TP-Link Easy Smart Switch security question
-
Is there any update on this?
@jahonix, did the TP-Link engineer ever answer your questions? I'm especially interested in the option to be able to set a management VLAN on the Easy Smart switches.
-
-
Any updates on this thread? Seems like this is a serious problem.
-
Any updates on this thread? Seems like this is a serious problem.
I haven't seen any firmware updates that allow removing VLAN1 untagged from the switch ports. I'm guessing TP-Link sees this as a feature, so that the end user can avoid having to set up the management interface on a VLAN and perhaps locking themselves out of managing the switch, since there's no console or anything like that.
Of course I understand the implications, and obviously these switches are meant for home use. I'd be curious to hear what TP-Link says about it, but that's my guess.
-
I got one of these and immediately returned it.
I ended up with a zyxel gs1900-8hp, it's 70W of PoE over all 8 ports for $100. It didn't have the forced VLAN 1, and it even has a telnet CLI you can activate and a header for serial access. MUCH better GUI and many more features!
The non-PoE version is I think $60. So almost double the price of a tplink might not be interesting but I thought I'd throw it out there.
I actually kept my LAN on VLAN1. It's for home use and you can force HTTP/S only acces, that combined with a strong password keeps me from worrying about needing a management only interface.
-
Any updates on this thread?
Sorry, I didn't make it to CeBIT. Workload prohibited going there.
And the engineer I talked to last year never responded to my mails. -
For just a couple dollars more you can get a D-Link DGS-1100-08 that has a management VLAN setting and doesn't do all this VLAN 1 nonsense.
Not sure what the fascination with these TP-Link things is. They are garbage.
-
At least for me the fascination was the price. Also, before asking around in a forum like this they appear to be a great buy based on amazon reviews.
But I agree, better off getting something a little better.
-
I got one of these to play with since see a lot of threads about them.. You can not remove vlan 1 that is for damn sure, and there also seems to be a cosmetic issue with it reporting rxbadpkts on interface that tagged vlan traffic hits… But seems to just be cosmetic.
I have not had a chance to test the security if vlan 1 traffic is broadcasted out a port if you change the pvid to some other vlan. But pretty sure you can get to the management IP from any switch port.. When I get some play time do some testing. But for a home switch, that does vlans the price is attractive.
-
But pretty sure you can get to the management IP from any switch port.
How big of a security concern is this really? If the webgui is HTTP/S and you have a strong password on it then what is the security risk?
My setup is home use only so for me I'm not at all concerned about anyone on my network even caring to look for a switch or router on the network, I was just curious how much of an actual security vulnerability this would be on a larger network?
-
I have very little patience (read zero) for any flakiness in my layer 2 gear.
-
But pretty sure you can get to the management IP from any switch port.
If the webgui is HTTP/S
It's not, and I don't see any way to change it. I get it, these switches are basically the same price as a typical unmanaged switch. They're cheap and offer VLANs. That's about all I can say.
Right now all my ports are either trunk ports (two between switches, one to my AP, one to my ESXi box) or access ports on a single VLAN (not VLAN1) which uses a subnet that also happens to contain the management IP address. My other two VLANs / subnets are either wireless only or contained entirely in ESXi / pfSense. In other words, I don't have any wired devices on an access port in a VLAN / subnet that doesn't also contain the management IP.
As expected, my guest wireless network cannot access the management IP of the switch. It can access certain services on that subnet, but only because I explicitly allow that access in pfSense. In that regard, the switches behave exactly as I'd expect.
I suppose I should put a port into the VLAN for the guest network and test that way with a wired connection, but for my setup that test would be academic.
Next time I buy a switch for home use, I'll choose something different. If anyone can show me a 16 port fanless 1Gbps fully managed switch (with a proper CLI) I'd be ecstatic. For now, I'm not freaking out about it.
-
But pretty sure you can get to the management IP from any switch port.
How big of a security concern is this really? If the webgui is HTTP/S and you have a strong password on it then what is the security risk?
My setup is home use only so for me I'm not at all concerned about anyone on my network even caring to look for a switch or router on the network, I was just curious how much of an actual security vulnerability this would be on a larger network?
It's not, and I don't see any way to change it. I get it, these switches are basically the same price as a typical unmanaged switch. They're cheap and offer VLANs. That's about all I can say.
I just meant in general is it a security concern if you can force HTTP/S and put a good password on it.
I replaced my TP-Link with a Zyxel GS1900 and it allows you to force HTTP/S WebGUI. -
I just meant in general is it a security concern if you can force HTTP/S and put a good password on it.
I replaced my TP-Link with a Zyxel GS1900 and it allows you to force HTTP/S WebGUI.Yeah, got it. Sorry, my response was not entirely directed at you or the https question.
-
If anyone can show me a 16 port fanless 1Gbps fully managed switch (with a proper CLI) I'd be ecstatic.
It's 16 port, gigabit and fanless. But not quite fully managed, you might be interested though.
-
I have two of those and a DGS-1210-10P.
I have never seen them lose the config.
You do have to explicitly save it so maybe those donkeys weren't doing that.
-
Depend of VLAN configuration & PVID settings if TL-SG108E switch IP is allocated on different subnet than normal clients (vlan);
using a browser, web management interface can't be accessed by clients;
however it can be accessed with Easy Smart Configuration Utility program that allow you also to change the switch IP… for home use is almost ok but not for Office / Enterprise use.A page for Linux users about TL-SG108E:
https://shred.zone/cilla/page/383/setting-up-tp-link-tl-sg108e-with-linux.html -
@http://us.dlink.com/products/business-solutions/dgs-1100-08p/:
The DGS-1100-08P, 10MP, -24P and -26MP comply with the 802.3af/at PoE+ standards, supporting up to 30W on each PoE port, not to exceed the switches specific power budget.
@http://us.dlink.com/products/business-solutions/dgs-1100-08p/#tab-spec:
Power Budget 64W
-
UK market products might be different.
-
@ecfx:
Depend of VLAN configuration & PVID settings if TL-SG108E switch IP is allocated on different subnet than normal clients (vlan);
using a browser, web management interface can't be accessed by clients;
however it can be accessed with Easy Smart Configuration Utility program that allow you also to change the switch IP..FWIW there are 2 versions of the TL-SG108E. Both can be managed by the config utility but only V2 has a browser config interface. Source: I have one of each.
