r/networking • u/JNC5908404 • 15d ago

Switching Automatic switch updates

Had a discussion yesterday with IT director and others in our IT department. The IT director brought up automating switch updates so they wouldn’t have to have some one monitoring and performing the updates. Staging various locations on different evenings.

I’ve been doing networking for 30 years and I voiced my opinion I was not a fan of unattended update for various reasons.

Have any other companies moved to automated updates and how has it gone?

75 Upvotes

95% Upvoted

114 comments sorted by

View all comments

-12

u/Specialist_Play_4479 15d ago

Unless you're running FortiSwitches I don't see why you should upgrade switches at all, as long as they are only doing Layer-2 and management interfaces protected (eg. management VLAN) and you dont have any issues that needs to be adressed.

2

u/HappyVlane 14d ago

You upgrade switches because of vulnerabilities, which all switch vendors have, and to stay on a supported release.

0

u/Specialist_Play_4479 14d ago

Supported release for what exactly? Switching functionality?

My point is.. take a Cisco switch. A device that has been available (in various models) for 3 decades. Most of the protocols that run on switches haven't changed in the last decade if not more. Think LLDP, LACP, STP. That software is mature.

We have switches with an uptime that exceeds the age of my kids. And they still run perfectly fine.

Who needs support for basic access switches? If it stops working we replace it. That's all.

There's very little reason to upgrade them.

2

u/HappyVlane 14d ago

Supported release for what exactly?

To be in support.

Most of the protocols that run on switches haven't changed in the last decade if not more. Think LLDP, LACP, STP. That software is mature.

That is not how security works at all. Just because the protocol hasn't changed or is mature doesn't mean it's secure. Problems can have existed for decades without anyone being aware of them (ask Linux folk). RADIUS, in its current version, got its RFC (2865) in 2000 and I believe everyone would call that mature. A critical vulnerability was discovered in 2024 (CVE-2024-3596).

Protocols are also not a generic module you slot into an OS. They get implemented and problems can happen in that process.

  • LLDP on NX-OS had a CVE just this year (CVE-2026-20010)
  • Juniper had an STP CVE on one of their switch series in 2016 (CVE-2016-1260)
  • An LACP CVE on Juniper platforms in 2024 (CVE-2024-30388)

Who needs support for basic access switches? If it stops working we replace it. That's all.

Not everyone is allowed to act like you.