How to disable IP forwarding in management VRF?

[Mister Cartwright]

Nessus scans shows that my switches are performing IP forwarding. Switches are IOS (4948E) and NXOS (9300). All of them are using the management or mgmtVRF VRFs for their management connections, and it's this IP that is forwarding. If I point one switch to another switch's mgmt IP I can confirm it is in fact forwarding (routing).

How can I disable IP forwarding / routing on both IOS and Cisco NX-OS devices for the management VRF?

[Reza Sharifi]

You can disable it by not using a default route on the management VRF, but if you do that than the switches will not be reachable from other subnets.

HTH

[Ganesh Hariharan]

Nessus scans shows that my switches are performing IP forwarding. Switches are IOS (4948E) and NXOS (9300). All of them are using the management or mgmtVRF VRFs for their management connections, and it's this IP that is forwarding. If I point one switch to another switch's mgmt IP I can confirm it is in fact forwarding (routing).

How can I disable IP forwarding / routing on both IOS and Cisco NX-OS devices for the management VRF?

Hi,

But is that a real issue that ip forwarding is happening , As switches are having latest features in current iOS for security purposes.

If it all it is required either you can do as per suggestion by Reza with risk involved or do scanning on some other LAN data interface to avoid doing scanning on Mgmt. interface.

Hope it Helps..

-GI

Rate if it Helps

[Peter Koltl]

Why is it a problem if they perform routing? A packet is routed only if another device has a next hop pointing to this switch's OOB port which is unlikely. Proxy ARP is the other potential cause but it should be disabled.

https://ltlnetworker.wordpress.com/2015/08/16/management-network-topology-and-asymmetric-routing/

[eclinton]

Hi Mister Cartwright,

Did you find a way to disable ip forwarding on the 3172?  I have the same issue from a scan.

Thanks.

[Mister Cartwright]

No I never found a way, but I never looked after my initial post. I filed a report with security explaining why it ultimately was not a security concern for us.

All management interfaces for our network devices are using dedicated VRFs which connect to a dedicated firewall security zone. So even if someone re-configured a certain device to use another as it's gateway, it would still be subject to firewall rules upstream.

[eclinton]

Hi Mister Cartwright,

Thanks for your reply, I will update this thread if and when I get an answer to this.