Emergency access via the very same network it’s supposed to protect isn’t really an emergency access. Anyone who wants to isolate their management network is thereby building the redundancy that, in an emergency, makes the difference between a remote reset command and a late-night drive to the data center.
Out-of-band access must be located on a separate VLAN or a physically isolated network and must never be directly accessible from the Internet. The BSI module NET.1.1 requires segmentation, DMZ designs, and redundant components to ensure that a failure of the production network does not take down emergency access.
Isolating the Management Network: What the BSI's Basic Protection Requirements Mandate
The IT-Grundschutz module NET.1.1 on network architecture and design describes how networks must be structured so that a single failure does not bring down the entire infrastructure. Requirements include segmentation, a well-thought-out DMZ concept, and redundant components at critical points (BSI, IT Basic Security Compendium). Out-of-band management should therefore be placed on a separate VLAN or, where the effort is justifiable, on a physically separate network. Under no circumstances should a BMC be connected directly to the Internet, not even behind a single firewall rule.
A BMC that is accessible via the Internet is one of the most popular targets for automated scans because many devices in the field are running with factory settings or outdated firmware. Anyone who gains control of a BMC potentially gains full access to the console, the file system via Virtual Media, and the server’s power supply—regardless of the operating system and its own security measures. Isolating the BMC from the production network serves as the first line of defense, long before any firewall rule or password even comes into play.
IPMI over LAN comes with an additional legacy issue. In older implementations, the protocol transmits login credentials in plain text or with weak encryption, which is why it should run exclusively on an isolated segment and never on a network that is also open for other purposes. Redfish solves this problem using TLS and modern authentication, as specified by the DMTF (DMTF, Redfish Specification). This does not affect the basic rule. The management network is separate and independent of the protocol used.
The BSI module on network architecture requires segmentation, a DMZ concept, and redundant components at critical points.
BSI, IT Basic Security Compendium
Address mapping, jump server, and two-factor authentication at the access point
In practice, the separation begins with a dedicated address plan for the management network, distinct from the segments for production, storage, and backup traffic. Each BMC is assigned a fixed address in this segment, documented in a central list rather than scattered across individual configuration files. Fixed addresses, rather than dynamically assigned ones, also make troubleshooting easier later on, because an alarm can be immediately assigned to a specific server without first having to look it up in a DHCP history.
External access is routed through a single, hardened jump server, also known as a jump host. No one connects directly to a BMC from their workstation; every connection passes through this single controlled point. Two-factor authentication is required on the jump server itself, because a compromised password at this point would grant access to the entire server fleet. Every session is logged: who connected, when, from where, and which BMC was accessed. In the event of an incident, these logs are often the only reliable source for determining when a disruption occurred.
For administrators working from home or on the go, access to the jump server is routed through a separate VPN profile, distinct from the VPN access used for the rest of the company's operations. This separation prevents a compromised standard VPN from automatically granting access to the management network.
Emergency access in the event of a main network outage
Redundancy in the management network means more than just a second network card in the server. It means a second, independent path to the jump server that does not run over the same line, router, or provider as the production network. If the main uplink fails—for example, due to an excavator in front of the building or an outage at the provider—access to the management network is maintained via a separate uplink or a cellular router. Without this second connection, the administrator is left with a network that is inaccessible precisely when they need it most.
This second connection does not need to provide the same bandwidth as regular operation. It simply needs to be sufficient to keep a console session open and issue power commands, as described in the article Remote Power Management: Restart Frozen Servers Without On-Site Intervention ...as described. In most cases, an LTE or 5G router with its own SIM card is sufficient for this purpose. The only important thing is that this router has its own power supply, separate from the main router—for example, via its own small UPS—otherwise it will go down along with the rest of the infrastructure.
VLAN or Physical Separation: A Question of Cost
A VLAN provides logical separation, while a physically separated network also provides separation at the cable and port levels. Both meet the basic requirement for segmentation. The difference lies in the residual risk and the ongoing effort.
| Criterion | VLAN | Physically separated |
|---|---|---|
| Residual risk | Higher, depending on the switch configuration | Minimal; no shared hardware |
| Investment | Minimal; existing switches can usually be used | Our Own Switches, Ports, and Cabling |
| Ongoing expenses | Configuration Maintenance, Rule Monitoring | Additional Hardware in Use |
| Typical Applications | Single location, manageable number of servers | Multiple clients, high security requirements |
Where the line is drawn between the two options depends on risk tolerance and the number of systems involved. A server fleet serving multiple customers or clients generally justifies the greater effort required for physical separation. A single location with just a few servers can often get by with a strictly isolated VLAN, provided that the switch configuration is checked regularly and not just once during setup.
Set Up Redundant Access to the Management Network
An addressing plan and a jump server do not answer the question of what happens if the primary uplink fails. A second, independent path to the management network should be included in any plan that accounts for a network failure from the outset.
Frequently Asked Questions
VLAN or physically separated?
Both options meet the basic segmentation requirements of BSI Basic Protection. A physically separated network offers a lower residual risk but requires dedicated ports, cabling, and maintenance. For smaller environments, a consistently isolated VLAN with strict access control is often sufficient.
How do you access the management network if the main network goes down?
Via a second, independent connection that does not use the same uplink, router, or provider as the production network. In practice, this can be achieved using a separate Internet connection or a mobile router with its own SIM card and power supply. Without this second connection, emergency access will be blocked precisely when it is needed.
Does the jump server belong on the management network?
The jump server is located at the boundary between a controlled-access network and the management network, not in the middle of the same segment as the BMCs. This placement prevents a compromised jump server from having direct access to all BMCs on the network without an additional access rule being enforced.
torck operates its own infrastructure in Maxhütte-Haidhof, Vienna, and Rabat via a separate management network and has firsthand experience with the pitfalls—such as when a firewall rule blocks the jump server instead of protecting it. The development teams work in a shared time zone, the project management speaks German, and the contracting party is the German company torck GmbH. This experience is directly incorporated into the access management and logging features of their own software, without requiring customers to redesign their network architecture from scratch. Anyone who wants to have their own architecture cross-checked for contingencies can schedule an initial consultation via the KVM Fleet Product Page.
German 
English 
French