How useful is a Management VLAN if all clients are out of the default/native LAN?
After a failed attempt at moving all devices into a Management VLAN (a while back), I was up for giving it another try.
I reread some of the docs, browsed the forums about this matter.
Beyond the effort that it will take now, I'm a bit worried going forward about some of the things I just found out (in particular difficulties adopting new devices).
It's actually a bit nuts that having an ER605 (that needs a special step to be told where the controller is) makes things more difficult than having a 3rd party router...
So I did a quick cost/benefit analysis and I'm now wondering if I should bother with that VLAN.
The main (if not only) benefit of the management VLAN seems to be proper isolation from random clients on the network.
But I have no clients in the native network because they are all in a few VLANs.
I did a quick test in a test VLAN (couple switch ACLs to allow members of the VLAN to access the VLAN's GW, one switch rule to deny access to the native VLAN).
I have at least DHCP, Internet DNS, Web.
I also tested SSH into the test VLAN (it took one more rule if the client is in LAN).
Am I missing something?
[Edit] FWIW, as an added benefit, having all Omada devices in the native VLAN makes things effectively simpler.
I should have no issues onboarding new devices. I don't have to worry as much about GW<->Controller discovery/comms.
Hi again @Hank21,
Maybe I'm going to summarize this differently. It doesn't look like I got my point across.
Typical Management VLAN:
Once setup, the gateway stays in the native VLAN, all other Omada devices end up in the management VLAN, other clients are either in the native VLAN or other VLANs (but not management, obviously).
Alternative VLAN proposal for similar isolation:
All Omada devices stay with the gateway in the native VLAN, all other cliens are in other VLANs. No wireless in the native VLAN.
In both cases, I assume the existence of ACLs to truly isolate the VLAN where most of the Omada devices reside from other VLANs.
Obviously, the wireless clients are following the same boundaries.
Excerpt from the documentation:
It seems both options achieve that goal.
It's not immediately clear to me why option #2 would be inferior to option #1.
I'd argue that option #2 makes adoption of future devices easier, so if they are equivalent security wise, my choice is clear.
The Management VLAN FAQ (2814), besides being obsolete (batch config no longer allows VLAN config in my experience), doesn't mention anything around port tagging/untagging which could be another area where options could differ. Maybe...
So again, am I missing something?
