XS716T100NES Can we disable HTTP

[MWCLOUD]

Is there a way via CLI or GUI to disable HTTP from listening?. We would like to lock down the switch where only the ports we are using are open.

[LaurentMa · Accepted solution]

Hi MWCLOUD

Thanks for asking. No, there is no way to disable Management CPU (Web GUI access via HTTP) on our XS716T 16-port 10G Smart Managed Pro switch. In fact, the per-port lock down is not very common. But Smart Managed switches don't offer management access control.

Instead, Fully Managed switches provide either Out of band management (OOB - you can deactivate inband CPU management access, and only access the switch CPU for GUI, telnet etc. via the 1G service port - this is useful if you have a separate management network); or Management ACLs for protecting inband access (for instance, restricting HTTP GUI access to certain IP addresses or subnets, restricting Telnet to certain other IP addresses, etc.).

If you require these features, you should look at our M4300 series. They offer both OOB management and Management ACLs:

Regards,

[LaurentMa · Accepted solution]

Hi MWCLOUD

Thanks for asking. No, there is no way to disable Management CPU (Web GUI access via HTTP) on our XS716T 16-port 10G Smart Managed Pro switch. In fact, the per-port lock down is not very common. But Smart Managed switches don't offer management access control.

Instead, Fully Managed switches provide either Out of band management (OOB - you can deactivate inband CPU management access, and only access the switch CPU for GUI, telnet etc. via the 1G service port - this is useful if you have a separate management network); or Management ACLs for protecting inband access (for instance, restricting HTTP GUI access to certain IP addresses or subnets, restricting Telnet to certain other IP addresses, etc.).

If you require these features, you should look at our M4300 series. They offer both OOB management and Management ACLs:

Regards,

[MWCLOUD]

Thanks for the quick response.  This is good to know for future purchases.

[schumaku]

Hi @LaurentMa,

Plase consider to push in at least a control to set (and limit) the manaement VLAN to a defined VLAN on all Smart Managed Plus and Smart Managed Pro with the firmware revisions.

Example? The new XS724EM Smart Managed Plus 



This does allow certain mitigation by limiting this access to a sinlge 802.1Q VLAN.

Regards,
.Kurt



 

[schumaku]

Oh sorry, my previous post wasn't really finished @LaurentMa. Of course, the Smart Managed Pro already support a management VLAN setting (it's in Management -> IP Configuration).

[LaurentMa]

Good point! Management VLAN is another best practice, but it requires VLANs for other users.

This is good input:

• Management VLAN can be used across Smart Managed, Pro and Fully Managed switches for protecting CPU Access (GUI etc.)
• Out-of-band or Management ACLs can be used in Fully Managed switches when Management VLAN isn't suitable

Regards,

[schumaku]

---

@LaurentMa wrote:

• Management VLAN can be used across Smart Managed, Pro and Fully Managed switches for protecting CPU Access (GUI etc.)

---

The implementation of the Management VLAN seems to have just started on the Smart Managed Plus switches. Have just spotted it on the brand new XS728EM, the GS110EMX released some weeks before for example does not have this feature. Queried one of your senior engineers in Tw on this difference some hours ago, he said "For Managed Plus, it depends. Case-by-case.".

Thank you for taking care!

-Kurt

[MWCLOUD]

Thanks for the information.  My issue is based upon regulatory requirements.  We are required to document and justify every open port on a piece of equipment.  The includes regular CVAs and baseline reviews for each piece of equipment.  As you can imagine, HTTP is deeply frowned upon. 

We are currently using these switches in a test environment so there isn't as big of an issue.