Management Network

I wanted to open this thread to discuss the benifits to having a "Management network". I have heard this term used loosely and in regards to several different elements almost like a catch all buzz word........When I try to find a way to define it I can not. When I try to justify the existance of a seperate network that handles administrative traffic I can not get my mind around it.
Is there anyone who has this implemented and can illustrate its usefullness for me?

Thanks all....There really is an awesome brain trust here.

Hmm...I'm not sure I follow you...Could you elaborate perhaps?

From what I gather so far, you're referring to a network set aside from the main corporate network to be used by management only? If that's the question, then consider:

1) Speed. A seperate LAN or subnetwork dedicated to management would be free of traffic from other departments/staff. Since managers of all types rely on speed for their work, this is no doubt advantageous. If the corporation is large enough, it may need a dedicated network for managment traffic only.

2) Security. A seperate LAN/subnetwork for management would also be more secure than including its traffic with the rest of corporate traffic. It would further ensure that unauthorized staff could not gain access to sensitive data on the management-level network, by accident or by more sinister means.

3) Organization. This relates relates to both points (1) and (2). In a large corporation with many departments and subdivions as well as multiple layers of management, having seperated networks and subnetworks can aid with the overall organization and necessary separation of different kinds of corporate data. It's like roads within your state -- each city has it's own unique road system catered to its specific local traffic level and needs, rather than one mess of roads designed with no more detail in mind than the entire state's needs.

I hope that's the down the lines of what you're shooting for, forgive me if I'm going in the wrong direction...

Angelic did a good job with a the question on how it was given (nice work Angelic) however I have only heard Management Network in another way. I have heard management network as a network of people, computers, paper, articles, picture etc. all organized by a main control point and hence you have a management network.

I am sorry if this is completely different from what you are trying to get at but that is my take on the subject.

To have a network specifically set aside for management does seem slightly wastful. However if that network will increase productivity beyond the amount paid for it then it is worth it. I am not sure how much more will get done or how much more secure the management network described above would be.

- MilitantEidolon

Well, what you're describing is what a true MIS is (Managment Information System -- what I have a degree in :D). In a huge corporation, you may very well have a network for every level, starting with a TIS (Transaction IS -- if memory serves correct -- been a while since I was in the class that discussed that) on up through the ranks to MIS. Let's see...trying to churn around my head for stuff I need to remember from my classes...on the executive level, you may even have what I think is called a DSS (Decision Support System)...bear with me, it's been a while since I had to remember this for a test. ;)

Anyway, I think this kind of stuff is definately geared towards the big corporations though -- the ones with thousands of staff to organize and communicate with. So your MIS (or management network) would be for only your uber 1337 people. :)

Knight-- "IT" in my case is on a separate subnet and is isolated from the other elements of the business and yet is part of one VLAN. When mitigating security risks for 'SNMP vulnerabilities' one of the documented mitigating factors is to create a "management network". Another example is when setting up an IDS system with centralized logging, recommendations includes making the centralized log server a part of the "management network".
This may be a matter of semantics. This is what I am trying to figure out :-). Your explanation makes sense and it is the path I am going down, but I want to make sure there are others that are defining this the same as I am interpreting it. If this is not the case then I need to be educated.

Ok, well "management network" is indeed a fuzzy term with lots of room for leeway, so it could mean any number of things. Now if you ever hear "MIS", it's either a managers-only network or an accounting network (going by academic textbook definitions, anyway).

So let me see if I'm following you a little better now -- The network in question here sounds like it's for the IT staff only, and in existance for the sole purpose of manageing security (IDS, log watching, etc.). Sort of like one network policing the others perhaps?

Hosting providers, for example in colo situations, often have such "management" networks.

The advantages are:

- Bandwidth contention - "management" traffic does not interfere with "front door" traffic for things like web and email.
- Bandwidth charging - if the provider is charging for bandwidth, you won't want to get charged for the provider's own systems monitoring your kit, right?
- Security - some protocols might be enabled on the management network that aren't on the public network (although of course a firewall could distinguish them anyway)

These management networks are typically used for monitoring, backups, and other systems management purposes either by the customer or the provider (in the case of managed systems).

In the case of networked backups, it's quite useful to have separate network hardware for backups, because they tend to create a large amount of traffic which can "max out" the network interfaces delaying other traffic.

Under some circumstances there might be a different route into such a management network, for instance dial-up (although these days a VPN is more likely)

Slarty

I am still trying to understand what you are getting at. Are talking about putting your IT staff on a separate network just so they can manage it the IT functions of the business?


[edit] I see I am not the only one wondering [/edit]

- MilitantEidolon

What Slarty said...
(I'd have greened Slarty's post to give value but I'm maxed out on Slarty ;) )


Ammo

Ok, here is a good example of bad security. Telnet is being used by the network admins to connect to the routers on the network (Please hold the boo's til the end). Having over 100 devices to change over to ssh and implement an authenication method will take a significant amount of time to coordinate with networking.....Y, because they are resisting the change........
Anyway, from the sounds of some things I was reading there was a "silver bullet" that I could put in place to limit the netwrork traffic and mitigate the risk of some of this clear text traffic IT is creating (a management network).
It could help with management of the SNMP traffic and IDS logging.
From the sounds of the folks in the thread, this silver bullet is a flight of fantasy.....not reality. In trying to look at all my options I was hoping to use the management network as a layer to protect the IT department from Telnet and SNMP traffic being grabbed, but I now see so many things wrong with this theory.
I think in this case the confusion I have caused is because a management network just does not do what I thought it would. I appreciate the input and your sharing my state of confusion.

Quote:

---

Telnet is being used by the network admins to connect to the routers on the network (Please hold the boo's til the end). Having over 100 devices to change over to ssh and implement an authenication method will take a significant amount of time to coordinate with networking.....Y, because they are resisting the change........

---

Ok, now you have me confused.... Who runs the network, networking or the network admins? Why are networking resisting a simple change in access application, which is all it really is?

Then again, how often are we making changes to routers? Surely it's not something someone is doing daily and if it is why isn't the architecture organized in such a way as to minimize the exposure of clear text transmissions?

I dunno.... A gazillion questions here.... not sure what direction to go..... :o

Sorry Tiger...Let me clarify
Networking = Network admins
The change to ssh from Telnet is still a change and these guys operate under the "if it ain't broke leave it alone" principle. There are a couple of devices that will need to have upgrades (firmware, or the device itselfwill need replaced). In my mind it is a simple and necessary change, however, it is the red tape and proving my point that is taking time. And the prying of fingers off of purse strings.
Our Routers are not often accessed and the amount of traffic is limited, however, I am still going to push for more secure transmissions. LOL, At the top of the list of gazzilion questions is....Why do I even bother trying to convince them this is a good thing......

Quote:

---

Why do I even bother trying to convince them this is a good thing......

---

Let me just say -- I FEEL YOUR PAIN! I'm in the exact same position here...

Uno:

Ok, the fog is clearing.... ;)

In many ways I'm all for the "if it ain't broke...." routine.... I really hate breaking stuff that works perfectly well only to find that the "rollback" isn't _exactly_ as advertised.... <LOL>

In these situations I have a tendency to fall back on my "personal risk assessment" strategy. It's a little different insofar as it takes in the other parameter.... That of the politics of having to deal with morons..... The thought process goes kinda like this, (it's my 12 step program ;)):-

Step 1. From a security standpoint I "think" this is a good idea.
Step 2. Who will bitch, moan and complain.
Step 3. Do I care.... If "No" go to step 10
Step 4. What is the actual level of risk, ie: what is the likelihood of something bad happening.
Step 5. If step 4 tends to zero, forget it if step 3 is "Yes"
Step 6. If step 4 tends to infinity then if step 3 is "Yes" what can I actually do to convince them it's "a good thing".
Step 7. If step 6 indicates "nothing" then what can I do to monitor and mitigate the issues.
Step 8. If step 7 indicates "nothing" then tell them the software costs too much to do it any other way.
Step 9. If step 8 doesn't convince them make up a scenario that is utterly outrageous .
Step 10. Implement it anyway and tell them that you have a "network problem"
Step 11. Use your superior technical knowledge, (and ability to bullshit), to head them off at every pass until they get used to the "limitations" in your system.....
Step 12. When they are _really_ frustrated tell them you found a "work-around"....
Step 12 1/2. Sit back, pop a tinnie and put another "victory" on your departments standard.... ;)

It works for me.... <LOL>

Tiger....Sounds like words of wisdom to me.....I think I will hang them in my office on Monday. Thanks to all the insight from everyone.