TP-Link Easy Smart Switch security question

[jahonix]

Check if there's a checksum or such yourself?

a) save config_1
b) change something small like hostname one character from lower to upper case. Don't change length.
c) save config_2
d) diff config_1 and config_2

e) report result.

[stephenw10]

Speculating….

The things that change other than the config change are the password seems to be re-hashed and stored twice. And at the begging of the file there is a 16bit value that changes. I'd bet that's a 16bit checksum but of what exactly I'm not sure. Or what algorithm... Not found a match so far.

Steve

[JKnott]

I can not access PCs that belong on another VLAN.  Would you please confirm that's what you're seeing too?

That's how VLANs are supposed to work, as though each VLAN is on a separate switch.  It's the accessing the management from any VLAN that's messed up.  It should be possible to have the management on it's own VLAN, unreachable from any other.

[tpham3783]

@ecfx:

Sg108E: at least in GUI I deleted default vlan 1.

Good find!

I've always thought they implemented a front-end logic (webpage) for first vlan to be non-editable; hence you must have the first vlan as a place holder!

Thanks!

[thuety]

@ecfx:

Sg108E: at least in GUI I deleted default vlan 1.

Thanks, didn't have the courage to try this ;)

I'm guessing the hex 01 is VLAN 1.

[n3by]

yes, and this changes seem to persist if you add-delete-change other vlans.

If I could figure how to set 2 "true" - trunk ports will be great.

p.s.
After that I made yesterday other try that soft bricked the switch but can be fix easy with hard button reset.

[lexxai]

@stephenw10:

Hmm, using:

Firmware Version 1.0.1 Build 20131023 Rel.33236
Hardware Version TL-SG1016DE 1.0

Refuses any edited config

Invalid config file! Please double check!

Yet lexxai seems to be good on his 1016DEv2….

Steve

I have same troubles with return to device changed configuration file…

[juanchopablo]

I have 2 108v2, what would I have to edit if I want to remove vlan 1 just from ports 7 and 8?

Thanks,

[stephenw10]

@lexxai:

I have same troubles with return to device changed configuration file…

Hmm, damn.
What is that checksum I wonder….

Steve

[bilbo]

Is this vlan 1 issue the reason i see tplink broadcast traffic on all ports? I have the five port.

Edit: I did the hex hack and removed all ports from the vlan but still see this broadcast, any pointers on stopping it.

edit: scrap that, it appears to have been the loop detection setting! Nice to get rid of the default vlan though.


[tpham3783]

Hi all,

It looks like tplink is going to fix the issue related to unlinking vlan1 according to this thread http://forum.tp-link.com/showthread.php?96245-TL-SG-108E-V2-VLAN-1-tagging#post226139

They will have a beta firmware to test in a week or two.  I am glad that the company has regnonized that it is a bug and is taking corrective action.

[johnpoz]

hehe - sweet… Will for sure fire the POS sitting on my shelf when this beta firmware comes out..

[stephenw10]

Mmm, better late than never I guess.  ;)

I hope they might think about fixing some other models, such os the one I have. Though it's way old at this point so I'm not holding my breath!

Steve

[BrucexLing]

@tpham3783:

They will have a beta firmware to test in a week or two.  I am glad that the company has regnonized that it is a bug and is taking corrective action.

This could put TPLink back on the pedestal with a product fit for purpose.

[n3by]

http://forum.tp-link.com/showthread.php?96245-TL-SG-108E-V2-VLAN-1-tagging&p=227797&viewfull=1#post227797

New firmware released for:
TL-SG105E v3
TL-SG108E v3

I tested 108E v2 and can be flashed with v3 Firmware Version: 1.0.0 Build 20171214 Rel.70905

It look like only a minor cosmetic change to allow VLAN1 edit ( like I did it on config edit some time ago ) and not a security update to fix management access from any port/vlan.

[stephenw10]

:(

[johnpoz]

so if you broadcast on vlan 1 all ports see it?  WTF?

[Apocalypse]

@stephenw10 Maybe is CRC16/CCITT (kermit) or CRC16/X-25. Yoy can try hashing the config file in this or more CRC16 algorithms with the checksum offsets filled with zeros or FF and compare results with original checksum. This checksum is based on config file, maybe in full config because this can verify every change made.

[noplan]

@johnpoz said in TP-Link Easy Smart Switch security question:

While I agree in enterprise setup you always remove vlan 1, do not use vlan 1 etc.. Your management vlan is not vlan 1, etc etc etc

As long as u can remove vlan1 from the ports u r pretty safe
Removing VLAN 1 not workin on a lot of lower priced switches..
eg zyxel or Dlink

I was pretty sure that
I can remove vlan1 membership of ports on tplink smart switches in 2019/2020

Hmmm gonna check

[johnpoz]

@noplan said in TP-Link Easy Smart Switch security question:

Removing VLAN 1 not workin on a lot of lower priced switches..

Not true at all.. I have multiple low priced smart switches on the shelf to play with.. Only one that did this nonsense where you could not remove vlan 1 from a port was the tplink that I have run into..