Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have switch (HP ProCurve 1810-24G to be exact) and it's placed in a datacenter.

To secure the switch, there's a lenghty password on it. But, there's one great downside: anyone with the IP address has access to the login screen. While this normally not an issue, I don't like it. There are some brute-force attacks going on and who knows there might be a zero-day exploit available for the switch. The switch doesn't have the option to 'auto-ban' IP's with exessive login attempts nor does it have a whitelist for allowed IP's.

So, my question is: how to secure this switch better than I currently have? I was thinking about giving it a private IP address, but then when my server crashes, I would be unable to access the switch (if I need to for any reason).

What are best practises for something like this?

share|improve this question
    
'anyone with the IP address' == accessible from the internet? screams 'VPN' to me... –  fuero Mar 1 '13 at 13:41
    
@fuero Correct, but the VPN would be installed on the server and when the server is down, the switch would be unreachable. –  Devator Mar 1 '13 at 13:43
2  
You should configure the switch's management stack so that it is not available through the same Vlan as the Internet traffic crosses. The management vlan can then be accessible only through your backend network. –  Celada Mar 1 '13 at 13:44
2  
You need a firewall between your switch and the Internet. –  David Schwartz Mar 1 '13 at 14:34
2  
How would anyone (that you didn't authorize) gain access to your network in such a way as to have access to the switch? If they've got access at that level I'd be worried about more than just the switch. –  joeqwerty Mar 1 '13 at 16:19

1 Answer 1

Configure the switch so it is not accessible from the public-facing network, and ideally from a specific management LAN connection.

Then connect using a VPN - configure it to use certificate authentication in addition to your logon.

If you absolutely cannot do this, configure the firewall between this switch and the internet to only accept management connections from your IP address. This isn't perfect security, but it limits visibility of the logon screen so will increase security.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.