Hardening

Regarding this:

 

 

"it’s recommend that the management port is not used, access being gained only through the switch ports and the serial console. "

 

 

The reason some people suggest this is that you cannot restrict access to ports on the management interface. However, there should be a firewall between hosts on the management subnet and any untrusted network or hosts. So I don't think this is a valid recommendation. And the major advantage of having the management interface available for admin access is that it will still work if TMM doesn't start. The switch ports will not work if TMM does not start--like if the config doesn't load or the license is invalid.

 

 

So I always recommend having the management port available and protected by an external firewall.

 

 

Aaron