Managed switches outside firewalls?

[Hari Sekhon <hpsekhon () googlemail com>]

Hi,

  I need to get some new switches outside of my firewalls, which means 
that they will have publicly accessible IPs if they are manageable switches.

I'm not quite sure what security stance to take on this. I know I can 
restrict the management interface to  certain IPs,  but I'm still not 
sure if this is asking for trouble to have switches will accessible IPs. 
Perhaps I should use a dumb switch and forgo any management features...

Do any of you guys have policies for this (like unmanaged switches 
outside firewalls and managed ones inside)?

Any thoughts and suggestions welcome.

-h

--
Hari Sekhon