Hardening the management interface
It is paramount that the management interface is kept secure and access is limited to only those administrators that need access. It is recommended to place the physical management interface in an Out-of-Band (oob) network, which limits exposure to the broader network. If access is needed to the management server from a different network, it is best to set up a dual-homes bastion host that mediates the connection, either through only allowing admins to log into it and use services from there, or having it set as a (transparent) proxy with a log of all sessions and limiting the source users and IP subnets as much as possible.
Limiting access via an access List
The management interface local access list can be edited by navigating to Device | Setup | Interfaces and clicking on the Management Interface:
Figure 2.25 – Management interface access list
The associated CLI configure mode command is as follows:
admin...
