management vlan on 3560X

I am configuring a brand new 3560X and according to the manual http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/hardware/quick/guide/3750xgsg.html#wp49930, I am in the Express setup and Cisco recommends that I use vlan 1 as the management vlan. I only have vlan 10 for data and vlan 110 for voice. Should I assign another vlan like 300 for the management vlan? Will it affect anything? Thx
biggynetAsked:
Who is Participating?
 
Ken BooneConnect With a Mentor Network ConsultantCommented:
I typically use a management vlan for all of my infrastructure switches as well.  Its interesting that they recommend using vlan 1 because in so many documents over the years, they have stressed not to use vlan 1.  There are legitimate reasons for staying away from vlan 1, but in any case, yes you can use another vlan like 300 for the management vlan.  It will not affect anything.
0
 
Ricardo MartínezConnect With a Mentor Information SecurityCommented:
The answer is a big yes, it's recommended to change the administration vlan to other than vlan 1 cause is the first vlan that some hackers will search for potential security holes, you can another one like the vlan 300 as you mention, it doesn't matter which you choose, this doesn't affect anything, just be sure to assign an ip address to that vlan before you loose the administration access in case you don't have physical access to the switch.
0
 
biggynetAuthor Commented:
Now let say I have my vlan 300 as my management vlan across my network which has 10 sites. Can I use one subnet for my management vlan for all of the site? Is it the best practice? Thanks
0
Improve Your Query Performance Tuning

In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!

 
Ricardo MartínezConnect With a Mentor Information SecurityCommented:
Yes, you can use one subnet for the management and another yes for the best practice. Why? cause this is the way you can manage all your devices in a secure mode. That vlan doesn't need to be routeable with other vlans for security reasons or in any case, you have to secure the access to it, providing access only to the network administrators.
0
 
Ken BooneConnect With a Mentor Network ConsultantCommented:
Well typically in that scenario there is a layer 3 backbone - so vlans won't span and IP address spaces won't span that.  In that case - I prefer to keep the vlans the same at every location.

i.e.  data vlan 10
       voice vlan 110
       mgmt  300

But each location has its own subnet  on those vlans.  
So site 1   data would be 10.1.10.0
     site 2 data would be 10.2.10.0
     site 3 data would be 10.3.10.0 etc..
0
 
biggynetAuthor Commented:
kenboonejr,

"But each location has its own subnet  on those vlans"
That is exactly that I was looking for. So if I understand correctly, all the sites can have the same vlans but different subnets. This will work because the connection facing the WAN will be layer 3. Thanks
0
 
Ken BooneNetwork ConsultantCommented:
That is correct.  What you are doing is building consistency at each location.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.