NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
GS308EP sends management traffic outside configured Management VLAN
Hello,
I would like to report a possible VLAN isolation issue with my GS308EP.
Environment
Device: NETGEAR GS308EP
Firmware: V2.0.0.11 (latest as of writing)
Configuration:
- The uplink port is configured as an IEEE 802.1Q trunk.
- Management VLAN is configured as VLAN 8.
- Management IP address is 192.168.8.18.
The uplink is connected to a Linux router with multiple 802.1Q VLAN interfaces. The VLAN interfaces share the physical NIC's MAC address, which is the default behavior of Linux VLAN interfaces.
The router also has arp_ignore=1 and arp_announce=2 configured to prevent ARP flux-related issues.
Observed behavior
Although the management VLAN is configured as VLAN 8, the GS308EP sends management-related traffic on VLANs other than VLAN 8.
For example, packet captures show the switch sending ARP requests on multiple VLANs:
VLAN 19:
ARP Request:
who-has 192.168.8.1 tell 192.168.8.18
Sender MAC: 28:94:01:XX:XX:XX
The same ARP request appears to be sent on the VLANs configured on the GS308EP, in ascending VLAN ID order.
In addition, management traffic generated by the switch, such as NTP, DNS, and UPnP/SSDP traffic, is observed on non-management VLANs.
Expected behavior
I would expect:
- Management traffic generated by the GS308EP to be sent only through the configured Management VLAN.
- ARP, NTP, DNS, UPnP/SSDP, and other management-plane traffic to use VLAN 8 only.
- No traffic sourced from the management IP address (192.168.8.18) to appear on other VLANs.
I can provide packet captures if needed.
Thank you.
10 Replies
ARP, NTP, DNS, UPnP/SSDP, and other management-plane traffic
Just want to point out that ARP, DNS, and UPnP/SSDP are control-plane, and not management-plane.
That said, if 192.168.8.18 is only part of VLAN 8, then ARP "who-has" packets should only be broadcast to the devices in that VLAN.
Thanks for the clarification.
Yes, 192.168.8.18 is the IP address assigned to the switch and is configured only for VLAN 8.
I observed that the switch sends ARP requests with 192.168.8.18 as the sender across configured VLANs, for example:
17:34:17.716727 28:94:01:XX:XX:XX > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 1, p 0, ethertype ARP (0x0806), Request who-has 192.168.8.1 tell 192.168.8.18, length 46 17:34:17.717436 28:94:01:XX:XX:XX > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 8, p 0, ethertype ARP (0x0806), Request who-has 192.168.8.1 tell 192.168.8.18, length 46 17:34:17.717470 b4:96:91:XX:XX:XX > 28:94:01:XX:XX:XX, ethertype 802.1Q (0x8100), length 46: vlan 8, p 0, ethertype ARP (0x0806), Reply 192.168.8.1 is-at b4:96:91:XX:XX:XX, length 28 17:34:17.718168 28:94:01:XX:XX:XX > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 9, p 0, ethertype ARP (0x0806), Request who-has 192.168.8.1 tell 192.168.8.18, length 46 17:34:17.718937 28:94:01:XX:XX:XX > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 16, p 0, ethertype ARP (0x0806), Request who-has 192.168.8.1 tell 192.168.8.18, length 46I believe these ARP requests should only be present on VLAN 8.
I also observe other traffic generated by the switch itself, such as DNS, NTP, and SSDP, being transmitted with VLAN tags other than VLAN 8.
17:37:49.884570 28:94:01:XX:XX:XX > b4:96:91:XX:XX:XX, ethertype 802.1Q (0x8100), length 94: vlan 19, p 0, ethertype IPv4 (0x0800), 192.168.8.18.123 > 192.168.10.123.123: NTPv4, Client, length 48 17:37:55.889576 28:94:01:XX:XX:XX > b4:96:91:XX:XX:XX, ethertype 802.1Q (0x8100), length 94: vlan 25, p 0, ethertype IPv4 (0x0800), 192.168.8.18.123 > 192.168.10.123.123: NTPv4, Client, length 48 17:38:00.893427 28:94:01:XX:XX:XX > b4:96:91:XX:XX:XX, ethertype 802.1Q (0x8100), length 94: vlan 19, p 0, ethertype IPv4 (0x0800), 192.168.8.18.123 > 192.168.10.123.123: NTPv4, Client, length 48 17:38:05.897160 28:94:01:XX:XX:XX > b4:96:91:XX:XX:XX, ethertype 802.1Q (0x8100), length 94: vlan 24, p 0, ethertype IPv4 (0x0800), 192.168.8.18.123 > 192.168.10.123.123: NTPv4, Client, length 48 17:38:11.902082 28:94:01:XX:XX:XX > b4:96:91:XX:XX:XX, ethertype 802.1Q (0x8100), length 94: vlan 19, p 0, ethertype IPv4 (0x0800), 192.168.8.18.123 > 192.168.10.123.123: NTPv4, Client, length 48I observed that the switch sends ARP requests with 192.168.8.18 as the sender across configured VLANs,
Are you seeing this behavior on devices that are not on VLAN 8?
Thanks for the reply.
I would like to contact NETGEAR Support if possible, but the 1-year technical support period for this device has already expired, so I posted here instead as suggested on NETGEAR Japan's support page: https://www.netgear.jp/support/info/troubleshooting.html.
If there is an appropriate way to report this kind of issue to NETGEAR, I would appreciate any guidance.
Please contact Netgear Support - nothing the Community members can do for you here.
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
