Alternate Management Interface on MS Devices

Overview  

In traditional Meraki network deployments, management traffic such as Syslog messages, responses to SNMP polling and communication with RADIUS servers, is sourced from the LAN IP - the address of the device's default management VLAN. Because this VLAN is also used by the MS device to communicate with the Meraki Dashboard, it has connectivity to the Internet.

Security policies in certain deployments may mandate isolation of management traffic from the public networks. The Alternate Management Interface feature provides for this option by enabling an MS series switch to source its management traffic from an IP address other than that of the default management VLAN.

Requirements, guidelines and limitations 

1. Hardware and software requirements: Alternate Management Interface is support on the following MS switch platforms and firmware versions
    

   MS Switch Family	MS Switch Model	MS Firmware Support (first supported on)
   MS2xx	MS210	MS14.5
   	MS225	MS14.5
   	MS250	MS14.5
   MS3xx	MS350	MS14.5
   	MS355	MS14.5
   	MS390	MS15
   MS4xx	MS410	MS14.5
   	MS425	MS14.5
   	MS450	MS14.5

     
2. The Alternate Management Interface (AMI) functionality is enabled at a per-network level and, therefore, all switches within the Dashboard Network will use the same VLAN for the AMI. The AMI IP address can be configured per switch.
    
3. The AMI VLAN should not be the same as the Management VLAN configured on any of the switches (the LAN IP VLAN on the switch details page) or for the network (via Switching > Switch settings > VLAN configuration).
    
4. Layer 3 routing must be enabled on a switch for its AMI to be activated. Please refer to the section on Configuring the switches with the routes toward the management servers for further details.

Configuring the Alternate Management Interface from Dashboard

Configuring the MS switches in a Meraki Dashboard network to use AMI involves three key steps.

1. Enabling AMI for the network and associating management services with it.
2. Configuring the Alternate Management Interface IP addresses on the switches.
3. Configuring the switches with the routes toward the management servers.

Configuring the Alternate Management Interface using API

Successful HTTP response code: 200

{ 
  "enabled": true,
  "vlanId": 100,
  "protocol": [
    "snmp",
    "radius",
    "syslog"
  ]
}

Successful HTTP response code: 200

{ 
  "enabled": true,
  "vlanId": 100,
  "protocols": ["radius","snmp","syslog"],
  "switches": [
    {
      "serial": "Q2AB-CDEF-GHIJ",
      "alternateManagementIp": "192.168.128.100"
    },
    {
      "serial": "Q2AB-CDEF-KLMN",
      "alternateManagementIp": "192.168.128.200"
    },
    .....
  ]
}

Successful HTTP response code: 200

{ 
  "enabled": false,
}

PUT /networks/L_12345/switch/alternateManagementInterface

{
  "enabled": true,
  "vlanId": 100,
  "protocols": ["syslog"]
}

Successful HTTP response code: 200

{ 
  "enabled": true,
  "vlanId": 100,
  "protocols": ["syslog"],
  "switches": []

PUT /networks/L_12345/switch/alternateManagementInterface

{
  "switches": [
    {
      "serial": "Q2AB-CDEF-GHIJ",
      "alternateManagementIp": "192.168.128.100"
    },
    {
      "serial": "Q2AB-CDEF-KLMN",
      "alternateManagementIp": "192.168.128.200"
    }
  ]
}

Successful HTTP response code: 200

{ 
  "enabled": true,
  "vlanId": 100,
  "protocols": ["syslog"],
  "switches": [
    {
      "serial": "Q2AB-CDEF-GHIJ",
      "alternateManagementIp": "192.168.128.100",
    },
    {
      "serial": "Q2AB-CDEF-KLMN",
      "alternateManagementIp": "192.168.128.200"
    }
  ]
}

PUT /networks/L_12345/switch/alternateManagementInterface

{
  "enabled": true,
  "vlanId": 100,
  "protocols": ["syslog"],
  "switches": [
    {
      "serial": "Q2AB-CDEF-GHIJ",
      "alternateManagementIp": "192.168.128.100"
    }
  ]
}

Successful HTTP response code: 200

{ 
  "enabled": true,
  "vlanId": 100,
  "protocols": ["syslog"],
  "switches": [
    {
      "serial": "Q2AB-CDEF-GHIJ",
      "alternateManagementIp": "192.168.128.100"
    }
  ]
}

PUT /networks/L_12345/switch/alternateManagementInterface

{
  "enabled": false
}

Successful HTTP response code: 200

{ 
  "enabled": false
}

Flow of traffic with Alternate Management Interface 

Traffic for the services selected under the Alternate Management Interface configuration is routed in accordance with the information in the routing table of the switch. The Alternate Management VLAN's IP is used as the source IP address of the data packets being sent. Sourcing this traffic from the IP address of the Alternate Management VLAN allows us to avoid any overlap and ensure that the return traffic from servers can be separated from the public network.