Manageable Mosaic switch Installation and User Guide
Page 60 of 87
5.1.5
Management Access (Secure NMS) Path
The in-band management path can be secured by limiting the remote access through either user ports,
backbone ports or all ports.
By default, the NMS path is not secured, allowing access from all ports.
To change the Secure NMS Path:
1. From the
Embedded web interface
main screen, click
Management
and expand the
Secure NMS Path
tab
2. Select the required option from the
Path
list. The following options are available
•
User Ports Only
– access is allowed only through the user ports (ports 1-4).
•
Backbone Port(s) Only
– access is allowed only through the backbone ports (uplink
ports 1-2).
•
All Ports
– Secure NMS Path option is disabled and access is allowed through all
ports.
NOTE:
MGMT VLAN
filtering overrules NMS access path.
Figure 5-3 Changing the Secured NMS Path
3. Click
Apply
.
5.1.6
Securing Management Access via VLAN
Securing management access via VLAN is used to isolate and secure management traffic and avoid
management flooding by irrelevant traffic.
The manageable Mosaic switch enables assigning a dedicated VLAN to the internal management port.
Only frames belonging to that specific VLAN, received from ports belonging to the same VLAN
membership group, can communicate with the management agent.
This type of VLAN configuration provides an additional level of security to the management access.
Assuming the switch operates in 802.1Q VLAN (i.e. the "802.1Q VLAN filtering enable" is checked
(selected), and the "VLAN filtering" is checked (selected) on all the ports) management access will only
be available for the following frames:
•
VLAN frames, with VID=4095, arriving from the uplink port.
•
Non-VLAN frames arriving from the uplink port (only if the default VID of the uplink port
is also configured to 4095).
If the frame arrives without a VLAN, and the VLAN filtering of this port is selected, the filtering is
according to the configured default VID of the port (4095 in our example)
Any other frame, whether VLAN (with other VID number) or non-VLAN arriving on ports other than the
uplink port, will be filtered, and will not be forwarded to the management agent.
Response frames, transmitted from the internal management agent to the remote manager, are VLAN
frames with VID=4095.
SUMMARY