I work at a data center, we need to setup a completely separate OOB network, I know about OOB using access server/terminal server, I mean how to setup something like Cisco 2511 with SCSI-2 ports and octal cable, but what the heck do they mean OOB network? I mean am i supposed to create a whole new subnet and connect each and every router, switch, firewall, server... to that? I'm a bit lost, I read this doc on Cisco but can't get it right, please don't talk about configuration, just the positioning of devices, and the main concept of having an OOB management network/subnet, any kinda document in simple words will do good thank you
1
-
Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.– Ron Maupin ♦Commented Aug 10, 2017 at 15:31
Add a comment
|
2 Answers
I mean am i supposed to create a whole new subnet and connect each and every router, switch, firewall, server... to that?
Basically, yes.
The OOB network is whatever you need to recover the network without relying on the network (Out Of Band). The form it takes will depend on the devices you could need to access out of band.
In many cases having remote access to a terminal server attached to console ports is sufficient for recovering from configuration mistakes but that's limited to devices with CLI and doesn't really help with recovering erased firmware, etc.
What I've done is take a router with dual-WAN and use my network for one WAN and the other WAN to a separate provider. Then I set up VPN access to the router. Then plug in every management port, server management card, console server, IP KVM, etc into the LAN side of the router. The idea being you VPN into the OOB router and have access to all devices that you'd need to fix to restore the network.
-
What u said about connecting all your devices to the router, is almost impossible for me, because we have 10 floor,and almost 300 active node like routers, sw, fw, servers, connecting all of these stuff even using just one port and one cable is impossible for me– user7741Commented Nov 25, 2014 at 7:32
-
1@user7741 Why so? You have structured wiring in place that links all these things already, I presume. You just need some space for switches for the OOB network; they don't have be fancy ones. Basic 100Mb/s ones will do for most purposes.– richardbCommented Nov 25, 2014 at 13:38
-
yes we have structured wiring, the thing is how far/ how deep this OOB network should be extended to? I mean how about Aps or Access switches do I need them connected to this OOB network or what?– user7741Commented Nov 25, 2014 at 13:41
-
Really it depends on your risk tolerance/SLAs/staffing. I have a 45-minute drive from my home and office to datacenter assuming light traffic and no on-site/remote-hands staff. My servers have iLO/DRAC cards with a dedicated ethernet port. Those get connected to the OOB network via old/cheap switches in the rack (Cisco 3550-48 or similar). Patching all that back to a central point would be nuts. On the other hand my Juniper ToR switches have a ethernet port and console port and those are patched back to a OOB switch. I can't say I've ever seen a AP with out-of-band management.– jdaCommented Nov 25, 2014 at 21:14
-
A lot of people just do OOB for their border/core and maybe dist layers and ignore access.– jdaCommented Nov 25, 2014 at 21:18
Im not sure this is exactly what you're after but where I work we have a physically separate color coded network for management which is connected to every machine in the network. The layout is pretty parallell to our "regular" network, just slower bandwidth. The problem with switches is that many of them don't have a dedicated management port but you can always dedicate e.g. port 1 on every switch for management. Servers is easy because they all have a mgt-port so we just have a second network in parallell.
