0

we have multiple Netgear switches (3300, 5300, 4300... - current firmware) and on most of them we have the same behavior.

Let's say we have two networks. One is the main office network 192.168.1.0/24 - the second is the management network 192.168.10.0/24. Management network runs as VLAN 10 on the switches, the office network runs on the "default" VLAN 1 on the Netgear devices.

Now we define an IP Address in the management network (no DHCP there) for the Management Interface of the switch. We configure the VLAN, set the IP address, and can connect. But as soon as we connect the switch to both networks, we get a secondary IP address in the office network (we have a DHCP server here). I don't want these addresses to exist, once because they are unnecessarily using DHCP leases, and also because I don't want the swtiches to be availble in the office network.

How can I tell my switch not to enable VLAN 1 as additional management interface?

I asked this in the Netgear forum and got a few responses that I did not really understand completly (not a networking expert), but if I interpreted the responses correctly, this is by design and not easy to disable, which is in my opinion a stupid desing choice from a security perspective - as soon as I use the preconfigured VLAN 1 on the switch, I will always have access to the switch from this network.

EDIT: Okay now I finaly found the place where I see this IP and could maybe configure it: I checked the config file for any occurence of "DHCP" and found this section:

interface vlan 1
routing
ip address dhcp
exit

In the web config I can go to "Routing", under "Routing Table" I can finaly see this IP. And under "Rounting - VLAN - VLAN Routing Configuration" I see an entry for both VLANs with the corresponding addresses. Now I am not sure what happens if I just delete the VLAN 1, but I have two switches on my desk I am preparing at the moment - so I will test this during the day.

Improve this question
10
  • Sorry, for a device to be on-topic here the vendor needs to offer optional, paid support, see the help center. Sadly, Netgear doesn't provide that. With switches I use you just remove the IP instance from the VLAN altogether. If that's not possible with VLAN 1 you might need to add another (default) VLAN.
    – Zac67 ♦
    Mar 24, 2022 at 10:34
  • 1
    Netgear offers paid support as far as I could see after a quick web search: netgear.com/business/services/prosupport
    – Tobias
    Mar 24, 2022 at 15:52
  • 1
    Good to know - sorry for closing your question, I've reopened it!
    – Zac67 ♦
    Mar 24, 2022 at 16:27
  • Have you tried configuring the management VLAN? That should disable management access from any other VLAN.
    – Zac67 ♦
    Mar 24, 2022 at 16:40
  • It sound like you just need to disable DHCP on the switch because it is requesting an address via DHCP on VLAN 1.
    – Ron Maupin ♦
    Mar 24, 2022 at 16:50

1 Answer 1

Reset to default
1

Looks like I found a way to remove this IP without crashing the switch functionality - if there will be no other answer that tells me not to do this (and why...) then I will mark this as the answer:

In the section "Routing" - "VLAN" - "VLAN Routing Configuration" there is an entry for VLAN1 (maybe by default) with the dhcp address, and another entry for VLAN10 with the management IP I choose. The Ports are called "0/14/1" and "0/14/2" - looks like some virutal port IDs. Here I can delete the entry with VLAN 1, and after this the VLAN 1 IP is no longer pingable, the VLAN 10 IP works fine.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.