Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Most new servers come with net-management port. How you use this feature in four company? How you control access to net-management network segment, do you use it for monitoring, disaster recovery and how net-management network is incorporated in all company network topology?

I am most interested in connection topology and access control of such network.


locked by HopelessN00b Mar 16 '15 at 0:45

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as too broad by HopelessN00b Mar 16 '15 at 0:44

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 1 down vote accepted

Consider an isolated VLAN with a heavily restricted bastion host facilitating access.

Access to the devices not only requires knowledge of and access to the bastion host, but also access to the lights-out management device, most of which can be configured to have a separate authentication scheme.

You can further restrict access by applying ACL's to restrict access to the bastion host so that connections can only come from authorised management stations.


We have 'iLO' access on all our HP servers/blades and this is a very powerful interface (it lets you have access to the power-on/off state, hardware setup, attach ISOs and screen/keyboard in an RDP/VNC fashion). We're very strict about using it, we disable the default account, create new accounts with specific privileges and rotate the passwords often. This is particularly important in a blade environment where one rogue user could 'kill' up to 160 servers with just the OA password.

We'd rather limit our normal tech guys to individual server admin access/roles and save the 'iLO' access for getting us out of the brown-stuff (for which it's invaluable)

Does it has public IP adresses? Is it reachable only from work places? Do you have IP based access lists or some kind of VPN connection to those iLO connections? – Kazimieras Aliulis May 4 '09 at 15:53
It's only used on an internal network and then only from a specific subnet that's dedicated to tech-team specific ports/desks, we have cameras into and out of that floor so nobody could sneak in undetected just to use that network. – Chopper3 May 4 '09 at 16:10

One of the useful features of many management cards is the ability to access the console. This helps in troubleshooting remote machines that will not boot into the OS (and so load remote access services). This has saved many trips to a DC when the server has rebooted and is wanting a key press to acknowledge an issue!

Aside from this, one of the key uses is the ability to use the management interface to obtain server health remotely, and pipe this into management software. This is vital to business's with many server where checking all these servers individually would be a nightmare.


If you have lots of servers/networking gear with this feature I would look into purchasing a serial server. It makes it really easy to manage your servers remotely.

Most of new servers comes with ethernet net-management port which is more flexible than console. – Kazimieras Aliulis May 4 '09 at 15:45 and most switches, routers, firewalls etc don't have ethernet out-of-band management. There is still a place for the TAS (Terminal Access Server) in an enterprise network. +1 to answer. – Daniel Lawson Jun 29 '09 at 5:10

We have a 'out-of-band' management network for our iLOs. Access to it is firewalled, and only the engineers get to go on it. It's extremely useful for troubleshooting, and also for server deployments.

I now its useful. I want to know how to firewall it the best. – Kazimieras Aliulis May 12 '09 at 13:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.