Well, it should always be on a physically isolated network, and avoid BMCs which share their NIC with the system.