Mgmt Interface

[zekebashi]

Hello,

We ran a vulnerability test against the mgmt interface on the NX7K and the results came back showing that a number of services, such as SSH, DHCPs, NTP, BGP, and SNMP that are open. Are these services/ports listening to these services by default?

Thanks in advance.

Best, ~zK

[Reza Sharifi]

Hi,

I think theses services are available under the mgmt vrf and the global.  So, for example SNMP port has to run on the device to be able to manage the switch using the mgmt port.  The same for NTP and DHCP.  If you are not using the services, you maybe able to turn them off or use access list to block them. I am not sure, if there is any other simple solution for this.

HTH

[zekebashi]

Hi Reza, 

Thanks for the response. I was having a discussion with my colleague regarding securing the mgmt interface and proposed using ACLs on the mgmt interface itself. He preferred the approach of securing the management plane, which I am not clear on. So, what is the best approach of securing the management interfaces on 4 VDCs on the NX7K? 

Thanks in advance. 

~zK