OS::TripleO::Network::StorageMgmt: ../network/storage_mgmt.yaml
   OS::TripleO::Network::Storage: ../network/storage.yaml
   OS::TripleO::Network::Tenant: ../network/tenant.yaml
+  # Management network is optional and disabled by default
+  OS::TripleO::Network::Management: ../network/noop.yaml
 
   # Port assignments for the VIPs
   OS::TripleO::Network::Ports::ExternalVipPort: ../network/ports/external.yaml
   OS::TripleO::Controller::Ports::StoragePort: ../network/ports/storage.yaml
   OS::TripleO::Controller::Ports::StorageMgmtPort: ../network/ports/storage_mgmt.yaml
   OS::TripleO::Controller::Ports::TenantPort: ../network/ports/tenant.yaml
+  OS::TripleO::Controller::Ports::ManagementPort: ../network/ports/noop.yaml
 
   # Port assignments for the compute role
   OS::TripleO::Compute::Ports::InternalApiPort: ../network/ports/internal_api.yaml
   OS::TripleO::Compute::Ports::StoragePort: ../network/ports/storage.yaml
   OS::TripleO::Compute::Ports::TenantPort: ../network/ports/tenant.yaml
+  OS::TripleO::Compute::Ports::ManagementPort: ../network/ports/noop.yaml
 
   # Port assignments for the ceph storage role
   OS::TripleO::CephStorage::Ports::StoragePort: ../network/ports/storage.yaml
   OS::TripleO::CephStorage::Ports::StorageMgmtPort: ../network/ports/storage_mgmt.yaml
+  OS::TripleO::CephStorage::Ports::ManagementPort: ../network/ports/noop.yaml
 
   # Port assignments for the swift storage role
   OS::TripleO::SwiftStorage::Ports::InternalApiPort: ../network/ports/internal_api.yaml
   OS::TripleO::SwiftStorage::Ports::StoragePort: ../network/ports/storage.yaml
   OS::TripleO::SwiftStorage::Ports::StorageMgmtPort: ../network/ports/storage_mgmt.yaml
+  OS::TripleO::SwiftStorage::Ports::ManagementPort: ../network/ports/noop.yaml
 
   # Port assignments for the block storage role
   OS::TripleO::BlockStorage::Ports::InternalApiPort: ../network/ports/internal_api.yaml
   OS::TripleO::BlockStorage::Ports::StoragePort: ../network/ports/storage.yaml
   OS::TripleO::BlockStorage::Ports::StorageMgmtPort: ../network/ports/storage_mgmt.yaml
+  OS::TripleO::BlockStorage::Ports::ManagementPort: ../network/ports/noop.yaml
+
+  # Port assignments for service virtual IPs for the controller role
+  OS::TripleO::Controller::Ports::RedisVipPort: ../network/ports/vip.yaml
 
--- /dev/null
+# Enable the creation of a system management network. This
+# creates a Neutron network for isolated Overcloud
+# system management traffic and configures each role to
+# assign a port (related to that role) on that network.
+# Note that the basic sample NIC configuration templates
+# do not include the management network, see the
+# single-nic-vlans-mgmt templates for an example.
+resource_registry:
+  OS::TripleO::Network::Management: ../network/management.yaml
+
+  # Port assignments for the controller role
+  OS::TripleO::Controller::Ports::ManagementPort: ../network/ports/management.yaml
+
+  # Port assignments for the compute role
+  OS::TripleO::Compute::Ports::ManagementPort: ../network/ports/management.yaml
+
+  # Port assignments for the ceph storage role
+  OS::TripleO::CephStorage::Ports::ManagementPort: ../network/ports/management.yaml
+
+  # Port assignments for the swift storage role
+  OS::TripleO::SwiftStorage::Ports::ManagementPort: ../network/ports/management.yaml
+
+  # Port assignments for the block storage role
+  OS::TripleO::BlockStorage::Ports::ManagementPort: ../network/ports/management.yaml
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet:
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
 
 resources:
   OsNetConfigImpl:
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet:
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
 
 resources:
   OsNetConfigImpl:
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet:
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
 
 resources:
   OsNetConfigImpl:
 
 
 There are two versions of the controller role template, one with
 an external network interface, and another without. If the
-external network interface is not configured the ctlplane address
+external network interface is not configured, the ctlplane address
 ranges will be used for external (public) network traffic.
 
-
 Configuration
 -------------
 
     OS::TripleO::ObjectStorage::Net::SoftwareConfig: network/config/bond-with-vlans/swift-storage.yaml
     OS::TripleO::CephStorage::Net::SoftwareConfig: network/config/bond-with-vlans/ceph-storage.yaml
 
+Or use this Heat environment file:
+
+  environments/net-bond-with-vlans.yaml
+
 Configuration with no External Network
 --------------------------------------
+
 Same as above except set the following value for the controller role:
 
     OS::TripleO::Controller::Net::SoftwareConfig: network/config/bond-with-vlans/controller-no-external.yaml
+
+Configuration with System Management Network
+--------------------------------------------
+
+To enable the optional System Management network, create a Heat environment
+that looks something like this:
+
+  resource\_registry:
+    OS::TripleO::Network::Management: ../network/management.yaml
+    OS::TripleO::Controller::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::Compute::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::CephStorage::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::SwiftStorage::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::BlockStorage::Ports::ManagementPort: ../network/ports/management.yaml
+
+Or use this Heat environment file:
+
+  environments/network-management.yaml
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   BondInterfaceOvsOptions:
     default: ''
     description: The ovs_options string for the bond interface. Set things like
     default: 40
     description: Vlan ID for the storage mgmt network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
                   addresses:
                     -
                       ip_netmask: {get_param: StorageMgmtIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  device: bond1
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   BondInterfaceOvsOptions:
     default: ''
     description: The ovs_options string for the bond interface. Set things like
     default: 40
     description: Vlan ID for the storage mgmt network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
                   addresses:
                     -
                       ip_netmask: {get_param: StorageMgmtIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  device: bond1
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   BondInterfaceOvsOptions:
     default: ''
     description: The ovs_options string for the bond interface. Set things like
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
                   addresses:
                     -
                       ip_netmask: {get_param: TenantIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  device: bond1
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   BondInterfaceOvsOptions:
     default: ''
     description: The ovs_options string for the bond interface. Set things like
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ExternalInterfaceDefaultRoute:
     default: '10.0.0.1'
     description: default route for the external network
             -
               type: ovs_bridge
               name: {get_input: bridge_name}
+              use_dhcp: true
               members:
                 -
                   type: ovs_bond
                   addresses:
                   -
                     ip_netmask: {get_param: TenantIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  device: bond1
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   BondInterfaceOvsOptions:
     default: 'bond_mode=active-backup'
     description: The ovs_options string for the bond interface. Set things like
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ExternalInterfaceDefaultRoute:
     default: '10.0.0.1'
     description: default route for the external network
                       ip_netmask: {get_param: ExternalIpSubnet}
                   routes:
                     -
-                      ip_netmask: 0.0.0.0/0
+                      default: true
                       next_hop: {get_param: ExternalInterfaceDefaultRoute}
                 -
                   type: vlan
                   addresses:
                     -
                       ip_netmask: {get_param: TenantIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  device: bond1
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   BondInterfaceOvsOptions:
     default: ''
     description: The ovs_options string for the bond interface. Set things like
     default: 40
     description: Vlan ID for the storage mgmt network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
                   addresses:
                     -
                       ip_netmask: {get_param: StorageMgmtIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  device: bond1
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
 Or use this Heat environment file:
 
   environments/net-multiple-nics.yaml
+
+Configuration with System Management Network
+--------------------------------------------
+
+To enable the optional System Management network, create a Heat environment
+that looks something like this:
+
+  resource\_registry:
+    OS::TripleO::Network::Management: ../network/management.yaml
+    OS::TripleO::Controller::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::Compute::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::CephStorage::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::SwiftStorage::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::BlockStorage::Ports::ManagementPort: ../network/ports/management.yaml
+
+Or use this Heat environment file:
+
+  environments/network-management.yaml
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ExternalInterfaceDefaultRoute:
     default: '10.0.0.1'
     description: default route for the external network
     description: The subnet CIDR of the control plane network.
     type: string
   ControlPlaneDefaultRoute: # Override this via parameter_defaults
-    description: The subnet CIDR of the control plane network.
+    description: The default route of the control plane network.
     type: string
   DnsServers: # Override this via parameter_defaults
     default: []
     description: A list of DNS servers (2 max for some implementations) that will be added to resolv.conf.
-    type: json
+    type: comma_delimited_list
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
               addresses:
                 -
                   ip_netmask: {get_param: StorageMgmtIpSubnet}
+            # Uncomment when including environments/network-management.yaml
+            #-
+            #  type: interface
+            #  name: nic7
+            #  use_dhcp: false
+            #  addresses:
+            #    -
+            #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ExternalInterfaceDefaultRoute:
     default: '10.0.0.1'
     description: default route for the external network
     description: The subnet CIDR of the control plane network.
     type: string
   ControlPlaneDefaultRoute: # Override this via parameter_defaults
-    description: The subnet CIDR of the control plane network.
+    description: The default route of the control plane network.
     type: string
   DnsServers: # Override this via parameter_defaults
     default: []
     description: A list of DNS servers (2 max for some implementations) that will be added to resolv.conf.
-    type: json
+    type: comma_delimited_list
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
               addresses:
                 -
                   ip_netmask: {get_param: InternalApiIpSubnet}
+            # Uncomment when including environments/network-management.yaml
+            #-
+            #  type: interface
+            #  name: nic7
+            #  use_dhcp: false
+            #  addresses:
+            #    -
+            #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
+  ExternalNetworkVlanID:
+    default: 10
+    description: Vlan ID for the external network traffic.
+    type: number
   InternalApiNetworkVlanID:
     default: 20
     description: Vlan ID for the internal_api network traffic.
     default: 30
     description: Vlan ID for the storage network traffic.
     type: number
+  StorageMgmtNetworkVlanID:
+    default: 40
+    description: Vlan ID for the storage mgmt network traffic.
+    type: number
   TenantNetworkVlanID:
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
+  ExternalInterfaceDefaultRoute:
+    default: '10.0.0.1'
+    description: default route for the external network
+    type: string
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
     type: string
   ControlPlaneDefaultRoute: # Override this via parameter_defaults
-    description: The subnet CIDR of the control plane network.
+    description: The default route of the control plane network.
     type: string
   DnsServers: # Override this via parameter_defaults
     default: []
     description: A list of DNS servers (2 max for some implementations) that will be added to resolv.conf.
-    type: json
+    type: comma_delimited_list
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
                   use_dhcp: false
                   # force the MAC address of the bridge to this interface
                   primary: true
+            # Uncomment when including environments/network-management.yaml
+            #-
+            #  type: interface
+            #  name: nic7
+            #  use_dhcp: false
+            #  addresses:
+            #    -
+            #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ExternalInterfaceDefaultRoute:
     default: '10.0.0.1'
     description: default route for the external network
     description: The subnet CIDR of the control plane network.
     type: string
   ControlPlaneDefaultRoute: # Override this via parameter_defaults
-    description: The subnet CIDR of the control plane network.
+    description: The default route of the control plane network.
     type: string
   DnsServers: # Override this via parameter_defaults
     default: []
     description: A list of DNS servers (2 max for some implementations) that will be added to resolv.conf.
-    type: json
+    type: comma_delimited_list
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
             -
               type: ovs_bridge
               name: {get_input: bridge_name}
+              dns_servers: {get_param: DnsServers}
               use_dhcp: false
               addresses:
                 -
                   ip_netmask: {get_param: ExternalIpSubnet}
               routes:
                 -
-                  ip_netmask: 0.0.0.0/0
+                  default: true
                   next_hop: {get_param: ExternalInterfaceDefaultRoute}
               members:
                 -
                   name: nic6
                   # force the MAC address of the bridge to this interface
                   primary: true
+            # Uncomment when including environments/network-management.yaml
+            #-
+            #  type: interface
+            #  name: nic7
+            #  use_dhcp: false
+            #  addresses:
+            #    -
+            #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ExternalInterfaceDefaultRoute:
     default: '10.0.0.1'
     description: default route for the external network
     description: The subnet CIDR of the control plane network.
     type: string
   ControlPlaneDefaultRoute: # Override this via parameter_defaults
-    description: The subnet CIDR of the control plane network.
+    description: The default route of the control plane network.
     type: string
   DnsServers: # Override this via parameter_defaults
     default: []
     description: A list of DNS servers (2 max for some implementations) that will be added to resolv.conf.
-    type: json
+    type: comma_delimited_list
   EC2MetadataIp: # Override this via parameter_defaults
     description: The IP address of the EC2 metadata server.
     type: string
               addresses:
                 -
                   ip_netmask: {get_param: InternalApiIpSubnet}
+            # Uncomment when including environments/network-management.yaml
+            #-
+            #  type: interface
+            #  name: nic7
+            #  use_dhcp: false
+            #  addresses:
+            #    -
+            #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
 This directory contains Heat templates to help configure
-Vlans on a single NICs for each Overcloud role.
+Vlans on a single NIC for each Overcloud role.
 
 There are two versions of the controller role template, one with
 an external network interface, and another without. If the
-external network interface is not configured the ctlplane address
+external network interface is not configured, the ctlplane address
 ranges will be used for external (public) network traffic.
 
 Configuration
 
   environments/net-single-nic-with-vlans.yaml
 
-
 Configuration with no External Network
 --------------------------------------
+
 Same as above except set the following value for the controller role:
 
     OS::TripleO::Controller::Net::SoftwareConfig: network/config/single-nic-vlans/controller-no-external.yaml
+
+Configuration with System Management Network
+--------------------------------------------
+
+To enable the optional System Management network, create a Heat environment
+that looks something like this:
+
+  resource\_registry:
+    OS::TripleO::Network::Management: ../network/management.yaml
+    OS::TripleO::Controller::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::Compute::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::CephStorage::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::SwiftStorage::Ports::ManagementPort: ../network/ports/management.yaml
+    OS::TripleO::BlockStorage::Ports::ManagementPort: ../network/ports/management.yaml
+
+Or use this Heat environment file:
+
+  environments/network-management.yaml
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   StorageNetworkVlanID:
     default: 30
     description: Vlan ID for the storage network traffic.
     default: 40
     description: Vlan ID for the storage mgmt network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
                   addresses:
                     -
                       ip_netmask: {get_param: StorageMgmtIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   InternalApiNetworkVlanID:
     default: 20
     description: Vlan ID for the internal_api network traffic.
     default: 40
     description: Vlan ID for the storage mgmt network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
                   addresses:
                     -
                       ip_netmask: {get_param: StorageMgmtIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   InternalApiNetworkVlanID:
     default: 20
     description: Vlan ID for the internal_api network traffic.
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
                   addresses:
                     -
                       ip_netmask: {get_param: TenantIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ExternalInterfaceDefaultRoute:
     default: '10.0.0.1'
     description: default route for the external network
                   addresses:
                   -
                     ip_netmask: {get_param: TenantIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   ExternalNetworkVlanID:
     default: 10
     description: Vlan ID for the external network traffic.
     default: 50
     description: Vlan ID for the tenant network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ExternalInterfaceDefaultRoute:
     default: '10.0.0.1'
     description: default route for the external network
                   addresses:
                     -
                       ip_netmask: {get_param: TenantIpSubnet}
+                #-  # Uncomment when including environments/network-management.yaml
+                #  type: vlan
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
     default: ''
     description: IP address/subnet on the tenant network
     type: string
+  ManagementIpSubnet: # Only populated when including environments/network-management.yaml
+    default: ''
+    description: IP address/subnet on the management network
+    type: string
   InternalApiNetworkVlanID:
     default: 20
     description: Vlan ID for the internal_api network traffic.
     default: 40
     description: Vlan ID for the storage mgmt network traffic.
     type: number
+  ManagementNetworkVlanID:
+    default: 60
+    description: Vlan ID for the management network traffic.
+    type: number
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
                   addresses:
                     -
                       ip_netmask: {get_param: StorageMgmtIpSubnet}
+                # Uncomment when including environments/network-management.yaml
+                #-
+                #  type: vlan
+                #  vlan_id: {get_param: ManagementNetworkVlanID}
+                #  addresses:
+                #    -
+                #      ip_netmask: {get_param: ManagementIpSubnet}
 
 outputs:
   OS::stack_id:
 
--- /dev/null
+heat_template_version: 2015-04-30
+
+description: >
+  Management network. System administration, SSH, DNS, NTP, etc. This network
+  would usually be the default gateway for the non-controller nodes.
+
+parameters:
+  # the defaults here work for static IP assignment (IPAM) only
+  ManagementNetCidr:
+    default: '10.0.1.0/24'
+    description: Cidr for the management network.
+    type: string
+  ManagementNetValueSpecs:
+    default: {'provider:physical_network': 'management', 'provider:network_type': 'flat'}
+    description: Value specs for the management network.
+    type: string
+  ManagementNetAdminStateUp:
+    default: false
+    description: This admin state of of the network.
+    type: boolean
+  ManagementNetEnableDHCP:
+    default: false
+    description: Whether to enable DHCP on the associated subnet.
+    type: boolean
+  ManagementNetShared:
+    default: false
+    description: Whether this network is shared across all tenants.
+    type: boolean
+  ManagementNetName:
+    default: management
+    description: The name of the management network.
+    type: string
+  ManagementSubnetName:
+    default: management_subnet
+    description: The name of the management subnet in Neutron.
+    type: string
+  ManagementAllocationPools:
+    default: [{'start': '10.0.1.4', 'end': '10.0.1.250'}]
+    description: Ip allocation pool range for the management network.
+    type: json
+
+resources:
+  ManagementNetwork:
+    type: OS::Neutron::Net
+    properties:
+      admin_state_up: {get_param: ManagementNetAdminStateUp}
+      name: {get_param: ManagementNetName}
+      shared: {get_param: ManagementNetShared}
+      value_specs: {get_param: ManagementNetValueSpecs}
+
+  ManagementSubnet:
+    type: OS::Neutron::Subnet
+    properties:
+      cidr: {get_param: ManagementNetCidr}
+      enable_dhcp: {get_param: ManagementNetEnableDHCP}
+      name: {get_param: ManagementSubnetName}
+      network: {get_resource: ManagementNetwork}
+      allocation_pools: {get_param: ManagementAllocationPools}
+
+outputs:
+  OS::stack_id:
+    description: Neutron management network
+    value: {get_resource: ManagementNetwork}
+
 
 
   TenantNetwork:
     type: OS::TripleO::Network::Tenant
+
+  ManagementNetwork:
+    type: OS::TripleO::Network::Management
 
--- /dev/null
+heat_template_version: 2015-04-30
+
+description: >
+  Creates a port on the management network. The IP address will be chosen
+  automatically if FixedIPs is empty.
+
+parameters:
+  ManagementNetName:
+    description: Name of the management neutron network
+    default: management
+    type: string
+  PortName:
+    description: Name of the port
+    default: ''
+    type: string
+  ControlPlaneIP: # Here for compatibility with noop.yaml
+    description: IP address on the control plane
+    type: string
+
+resources:
+
+  ManagementPort:
+    type: OS::Neutron::Port
+    properties:
+      network: {get_param: ManagementNetName}
+      name: {get_param: PortName}
+      replacement_policy: AUTO
+
+outputs:
+  ip_address:
+    description: management network IP
+    value: {get_attr: [ManagementPort, fixed_ips, 0, ip_address]}
+  ip_subnet:
+    # FIXME: this assumes a 2 digit subnet CIDR (need more heat functions?)
+    description: IP/Subnet CIDR for the management network IP
+    value:
+          list_join:
+            - ''
+            - - {get_attr: [ManagementPort, fixed_ips, 0, ip_address]}
+              - '/'
+              - {get_attr: [ManagementPort, subnets, 0, cidr, -2]}
+              - {get_attr: [ManagementPort, subnets, 0, cidr, -1]}
 
   TenantIpList:
     default: []
     type: comma_delimited_list
+  ManagementIpList:
+    default: []
+    type: comma_delimited_list
 
 outputs:
   net_ip_map:
       storage: {get_param: StorageIpList}
       storage_mgmt: {get_param: StorageMgmtIpList}
       tenant: {get_param: TenantIpList}
+      management: {get_param: ManagementIpList}
 
   TenantIp:
     default: ''
     type: string
+  ManagementIp:
+    default: ''
+    type: string
 
 outputs:
   net_ip_map:
       storage: {get_param: StorageIp}
       storage_mgmt: {get_param: StorageMgmtIp}
       tenant: {get_param: TenantIp}
+      management: {get_param: ManagementIp}
 
   TenantIpSubnet:
     default: ''
     type: string
+  ManagementIpSubnet:
+    default: ''
+    type: string
   ControlPlaneSubnetCidr: # Override this via parameter_defaults
     default: '24'
     description: The subnet CIDR of the control plane network.
       storage: {get_param: StorageIpSubnet}
       storage_mgmt: {get_param: StorageMgmtIpSubnet}
       tenant: {get_param: TenantIpSubnet}
+      management: {get_param: ManagementIpSubnet}
 
   OS::TripleO::Network::StorageMgmt: network/noop.yaml
   OS::TripleO::Network::Storage: network/noop.yaml
   OS::TripleO::Network::Tenant: network/noop.yaml
+  OS::TripleO::Network::Management: network/noop.yaml
 
   OS::TripleO::Network::Ports::NetVipMap: network/ports/net_ip_map.yaml
   OS::TripleO::Network::Ports::NetIpMap: network/ports/net_ip_map.yaml
   OS::TripleO::Controller::Ports::StoragePort: network/ports/noop.yaml
   OS::TripleO::Controller::Ports::StorageMgmtPort: network/ports/noop.yaml
   OS::TripleO::Controller::Ports::TenantPort: network/ports/noop.yaml
+  OS::TripleO::Controller::Ports::ManagementPort: network/ports/noop.yaml
 
   # Port assignments for the compute role
   OS::TripleO::Compute::Ports::InternalApiPort: network/ports/noop.yaml
   OS::TripleO::Compute::Ports::StoragePort: network/ports/noop.yaml
   OS::TripleO::Compute::Ports::TenantPort: network/ports/noop.yaml
+  OS::TripleO::Compute::Ports::ManagementPort: network/ports/noop.yaml
 
   # Port assignments for the ceph storage role
   OS::TripleO::CephStorage::Ports::StoragePort: network/ports/noop.yaml
   OS::TripleO::CephStorage::Ports::StorageMgmtPort: network/ports/noop.yaml
+  OS::TripleO::CephStorage::Ports::ManagementPort: network/ports/noop.yaml
 
   # Port assignments for the swift storage role
   OS::TripleO::SwiftStorage::Ports::InternalApiPort: network/ports/noop.yaml
   OS::TripleO::SwiftStorage::Ports::StoragePort: network/ports/noop.yaml
   OS::TripleO::SwiftStorage::Ports::StorageMgmtPort: network/ports/noop.yaml
+  OS::TripleO::SwiftStorage::Ports::ManagementPort: network/ports/noop.yaml
 
   # Port assignments for the block storage role
   OS::TripleO::BlockStorage::Ports::InternalApiPort: network/ports/noop.yaml
   OS::TripleO::BlockStorage::Ports::StoragePort: network/ports/noop.yaml
   OS::TripleO::BlockStorage::Ports::StorageMgmtPort: network/ports/noop.yaml
+  OS::TripleO::BlockStorage::Ports::ManagementPort: network/ports/noop.yaml
 
   # Service Endpoint Mappings
   OS::TripleO::Endpoint: network/endpoints/endpoint.yaml
 
       StorageIpList: {get_attr: [Controller, storage_ip_address]}
       StorageMgmtIpList: {get_attr: [Controller, storage_mgmt_ip_address]}
       TenantIpList: {get_attr: [Controller, tenant_ip_address]}
+      ManagementIpList: {get_attr: [Controller, management_ip_address]}
 
   allNodesConfig:
     type: OS::TripleO::AllNodes::SoftwareConfig
       InternalApiIp: {get_attr: [InternalApiVirtualIP, ip_address]}
       StorageIp: {get_attr: [StorageVirtualIP, ip_address]}
       StorageMgmtIp: {get_attr: [StorageMgmtVirtualIP, ip_address]}
-      # No tenant VIP required
+      # No tenant or management VIP required
 
   VipConfig:
     type: OS::TripleO::VipConfig
 
     properties:
       ControlPlaneIP: {get_attr: [CephStorage, networks, ctlplane, 0]}
 
+  ManagementPort:
+    type: OS::TripleO::CephStorage::Ports::ManagementPort
+    properties:
+      ControlPlaneIP: {get_attr: [CephStorage, networks, ctlplane, 0]}
+
   NetworkConfig:
     type: OS::TripleO::CephStorage::Net::SoftwareConfig
     properties:
       ControlPlaneIp: {get_attr: [CephStorage, networks, ctlplane, 0]}
       StorageIpSubnet: {get_attr: [StoragePort, ip_subnet]}
       StorageMgmtIpSubnet: {get_attr: [StorageMgmtPort, ip_subnet]}
+      ManagementIpSubnet: {get_attr: [ManagementPort, ip_subnet]}
 
   NetIpMap:
     type: OS::TripleO::Network::Ports::NetIpMap
       ControlPlaneIp: {get_attr: [CephStorage, networks, ctlplane, 0]}
       StorageIp: {get_attr: [StoragePort, ip_address]}
       StorageMgmtIp: {get_attr: [StorageMgmtPort, ip_address]}
+      ManagementIp: {get_attr: [ManagementPort, ip_address]}
 
   NetIpSubnetMap:
     type: OS::TripleO::Network::Ports::NetIpSubnetMap
       ControlPlaneIp: {get_attr: [CephStorage, networks, ctlplane, 0]}
       StorageIpSubnet: {get_attr: [StoragePort, ip_subnet]}
       StorageMgmtIpSubnet: {get_attr: [StorageMgmtPort, ip_subnet]}
+      ManagementIpSubnet: {get_attr: [ManagementPort, ip_subnet]}
 
   NetworkDeployment:
     type: OS::TripleO::SoftwareDeployment
   storage_mgmt_ip_address:
     description: IP address of the server in the storage_mgmt network
     value: {get_attr: [StorageMgmtPort, ip_address]}
+  management_ip_address:
+    description: IP address of the server in the management network
+    value: {get_attr: [ManagementPort, ip_address]}
   config_identifier:
     description: identifier which changes if the node configuration may need re-applying
     value:
 
     properties:
       ControlPlaneIP: {get_attr: [BlockStorage, networks, ctlplane, 0]}
 
+  ManagementPort:
+    type: OS::TripleO::BlockStorage::Ports::ManagementPort
+    properties:
+      ControlPlaneIP: {get_attr: [BlockStorage, networks, ctlplane, 0]}
+
   NetworkConfig:
     type: OS::TripleO::BlockStorage::Net::SoftwareConfig
     properties:
       InternalApiIpSubnet: {get_attr: [InternalApiPort, ip_subnet]}
       StorageIpSubnet: {get_attr: [StoragePort, ip_subnet]}
       StorageMgmtIpSubnet: {get_attr: [StorageMgmtPort, ip_subnet]}
+      ManagementIpSubnet: {get_attr: [ManagementPort, ip_subnet]}
 
   NetIpMap:
     type: OS::TripleO::Network::Ports::NetIpMap
       InternalApiIp: {get_attr: [InternalApiPort, ip_address]}
       StorageIp: {get_attr: [StoragePort, ip_address]}
       StorageMgmtIp: {get_attr: [StorageMgmtPort, ip_address]}
+      ManagementIp: {get_attr: [ManagementPort, ip_address]}
 
   NetworkDeployment:
     type: OS::TripleO::SoftwareDeployment
   storage_mgmt_ip_address:
     description: IP address of the server in the storage_mgmt network
     value: {get_attr: [StorageMgmtPort, ip_address]}
+  management_ip_address:
+    description: IP address of the server in the management network
+    value: {get_attr: [ManagementPort, ip_address]}
   config_identifier:
     description: identifier which changes if the node configuration may need re-applying
     value:
 
     properties:
       ControlPlaneIP: {get_attr: [NovaCompute, networks, ctlplane, 0]}
 
+  ManagementPort:
+    type: OS::TripleO::Compute::Ports::ManagementPort
+    properties:
+      ControlPlaneIP: {get_attr: [NovaCompute, networks, ctlplane, 0]}
+
   NetIpMap:
     type: OS::TripleO::Network::Ports::NetIpMap
     properties:
       InternalApiIp: {get_attr: [InternalApiPort, ip_address]}
       StorageIp: {get_attr: [StoragePort, ip_address]}
       TenantIp: {get_attr: [TenantPort, ip_address]}
+      ManagementIp: {get_attr: [ManagementPort, ip_address]}
 
   NetworkConfig:
     type: OS::TripleO::Compute::Net::SoftwareConfig
       InternalApiIpSubnet: {get_attr: [InternalApiPort, ip_subnet]}
       StorageIpSubnet: {get_attr: [StoragePort, ip_subnet]}
       TenantIpSubnet: {get_attr: [TenantPort, ip_subnet]}
+      ManagementIpSubnet: {get_attr: [ManagementPort, ip_subnet]}
 
   NetworkDeployment:
     type: OS::TripleO::SoftwareDeployment
   tenant_ip_address:
     description: IP address of the server in the tenant network
     value: {get_attr: [TenantPort, ip_address]}
+  management_ip_address:
+    description: IP address of the server in the management network
+    value: {get_attr: [ManagementPort, ip_address]}
   hostname:
     description: Hostname of the server
     value: {get_attr: [NovaCompute, name]}
 
       NodeIndex: {get_param: NodeIndex}
       ControlPlaneIP: {get_attr: [Controller, networks, ctlplane, 0]}
 
+  ManagementPort:
+    type: OS::TripleO::Controller::Ports::ManagementPort
+    properties:
+      ControlPlaneIP: {get_attr: [Controller, networks, ctlplane, 0]}
+
   NetIpMap:
     type: OS::TripleO::Network::Ports::NetIpMap
     properties:
       StorageIp: {get_attr: [StoragePort, ip_address]}
       StorageMgmtIp: {get_attr: [StorageMgmtPort, ip_address]}
       TenantIp: {get_attr: [TenantPort, ip_address]}
+      ManagementIp: {get_attr: [ManagementPort, ip_address]}
 
   NetIpSubnetMap:
     type: OS::TripleO::Network::Ports::NetIpSubnetMap
       StorageIpSubnet: {get_attr: [StoragePort, ip_subnet]}
       StorageMgmtIpSubnet: {get_attr: [StorageMgmtPort, ip_subnet]}
       TenantIpSubnet: {get_attr: [TenantPort, ip_subnet]}
+      ManagementIpSubnet: {get_attr: [ManagementPort, ip_subnet]}
 
   NetworkConfig:
     type: OS::TripleO::Controller::Net::SoftwareConfig
       StorageIpSubnet: {get_attr: [StoragePort, ip_subnet]}
       StorageMgmtIpSubnet: {get_attr: [StorageMgmtPort, ip_subnet]}
       TenantIpSubnet: {get_attr: [TenantPort, ip_subnet]}
+      ManagementIpSubnet: {get_attr: [ManagementPort, ip_subnet]}
 
   NetworkDeployment:
     type: OS::TripleO::SoftwareDeployment
   tenant_ip_address:
     description: IP address of the server in the tenant network
     value: {get_attr: [TenantPort, ip_address]}
+  management_ip_address:
+    description: IP address of the server in the management network
+    value: {get_attr: [ManagementPort, ip_address]}
   hostname:
     description: Hostname of the server
     value: {get_attr: [Controller, name]}
 
     properties:
       ControlPlaneIP: {get_attr: [SwiftStorage, networks, ctlplane, 0]}
 
+  ManagementPort:
+    type: OS::TripleO::SwiftStorage::Ports::ManagementPort
+    properties:
+      ControlPlaneIP: {get_attr: [SwiftStorage, networks, ctlplane, 0]}
+
   NetworkConfig:
     type: OS::TripleO::ObjectStorage::Net::SoftwareConfig
     properties:
       InternalApiIpSubnet: {get_attr: [InternalApiPort, ip_subnet]}
       StorageIpSubnet: {get_attr: [StoragePort, ip_subnet]}
       StorageMgmtIpSubnet: {get_attr: [StorageMgmtPort, ip_subnet]}
+      ManagementIpSubnet: {get_attr: [ManagementPort, ip_subnet]}
 
   NetIpMap:
     type: OS::TripleO::Network::Ports::NetIpMap
       InternalApiIp: {get_attr: [InternalApiPort, ip_address]}
       StorageIp: {get_attr: [StoragePort, ip_address]}
       StorageMgmtIp: {get_attr: [StorageMgmtPort, ip_address]}
+      ManagementIp: {get_attr: [ManagementPort, ip_address]}
 
   NetworkDeployment:
     type: OS::TripleO::SoftwareDeployment
   storage_mgmt_ip_address:
     description: IP address of the server in the storage_mgmt network
     value: {get_attr: [StorageMgmtPort, ip_address]}
+  management_ip_address:
+    description: IP address of the server in the management network
+    value: {get_attr: [ManagementPort, ip_address]}
   config_identifier:
     description: identifier which changes if the node configuration may need re-applying
     value: