Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Most new servers come with net-management port. How you use this feature in four company? How you control access to net-management network segment, do you use it for monitoring, disaster recovery and how net-management network is incorporated in all company network topology?

I am most interested in connection topology and access control of such network.

share|improve this question
add comment

5 Answers

up vote 1 down vote accepted

Consider an isolated VLAN with a heavily restricted bastion host facilitating access.

Access to the devices not only requires knowledge of and access to the bastion host, but also access to the lights-out management device, most of which can be configured to have a separate authentication scheme.

You can further restrict access by applying ACL's to restrict access to the bastion host so that connections can only come from authorised management stations.

share|improve this answer
add comment

We have 'iLO' access on all our HP servers/blades and this is a very powerful interface (it lets you have access to the power-on/off state, hardware setup, attach ISOs and screen/keyboard in an RDP/VNC fashion). We're very strict about using it, we disable the default account, create new accounts with specific privileges and rotate the passwords often. This is particularly important in a blade environment where one rogue user could 'kill' up to 160 servers with just the OA password.

We'd rather limit our normal tech guys to individual server admin access/roles and save the 'iLO' access for getting us out of the brown-stuff (for which it's invaluable)

share|improve this answer
    
Does it has public IP adresses? Is it reachable only from work places? Do you have IP based access lists or some kind of VPN connection to those iLO connections? –  Kazimieras Aliulis May 4 '09 at 15:53
    
It's only used on an internal network and then only from a specific subnet that's dedicated to tech-team specific ports/desks, we have cameras into and out of that floor so nobody could sneak in undetected just to use that network. –  Chopper3 May 4 '09 at 16:10
add comment

One of the useful features of many management cards is the ability to access the console. This helps in troubleshooting remote machines that will not boot into the OS (and so load remote access services). This has saved many trips to a DC when the server has rebooted and is wanting a key press to acknowledge an issue!

Aside from this, one of the key uses is the ability to use the management interface to obtain server health remotely, and pipe this into management software. This is vital to business's with many server where checking all these servers individually would be a nightmare.

share|improve this answer
add comment

If you have lots of servers/networking gear with this feature I would look into purchasing a serial server. It makes it really easy to manage your servers remotely.

share|improve this answer
    
Most of new servers comes with ethernet net-management port which is more flexible than console. –  Kazimieras Aliulis May 4 '09 at 15:45
    
@softly.lt and most switches, routers, firewalls etc don't have ethernet out-of-band management. There is still a place for the TAS (Terminal Access Server) in an enterprise network. +1 to answer. –  Daniel Lawson Jun 29 '09 at 5:10
add comment

We have a 'out-of-band' management network for our iLOs. Access to it is firewalled, and only the engineers get to go on it. It's extremely useful for troubleshooting, and also for server deployments.

share|improve this answer
    
I now its useful. I want to know how to firewall it the best. –  Kazimieras Aliulis May 12 '09 at 13:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.