What is out-of-band management?
Out-of-band (OOB) management means reaching the management interfaces of switches, routers, firewalls, servers and storage over a path that is separate from the network carrying business traffic. In-band management, the alternative, uses the production network itself: an administrator opens SSH or a web console to a switch's ordinary IP address. That works until the production network breaks, at which point the people who need to fix it lose their way in. It also means any machine that can route to the switch can try to log in to it.
An OOB design addresses both problems. Management keeps working during an outage, and management interfaces are unreachable from user and server networks.
Ways to build an out-of-band path
- Dedicated management network: each device's management port connects to separate switches that route only to an administrative zone, reached through jump hosts or privileged access workstations.
- Management VLAN: a logical version of the same idea. It is cheaper but shares hardware with production, so a misconfiguration can bridge the two.
- Console servers: also called terminal servers, they connect by serial cable to each device's console port, giving command-line access even when the device has no working IP configuration.
- Independent links: a cellular modem or a second internet service on a remote site's console server provides access when the site's WAN circuit is down.
- Server management controllers: baseboard management controllers such as Dell iDRAC and HPE iLO give remote power control and console access to servers, and they belong on the OOB network.
Example: recovering from a bad change
An engineer pushes an access list to a branch router and accidentally blocks the SSH session she is using, along with the branch's routing. In-band, the only fix is a site visit. With OOB management, she connects through the management VPN to the branch's console server over its LTE modem, opens the serial session to the router's console port, removes the access list and restores routing in minutes. The console server logs her session for the change record.
Securing the management path
An OOB network gives control of everything, so it is a prime target. Require MFA on the jump hosts and console servers, use SSH rather than Telnet, and remove default passwords. Make sure nothing on the production network can route into the management network, and that the cellular modem accepts connections only through an authenticated VPN. Send management logins to the SIEM, and lock console servers in their racks or closets, since anyone with physical access to a console port and a serial cable can reach the device's command line.
Other meanings of out-of-band
The phrase appears elsewhere in security, always meaning through a separate channel:
- Out-of-band communication: incident responders moving to a phone bridge or separate messaging service when email may be compromised.
- Out-of-band key exchange: delivering a key or verifying a fingerprint over a different channel from the one it protects.
- Out-of-band sensors: an IDS that receives a copy of traffic from a SPAN port or tap rather than sitting inline.
Out-of-band management on the CompTIA Security+ exam
Out-of-band management falls under SY0-801 objective 3.2, which covers managing the security architecture, as one of the ways to keep administrative access secure. Wording such as "administrators couldn't reach the switches during the outage", "management interfaces are reachable from the user network" or "the remote site's WAN link is down and the router needs reconfiguring" points to OOB management. Distractors include a management VLAN, which is logical separation only; a jump server on the production network; a remote access VPN; and SNMPv3, which secures monitoring traffic but doesn't create a separate path.