Content

| 9.5 |  | Securing Remote Management |
| 9.5.5 |  | Using VLANs to restrict remote management |

Virtual LANs can be used to control who can establish in-band communications with the switch. The switch will use VLAN 1 as the management VLAN unless it is explicitly configured to be on another VLAN. The management VLAN on a switch is the only VLAN from which in-band management sessions can be established. When shipped from the factory, all ports on the switch are configured as members of VLAN1. At factory default settings, the switch will accept management traffic from any port.

Network administrators should separate management traffic and user traffic. The recommended practice for managing network devices (router and switches) is to establish separate logical networks for user traffic and management traffic using multiple VLANs and subnets. The management VLAN should not carry any user traffic. It is also important that the management VLAN be included in the list of VLANs propagated by the VLAN Trunking Protocol (VTP) processes. Separating management and user traffic helps protect the network infrastructure against attacks from users of the network.

Note that in a multilayer switched network, a switch does not need to have a port that is a member of the management VLAN in order to accept traffic from the management VLAN. Because a trunk port is normally passing traffic for all VLANs, the switch will accept management traffic over a trunked connection.