TP-Link Easy Smart Switch security question



  • Hello,

    I'm planning to buy TP-Link Easy Smart lineup (TL-SG1016DE and TL-SG108E) so I can separate my LAN. Here's the current setup in my house.

    modem -> pfSense -> unmanaged switch (will replace this with easy smart switch) -> patch panel -> keystone jack / wall plate across several rooms in the house -> devices

    So what I'm trying to achieve is devices from other room won't be able to access the devices in my room. For example my sister laptop won't be able to access my NAS or PC.

    However I look around the internet and found this post on reddit about the easy smart switch lineup.

    I have one of these and it's a huge hassle to get it working just so you can change the default password at minimum.
    And more importantly the VLAN stuff, while obstensibly working, doesn't do network separation; an attacker on VLAN1 can spoof the ARP table for other VLANs. So it works but not for security, so it's useless.

    source: https://www.reddit.com/r/homelab/comments/4tym2z/best_cheap_gigabit_switch_4060/d7pvtxc/

    Is this true?

    I read the whole 14 pages I found in this forum : https://forum.pfsense.org/index.php?topic=76022.0 but I can't seem to find anyone mention it.

    Is there better alternative beside these easy smart lineup with similar price range?

    Any help will be appreciated and apologize for bad english


  • Netgate Administrator

    I have an SG1016DE and have had no issues with it. I've never really tested VLAN isolation to any depth, I have a hard time believing it's not isolated if configured correctly. I've never seen any stray traffic on the wrong VLAN/Port. I could probably run a test if you need me to.

    It's perhaps not the most intuitive GUI in the world but hard to argue with the price and I love that it's fanless. It will do what you need there.

    Steve



  • I suggest you also read this: http://www.aredn.org/content/tp-link-tl-sg108e-vlan-setup

    I considered getting either a TP-Link TL-SG108E or a Netgear GS108E https://www.netgear.com/business/products/switches/web-managed/GS108E.aspx

    I went with the Netgear GS108E and am happy with it.


  • Netgate Administrator

    You mean specifically the VLAN1 restriction?

    You should not ever use VLAN 1 for exactly these sorts of reasons. Switches often use VLAN 1 internally for untagged traffic and the results of trying to use it externally can be unpredictable.

    I haven't found it a restriction myself. Of course I'm not using VLAN1 though…  ;)

    Steve



  • You mean specifically the VLAN1 restriction?

    Yes, just in case it might be an issue.



  • @stephenw10:

    You mean specifically the VLAN1 restriction?

    You should not ever use VLAN 1 for exactly these sorts of reasons. Switches often use VLAN 1 internally for untagged traffic and the results of trying to use it externally can be unpredictable.

    I haven't found it a restriction myself. Of course I'm not using VLAN1 though…  ;)

    Steve

    So it should be fine as long as I stay away from the default VLAN1?



  • @warheat1990:

    @stephenw10:

    You mean specifically the VLAN1 restriction?

    You should not ever use VLAN 1 for exactly these sorts of reasons. Switches often use VLAN 1 internally for untagged traffic and the results of trying to use it externally can be unpredictable.

    I haven't found it a restriction myself. Of course I'm not using VLAN1 though…  ;)

    Steve

    So it should be fine as long as I stay away from the default VLAN1?

    No.

    Crappy fly-by-nite chinese company networking hardware is almost always full of security problems, you would be better off purchasing a used switch off ebay from a more reputable OEM.



  • @stephenw10:

    I've never really tested VLAN isolation to any depth, I have a hard time believing it's not isolated if configured correctly. I've never seen any stray traffic on the wrong VLAN/Port. I could probably run a test if you need me to.

    I'd appreciate if you can run a simple test to check if it's isolated correctly.


  • LAYER 8 Global Moderator

    Are we talking installation in a DOD facility or your house?? ;)

    Pretty sure it does vlan isolation, kind of useless of them to state its a smart switch with vlan support if it doesn't actually isolate the vlans..  It might be very limited in what "vlan" its managment IP is on - most likely its going to be default vlan 1 with no way to change it..  And will have to be untagged.

    I really don't see how that is an issue in a "home" setup.. Are you worried about someone coming into your house plugging into one of your switch ports and doing a vlan hop attack on you?  Really??? ;)

    While I agree in enterprise setup you always remove vlan 1, do not use vlan 1 etc.. Your management vlan is not vlan 1, etc etc etc..  But pretty sure your setting this up in you house right??  Your looking at very LOW END smart switches.. To expect the bells and whistles of a fully managed switch??  If you want the ability to change your management vlan away from an untagged vlan 1 setup then your going to have to spend a few more $'s

    But for quick and dirty hey I need to have vlan support on my home budget that is really low or the wife will kill me.. Then sure the tplink or negear low end less than $40 smart switches are fine.. I have a netgear 108ev3 in my av cabinet.  It does what it needs to do.. Not worried about someone plugging into my av cab switch and doing a vlan hop attack on me ;)  And yeah I run vlan 1 on my "home" network - its just easier!!

    I wish it did more, has not snmp support, etc.  again its a LOW END smart switch - you get what you pay for..  Now if you bump your budget to say closer to 200 then sure you can get some really feature rich switches..


  • Netgate Administrator

    If someone wants to suggest a test I can probably run it.

    I've never had any issues with it. I have different DHCP servers on different VLANs and clients always pull from the expected subnet.

    Yes the management interface is always on the default vlan, effectively untagged. I'm using it at home, that's not a problem.

    Steve


  • LAYER 8 Global Moderator

    Well per the link he gave says

    "attacker on VLAN1 can spoof the ARP table for other VLANs."

    So on vlan 1 can you arp for other devices on other vlans?  If you are connected to a vlan 1 port, can you spoof a mac that is on different vlan and then gain access to that vlan device?  I find it highly unlikely to be honest..  But then again this is a HOME setup.. Who exactly is going to have access to your vlan 1 in the first place?  And they are going to be doing a vlan hop attack?

    As you mentioned already if there was no actual layer 2 isolation then you would have issues with your multiple dhcp servers.  There are many switches that are open to vlan hoping attacks.. not just the cheap ones.. Especially if they are not configured secure..

    Either way I don't see how any of that really matters for a "home" setup.. It does what you need it to do right - which is isolate your traffic at layer 2.  It clearly does that ;)  Or Stephenw10 for example would have all kinds of issues with his dhcp servers and other vlans getting the wrong IP..

    You could use any of the vlan hopping pentesting tools, frogger comes to mind.



  • @warheat1990:

    … my sister laptop won't be able to access my NAS or PC...

    Unless your sister is a hardcore hacker this is totally over the top!
    Even if she was then there are different ways to solve this "problem" in the family - get her involved in testing the network security for example. But if she was she'd taken care of it already and not you…
    So you worry about problems you don't have.



  • I don't want to sound offensive, but my question is simple if this have proper isolation before I drop $150 on it. I don't see any relevance on "this is home switch, you better not to expect anything", well yeah if it doesn't do anything that I want it, I'd rather invest in a better switch because $150 is not cheap for me.

    And I don't see any relevance in "your sister is probably not a hacker" or "this is highly unlikely someone's going to come to your house and plug something into the port". Well it's also very highly unlikely that someone will get your modem or router password especially if you turn your wifi off so why not just leave the default admin/admin or it's also very highly unlikely someone will get into your email account especially if you have 2 way auth so don't bother with password manager.

    I mean what's the point of the discussion then? That being said, I'm new here so I don't know how things work around here and I don't mean disrespect, but these responses are definitely not what I expected.



  • I'm new here so I don't know how things work around here and I don't mean disrespect, but these responses are definitely not what I expected.

    We get a fair amount of people (usually with little networking knowledge) who think they're trying to secure their family photos from nefarious Russian super-hackzors.  This usually leads to overly-complex configurations that nobody can decipher.  Gauging your users & their abilities will help you to determine how tightly to wind the tinfoil around your head.  I run networks at the office and at home.  At the office, everything is locked down.  At home, things are much looser since my family wouldn't know a network if they tripped over the Ethernet cable.

    For what it's worth, I just bought the 105E over the holidays for $40, but I haven't had much time to play with it or its VLAN support.



  • No offense taken.

    @warheat1990:

    before I drop $150 on it.

    What do you want to buy for $150?
    A TL-SG108E is something like 25 Euros which should be $30 max, double that for a TL-SG1016DE

    Personally, I don't like Esay Smart Switches and prefer one step up. Have a look at the TL-SG3210 of which I use multiple myself at home.

    Don't use VLAN1 for anything and you should be fine and have proper isolation.



  • I've got 2 of the TL-SG108E and while they're basic in function, they are inexpensive and do work as intended.  They will indeed provide the level of security you're looking for, as long as you have the networking knowledge to do so.



  • @jahonix:

    A TL-SG108E is something like 25 Euros which should be $30 max, double that for a TL-SG1016DE

    Where do you find 1016DE for $60? Here 1016DE is about $125 but it's currently on sale on Amazon for $100, 108E is about $25-30.



  • @warheat1990:

    Where do you find 1016DE for $60?

    I just looked here

    but it seems that those are only TL-SG1016D, which is the unmanaged version.

    The version in question isn't that much more expensive though:

    That is including 19% VAT.

    This isn't, that's dealer cost…

    ![Bildschirmfoto 2017-01-04 um 09.52.16.png_thumb](/public/imported_attachments/1/Bildschirmfoto 2017-01-04 um 09.52.16.png_thumb)
    ![Bildschirmfoto 2017-01-04 um 09.52.16.png](/public/imported_attachments/1/Bildschirmfoto 2017-01-04 um 09.52.16.png)
    ![Bildschirmfoto 2017-01-04 um 09.51.08.png](/public/imported_attachments/1/Bildschirmfoto 2017-01-04 um 09.51.08.png)
    ![Bildschirmfoto 2017-01-04 um 09.51.08.png_thumb](/public/imported_attachments/1/Bildschirmfoto 2017-01-04 um 09.51.08.png_thumb)
    ![Bildschirmfoto 2017-01-04 um 10.03.26.png](/public/imported_attachments/1/Bildschirmfoto 2017-01-04 um 10.03.26.png)
    ![Bildschirmfoto 2017-01-04 um 10.03.26.png_thumb](/public/imported_attachments/1/Bildschirmfoto 2017-01-04 um 10.03.26.png_thumb)



  • Hi,
    I just bought one TL-SG108E ( it is v2 with web management interface HTTP ) and price is ~30Euro.

    PVID 1 it is default and can't be changed.

    I defined 3 VLANS
    101 for WIFI private
    103 for WIFI guests
    105 for LAN private

    I wanted to use port 8 as Trunk & port 6 & 7 for AP:
    port 8 from pfSense interface Tagged ( for VLAN 101 & 103 & 105 )
    port 7 Tagged to AP1 CISCO 2602 ( for VLAN 101 & 103 ).
    port 6 Tagged to AP2 CISCO 2602 ( for VLAN 101 & 103 ).
    port 3-2-1 Untagged to LAN devices ( for VLAN 105 ).

    It's working, but in this configuration watching with NTOPNG on each VLAN interface it reveal that all traffic, from other/all VLANs it is broadcasted / visible in every VLAN interface, not exactly what I wanted … any ideas ?






  • @n3by:

    PVID 1 it is default and can't be changed.

    Yes, it can.  I have a simple setup with two of the TL-SG108E (one of which is V1, the other V2) and I changed the PVID of all ports to my primary VLAN ID (not 1).  My primary VLAN is for my home LAN; the only other VLAN I have defined is for my guest network and that is provided entirely via wireless.  So I set the port for my Ubiquiti AP to tag that one, and the port for my ESXi box (which hosts pfSense) to tag both.  The tagged traffic is passed to the pfSense VM still tagged via a port group in ESXi with VLAN ID 4095 (which is ESXi's version of a trunk.  In other words, pass all traffic with tags intact).  I also have an uplink between the two switches, which tags both VLANS.  No problems here; everything works as expected and traffic is isolated.  It's not super intuitive if you've come from managing switches that have a Cisco-like CLI, but once you get it, it works.

    I'm showing the web interface of the V2 switch here because I'm on my Mac and can only access the V1 switch with a Windows app (at least easily).



  • For me it look like you can change PVID for any port, only if that port is member in that VLAN… if you can show the VLAN Configuration page we can see exactly what you set.



  • @n3by:

    For me it look like you can change PVID for any port, only if that port is member in that VLAN…

    Then change the PVID to whatever VLAN you want that port to be a member of.

    Here's my tagging config for my V2 switch.  Port 1 is the trunk between the two switches.  Port 4 is connected to my Ubiquiti AP.  Bear in mind I have another V1 switch connected to this one, so you're not seeing the whole picture:



  • Exactly how I anticipated I already tested this model of config and for my config will not solve that all traffic is mirrored on all VLANs.

    Now when you have time have a look with NTOPNG in every VLAN interface you defined and let us know if you see all tagged traffic from all VLAN.

    For example in your VLAN 11 you will see all traffic from 44, for me this is not normal to be seen there.

    In my test all traffic from all clients on LAN, WIFI can be seen also on GUESTS… etc.



  • The only thing I can see wrong with your config is that some of your ports are still set to PVID 1.

    I'm coming from a world where I manage Dell Powerconnect switches.  In Dell CLI parlance (and I think Cisco is similar), there are two main switchport modes, access, and trunk.  Setting a switchport to access with the command "switchport access vlan 44" tells the switch to tag any incoming traffic on that port with VLAN 44, and to send any traffic on VLAN 44 out of that port, removing the tag in the process.  In reality it's a bit more than that, since it is, after all, a switch, and learns MAC addresses, thereby avoiding sending all VLAN 44 traffic over all VLAN 44 ports.  But let's ignore that for now.

    So, to mirror that behavior on the TP-LINK switch, you need to set the port as an untagged member in VLAN 44, but you also need to set the PVID to 44.  The reason for this, as I understand it, is that the untagged setting tells the switch to send VLAN44 out of the port, but it doesn't tell it what to do with incoming untagged traffic.  That's what the PVID setting does.  For a port with PVID 44, any incoming traffic that's not already tagged with a VLAN ID will get tagged with 44.  (someone correct me if I'm wrong on this, please).

    The other mode on the Dell switch is trunk.  This is used in a situation where we want to send traffic with VLAN tags intact, so that the device on the other end can handle the VLANs.  That device could be anything:  a pfsense router with multiple VLAN interfaces, another switch, whatever.  In that case, we set the port with "switchport trunk allowed vlan add 44" and "switchport trunk allowed vlan add 11".  (I'm using my own VLAN IDs here, obviously).  So, that works in the case where all the traffic on the port is tagged.  But what if we want to handle untagged traffic on a trunk port as well?  In that case, we also set "switchport trunk native vlan 15" and then any untagged ingress traffic will get VLAN ID 15. [EDIT:  and egress traffic for VLAN 15 would be sent over the port as well, untagged.]  That's roughly equivalent to the PVID setting on the TP-LINK switch.  That comes in handy in the case of a device like the Ubiquiti AP, where the management network is untagged, but the SSIDs handle tagged traffic in different VLANs than the management network.

    To mirror the trunk allowed setting on the TP-LINK switch, you just need to set the port as a tagged member of whichever VLANs you want to trunk.  The PVID will still be in place, and will handle any untagged traffic coming into the port, if there is any.  The PVID setting comes in handy again for devices like the Ubiquiti AP.  My own has its management interface in VLAN44 and also serves an SSID in that VLAN.  So the port it's connected to is untagged 44 and PVID 44.  But it also serves an SSID in VLAN 11, so the port is also set to tag VLAN 11.  That's port 4 in the screenshots I've posted.

    I've checked with ntopng and also with tcpdump and I don't see any untoward traffic on any of my interfaces.


  • Netgate Administrator

    @n3by Are you sure ntopng is not listening on the parent interface in pfSense?

    Even if the switch were leaking traffic from VLANs you don't have 103 or 101 untagged or set as PVID anywhere so it's hard to believe that traffic could end up on those?

    Steve



  • I was really surprised and I double checked, also on history traffic log:
    As you can see all VLAN 101-103-105 had the same high traffic spike ( one week ago ) but on VL103 = Guest I don't had / have any client.

    At the moment I am using SG-108E only as L3 switch for LAN.
    Next day I disabled VL105 and moved back to separate network interface ( this is why in history log now is showed as opt2 instead of VL105 ).
    I moved back on another separate network interface VL101 & VL103 managed only by pfSense ( and a no-managed switch as trunk to connect the APs to pfSense ) so no more problems with unwanted traffic on VLANs.








  • I want to restate what's being said here because I believe that these TP-Link "Easy Smart Switches" do indeed have a fundamental flaw with their VLAN implementation. I hope this can serve as a warning for future prospective buyers.

    I am a networking professional and I have been using pfSense appliances in my personal network for years. Power consumption is something that I'm trying to minimize as of late, so I wanted to purchase a low power switch that supported VLANs so that I could implement a "pfSense on a stick" style network with a slightly older low power Intel NUC that only has one 1gbps port. It was to be a fairly simple deployment with one "access port" on a VLAN designated for the "WAN" (external network, VLAN99), several "access ports" designated for the "LAN" (internal network, VLAN10) and one "trunk" port which would trunk these two networks into the pfSense appliance.

    Flaw #1: The first flaw with this switch is that you have no control over the management interface with regard to VLANs. On a Cisco switch, there is the concept of an "Interface VLAN" where you can select what VLAN you wish to attach a layer-three interface. Not only do these TP-Link switches switch lack that functionality, they instead allow access to their management IP interface from all ports on the switch regardless of the VLAN or PVID configured.

    Here is how to test this: For anyone who has this switch configured with multiple VLANs, plug a computer into any port on the switch and hard-code your IP to be in the same subnet as the switches management IP and ping the switch. I am able to access the management IP of the switch from any port regardless of changes made to the "802.1Q VLAN Configuration" tab or the "802.1Q PVID Setting" tab. This is a huge security issue in router on a stick deployment such as the one outlined above

    When I noticed this behavior, I quickly pulled out my old WireShark PC and the results were simply baffling:

    Flaw #2: Any broadcast received on a port whose PVID is set to VLAN1 will be flooded out of all ports regardless of the VLAN or PVID settings. Easy enough, just don't use VLAN1 right? This was verified by injecting ARP requests into port 8 and monitoring every other port with WireShark (see photos which contain my configuration settings).

    Flaw #3: Traffic sourced from the switch's management IP address is flooded out of all ports regardless of the destination MAC address or the VLAN or PVID settings. This was verified by opening a browser and pointing it to the switches web based management while connected to a port set to PVID of VLAN 10. This resulted in WireShark showing a flood of HTTP traffic sourced from the MAC address of the switch egressing a port whose PVID and untagged VLAN setting was set to VLAN99 or VLAN1.

    I purchased two of these TP-Link switches over the past few weeks. The first was the 8 port model: TL-SG108E 2.0, which I promptly returned upon the discovery of this "flaw". The second was model: TL-SG1024DE 2.0 which was on sale for the ridiculously low price of 35$ after mail-in rebate at Amazon. Both exhibited the same behavior.

    I guess that why they always say: caveat emptor!

    ![TL-SG108E PVID SETTINGS.PNG](/public/imported_attachments/1/TL-SG108E PVID SETTINGS.PNG)
    ![TL-SG108E PVID SETTINGS.PNG_thumb](/public/imported_attachments/1/TL-SG108E PVID SETTINGS.PNG_thumb)
    ![TL-SG108E VLAN SETTINGS.PNG](/public/imported_attachments/1/TL-SG108E VLAN SETTINGS.PNG)
    ![TL-SG108E VLAN SETTINGS.PNG_thumb](/public/imported_attachments/1/TL-SG108E VLAN SETTINGS.PNG_thumb)


  • LAYER 8 Global Moderator

    Why do you not remove the ports from vlan 1.. Clearly from your shot showing that you have multiple untagged ports on a port then yeah if you send broadcast traffic on vlan 1, and the port is a member of vlan 1 it should see that traffic..

    If your saying there is no way to remove a port from untagged 1 then sure that would be an issue, but looks like you can do it on the screen you posted above - you just didn't do it.. Not talking about delete vlan 1, talking about taking port out of the vlan vs it being a member of 2 in an untagged state.

    "which was on sale for the ridiculously low price of 35$ after mail-in rebate at Amazon"

    Really.. That is not what I show, I show that the rebate is $30.. So puts the price at 80$  If there was a mistake and you got the switch for $30 sweet for you!!  But I am guessing more same sort of info that didn't get right either ;) Just Sayin…

    I don't have one of the tplink to test with, but I have a netgear that is same sort of price point.. Dirt Cheap - and "smart" to the point it does vlans but not much else.  Same thing you can not delete vlan 1 on the device.  But you can for sure remove a port from being untagged in more than one vlan and can change its pvid..

    It doesn't protect you from stupid configurations.. See last pic where I put port 2 in vlan 1 and vlan 20 as untagged.










  • On first top row, Delete box with VLAN 1 and ports 1-8 it is disabled.

    It looks like always all switch ports are part of VLAN 1, even you assign them to other VLAN.

    From my test in ALL configuration even you assign to the switch an management IP in another class; out of all your LAN / VLAN sub-net,
    all port and clients connected to switch are allowed to access that management switch IP, without restriction.

    All you have to do is to change client IP in the same sub-net as switch IP, TPLink sw management utility will always display switch IP so is no need to scan for all IP range.
    Because it is HTTP and management traffic is broadcasted on all ports it is easy to access/sniff the configuration account.

    This Chinese switch looks like a perfect Trojan horse.

    p.s
    in V2 ASIC is RTL8367c… maybe later a custom firmware will be ported.



  • Yeah, as n3by says, you can't check that box or edit VLAN1 in any way. I even tried to edit the the HTML code surrounding that checkbox with Chrome's Development console to no avail.

    @johnpoz:

    Really.. That is not what I show, I show that the rebate is $30.. So puts the price at 80$  If there was a mistake and you got the switch for $30 sweet for you!!  But I am guessing more same sort of info that didn't get right either ;) Just Sayin…

    It must have been some sort of price mistake and it popped up on a deal site (https://slickdeals.net/f/9686276) for $35. I figured even with this "VLAN flaw" it would still work well as a "dumb" switch for a network contained to a single broadcast domain at that price.

    @n3by:

    in V2 ASIC is RTL8367c… maybe later a custom firmware will be ported.

    I was going to look into this somewhat. Not necessary "custom" firmware, but I had hopes that there may be a way to port the Netgear firmware over (assuming they use the same or similar hardware).

    Does anybody think we have any recourse with TP-Link support to get a new firmware released? In this day and age where some of the largest ever DDoS attacks are sourced from IP camera DVRs and other embedded devices, one would think that a company would make it a priority to resolve security issues of this nature.



  • I e-mailed a TP-Link engineer I met at a trade show last year. I'll report back what he responds.
    Be gentle, I linked this thread to him.


  • LAYER 8 Global Moderator

    Not talking about editing the vlan 1, I am talking about removing the port from the vlan.. If you can not remove a port from being in vlan 1 as untagged then you have a problem sure.. The switch is doing what it says its going to do.. Port 1-8 are set to be untagged vlan 1.. So yeah any traffic on vlan 1 that is broadcast traffic should flood out those ports as untagged.

    Does not matter that you set PVID to.. All this says that hey untagged traffic I see INBOUND to this port, this is the vlan that traffic is in..

    So your using the webgui - can you try their utility software?  Maybe their is bug in their code in the web gui for removal of ports from vlan 1?  I have half a mind to just order one of these to play with.. But from what you posted the switch is doing what its configured to do..  All ports are in vlan 1 untagged.  Any broadcast traffic that it see inbound to a port that has pvid of 1, will be flooded out every other port that as being in vlan 1..

    Generate your broadcast traffic inbound to a port that has its pvid set to something other than vlan 1.  That untagged traffic would be in that vlan and not broadcast out vlan 1 ports.  But in the current config state any traffic ingress to ports 1 or 8 that have pvid of 1 would be flooded out all the ports since they are listed as being untagged in vlan 1.

    If you set all the pvid to something else other than 1 - can you still get to the IP of the switch?  Does the config software utility still work?



  • Johnpoz, I think you have the right idea.  I have a TL-SG2008 and a couple of TL-SG3424's and removed all the ports from the default VLAN 1 when I set them up.  I don't think you can delete VLAN 1, but on my models at least you can remove all the ports from it.  All the PVID's are set to something other than 1 and I can still reach the IP of the switch.  I've never seen any traffic bleeding from one vlan to another.



  • @johnpoz:

    Not talking about editing the vlan 1, I am talking about removing the port from the vlan.. If you can not remove a port from being in vlan 1 as untagged then you have a problem sure.. The switch is doing what it says its going to do.. Port 1-8 are set to be untagged vlan 1.. So yeah any traffic on vlan 1 that is broadcast traffic should flood out those ports as untagged.

    Does not matter that you set PVID to.. All this says that hey untagged traffic I see INBOUND to this port, this is the vlan that traffic is in..

    So your using the webgui - can you try their utility software?  Maybe their is bug in their code in the web gui for removal of ports from vlan 1?  I have half a mind to just order one of these to play with.. But from what you posted the switch is doing what its configured to do..  All ports are in vlan 1 untagged.  Any broadcast traffic that it see inbound to a port that has pvid of 1, will be flooded out every other port that as being in vlan 1..

    Generate your broadcast traffic inbound to a port that has its pvid set to something other than vlan 1.  That untagged traffic would be in that vlan and not broadcast out vlan 1 ports.  But in the current config state any traffic ingress to ports 1 or 8 that have pvid of 1 would be flooded out all the ports since they are listed as being untagged in vlan 1.

    If you set all the pvid to something else other than 1 - can you still get to the IP of the switch?  Does the config software utility still work?

    I'll have to double check, but I think all ports remain untagged in VLAN 1 no matter what we do.  That could explain some of the behavior reported, but I've had no problem keeping traffic isolated.  I have my PVID set to something other than VLAN1 on all ports and can still hit the management interface.  There is no way to define a VLAN for the management interface that I can see.



  • Is there any update on this?

    @jahonix, did the TP-Link engineer ever answer your questions? I'm especially interested in the option to be able to set a management VLAN on the Easy Smart switches.



  • @Vlado:

    did the TP-Link engineer ever answer your questions?

    Unfortunately not, I would have let you know otherwise.
    I'm confident to meet some TP-Link guys at CeBIT this March. I'll point them to this thread.


  • Galactic Empire

    Any updates on this thread? Seems like this is a serious problem.



  • @ivor:

    Any updates on this thread? Seems like this is a serious problem.

    I haven't seen any firmware updates that allow removing VLAN1 untagged from the switch ports.  I'm guessing TP-Link sees this as a feature, so that the end user can avoid having to set up the management interface on a VLAN and perhaps locking themselves out of managing the switch, since there's no console or anything like that.

    Of course I understand the implications, and obviously these switches are meant for home use. I'd be curious to hear what TP-Link says about it, but that's my guess.


  • Banned

    I got one of these and immediately returned it.

    I ended up with a zyxel gs1900-8hp, it's 70W of PoE over all 8 ports for $100. It didn't have the forced VLAN 1, and it even has a telnet CLI you can activate and a header for serial access.  MUCH better GUI and many more features!

    The non-PoE version is I think $60. So almost double the price of a tplink might not be interesting but I thought I'd throw it out there.

    I actually kept my LAN on VLAN1. It's for home use and you can force HTTP/S only acces, that combined with a strong password keeps me from worrying about needing a management only interface.



  • @ivor:

    Any updates on this thread?

    Sorry, I didn't make it to CeBIT. Workload prohibited going there.
    And the engineer I talked to last year never responded to my mails.


Log in to reply