Comware

Hello all you Comware Gurus. It has been a while since we have had to post any new questions. Thank You Sincerly in Advance, you all have expanded my knowledge tremendously over the years and I am very appreciative. This time I am in need ok knowledge of 5500 switch (Prevously was always 5700 IRF ring switch stack)

So something interesting happened yesterday and I do not have an answer. It has been working for years without issue.

We have a stack of three 5500 switches configured with IRF in a ring. We can no longer access the web interface or get the web login page. Also I cannot connect to the switch via ssh using putty but I get the prompt but the username and password no longer work. I connect to the switch via the console and can display current-configuration and reset my password but no matter what I do, I cannot ssh into the switch. I am using putty 0.84 and the switch is running 5.20.99 Release 5101P05

I generated a new rsa 2048 bit key but still no ssh with the username and password access. I attempted to redo http access but I am afraid because I do not want to have to reboot switch and take down the network without a maintenance window. 

Another Question: So the three switches are in a stack so does a single ip address that I assign on the Management port on a single unit get "ported" for access across all switches? We also have a Vlan1 interface but No IP is assigned there. The Management ethernet port is M-GigabitEthernet0/0/0. We have a cable plugged into all three switches on the Management port but if I unplug them all, the switch still responds to ping. When I look at arp cache on windows and use arul john mac lookup website, it says unknown.  IP 192.168.50.252 shows mac 02-48-ff-89-56-a5

Can I setup http access again without a reboot?
It looks like http is running again but I cannot access it! Help!
display ip http
Operation Status: Running

I have attached a sanitized config.

Thanks Again!

Attachment(s)

DBNET -1-063026 - sanitized.txt   23 KB 1 version

Just a few thoughts shooting from the hip without a lot of analysis. I'm not an expert.

• If nothing changed on the switches, then it would strike me that software updates on the "client" end have resulted in a (out of box) incompatibility.
• Your firmware looks very old. Our 5710 switches are running version 7.1.070. You're running 5.20.99. That's where I'd aim my focus. I'm doubtful you're under support with that old a version, but what do I know.
• RSA keys have looong become old-fashioned and less preferred by SSH clients of all sorts. I'd recommend (trying) to create an ecdsa key as follows: `public-key local create ecdsa secp384r1`
  • The above is the command that works on my switch firmware versions. YMMV.
• My understanding of the switch stacks is that yes, once they're stacked they are essentially one switch with shared management IP addressing and the IRF ring is what prevents split-brain from occurring.
• IIRC "http" web being enabled is not the same as HTTPS. Security requirements tend to go up with time, so similar to my SSH point, old algorithms/ciphers may no longer be accepted on your browser. Browsers especially hate plain-HTTP these days.
• I see you have a RADIUS config. Look into your network logs to see if something is preventing RADIUS traffic, or the logs on the RADIUS server itself.

Good luck.