My switches communicate into the internet. What purpose is it for?

[kolping-mw]

and how can I deactivate it.

My switches are connecting to the following IPs and fail because we are using SSL interception so I can see this failed connections...

What is it for and where is it switched off?

IPs:

18.205.167.7

34.192.246.10

18.205.127.81

[marce1000]

 - They all seem to be related to Amazon , use this tool to verify : https://whatismyipaddress.com/ip-lookup

 M.

[kolping-mw]

I know, they belong to AWS. So that says absolutely nothing about their purpose. I assume that behind these IPs are AWS workloads from Cisco but I want to know what they do...

[Leo Laohoo]

---

@kolping-mw wrote:

 I assume that behind these IPs are AWS workloads from Cisco but I want to know what they do...

---

Two options: 

1. Packet capture the traffic; or
2. Scream-Test:  Block the traffic and wait for someone to scream

[kolping-mw]

2. is active. Because the switch can't establish connection because of our SSL decryption. That is why I know these connections...

1. would be an option if I would establish the connection (what I don't want to at the moment)

But the vendor should know what the devices do, so we will hopefully know from Cisco in a few time...

[Leo Laohoo]

---

@kolping-mw wrote:

But the vendor should know what the devices do

---

In an "ideal" world, the vendor would know and experience have taught me that this is all but a fallacy.

[marce1000 · Accepted solution]

  - They seem to be related to https://domain.glass/devicehelper.cisco.com    , from https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Plug-and-Play/solution/guidexml/b_pnp-solution-guide.html

  >...

• Plug and Play Connect—Optional cloud component for automatic PNP server discovery if the DHCP or DNS methods are not available. The PNP Server is the backend part of the Cisco Network Plug and Play application in the APIC-EM. The Cisco network device contacts the Cisco Plug and Play Connect cloud service at devicehelper.cisco.com to obtain the IP address of the appropriate PNP server that is defined for your organization.

 M.

[kolping-mw]

Interesting idea, that could fit. Will switch it off and see what it brings.

Interestingly in the host field there the proposal in settings is pnpserver but it actually uses devicehelper.cisco.com if you didn't configure it (can be seen under pnp sessions). In my eyes I think this is a bug because there is no reason to use another host than a configured one even if the service is enabled (which it is by default)...

[kolping-mw]

Seems to fit. Didn't see these connections again after changing.

[balaji.bandi]

what switch model and IOS or XE running on this ?

[kolping-mw]

SG350-10, firmware 2.5.8.15