• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

TP-Link Easy Smart Switch security question

Hardware
44
185
78.6k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • T
    tpham3783
    last edited by Dec 22, 2017, 4:40 PM

    Hi all,

    It looks like tplink is going to fix the issue related to unlinking vlan1 according to this thread http://forum.tp-link.com/showthread.php?96245-TL-SG-108E-V2-VLAN-1-tagging#post226139

    They will have a beta firmware to test in a week or two.  I am glad that the company has regnonized that it is a bug and is taking corrective action.

    1 Reply Last reply Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator
      last edited by Dec 22, 2017, 5:06 PM

      hehe - sweet… Will for sure fire the POS sitting on my shelf when this beta firmware comes out..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

      1 Reply Last reply Reply Quote 0
      • S
        stephenw10 Netgate Administrator
        last edited by Dec 22, 2017, 7:29 PM

        Mmm, better late than never I guess.  ;)

        I hope they might think about fixing some other models, such os the one I have. Though it's way old at this point so I'm not holding my breath!

        Steve

        1 Reply Last reply Reply Quote 0
        • B
          BrucexLing
          last edited by Dec 24, 2017, 3:14 AM

          @tpham3783:

          They will have a beta firmware to test in a week or two.  I am glad that the company has regnonized that it is a bug and is taking corrective action.

          This could put TPLink back on the pedestal with a product fit for purpose.

          1 Reply Last reply Reply Quote 0
          • N
            n3by
            last edited by Jan 9, 2018, 3:00 PM

            http://forum.tp-link.com/showthread.php?96245-TL-SG-108E-V2-VLAN-1-tagging&p=227797&viewfull=1#post227797

            New firmware released for:
            TL-SG105E v3
            TL-SG108E v3

            I tested 108E v2 and can be flashed with v3 Firmware Version: 1.0.0 Build 20171214 Rel.70905

            It look like only a minor cosmetic change to allow VLAN1 edit ( like I did it on config edit some time ago ) and not a security update to fix management access from any port/vlan.

            1 Reply Last reply Reply Quote 0
            • S
              stephenw10 Netgate Administrator
              last edited by Jan 9, 2018, 3:12 PM

              :(

              1 Reply Last reply Reply Quote 0
              • J
                johnpoz LAYER 8 Global Moderator
                last edited by Jan 9, 2018, 3:33 PM

                so if you broadcast on vlan 1 all ports see it?  WTF?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 0
                • A
                  Apocalypse @stephenw10
                  last edited by Apocalypse Sep 25, 2020, 8:42 PM Sep 25, 2020, 8:38 PM

                  @stephenw10 Maybe is CRC16/CCITT (kermit) or CRC16/X-25. Yoy can try hashing the config file in this or more CRC16 algorithms with the checksum offsets filled with zeros or FF and compare results with original checksum. This checksum is based on config file, maybe in full config because this can verify every change made.

                  1 Reply Last reply Reply Quote 0
                  • N
                    noplan @johnpoz
                    last edited by noplan Sep 26, 2020, 6:53 AM Sep 26, 2020, 6:51 AM

                    @johnpoz said in TP-Link Easy Smart Switch security question:

                    While I agree in enterprise setup you always remove vlan 1, do not use vlan 1 etc.. Your management vlan is not vlan 1, etc etc etc

                    As long as u can remove vlan1 from the ports u r pretty safe
                    Removing VLAN 1 not workin on a lot of lower priced switches..
                    eg zyxel or Dlink

                    I was pretty sure that
                    I can remove vlan1 membership of ports on tplink smart switches in 2019/2020

                    Hmmm gonna check

                    1 Reply Last reply Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator
                      last edited by Sep 26, 2020, 11:33 AM

                      @noplan said in TP-Link Easy Smart Switch security question:

                      Removing VLAN 1 not workin on a lot of lower priced switches..

                      Not true at all.. I have multiple low priced smart switches on the shelf to play with.. Only one that did this nonsense where you could not remove vlan 1 from a port was the tplink that I have run into..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      N 1 Reply Last reply Sep 26, 2020, 11:42 AM Reply Quote 0
                      • N
                        noplan @johnpoz
                        last edited by Sep 26, 2020, 11:42 AM

                        @johnpoz

                        tplink, cool we use them a lot for low budget setups
                        And always remove VLAN 1 but yep depending on version and firmware

                        Never run into a problem on an audit or cert when we told them
                        That there is no default VLAN (1) on the switch

                        But bottom line... Remove vlan1 on low budget switch removes some security concerns tooooo

                        😎

                        1 Reply Last reply Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator
                          last edited by Sep 26, 2020, 11:44 AM

                          @noplan said in TP-Link Easy Smart Switch security question:

                          That there is no default VLAN (1) on the switch

                          So you lied to them..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          N 1 Reply Last reply Sep 26, 2020, 11:46 AM Reply Quote 0
                          • N
                            noplan @johnpoz
                            last edited by Sep 26, 2020, 11:46 AM

                            @johnpoz

                            No port is member to vlan1

                            I would never ever lie to a 3rd party auditor ggggggggg

                            1 Reply Last reply Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator
                              last edited by johnpoz Sep 26, 2020, 11:48 AM Sep 26, 2020, 11:46 AM

                              that is different than removing vlan 1 from the device and setting a different vlan as default ;)

                              The reason tplink stated you couldn't remove vlan 1 on a port, is you wouldn't be able to admin the switch.. Its possible on those low end switches that do not allow you to change the default vlan.. 1 port has to remain in vlan 1 to be able to admin it.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              N 2 Replies Last reply Sep 26, 2020, 11:48 AM Reply Quote 0
                              • N
                                noplan @johnpoz
                                last edited by Sep 26, 2020, 11:48 AM

                                @johnpoz

                                Default VLAN ist always 666 👺👺👺

                                As long as the core switches supports this funNonsens

                                1 Reply Last reply Reply Quote 0
                                • N
                                  noplan @johnpoz
                                  last edited by Sep 26, 2020, 11:50 AM

                                  @johnpoz said in TP-Link Easy Smart Switch security question:

                                  1 port has to remain in vlan 1 to be able to admin it.

                                  Yes true...

                                  Got one tplink in the mail today to set up for a super low budget... I'm gonna check this VLAN1 fun next hours....

                                  First New Light bulbs needed :)

                                  1 Reply Last reply Reply Quote 0
                                  • N
                                    noplan
                                    last edited by Sep 28, 2020, 7:36 AM

                                    so back with the budget project report ...
                                    (at the moment ~ 20 - 28 EUR incl. VAT)

                                    login-to-view

                                    u can remove VLAN1 from all ports (not member of) ;)

                                    but u have to use both (if not both is set its not gonna work)

                                    login-to-view

                                    works wit an uplink from coreswitch (Cisco / HP)
                                    and direct filled from pfS

                                    brNP

                                    1 Reply Last reply Reply Quote 1
                                    • A
                                      Apocalypse
                                      last edited by Sep 28, 2020, 8:04 AM

                                      TL-SG108E v1.0/v2.0: You can edit .cfg with hex editor and remove ports from VLAN1, mark as tagged or even remove VLAN1 completely. v2.0 can be flashed with v3.0 firmware.

                                      TL-SG108E v3.0/v4.0/v5.0: Allow remove ports from VLAN1, or mark as tagged.

                                      TL-SG105E v1.0/v2.0: .cfg can be modified. I don't know if v2.0 can be flashed with v3.0 firmware.

                                      TL-SG105E v3.0/v4.0/v5.0: Allow remove or tag ports from VLAN1.

                                      TL-SG1016DE v1.0/v2.0: Verifies .cfg checksum, and if it does not match, it cannot be restored.

                                      TL-SG1016DE v3.0/v4.0: Allow remove ports from VLAN1 or mark as tagged.

                                      N 1 Reply Last reply Sep 28, 2020, 8:13 AM Reply Quote 0
                                      • N
                                        noplan @Apocalypse
                                        last edited by Sep 28, 2020, 8:13 AM

                                        @Apocalypse

                                        wow pretty cool info ... thanks a lot !

                                        pricing in retail incl. VAT 28EUR for SG108E and 20EUR for SG105E
                                        makes it pretty easy to go with the SG108E for low budget projects

                                        brNp

                                        1 Reply Last reply Reply Quote 0
                                        • N
                                          noplan
                                          last edited by Sep 28, 2020, 11:52 AM

                                          lets have a look how these little TPLinks perform out in the wild ....
                                          never done a LAG group for a VLAN before ... i think i have to test it ...well ;)

                                          haha this will e so much fun ;)
                                          any hints / ideas or inputs are welcome ;)

                                          login-to-view

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.