<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} @font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
a:link, span.MsoHyperlink
{color:#0563C1;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:#954F72;
text-decoration:underline}
span.EmailStyle17
{font-family:"Calibri",sans-serif;
color:windowtext}
.MsoChpDefault
{font-family:"Calibri",sans-serif}
@page WordSection1
{margin:72.0pt 72.0pt 72.0pt 72.0pt}
div.WordSection1
{}--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hi Michael,</p>
<p><br>
</p>
<p>When I recently deployed a few 9300's in our DC, this feature was disabled before bringing in external connectivity because one of our engineers here was aware of this vulnerability and removed it.</p>
<p><br>
</p>
<p>It's enabled out of the box because the idea is that it's for zero-touch initial provisioning of the switch. The above engineer was working on a large infrastructure project for a govt department, which involved deploying approximately 600x 3850 switches.
These were set up in a central system and when powered on, the configs were delivered, rather than having to console into every switch and deploy the configuration.</p>
<p><br>
</p>
<p>Michael<br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> AusNOG <ausnog-bounces@lists.ausnog.net> on behalf of Michael J. Carmody <michael@opusv.com.au><br>
<b>Sent:</b> Wednesday, 9 May 2018 14:21<br>
<b>To:</b> ausnog@lists.ausnog.net<br>
<b>Subject:</b> [AusNOG] Bouncing Cisco Equipment and "Smart Install"</font>
<div> </div>
</div>
<div>
<div class="WordSection1">
<p class="MsoNormal">Hey All,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Just a feeler to see if anyone else is seeing this.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">We have some Cisco switches we use as Layer 2/3 NTU’s to talk to client equipment on the far ends of fibre links.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">As of yesterday morning, all of these switches started a roughly 1-2 hour reboot outage.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">All smartnet’ed, running latest recommended stable from cisco, and nothing in the logs other than a hard reset just occurred.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">We have been additionally hardening the exposure of various interfaces (attacks were captured coming from resi ISP looking .mx domains), and it appears the one that has stopped the rot is disabling the “Smart Install” feature with a “no
vstack” command, reload config from out config store and back to work…</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">TBH I didn’t even know this protocol existed… a non-authenticated, on by default protocol that allows you to configure and image deploy on network equipment.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Like, its our own fault, but what the hell is this doing on by default?</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Anyone else with Cisco or “Smart Install” equipment seeing an uptick in scanning/poking activity?</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">-Michael Carmody</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">(Ref: <a href="https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170214-smi">
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170214-smi</a> )</p>
</div>
</div>
</div>
</body>
</html>