Most new servers come with net-management port. How you use this feature in four company? How you control access to net-management network segment, do you use it for monitoring, disaster recovery and how net-management network is incorporated in all company network topology?
I am most interested in connection topology and access control of such network.
Consider an isolated VLAN with a heavily restricted bastion host facilitating access.
Access to the devices not only requires knowledge of and access to the bastion host, but also access to the lights-out management device, most of which can be configured to have a separate authentication scheme.
You can further restrict access by applying ACL's to restrict access to the bastion host so that connections can only come from authorised management stations.
We have 'iLO' access on all our HP servers/blades and this is a very powerful interface (it lets you have access to the power-on/off state, hardware setup, attach ISOs and screen/keyboard in an RDP/VNC fashion). We're very strict about using it, we disable the default account, create new accounts with specific privileges and rotate the passwords often. This is particularly important in a blade environment where one rogue user could 'kill' up to 160 servers with just the OA password.
We'd rather limit our normal tech guys to individual server admin access/roles and save the 'iLO' access for getting us out of the brown-stuff (for which it's invaluable)
One of the useful features of many management cards is the ability to access the console. This helps in troubleshooting remote machines that will not boot into the OS (and so load remote access services). This has saved many trips to a DC when the server has rebooted and is wanting a key press to acknowledge an issue!
Aside from this, one of the key uses is the ability to use the management interface to obtain server health remotely, and pipe this into management software. This is vital to business's with many server where checking all these servers individually would be a nightmare.
If you have lots of servers/networking gear with this feature I would look into purchasing a serial server. It makes it really easy to manage your servers remotely.
We have a 'out-of-band' management network for our iLOs. Access to it is firewalled, and only the engineers get to go on it. It's extremely useful for troubleshooting, and also for server deployments.
