I can only assume it’s based on VLAN for security (and probably dedicated ports assigned to VLANs so regular ports are never able to access the VLAN), but other

I can only assume it’s based on VLAN for security (and probably dedicated ports assigned to VLANs so regular ports are never able to access the VLAN), but other than that, I have a hard time envisioning in-band management that doesn’t lock you out when the network goes down. It would protect you against things like DDoS attacks, and you can even assign dedicated (prioritized) access for these management ports. It’s an economical decision I suppose.