I have a modestly smart Cisco SG200 switch connected to our institute's Ethernet network. To this switch, I connected four Linux and Windows computers. (So, the configuration is: one network connection to the switch from the institutional net, and four network connections to the four machines.) The computers also have separate management interfaces. (Dell iDRAC's.) Ideally, if it were possible, I would add network connections from the computers' management interfaces to the switch (i.e., four more separate network connections), then put those connections on their own VLAN, and make that secure such that only authorized access from outside of the switch can reach the VLAN or the management interfaces. In other words, I'd like the little management network to be secure and inaccessible except to me (somehow).

How does one set up a network configuration like this, allowing only authorized (somehow) access to a VLAN from outside of the switch? For instance, if I'm working remotely, is there any way to reach the management interfaces on those computers, sitting as they are on their own VLAN on the "other side" of the switch from the institutional network? If it is not possible given the current hardware, what additional hardware would I need? Or, is there a better approach to achieving this?

This must be a basic question about VLANs and networking, but searching for an answer has stumped me, possibly because I don't know the right terminology for what I'm looking for. Another ServerFault question asked something very similar, but the key piece missing from that question and the answers is how to access the management interfaces from outside the switch. I'm not a networking expert (obviously), but can work through this if pointed in the right direction.

  • 2
    This isn't a Layer 3 switch (the 300 series is). Without replacing the switch, you need an upstream router to handle the routing (and firewalling) for you. – Michael Hampton Jan 27 '16 at 1:59
  • Thank you for your comment. Would it be possible to add a separate device (router?), connect one side to the institutional net and the other side to the management interfaces on the computers? – mhucka Jan 27 '16 at 2:00
  • You just need to set a port on the switch as a trunk port, and plug that into the router. The router can then be set up to route between all of your VLANs, the rest of campus, or the Internet. – Michael Hampton Jan 27 '16 at 2:03
  • Brilliant. Thank you. Your comments answer my question, really -- would you like to post it as an answer? I'll upvote it and accept it. – mhucka Jan 27 '16 at 2:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.