11:42
  • I wanna set a vlan for the switches management, all of them. I mean, I could access SSH JUST in that vlan (this being the only method of access). Commented Aug 25, 2014 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.