NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
Access restrictions on a GS108Ev3 ProSAFE Plus switch
Hello.
I am trying to restrict web access to a few authorized management stations on a NETGEAR ProSAFE GS108Ev3 Plus Switch. This switch has the most recent firmware (V2.06.03EN) and bootloade...
ProSAFEr wrote:
Is there any way to restrict access to the web management interface on this switch to only a few workstations, an address pool or a VLAN?No.*
ProSAFEr wrote:
I do not want to serve an unencrypted (HTTP only) web interface to the world.The service processors for the Smart Managed Plus switches - almost unmanaged - have a marginal resources, even the availability of the Web UI in plain http is kind of "magic" for these switches.
*The release notes show that the processing capabilities are limited, e.g when it comes to the flow control or exact timely ICMP multicast handling.
ProSAFEr wrote:
Is there any way to restrict access to the web management interface on this switch to only a few workstations, an address pool or a VLAN?
No.*
ProSAFEr wrote:
I do not want to serve an unencrypted (HTTP only) web interface to the world.
The service processors for the Smart Managed Plus switches - almost unmanaged - have a marginal resources, even the availability of the Web UI in plain http is kind of "magic" for these switches.
*The release notes show that the processing capabilities are limited, e.g when it comes to the flow control or exact timely ICMP multicast handling.
Thank you for your detailed answer. I know this device has an underpowered service processor. A service processor like this one is not so bad as it sounds; the device draws only between three and four watts and runs really cold. I am not against an unencrypted management interface either iff it can be restricted to a few ports, a single management VLAN or a few authorized IP addresses. Even the cheaper GS105Ev2 supports an access control table.
Ok, it is time to look for another use for these switches that obviously should not be connected to public or untrusted networks. We are running a few air gapped networks where these switches would fit better.
Thank you back for the heads up, I have to make a little revision:
Indeed, some of the Smart Managed Plus (GSxxx[P]E) have an acess control on board - and of course (Murphys Law) I've checked the wrong products.
Gigabit Ethernet Smart Managed Plus Switches User Manual - Models GS105Ev2 GS105PE GS108Ev3 GS108PEv3 GS116Ev2 GS305E GS308E JGS516PE JGS524Ev2 JGS524PE , p.64 ff., Manage Access Control
However, there is a Note: Models GS108Ev3, GS108PEv3, and GS308E do not support access control.Similar, the "big" XS512EM and XS724EM 12-/24-Port 10-Gigabit/Multi-Gigabit Ethernet Smart Managed Plus Switch with 2 SFP+ Combo don't come with the Access Control (as of writing) either.
ProSAFEr wrote:
Thank you for your detailed answer. I know this device has an underpowered service processor. A service processor like this one is not so bad as it sounds; the device draws only between three and four watts and runs really cold. I am not against an unencrypted management interface either iff it can be restricted to a few ports, a single management VLAN or a few authorized IP addresses.
Did not intended to be negative - an absolutley amazing switch category! We challenged Netgear about getting the Management VLAN control as available on the XSxxxEM (different platform, different service processor) on the other Smart Managed Plus models, but were told this is technically not possible.
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
