And even if all the dedicated IPMI ports are on a separate switch, if you have root on one box, you can attack another via the IPMI network. You have to put ACL

And even if all the dedicated IPMI ports are on a separate switch, if you have root on one box, you can attack another via the IPMI network. You have to put ACLs on the switch to prevent traffic except to the admin node.