pfSense Support Subscription

Author Topic: TP-Link Easy Smart Switch security question  (Read 8062 times)

0 Members and 2 Guests are viewing this topic.

Offline whosmatt

  • Sr. Member
  • ****
  • Posts: 432
  • Karma: +27/-0
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #45 on: May 19, 2017, 09:27:11 pm »
But pretty sure you can get to the management IP from any switch port.

If the webgui is HTTP/S

It's not, and I don't see any way to change it.  I get it, these switches are basically the same price as a typical unmanaged switch.  They're cheap and offer VLANs.  That's about all I can say.

Right now all my ports are either trunk ports (two between switches, one to my AP, one to my ESXi box) or access ports on a single VLAN (not VLAN1) which uses a subnet that also happens to contain the management IP address.  My other two VLANs / subnets are either wireless only or contained entirely in ESXi / pfSense.  In other words, I don't have any wired devices on an access port in a VLAN / subnet that doesn't also contain the management IP.

As expected, my guest wireless network cannot access the management IP of the switch.  It *can* access certain services on that subnet, but only because I explicitly allow that access in pfSense.  In that regard, the switches behave exactly as I'd expect.

I suppose I should put a port into the VLAN for the guest network and test that way with a wired connection, but for my setup that test would be academic.

Next time I buy a switch for home use, I'll choose something different.  If anyone can show me a 16 port fanless 1Gbps fully managed switch (with a proper CLI) I'd be ecstatic.  For now, I'm not freaking out about it. 

« Last Edit: May 19, 2017, 09:45:20 pm by whosmatt »
home:  pfSense on ESXi 6.5. 2 v cores, 512MB RAM, 8GB disk.  Host is MSI AM1I, Athlon 5350, 16GB DDR3, 60GB SSD, 320GB HDD, HP NC360T NIC.

Offline pfBasic

  • Hero Member
  • *****
  • Posts: 1021
  • Karma: +139/-22
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #46 on: May 19, 2017, 09:49:01 pm »
But pretty sure you can get to the management IP from any switch port.
How big of a security concern is this really? If the webgui is HTTP/S and you have a strong password on it then what is the security risk?

My setup is home use only so for me I'm not at all concerned about anyone on my network even caring to look for a switch or router on the network, I was just curious how much of an actual security vulnerability this would be on a larger network?
It's not, and I don't see any way to change it.  I get it, these switches are basically the same price as a typical unmanaged switch.  They're cheap and offer VLANs.  That's about all I can say.

I just meant in general is it a security concern if you can force HTTP/S and put a good password on it.
I replaced my TP-Link with a Zyxel GS1900 and it allows you to force HTTP/S WebGUI.

Offline whosmatt

  • Sr. Member
  • ****
  • Posts: 432
  • Karma: +27/-0
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #47 on: May 19, 2017, 09:55:44 pm »

I just meant in general is it a security concern if you can force HTTP/S and put a good password on it.
I replaced my TP-Link with a Zyxel GS1900 and it allows you to force HTTP/S WebGUI.

Yeah, got it.  Sorry, my response was not entirely directed at you or the https question.
home:  pfSense on ESXi 6.5. 2 v cores, 512MB RAM, 8GB disk.  Host is MSI AM1I, Athlon 5350, 16GB DDR3, 60GB SSD, 320GB HDD, HP NC360T NIC.

Offline pfBasic

  • Hero Member
  • *****
  • Posts: 1021
  • Karma: +139/-22
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #48 on: May 19, 2017, 10:07:54 pm »
If anyone can show me a 16 port fanless 1Gbps fully managed switch (with a proper CLI) I'd be ecstatic.
https://www.youtube.com/watch?v=lVy1rHE3oxc

It's 16 port, gigabit and fanless. But not quite fully managed, you might be interested though.

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9047
  • Karma: +1032/-306
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #49 on: May 20, 2017, 04:16:35 am »
I have two of those and a DGS-1210-10P.

I have never seen them lose the config.

You do have to explicitly save it so maybe those donkeys weren't doing that.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline ecfx

  • Full Member
  • ***
  • Posts: 221
  • Karma: +28/-11
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #50 on: May 20, 2017, 07:50:26 am »
Depend of VLAN configuration & PVID settings if TL-SG108E switch IP is allocated on different subnet than normal clients (vlan);
using a browser, web management interface can't be accessed by clients;
however it can be accessed with Easy Smart Configuration Utility program that allow you also to change the switch IP... for home use is almost ok but not for Office / Enterprise use.

A page for Linux users about TL-SG108E:
https://shred.zone/cilla/page/383/setting-up-tp-link-tl-sg108e-with-linux.html

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9047
  • Karma: +1032/-306
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #51 on: May 20, 2017, 02:14:39 pm »
The DGS-1100-08P, 10MP, -24P and -26MP comply with the 802.3af/at PoE+ standards, supporting up to 30W on each PoE port, not to exceed the switches specific power budget.

Power Budget 64W
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9047
  • Karma: +1032/-306
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #52 on: May 20, 2017, 04:27:06 pm »
UK market products might be different.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline whosmatt

  • Sr. Member
  • ****
  • Posts: 432
  • Karma: +27/-0
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #53 on: May 20, 2017, 10:41:19 pm »
Depend of VLAN configuration & PVID settings if TL-SG108E switch IP is allocated on different subnet than normal clients (vlan);
using a browser, web management interface can't be accessed by clients;
however it can be accessed with Easy Smart Configuration Utility program that allow you also to change the switch IP..

FWIW there are 2 versions of the TL-SG108E. Both can be managed by the config utility but only V2 has a browser config interface.  Source: I have one of each.
home:  pfSense on ESXi 6.5. 2 v cores, 512MB RAM, 8GB disk.  Host is MSI AM1I, Athlon 5350, 16GB DDR3, 60GB SSD, 320GB HDD, HP NC360T NIC.

Offline ivor

  • Administrator
  • Sr. Member
  • *****
  • Posts: 583
  • Karma: +134/-125
    • View Profile
    • Netgate
Re: TP-Link Easy Smart Switch security question
« Reply #54 on: May 21, 2017, 08:59:57 am »
Please do not go off-topic as this thread is about security concerns of TP-Link switch series.
Need help fast? Commercial support: https://www.netgate.com/support/

Offline CanYaHearMeNow4

  • Newbie
  • *
  • Posts: 3
  • Karma: +0/-0
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #55 on: July 11, 2017, 09:29:40 pm »
I tried to use my TP-Link "Easy Smart Switch" in a different deployment and the VLAN1/MGMT issue bothered me again so I submitted some security feedback to them via their "Submit Security Feedback" forum. I outlined the issue the best I could and even linked directly to this forum.

I sure hope they respond, because according to TP-Link:
Quote
At TP-Link, customer security comes first. Thatís why we work diligently to ensure that our products include the highest level of security features, with firmware and hardware that protect customers and their devices from the very latest threats.

If anyone has some free time to submit similar security feedback, it might help the cause: http://www.tp-link.com/us/security

Offline robi

  • Hero Member
  • *****
  • Posts: 956
  • Karma: +74/-2
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #56 on: July 12, 2017, 04:45:44 am »
All these "Easy Smart Switch" models have this "feature". I think this is intentionally like this, for very basic home users. To be "easy" to use the GUI...
You have to buy products from their series called "Smart Switches" or "Managed Switches", not the "Easy Smart Switches" series.

"Smart Switches" and "Managed Switches" don't exhibit these problems. I just deployed a network consisting of about 60 such switches in various sizes, all interconnected with optics and offering 2 dozens of VLANs, no unwanted traffic passing between them. On top of this, 2 CARP-enabled pfSense boxes do all the inter-VLAN traffic.

Offline warheat1990

  • Jr. Member
  • **
  • Posts: 26
  • Karma: +0/-0
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #57 on: August 16, 2017, 04:13:27 am »
I email their support and technical few times, gave them a link to this thread and never got a response, you get what you pay for I guess.

Offline Finger79

  • Full Member
  • ***
  • Posts: 166
  • Karma: +15/-0
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #58 on: August 16, 2017, 04:54:49 am »
If anyone has some free time to submit similar security feedback, it might help the cause: http://www.tp-link.com/us/security
Ironically, that page isn't available over HTTPS, so the entire form contents are in the clear.

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 14276
  • Karma: +1329/-191
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #59 on: August 16, 2017, 05:15:58 am »
It is there via https - just BAD

The certificate is only valid for the following names: *.akamaized.net, *.akamaihd-staging.net, *.akamaized-staging.net, *.akamaihd.net, a248.e.akamai.net

Agree yet another example of not really getting it ;)
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.3.4_p1 (work)
1x 2.4.1-RELEASE on VM esxi 6.5 (home)