Out-of-band management
An Opengear cellular console server gives each site a second management path to the firewall and switches. When a firmware upgrade fails, a change locks out remote access or the internet circuit goes down, we can work on it remotely as long as the site has power, cellular service and the console connection. Some faults still need someone on site or the carrier.
Updated October 30, 2026
Normally you manage a firewall or switch over the same network it runs: you log in over SSH or the web interface through the office LAN or a VPN. That is in-band management, and it fails exactly when you need it most. A bad firmware upgrade, a wrong route or a dead circuit takes the management path down with the network.
Out-of-band management, also called OOB management, adds a separate path. A console server sits in the rack, is cabled to the console ports of the firewall and switches, and has its own connection, usually cellular. Through it we see the device’s console exactly as if we were standing in front of it, including boot messages and recovery menus, even when the device has no working network at all. This separate path is often called an out-of-band network.
In-band management reaches a device over the production network it serves, using SSH or HTTPS through the LAN or a VPN. Out-of-band management uses a separate path, usually a console server with its own cellular link, so it still works when the production network, the firewall or the internet circuit is down, as long as the console server and its cellular link are up.
An out-of-band management (OOBM) network is a separate network used only to administer infrastructure. Console servers connect to the serial console ports of firewalls, switches and routers, and reach the outside over their own cellular link or a separate circuit. It carries management traffic separately from user traffic; a separate uplink keeps access available during a production-network outage, provided the console server and uplink remain powered and operational.
Recovery when the normal path is gone: rolling back a change that cut off remote access, watching a firewall restart after a failed firmware upgrade and using its recovery menus, and checking whether an outage is the circuit or the equipment. It cuts down on site visits, though some faults still need someone on site.
A console server is an appliance with many serial console ports, cabled to the console ports of firewalls, switches and routers. An engineer connects to it over the network or cellular and opens any device’s console as if standing at the rack, including boot messages and recovery prompts that a network login never shows.
Ambio Edge Networks is an Authorized Opengear Partner and buys Opengear hardware, support and subscriptions through Opengear’s authorized U.S. distribution. We are also a Fortinet Engage Advocate partner, which is why our out-of-band designs start from the FortiGate.
From the console we can watch the FortiGate start up and use its built-in recovery options. Reloading a firmware image over TFTP also needs an Ethernet link from the console server to the firewall. Opengear’s Operations Manager user guide documents a built-in TFTP server, off by default; we confirm it on the selected model’s firmware when we scope the site.
A policy, routing or interface mistake can cut off normal remote management. Over the console we can still log in, inspect the configuration and roll the change back. Some faults still need someone on site.
With site power and cellular service up, we can reach the firewall while the circuit is down, check whether the fault is the provider, the hand-off or the firewall, and gather what the provider needs. Carrier faults still need the carrier.
Under Firmware Care, on-site recovery after a failed upgrade is free, including travel, at sites that are Recovery-Ready at the start of the window: a working Ambio-approved cellular console that you purchase, or a synced high-availability pair with both units under support. Hardware faults, and a console or pair that was unavailable for reasons outside our control, are excluded. Your service agreement governs.
We pick the model for each site, stage the configuration and install it, with your firewall project or on its own. On a managed plan the console server is monitored with the rest of your network, so a dead cellular path shows up as an alert before you need it. Alerts go to your Slack or Teams channel and to us at the same time, and a senior engineer responds Monday to Friday, 8 AM–5 PM Pacific. Installation and ongoing monitoring are quoted after scoping.
For MSPs and co-managed IT teams. If you already run the desktops, accounts and help desk, we can supply and configure the console servers and give your engineers their own named accounts, or run them alongside the firewall under a co-managed arrangement. Either way, the access design is written into the quote.
For a branch or small office we use Opengear’s current compact models. The OM1300 combines serial console ports with a built-in managed Ethernet switch. The CM8000 has serial console ports and two network ports without the built-in switch. Both run Docker and come with or without a cellular modem. Larger sites and server rooms step up to the CM8100, with 16 to 96 serial ports, or the OM2200, with 24 serial ports and a 24-port switch in one unit.
| Model | What it has | Fits | List price |
|---|---|---|---|
| OM1304-4E-C | 4 serial console ports, 4 switched gigabit ports, 2 combo uplinks (copper or SFP), 5G/LTE modem with two SIM slots, Docker | Sites that also need a small management switch for out-of-band Ethernet access | $2,549 |
| CM8004-C | 4 serial console ports, 2 combo uplinks, 5G/LTE modem with two SIM slots, Docker | Sites that only need console access to the firewall and a few switches | $1,949 |
| OM1304-4E / CM8004 | OM1304-4E-C and CM8004-C without the cellular modem | Sites with a separate backup circuit the console server can use | $1,849 / $1,249 |
| 8-port versions | OM1308-8E and CM8008, with or without cellular | Racks with more than four console ports to reach | Quoted by part number |
List prices are from Opengear’s U.S. price list effective October 26, 2026, and are shown for reference; we confirm the exact part number and price when we quote. See Opengear models and reference list prices. One year of Opengear Foundation support is a separate line: $359 list price for the OM1300 and $259 for the CM8000. Opengear’s AT&T incidental-use data plan is $72 a year list price; we confirm coverage, data allowance and the plan when we scope the site. The older OM1200 reached end of sale on March 24, 2026; the OM1300 replaces it.
A serial console server gives remote access to the console ports of connected devices. It becomes part of an out-of-band network when its own connection is independent of the production network, for example through a cellular modem or a separate circuit. Per Opengear’s datasheets, the cellular models also include a firewall, VPN and failover to cellular, and all current models can run scripts. We check each device’s console interface, pinout and cabling when we scope the site: the OM1300’s serial ports switch between the two common pinouts in software, the CM8004 uses the Cisco-style X2 pinout, and devices with a USB console port need a separately confirmed connection.
Many FortiGate models have a dedicated management port, labeled MGMT, or MGMT1 and MGMT2 on models with two (Fortinet FortiOS 7.6.4 Administration Guide). In a high-availability cluster, FortiOS can also reserve an interface on each unit for out-of-band management, with its own IP address (FortiOS 7.4.4 Administration Guide).
Both are Ethernet interfaces run by FortiOS. They answer only while the FortiGate is booted, its configuration is sound and a network path reaches them. A console server connects to the serial console instead, so it still works during a restart, after a failed upgrade or a bad change, and, with a cellular modem, when the site’s circuit is down. The two work together: the management port for day-to-day access, the console server for when FortiOS or the circuit is the problem. The OM1300’s built-in switch can also carry the management port onto the out-of-band network.
A second way into the network has to be locked down at least as well as the first. We configure encrypted remote access, keep the unit’s firewall zones on deny by default, open management services only on approved paths and give accounts only to named engineers. The quote spells out the access design and any licensing it needs; on a managed plan, console-server firmware updates are handled as your service agreement describes.
Lighthouse is Opengear’s central management software for a fleet of console servers. Whether a deployment needs it depends on the remote-access design, the carrier connection and how many sites you run. We settle that when we scope the work and quote any Lighthouse licensing as its own line. Lighthouse list prices by node count.
We count the console ports you need, check cellular coverage at the site and decide whether the site needs the built-in switch.
Hardware, Opengear support term, data plan, any Lighthouse licensing and ongoing monitoring each get their own line. Installation is quoted after scoping, alone or with your firewall project.
We stage the configuration, the unit ships to your site, and it is cabled to the firewall and switch console ports during the install. Hardware and support are registered to your organization.
Opengear hardware is special-order: payment clears before we place the distributor order, and once placed it cannot be cancelled or returned. Opengear runs trade-in promotions for older console servers from time to time; we check what applies when we quote.
We install on site in Sacramento, the Bay Area and San Jose. Hardware ships direct anywhere in the U.S.; elsewhere a local contact cables the unit while we configure it remotely. To have the whole site run after install, see our managed firewall and multi-site Fortinet MSP pages.
A synced HA pair with both units under support is one way to be Recovery-Ready under Firmware Care. Out-of-band adds a separate management path for when a change affects both units or the internet circuit is down. Recovery coverage and exclusions follow your service agreement.
Yes. You can buy Opengear hardware without an Ambio managed plan. The quote lists the hardware and Opengear support separately, with the support term you choose.
Recurring costs can include the cellular data plan, Opengear support renewals, Lighthouse licensing where the design needs it, and our monitoring of the console server. The quote lists each charge and its billing term.
Send the model and serial. The OM1200 reached end of sale in March 2026, and the OM2216, OM2232 and OM2248 on June 30, 2026 (support to June 30, 2031). Opengear publishes the remaining support dates for each line. We tell you what support remains and whether a trade-in applies.
Request a Quote
Send the number of sites, the firewall and switch models at each one, and whether each site has a backup circuit. You get a written quote with Opengear part numbers and separate support, data-plan and installation lines.
A senior engineer reads your request and replies within 1 business day.
If anything is missing for an exact quote, we ask before guessing.
You get a written quote with part numbers, terms, shipping and tax lines.
Nothing is ordered until you accept and payment clears.
