cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

3963
Views
5
Helpful
6
Replies
Highlighted

How to disable IP forwarding in management VRF?

Nessus scans shows that my switches are performing IP forwarding. Switches are IOS (4948E) and NXOS (9300). All of them are using the management or mgmtVRF VRFs for their management connections, and it's this IP that is forwarding. If I point one switch to another switch's mgmt IP I can confirm it is in fact forwarding (routing).

How can I disable IP forwarding / routing on both IOS and Cisco NX-OS devices for the management VRF?

Everyone's tags (3)
6 REPLIES 6
VIP Expert

You can disable it by not

You can disable it by not using a default route on the management VRF, but if you do that than the switches will not be reachable from other subnets.

HTH

Nessus scans shows that my

Nessus scans shows that my switches are performing IP forwarding. Switches are IOS (4948E) and NXOS (9300). All of them are using the management or mgmtVRF VRFs for their management connections, and it's this IP that is forwarding. If I point one switch to another switch's mgmt IP I can confirm it is in fact forwarding (routing).

How can I disable IP forwarding / routing on both IOS and Cisco NX-OS devices for the management VRF?

Hi,

But is that a real issue that ip forwarding is happening , As switches are having latest features in current iOS for security purposes.

If it all it is required either you can do as per suggestion by Reza with risk involved or do scanning on some other LAN data interface to avoid doing scanning on Mgmt. interface.

Hope it Helps..

-GI

Rate if it Helps

Contributor

Why is it a problem if they

Why is it a problem if they perform routing? A packet is routed only if another device has a next hop pointing to this switch's OOB port which is unlikely. Proxy ARP is the other potential cause but it should be disabled.

https://ltlnetworker.wordpress.com/2015/08/16/management-network-topology-and-asymmetric-routing/

Beginner

Hi Mister Cartwright,

Hi Mister Cartwright,

Did you find a way to disable ip forwarding on the 3172?  I have the same issue from a scan.

Thanks.

No I never found a way, but I

No I never found a way, but I never looked after my initial post. I filed a report with security explaining why it ultimately was not a security concern for us.

All management interfaces for our network devices are using dedicated VRFs which connect to a dedicated firewall security zone. So even if someone re-configured a certain device to use another as it's gateway, it would still be subject to firewall rules upstream.

Beginner

Hi Mister Cartwright,

Hi Mister Cartwright,

Thanks for your reply, I will update this thread if and when I get an answer to this.

CreatePlease to create content
Content for Community-Ad
July's Community Spotlight Awards