Peer administration on other port then MGMT

Question

We have XGS4500 active-passive cluster and i stubled across a pretty annoying issue. 
 In the past (with XG450 and others) we always set the peer administration address to something that allowed us no monitor the auxilary device via our monitoring solution. Usually that was just an IP higher then the primary device. On the same interface and on the same subnet as the primary management IP. 
 On XGS4500 this does not seem to work anymore. The only interface that i am able to select in peer administration settings is "PortMGMT". We do not use PortMGMT as we manage our devices through the primary interfaces/VLANs. However, if i set peer administration to PortMGMT and use an IP from a subnet that is accessible as well through the primary interfaces, the routing collapse, as it seems to prefer routing through physically connected interfaces (even its PortMGMT) instead of the static routes set. 
 This is a complete mess in my opinion! 
 - Why can't i select other ports then PortMGMT anymore for peer administration? 
 - Why does PortMGMT participates in routing? If it is meant to act as out-of-band MGMT, then it definately should not have any impact on routing!

sanket.shah · Accepted Answer

Yes, you have to use different subnet for MGMT port and other data ports. MGMT port is routable interface as I mentioned above. 
 Why is it called PortMGMT? - Because it's connected to host CPU (control/config plane) and not to network processor (NPU/data plane). Its main purpose is to manage the appliance via CLI/GUI.

sanket.shah · Answer

Hello FloRa , 
 Reg. your comments, please find my inputs. 
 - I can't select any other interface then PortMGMT as peer administration. Probably because we only habe VLAN interfaces?? If this is the case, then please document it! 
 That could be the case in your setup. Only physical, bridge and LAG type of ports are supported for peer administration. If you have any spare data port which can be configured for peer administration, it would be advisable. Otherwise as an admin, PortMGMT seems appropriate to me. I will check with documentation team internally and see if it can be included. 
 - PortMGMT is participating in routing, which should not be the case for a out-of-band management port. This is a design failure from sophos in my opinion. 
 I would say it's flexibility given to customer whether they want to use management port for routing traffic to Internet or internal networks based on the setup. Imagine, admin is only accessing PortMGMT and also accessing Internet (WAN port Port2, for example) via that port. In general, I agree that end users might be connected via LAN/DMZ data ports other than PortMGMT.

Peer administration on other port then MGMT

Top Replies