0

Say I have some network equipment with management interfaces on a VLAN X. Now say I also have servers with double interfaces: one for production and one for management.

Is it considered a good or bad practice to put all of these in one single management VLAN or should I keep network equipment and servers in separate VLANs?

  • Unfortunately, question that solicit primarily opinion-based answers, and those that are too broad (lacking detailed information) mare off-topic here. This is the type of question you should ask in Network Engineering Chat, and you have enough reputation for that. – Ron Maupin Oct 3 '18 at 14:28
1

This is not a question we can answer for you. You may get lots of opinions (which are off-topic here), but ultimately, you need to base your decision on your organization's security policies and practices.

Remember, the benefit of having separate VLANs is so you can apply policies (access lists) to restrict which traffic is allowed on the VLAN. You should consider:

  1. Are you restricting traffic on the management VLAN with access lists?
  2. Are the servers managed by different administrators?
  3. Does your security policy prevent them for accessing network equipment?

If the answer to all these questions are Yes, then it may make sense to have a separate VLAN. Otherwise, there's not much point.

| improve this answer | |
1

It all depends.

If your organisation is big enough to have separate networking and server management teams, you might want separate, especially if that's enforced for any security concerns. If it's small enough that the people who look after routers are the same as those who look after servers, there's a bit less to be gained.

It is good to be able to contact your networking infrastructure if your servers have gone rogue, so if the marginal complexity of adding it is small, you might find it worthwhile. All depends on how big your network is and how good your general management infrastructure is.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.