How do you prefer to restrict access on your management network?

Looking to see how people set up their management network and what they do to restrict access on them. Im assuming a lot of us use a virtual interface like vlan1 to assign an ip on tje management network, but beyond that what are you doing? Creating a mgmt vlan, restricting things down to telnet and https only, etc? What is your preferred method to do those things?