cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
5442
Views
5
Helpful
6
Replies
Highlighted

How to disable IP forwarding in management VRF?

Nessus scans shows that my switches are performing IP forwarding. Switches are IOS (4948E) and NXOS (9300). All of them are using the management or mgmtVRF VRFs for their management connections, and it's this IP that is forwarding. If I point one switch to another switch's mgmt IP I can confirm it is in fact forwarding (routing).

How can I disable IP forwarding / routing on both IOS and Cisco NX-OS devices for the management VRF?

6 REPLIES 6
Highlighted
Hall of Fame Expert

You can disable it by not using a default route on the management VRF, but if you do that than the switches will not be reachable from other subnets.

HTH

Highlighted

Nessus scans shows that my switches are performing IP forwarding. Switches are IOS (4948E) and NXOS (9300). All of them are using the management or mgmtVRF VRFs for their management connections, and it's this IP that is forwarding. If I point one switch to another switch's mgmt IP I can confirm it is in fact forwarding (routing).

How can I disable IP forwarding / routing on both IOS and Cisco NX-OS devices for the management VRF?

Hi,

But is that a real issue that ip forwarding is happening , As switches are having latest features in current iOS for security purposes.

If it all it is required either you can do as per suggestion by Reza with risk involved or do scanning on some other LAN data interface to avoid doing scanning on Mgmt. interface.

Hope it Helps..

-GI

Rate if it Helps

Highlighted

Why is it a problem if they perform routing? A packet is routed only if another device has a next hop pointing to this switch's OOB port which is unlikely. Proxy ARP is the other potential cause but it should be disabled.

https://ltlnetworker.wordpress.com/2015/08/16/management-network-topology-and-asymmetric-routing/

Highlighted
Beginner

Hi Mister Cartwright,

Did you find a way to disable ip forwarding on the 3172?  I have the same issue from a scan.

Thanks.

Highlighted

No I never found a way, but I never looked after my initial post. I filed a report with security explaining why it ultimately was not a security concern for us.

All management interfaces for our network devices are using dedicated VRFs which connect to a dedicated firewall security zone. So even if someone re-configured a certain device to use another as it's gateway, it would still be subject to firewall rules upstream.

Highlighted

Hi Mister Cartwright,

Thanks for your reply, I will update this thread if and when I get an answer to this.

Content for Community-Ad