Disabling Smart Install on Cisco switch/router

[preetpeethambaran]

Will there be any impact on Cisco switch/router configuration while disabling Smart Install, as the Router/Switch are in production

Also kindly confirm if below are the best practice for disabling Smart Install on Router/Switch

1)   no Vstack

2)   Block the traffic on TCP port 4786

[Leo Laohoo]

Use the command "no vstack" or "no vstack config" to disable the process and also block TCP 4786.
Both needs to be done and not just the command.

[Philip D'Ath]

To build on Leo's comment, their is no impact. You can just execute those commands.

[christiansu]

Neither no vstack or no vstack config commands worked for me although the Client Role appears to be enabled on my Cisco Switch 2960-X. Also tried to used ACL with the command below that also did not execute.

ip access-list extended SMI_HARDENING_LIST permit tcp host 0.0.0.0 host 0.0.0.0 eq 4786 deny tcp any any eq 4786 permit ip any any

Any other ideas?

[Leo Laohoo]

Upgrade to a firmware version where SmartInstall is permanently disabled.

[Mandy]

Which version that Smart Install is disabled by default?

[Leo Laohoo]

Any firmware released after July 2016.

[Mandy]

Firmware upgraded but still showing  Role: Client (SmartInstall enabled)

[Leo Laohoo]

What is the exact IOS used?

[Mandy]

I have same issue where I have issue a command 'no vstack' but it's the config still shows 'enabled'. any idea?