Best practise to realise management ports on iscsi/san switches

Hello,

currently we have a management VM in our SAN, just to get to the management IPs of our SAN switches. I want to change that and remove all hosts from the SAN network.

My idea was to setup a management vlan, put one port on the iscsi switch in that vlan and configure the management ip and vlan to that port. Than I would connect that port to our "normal" traffic network. That way, there would be no "bridge" between our SAN network an normal traffic and I would also be able to configure my san switches from my normal workstation.

The problem I ran into was that I somehow need to allow traffic from some ips in my lan-vlan to access the the management IPs.

How would you solve this?