With one switch, management is an address you remember. With thirty devices across six locations it is a network with a plan. The management VLAN is the network you sit on when something has to be repaired, and therefore the last network that is allowed to break.
The plan
One number, the same everywhere, preferably high and fixed. 99 is a good habit: it never changes again, whatever else arrives. Mark that row in the site's VLAN table with the Mgmt tick.
The address differs per location, because every location on the network board has its own address range. The third and fourth numbers stay put, the first two are replaced.
| Location | Management VLAN 99 | Router | Switches and APs | Free for fixed |
|---|---|---|---|---|
| Head office | 10.10.99.0/24 | 10.10.99.1 | 10.10.99.2 and up | through .9 |
| Branch Zwolle | 10.21.99.0/24 | 10.21.99.1 | 10.21.99.2 and up | through .9 |
| Branch Breda | 10.22.99.0/24 | 10.22.99.1 | 10.22.99.2 and up | through .9 |
Do not use a /30 for a management network. Two usable addresses is enough for a point-to-point link, not for a switch, two access points and yourself with a laptop.
Which addresses the devices get
Only the router carries the layer-3 side of a VLAN: the address and the DHCP server. A switch or an access point gets the same VLAN table to tag with, but without an address and without DHCP, because two devices claiming the same gateway address is not a matter of taste but a broken network.
For the management address of those devices the tool does something of its own: it counts on from the router's address in the management VLAN, in the order the devices appear in the site. The first device after the router gets .2, the next .3, and so on. The address becomes static, DHCP goes off, and the gateway becomes the router address of that location.
Two things to know:
- The order is that of the whole site, not of the location. If a switch in Breda is sixth in the list, it gets .7 inside Breda's range. The addresses are unique and correct, but they do not run neatly per building.
- Inserting devices moves addresses. Add a switch in the middle of the list later and everything after it shifts along. If you want fixed, stable management addresses, fill them in per device under Management address. The check reports it straight away if two devices end up with the same one.
How you reach it
Inside a location it is simple: you are on the management VLAN, or your router routes to it from your own network. Across locations it works by itself, which is the nice part. The tool works out per tunnel which networks sit on the other side, and those are all the VLAN subnets of that location, management included. Those networks land in the configuration as a route and as an allowed-address. From the head office you can reach the switch in Breda directly.
If you want to be stricter, there are two controls:
- Router manageable only from the management VLAN, under Firewall. That restricts the input chain to that VLAN.
- Manage from, in the Management access section: the addresses or networks WinBox, SSH and the rest may come from. Put the management subnets of every location in there, or you lock yourself out from the head office.
Staying out of a lockout
Most lockouts happen at the moment VLAN filtering is switched on. There are three safety nets around that.
- The hard check. If VLAN filtering is switched on while no VLAN has an address and no port is untagged on the bridge, that is an error, not a warning. The result would be a router you can only reach with MAC WinBox or the reset button.
- The soft check. If no VLAN is marked as management, the tool says so, adding that MAC WinBox on the LAN keeps working.
- The emergency port. Under Bridge and ports you can keep one port out of the bridge, with a subnet of its own and DHCP on it if you want. When something goes wrong with the bridge or the VLAN table, every bridged port goes down at once and this one does not. The tool checks that its subnet overlaps nothing else, and refuses a WAN port or a bond member as the emergency port.
- The reachability check. A device that does not carry the management VLAN cannot be managed. That is an error in the site checks.
Beyond that: work from the outside in. Convert the devices at the end of the chain first and finish with the router you are talking through yourself. Use safe mode and keep the rollback script to hand; one is generated alongside every script.
What the checks catch besides that
- Two devices with the same address, across the whole site and not only within one device.
- Two devices with the same name. The identity has to be unique; with thirty devices this really happens.
- A VLAN that exists on one end of a cable and not on the other, so the management VLAN stops halfway.
- An address inside the DHCP range of its own network: the router may hand out the same one.
- No administrator password for the site. Without it a site is a set of unrelated devices.
Further reading: Management access, I cannot reach the router any more and Hardening.