What are the downfalls of deploying in OOBM network?

Question

Good morning everyone!

I have been tasked with installing and configuring an NPM/NTA in an OOBM network on HP switches. The customer wants visibility of network traffic and detailed information about what endpoints are utilizing the most bandwidth. My concern with installing in an OOBM environment is that I will not be able to pass policies or install agents on systems and have them communicate with the Orion server if it is sitting in a management network.

Does anyone have experience with this type of configuration? I feel this won't work, but don't know where to begin with explaining why it won't work to the customer.

Any help is greatly appreciated.

Robert B.

sja · Answer

Hi robert.biehl​

I think there is problems with OOB...

In case of production nodes are connected to the OOB network ,and If you manage / monitor those nodes from the OOB..

You should expect false reachablety alerts from the production when something is wrong with the OOB..

That is not a big deal for network with 5 OOB nodes in the same state..could be a problem if you are global...

That means that the OOB should have redundancy power and uplinks...

d09h · Answer

https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/SAFE_RG/SAFE_rg/chap9.html

https://www.sans.org/reading-room/whitepapers/networkdevs/securing-out-of-band-device-management-906

For the SANS link, see the section "Definitions for vulnerabilities and risks of out-of-band access".

https://cyber.dhs.gov/assets/report/ar-16-20173.pdf

See pages 4-8 in particular.  These aren't downfalls.  They are reasons you should use out of band management.

Top 10 Basic Network Security Practices