t pass through a router, the router can be a firewall. The problem with both of these designs is that there is no easy way to manage the servers remotely. If you have easy access to the servers, having a Keyboard Video Mon- itor (KVM) switch in each rack can solve this problem. However, ecommerce websites are typically hosted in separate collocation facilities. In this case, remote management capabilities are vital. Network Designs Remote management is often accomplished with another VLAN that connects to every server and network device at the site. This management VLAN then connects to a router or firewall that allows connectivity to the main site. Figure 35-14 shows such a design. Internet Web VLAN Upper application VLAN Lower application VLAN Upper database VLAN To management networks Lower database VLAN Management VLAN Figure 35-14. Ecommerce management network You've gone through great pains to make sure the servers are secure. You've separated all of the servers into layers and prohibited the web servers from communicating with the database servers. Now you've added another VLAN that connects them all together. If you're thinking that this looks like a bad idea, you're right. The benefits of a man- agement network do outweigh the risks, but only if you design the network properly. Management networks should be very secure. Features like port security and private VLANs can help keep the network secure. No server should be allowed to talk to any other server on this network, with the exception of backup and telemetry servers. The problem with all these VLANs is that they are usually combined with a high- availability network design. For every VLAN a server must connect to, it must use two Ethernet interfaces: one for each switch in the high-availability pair. While this may not sound like a big deal, with only three VLANs for the average server, that's six Ethernet interfaces in use. Figure 35-15 shows a typical server connected to three VLANs on two switches. When designing a network like this, make sure you