Bad update on 8 port Gs108eV3

Question

Thought I would ask and possibly warn people about this.

I have a GS108Ev3 on the bench. It was in use for about 2 years. I attempted to update it with the latest firmware off the Netgear website using Chrome. The switch went into firmware upload mode fine, it took the upload file. Then I got a browser error that the switch was no longer communicating.

I can pin reset it, and it reverts to the 192.168.0.209 ip number. But any attempt to access it with a web browser and no joy. I also tried accessing it with the ProSafe utility and that utility sees it but says it must be configured with a web browser.

So I guess the latest firmware is designed to take a managed switch and turn it into an unmanaged switch. /s

Any suggestions on recovery?

tmittelstaedt · Answer

As it turned out, yes this was the problem.&nbsp; Unknown to me the MTU on the Ethernet interface on my laptop was set to 1300.&nbsp; I don't know WHY it was set to that but my STRONG suspicions are that the Cisco IPSec VPN client that I have loaded on it reduced the MTU.&nbsp;So, I will NOT modify my warning due to the following:&nbsp;1) Netgear changed this due to some completely unnecessary monkeying around inside the switch firmware to try and implement a "security" thing of sorts.&nbsp; At least that is what was told to me by Netgear support when I called in to try to get more information.&nbsp; The engineers know they screwed up and there IS a "fix" in the works for this - in the next firmware version for this switch.&nbsp; Interestingly, this switch is due to go off Netgear's firmware support as of 6/30/2021 according to a document on the Netgear site so someone clearly got their hind end chewed by this for them to violate their EOL policy.&nbsp;2) Even though this is a showstopper bug Netgear has not pulled the firmware.&nbsp; Nor have they modified the readme to warn people.&nbsp; This is a showstopper because small low-port-count managed switches are de-rigueur in small remote 2-3 person sattelite offices that are behind site-to-site fixed VPNs.&nbsp; And sometimes those VPN's are things like OpenSSH/OpenSSL VPN's which have reduced MTU, or are riding on PPPoE Internet connections with reduced MTU.&nbsp; So an admin at a central headquarters who is under an IT Department policy to keep all network components at current firmware levels is going to get a VERY unpleasant surprise if they remotely update the switch.&nbsp;I will point out the most recent version of OpenVPN introduced a bug where it improperly calculates it's internal MTU sizes on Linux K3.0 and later kernels for the internal tun interface it uses.&nbsp; For certain packet sizes it simply drops the packet completely without sending back any ICMP "packet too large" messages.&nbsp; Thus there is no guarantee PMTUD will work in all cases.&nbsp; Assuming MTU is always 1500 is a very very BAD mistake for a switch firmware programmer to make.&nbsp;3) According to Netgear support this bug affects ALL PROSAFE SWITCHES that run the 2.06.14 firmware REGARDLESS of port count.&nbsp;4) MTU path discovery only works if the remote is able to respond back at lower MTU sizes.&nbsp; This firmware prevents that so anyone running wireshark to try to figure out what is going on isn't going to see any packet exchange that has any meaning.&nbsp;5) The de-facto standard for MTU on the Internet today is 1500, period.&nbsp; There is NOT an "optimal" MTU that is smaller than that, all smaller MTUs are sub-optimal.&nbsp; PPPoE links use 1492 but they are the only link in common use on the Internet by ISP's and large public networks and most ISP's are phasing them out because of problems like this.&nbsp; Jumbo Ethernet frames, OC3, Sonet, and other esoteric links used internally on large public networks have larger MTUs but they have routers on each end that fragment larger packets in any case, and on top of that no ISP out there accepts jumbo Ethernet frames if they offer gigabit handoffs.&nbsp;For posterity, heres the exact sequence I used to back-rev:&nbsp;1) Open administrative command prompt&nbsp; (run cmd as administrator by right clicking the cmd icon and selecting run as administrator)2) pin-reset the switch for 30 seconds3) At command prompt issue:&nbsp;C:\Users	edm&gt;netsh interface ipv4 show subinterfaces&nbsp;got back:&nbsp;MTU MediaSenseState Bytes In Bytes Out Interface------ --------------- --------- --------- -------------4294967295 1 0 5666836 Loopback Pseudo-Interface 11300 1 3809710955 823795215 Wi-Fi1300 5 0 0 Bluetooth Network Connection1300 5 0 0 Local Area Connection* 11300 1 5268 220312 Ethernet1300 5 0 0 Local Area Connection* 2&nbsp;issued:&nbsp;C:\WINDOWS\system32&gt;netsh interface ipv4 set subinterface "Ethernet" mtu=1500 store=persistent&nbsp;got back:&nbsp;Ok.&nbsp;issued:&nbsp;C:\WINDOWS\system32&gt;netsh interface ipv4 show subinterfaces&nbsp;got back:&nbsp;MTU MediaSenseState Bytes In Bytes Out Interface------ --------------- --------- --------- -------------1300 1 0 5756136 Loopback Pseudo-Interface 11300 2 3810708325 824182678 Wi-Fi1300 5 0 0 Bluetooth Network Connection1300 5 0 0 Local Area Connection* 11500 1 14104 306343 Ethernet1300 5 0 0 Local Area Connection* 2&nbsp;&nbsp;accessed switch with web browser.&nbsp;Did firmware downgrade&nbsp;After switch responded did pin-reset on it again&nbsp;At command prompt issued:&nbsp;C:\WINDOWS\system32&gt;netsh interface ipv4 set subinterface "Ethernet" mtu=1300 store=persistent&nbsp;got back&nbsp;Ok.&nbsp;exited command prompt and accessed the switch by web browser.&nbsp;Lastly, my apologies for anyone offended.&nbsp; My irritation is with Netgear's programmers and paid testers because they are paid to test for this sort of thing.&nbsp; Sorry to yell at you guys!

DaneA · Answer

tmittelstaedt,&nbsp;Welcome to the community! :)&nbsp;&nbsp;Kindly try to disconnect the&nbsp;GS108Ev3 from your existing network. Then, connect a PC/laptop directly a LAN port of it.&nbsp; Try to access its web-GUI using its default IP Address which is&nbsp;192.168.0.239.&nbsp; You can also check if you can get replies when you ping the default IP Address of your&nbsp;&nbsp;GS108Ev3.&nbsp;&nbsp;&nbsp;Regards,&nbsp;DaneANETGEAR Community Team

tmittelstaedt · Answer

&gt;Kindly&nbsp;try to disconnect the GS108Ev3 from your existing networkThat is what "I have the switch on the bench" means.&nbsp;Bench testing means completely disconnected from the network and on a workbench.&nbsp; Please add this term to yourvocabulary.&nbsp; Here is an explanation:&nbsp;&nbsp;https://en.wikipedia.org/wiki/Test_bench&nbsp;&gt;connect a PC/laptop directly a LAN port of itThat is implied by "bench testing"&nbsp;&gt;Try to access its web-GUI using its default IP Address which is 192.168.0.239.I already said in my post that I had tried this on the bench&nbsp;&gt;You can also check if you can get replies when you ping the default IP Address of your GS108Ev3.I do get replies from it when it's on the bench.&nbsp; &nbsp;As I stated already in my original post Prosafe connects to it which wouldnot be possible if the IP stack was not working at all.&nbsp; But the web GUI does not come up when attempting to accesswith a web browser.

schumaku · Answer

Recent Smart Managed Plus update switch IP stack seems to be cumbersome on the MTU&nbsp; - double check if there is an MTU lower than 1500 is in place on the Web browser host.
&nbsp;
Please provide more details (e.g. the original and the current updated firmware version) if you like to bring up any kind of "warning".

tmittelstaedt · Answer

You have to be kidding.&nbsp; I already said the laptop with the web browser on it is plugged into the ethernet switch by an ethernet cable.&nbsp; It is the laptop, the cable, and the switch.&nbsp; That is all that there is on the bench&nbsp; &nbsp;Why do you guys insist on believing the switch is in some esoteric weird configuration where I'd even be able to muck around with MTU?&nbsp;&nbsp;MTU on ethernet is 1500.&nbsp;And as for the prior firmware version, there is nothing in the readme that says users should NOT be able to go directly to the latest firmware for the switch from any prior version of firmware.&nbsp; So unless that is the case i have done everything in the instructions for firmware version 2.06.14 and now have a switch that is no longer manageable.&nbsp; So a warning is justified.&nbsp; Update to the latest version if you dare.

Forum Discussion

Bad update on 8 port Gs108eV3

10 Replies

Related Content

GS108Ev3 Port Trunking

GS108Ev3 port issues

GS108Ev3 port based VLAN cannot be deactivated

GS108Ev3 Naming Ports

GS108Ev3 not accessible

NETGEAR Academy

ProSupport for Business