pfSense Gold Subscription

Author Topic: TP-Link Easy Smart Switch security question  (Read 8313 times)

0 Members and 1 Guest are viewing this topic.

Offline jahonix

  • Hero Member
  • *****
  • Posts: 2404
  • Karma: +144/-14
  • volunteer since 2006
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #30 on: January 20, 2017, 11:09:07 am »
I e-mailed a TP-Link engineer I met at a trade show last year. I'll report back what he responds.
Be gentle, I linked this thread to him.
Chris

The issue with IPv6 jokes is that almost no one understands them and no one is using them yet.

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 14299
  • Karma: +1330/-193
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #31 on: January 21, 2017, 08:41:12 am »
Not talking about editing the vlan 1, I am talking about removing the port from the vlan.. If you can not remove a port from being in vlan 1 as untagged then you have a problem sure.. The switch is doing what it says its going to do.. Port 1-8 are set to be untagged vlan 1.. So yeah any traffic on vlan 1 that is broadcast traffic should flood out those ports as untagged.

Does not matter that you set PVID to.. All this says that hey untagged traffic I see INBOUND to this port, this is the vlan that traffic is in..

So your using the webgui - can you try their utility software?  Maybe their is bug in their code in the web gui for removal of ports from vlan 1?  I have half a mind to just order one of these to play with.. But from what you posted the switch is doing what its configured to do..  All ports are in vlan 1 untagged.  Any broadcast traffic that it see inbound to a port that has pvid of 1, will be flooded out every other port that as being in vlan 1..

Generate your broadcast traffic inbound to a port that has its pvid set to something other than vlan 1.  That untagged traffic would be in that vlan and not broadcast out vlan 1 ports.  But in the current config state any traffic ingress to ports 1 or 8 that have pvid of 1 would be flooded out all the ports since they are listed as being untagged in vlan 1.

If you set all the pvid to something else other than 1 - can you still get to the IP of the switch?  Does the config software utility still work?
« Last Edit: January 21, 2017, 08:48:46 am by johnpoz »
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.3.4_p1 (work)
1x 2.4.2-RELEASE on VM esxi 6.5 (home)

Offline wbond

  • Jr. Member
  • **
  • Posts: 36
  • Karma: +3/-0
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #32 on: January 21, 2017, 09:20:51 am »
Johnpoz, I think you have the right idea.  I have a TL-SG2008 and a couple of TL-SG3424's and removed all the ports from the default VLAN 1 when I set them up.  I don't think you can delete VLAN 1, but on my models at least you can remove all the ports from it.  All the PVID's are set to something other than 1 and I can still reach the IP of the switch.  I've never seen any traffic bleeding from one vlan to another.

Offline whosmatt

  • Sr. Member
  • ****
  • Posts: 432
  • Karma: +27/-0
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #33 on: January 22, 2017, 09:48:20 pm »
Not talking about editing the vlan 1, I am talking about removing the port from the vlan.. If you can not remove a port from being in vlan 1 as untagged then you have a problem sure.. The switch is doing what it says its going to do.. Port 1-8 are set to be untagged vlan 1.. So yeah any traffic on vlan 1 that is broadcast traffic should flood out those ports as untagged.

Does not matter that you set PVID to.. All this says that hey untagged traffic I see INBOUND to this port, this is the vlan that traffic is in..

So your using the webgui - can you try their utility software?  Maybe their is bug in their code in the web gui for removal of ports from vlan 1?  I have half a mind to just order one of these to play with.. But from what you posted the switch is doing what its configured to do..  All ports are in vlan 1 untagged.  Any broadcast traffic that it see inbound to a port that has pvid of 1, will be flooded out every other port that as being in vlan 1..

Generate your broadcast traffic inbound to a port that has its pvid set to something other than vlan 1.  That untagged traffic would be in that vlan and not broadcast out vlan 1 ports.  But in the current config state any traffic ingress to ports 1 or 8 that have pvid of 1 would be flooded out all the ports since they are listed as being untagged in vlan 1.

If you set all the pvid to something else other than 1 - can you still get to the IP of the switch?  Does the config software utility still work?

I'll have to double check, but I think all ports remain untagged in VLAN 1 no matter what we do.  That could explain some of the behavior reported, but I've had no problem keeping traffic isolated.  I have my PVID set to something other than VLAN1 on all ports and can still hit the management interface.  There is no way to define a VLAN for the management interface that I can see.
home:  pfSense on ESXi 6.5. 2 v cores, 512MB RAM, 8GB disk.  Host is MSI AM1I, Athlon 5350, 16GB DDR3, 60GB SSD, 320GB HDD, HP NC360T NIC.

Offline Vlado

  • Newbie
  • *
  • Posts: 12
  • Karma: +0/-0
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #34 on: March 13, 2017, 05:09:27 am »
Is there any update on this?

@jahonix, did the TP-Link engineer ever answer your questions? I'm especially interested in the option to be able to set a management VLAN on the Easy Smart switches.

Offline jahonix

  • Hero Member
  • *****
  • Posts: 2404
  • Karma: +144/-14
  • volunteer since 2006
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #35 on: March 13, 2017, 05:17:41 pm »
did the TP-Link engineer ever answer your questions?
Unfortunately not, I would have let you know otherwise.
I'm confident to meet some TP-Link guys at CeBIT this March. I'll point them to this thread.
Chris

The issue with IPv6 jokes is that almost no one understands them and no one is using them yet.

Offline ivor

  • Administrator
  • Sr. Member
  • *****
  • Posts: 586
  • Karma: +134/-125
    • View Profile
    • Netgate
Re: TP-Link Easy Smart Switch security question
« Reply #36 on: May 14, 2017, 02:30:21 pm »
Any updates on this thread? Seems like this is a serious problem.
Need help fast? Commercial support: https://www.netgate.com/support/

Offline whosmatt

  • Sr. Member
  • ****
  • Posts: 432
  • Karma: +27/-0
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #37 on: May 14, 2017, 06:48:43 pm »
Any updates on this thread? Seems like this is a serious problem.

I haven't seen any firmware updates that allow removing VLAN1 untagged from the switch ports.  I'm guessing TP-Link sees this as a feature, so that the end user can avoid having to set up the management interface on a VLAN and perhaps locking themselves out of managing the switch, since there's no console or anything like that.

Of course I understand the implications, and obviously these switches are meant for home use. I'd be curious to hear what TP-Link says about it, but that's my guess.
home:  pfSense on ESXi 6.5. 2 v cores, 512MB RAM, 8GB disk.  Host is MSI AM1I, Athlon 5350, 16GB DDR3, 60GB SSD, 320GB HDD, HP NC360T NIC.

Offline pfBasic

  • Hero Member
  • *****
  • Posts: 1021
  • Karma: +139/-22
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #38 on: May 14, 2017, 07:15:06 pm »
I got one of these and immediately returned it. 

I ended up with a zyxel gs1900-8hp, it's 70W of PoE over all 8 ports for $100. It didn't have the forced VLAN 1, and it even has a telnet CLI you can activate and a header for serial access.  MUCH better GUI and many more features!

The non-PoE version is I think $60. So almost double the price of a tplink might not be interesting but I thought I'd throw it out there.

I actually kept my LAN on VLAN1. It's for home use and you can force HTTP/S only acces, that combined with a strong password keeps me from worrying about needing a management only interface.

Offline jahonix

  • Hero Member
  • *****
  • Posts: 2404
  • Karma: +144/-14
  • volunteer since 2006
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #39 on: May 14, 2017, 09:26:34 pm »
Any updates on this thread?
Sorry, I didn't make it to CeBIT. Workload prohibited going there.
And the engineer I talked to last year never responded to my mails.
Chris

The issue with IPv6 jokes is that almost no one understands them and no one is using them yet.

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9092
  • Karma: +1037/-306
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #40 on: May 14, 2017, 10:16:02 pm »
For just a couple dollars more you can get a D-Link DGS-1100-08 that has a management VLAN setting and doesn't do all this VLAN 1 nonsense.

Not sure what the fascination with these TP-Link things is. They are garbage.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline pfBasic

  • Hero Member
  • *****
  • Posts: 1021
  • Karma: +139/-22
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #41 on: May 14, 2017, 10:23:19 pm »
At least for me the fascination was the price. Also, before asking around in a forum like this they appear to be a great buy based on amazon reviews.

But I agree, better off getting something a little better.

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 14299
  • Karma: +1330/-193
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #42 on: May 15, 2017, 11:53:15 am »
I got one of these to play with since see a lot of threads about them.. You can not remove vlan 1 that is for damn sure, and there also seems to be a cosmetic issue with it reporting rxbadpkts on interface that tagged vlan traffic hits...  But seems to just be cosmetic.

I have not had a chance to test the security if vlan 1 traffic is broadcasted out a port if you change the pvid to some other vlan.  But pretty sure you can get to the management IP from any switch port..  When I get some play time do some testing.  But for a home switch, that does vlans the price is attractive.
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.3.4_p1 (work)
1x 2.4.2-RELEASE on VM esxi 6.5 (home)

Offline pfBasic

  • Hero Member
  • *****
  • Posts: 1021
  • Karma: +139/-22
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #43 on: May 15, 2017, 03:56:27 pm »
But pretty sure you can get to the management IP from any switch port.


How big of a security concern is this really? If the webgui is HTTP/S and you have a strong password on it then what is the security risk?

My setup is home use only so for me I'm not at all concerned about anyone on my network even caring to look for a switch or router on the network, I was just curious how much of an actual security vulnerability this would be on a larger network?

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9092
  • Karma: +1037/-306
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #44 on: May 16, 2017, 05:31:39 pm »
I have very little patience (read zero) for any flakiness in my layer 2 gear.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM