RE: Managed switches outside firewalls?

Some of the managed switches I have worked with make it possible to turn
off management of the switch on certain ports. So if you have your
router connected to a certain port you can turn off management of that
switch for all ports but the one that comes from inside your network.
Or if you have a internet drop in one of the ports make sure to disable
management from that port and allow it from others. That is how a few
of our public IP managed switches are setup and has been successful so
far.

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of ragdelaed
Sent: Wednesday, May 30, 2007 1:56 PM
To: 'Hari Sekhon'; security-basics@xxxxxxxxxxxxxxxxx
Subject: RE: Managed switches outside firewalls?

Sorry if this was already posted, but why do you want to do this? Or
what is the business justification for doing this?

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of Hari Sekhon
Sent: Tuesday, May 29, 2007 4:57 AM
To: security-basics@xxxxxxxxxxxxxxxxx
Subject: Managed switches outside firewalls?

Hi,

I need to get some new switches outside of my firewalls, which means
that they will have publicly accessible IPs if they are manageable
switches.

I'm not quite sure what security stance to take on this. I know I can
restrict the management interface to certain IPs, but I'm still not
sure if this is asking for trouble to have switches will accessible IPs.

Perhaps I should use a dumb switch and forgo any management features...

Do any of you guys have policies for this (like unmanaged switches
outside firewalls and managed ones inside)?

Any thoughts and suggestions welcome.

-h

--
Hari Sekhon

Relevant Pages

  • Re: FreeBSD > 4.11 hardware issue with Asus PSCH-SR/SATA mobo
    ... Which is ironic, for management is ... I haven't had much trouble with that, but then the cheap switches were ... single netbios box broadcasting while the nbns works, and if it doesn't, ... fit just like they'd do after a power dip. ...
    (comp.unix.bsd.freebsd.misc)
  • Re: tty: add active sysfs attribute to tty0 and console device
    ... and would add a massive amount of code to the kernel. ... block VT switches and the kernel indefinitely. ... track which VT is in the foreground for presentation, or for permission ... management purposes then you care little of who else should have had ...
    (Linux-Kernel)
  • Detecting multiple hosts behind a single managed switch port
    ... I'm looking for a tool that can query a list of managed switches (both ... would need to filter out ports that are connected to other managed ... EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE ... Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. ...
    (Security-Basics)
  • Re: Managed switches outside firewalls?
    ... that they will have publicly accessible IPs if they are manageable ... restrict the management interface to certain IPs, ... sure if this is asking for trouble to have switches will accessible ... Perhaps I should use a dumb switch and forgo any management ...
    (Security-Basics)
  • RE: Managed switches outside firewalls?
    ... Subject: Managed switches outside firewalls? ... sure if this is asking for trouble to have switches will accessible IPs. ... Perhaps I should use a dumb switch and forgo any management features... ...
    (Security-Basics)