1) I agree it's better to move the management to another VLAN from the security point of view. I noticed big trouble in a case of broadcast storm in VLAN1, e.g.
2) I think you should also change the default gateway on your switch if you want to access the management interface from another VLAN (your management station can be in behind a router, e.g.), you can use IP permit list or ACL on the router to restrict the access to the management VLAN.
3) There are also some troubles brought by moving management interface to another VLAN than VLAN1.
Could anybody tell me how to use L2trace command in that case, .e.g.?
Or any other effective way how to find a port to which a particular device (I know it's IP address only) is connected?
Another doubt to clear before proceding: Management traffic (CDP, STP BPDUs, DTP, etc) is still transported over VLAN 1 even if I use another one as Mgmt VLAN, or is it automatically changed..? I think it actually remains in VLAN1 since it cannot be removed..am I certain..??.
My approach is to use VLAN1 as mgmt vlan by default. This is more fool-proof as it cannot be deleted or so. This advantage outweighs the potential security hazard of new ports being in the mgmt vlan by default.
In general the network admin (probably you) will configure the correct (not vlan 1) vlan for user ports. Disabling auto-trunking mode on acces ports helps to reduce the risk even further.
This document gives several answers on frequently asked questions for PFRv3 channel state behavior.
Q1: What are all the channel operational states from a BR (border role) perspective and what are the rules/conditions to be in each st...
The need was to reach an host inside a LAN through a VPN connection managed by the LAN gateway (Cisco 1921).
The LAN gateway performs NAT and there was a dedicate nat rule for the host i wanted to reach through VPN.
I couldn't connect to the hos...
We have 3 identical switches configured by someone else and would like to claim some of the Gigabit ports(G1/G2/G3/G4) for use on servers. When we try to change the wiring and configuration, we run in to connectivity issues. Attached is a des...