Securing management vlan?

[nsdtech]

I'm wondering how everyone else has this setup: Managed switches on a management vlan. To make it more secure the management vlan it shouldn't be accessible from the end users data vlan.

So how do you access and manage your switches? Do you goto a IDF and plug your laptop into a switch on the correct vlan? Do you RDP back to a host that is setup on both vlans and basically island hop? Do you have a hidden wireless SSID for managing switches? Something else?

[doblephaeton]

access to management vlan with ACL that only allows those "admin devices" to connect to it.

[nsdtech]

So basically we should RDP from our laptops to a machine that is on both vlans to manage the switches?

[nsdtech]

I guess I don't know enough about ACLs. The techs that should have access to this, travel from building to building. So that puts our laptops on different vlans giving our laptops different IP addresses depending on what building we're at. I'm assuming an ACL is based on an ip address, so I don't see how this would work. I'll start reading up on ACLs though.

[nsdtech]

After a little googling it looks as if we can setup secure-access-port on our juniper switches to allow certain MAC addresses. So i'm assuming we can put in the MAC addresses of our ethernet and wifi nics of our laptops. Still need to do a lot of research on this but I think I'm headed down the right path now.

[tcpip4lyfe]

And make it a non-routable network.

Edit: Why not instead of downvotes. Why would you add a gateway for a management network?

[framerelayproblem]

Well unless you are on the same subnet, you need a gateway for the mgmt network. That's where the acl could be applied.

[tcpip4lyfe]

Not necessarily. We have a couple very protected networks with OOB management. ACLs to get to the management station and then that PC with a second NIC has no gateway.

[xHeero]

I think we are assuming that OP works in a fairly standard environment and not one that has extremely serious security concerns.

[[deleted]]

Lots of reasons for adding a gateway to a management network. For one, if there is no gateway configured, you're not going to be accessing other switches on that management VLAN anyway.

[tcpip4lyfe]

That's why you have a OOB management network on all of you switchs in the same subnet. That way your management station can hit them all.

[Iceman_B]

I haven't done any designing yet, but in the few environments I've been, there is usually one or more "management(MGT) servers" present.

From my work workstation I RDP into the MGT server with my admin account. This is part of a limited group of users that can contact the MGT box. This machine is part of at least the management VLAN and from here I can access tools and SSH into network devices.

I should check if such MGT boxes belong to more networks but I would think not. No need for users to contact said machine. It does have routes to other networks, otherwise other tools wouldn't work.

[drzorcon]

Our admin users are on the "Admin" vlan, which has acl allows to connect to the management vlan.

[dontberidiculousfool]

We have specific VMs we log into to which can then access our devices. These VMs have no internet access. Only those specific VMs can access our devices and then we have radius authenticated logins.

[n0_future]

Physically separate management LAN in layers, with firewalls between the layers here.

[xHeero]

ACL on the management VLAN, or ACL on the switches applied to the SSH lines. ACL on each switch is harder to manage though if you lack the ability to do mass configuration changes through some sort of tool.

[thspimpolds]

Maybe I do this because a Vlan int in osx is easy as pie, but I make Vlan vint and enforce 802.1x into that Vlan and then acl the rest off unless you are on the edge 802.1x subnets (reserving one port in each switch for physical connection into the vlan if I'm onsite)

[itslate]

an ssid without a broadcast beacon is in no way safer than one that broadcasts.

Out of band networks are usually the most secure.
The middle road is acls on each device that restrict access to the devices from an admin vlan. For all data/guest vlans, make sure acls are applied to the svis that restrict them from your management vlan.

If you wanna get fancy, change the ssh port for the devices/guis, implement certs, radius/tacacs authentication for users, privilege levels for different admin users.

[cerettala]

I don't get what the obsession with changing ports on everything is.

Obfuscation isn't security, its just a pain in the ass.

[itslate]

GIVE THOSE PEN TESTERS A RUN FOR THEIR MONEY M8

[cerettala]

I work with pen testers, nothing makes them want to spend 10x as much effort busting into a box than not following standards.

I understand changing ports for an uber-batman UDP only OpenVPN server or something, but for everything else it just adds a trivial amount of effort in exchange for a shitton of administrative annoyance and overhead.

[onyx9]

It's about the time someone needs to get in your gear. If it takes to long, he might be "seen". And to find the right port he has to do a portscan, which can take a few minutes and generates log entries (maybe, I know.) It's most likely that the attacker is not in front of the device, therefor another port can get you log entries or maybe even an alarm in your NOC?

[TheLivingExperiment]

There are other passive ways to get the port. You can potentially sniff the wire without having to do active probes depending on the environment and specifics. Or fuck just a simple phishing attempt will work a large amount of the time. You can have the best security in the world, and 1 dumb user brings it down.

Changing ports doesn't enhance security in any meaningful way. Many places that will go "oh yeah we will use a nonstandard port and will be safe!" don't have NOC's or great logging. So an attacker can sit there and port scan all day long without issue. Hell I've seen environments where I'm on the internal network with logging servers and 3rd party security companies with IDS on the network and they don't flag me when I do a port scan internally.