nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Unleashed connection to ICX

unknown

Just updated my AP in my local test system here to 200.8.10.3.243, attached to an ICX 7150-C08P (also updated to 8.0.92). In the Unleashed interface, we can now get status from the ICX switch, which is a nice feature. When I tried to set this up today, it won't let me login, tells me my username & password is incorrect. SSH is enabled (should be by default on 8.0.90) , and I assigned it credentials. when I login to the switch via SSH through putty it connects just fine. Any ideas on why it should fail via the unleashed interface?

Find more posts tagged with

Accepted answers

ricardo_navarre

Update the firmware using SPSxxxx.bin file, it is for L2 ( only switch ) configuration, with this firmware, unleashed automatically detects and add the switch to unleashed network.

All comments

unknown

Glad I searched first and found someone else banging their head against the keyboard re: this feature.

First, any Ruckus employees reading this: this feature is poorly implemented, buggy as hell and to the wider community, broken.

The good news is, assuming you've got a decent head on your shoulders, you can get the feature working irrespective of Ruckus's dodgy code.

After reading the manual and immediately recognising this feature was never properly QA-ed, I jumped onto `Debug Info` under `Administration --> Diagnostics --> Debug Info` and checked a new tick box that appears in this release `Network Management (ICX)`.

Image_ images_messages_5f91c45a135b77e247a3c306_c78783af72c41d3b17351d97372514eb_RackMultipart2020020359101g1zx-631286ff-e082-4802-8c5e-0485b76887c0-588941197.png1580729104

Image_ images_messages_5f91c45a135b77e247a3c306_c78783af72c41d3b17351d97372514eb_RackMultipart2020020359101g1zx-631286ff-e082-4802-8c5e-0485b76887c0-588941197.png1580729104

After a few minutes I reviewed the output from the `Logs` tab, specifically, `To show current system logs, click here`. You could also elect to download the tarball via `Save System Log`.

Here's what Unleashed is trying to do and why it'll never succeed by itself (but you can fix it until Ruckus do).

In the manual for Unleashed 200.8 it states the easiest way to get this feature to work is to ensure that you factory reset the switch (or the switch is in out of the box brand new).

Knowing the only way to access a factory reset device is via serial, that was enough info to know that this feature was never going to work.

The Unleashed master will attempt to the following:

1. Discover the switch and its management IP address via LLDP.
2. Login via SSH with the username / password of **super** and **sp-admin**.
3. If this combo fails, it tries **unleashed** as the password.
4. If the user **super** does not exist the Unleashed GUI will never ask you to "Approve" the switch(es) its trying to log into. This a misnomer, since by default "Auto Approve" is enabled in the Unleashed GUI and it's actually prompting you to enter a set of credentials that will work.
5. Assuming it gets this far, it removes the **super** user since it's default and shouldn't exist in the first place. It then creates a user/password identical to the primary Unleashed admin. If the username already exists, Fastiron will just change that user's password to match the Unleashed admin.
6. Unleashed checks to see if you've enabled snmp server in Fastiron via a grep of the running config.
7. Unleashed attempts the command `show running-config | include snmp-server enable vlan` then at some point runs the command `snmp-server community ro` where `` is a string comprising `un` folllowed by 25 numbers (generated when you first configure Unleashed and can be regenerated if neccessary, under what circumstances I have no idea).
8. Assuming all the above works, the Unleashed master can now access the read-only SNMPv2 community string and grab a bunch of run-of-the-mill SNMP read-only data and display a pretty graphical representation of your Fastiron ICX.

I assume that because you can also backup the config and do some other things like "Reset Port" which I haven't tested, the Unleashed master will attempt to access your ICX(es) via the privileged user it created in the above process.

Now here's why this will never, ever, work for anyone automatically.

1. SSH is disabled out of the box.
2. Accessing the switch in its factory default state immediately enforces you to change the password of the **super** user. The moment you do that, you cannot change it back to **sp-admin**. Fastiron will throw a console error with `Error: Cannot create local user with default password`.
3. Yes, you *can* change it to **unleashed** but how would you know to do that other than debugging? Unleashed also assumes you have `aaa authentication login privilege-mode` enabled so whatever user it logs in as will immediately be in priv exec mode.
4. Enabling SSH requires generating the public/private key pair via `crypto key generate rsa`.
5. Once enabled, you need a management IP address configured that's on the same subnet as your Unleashed master.
6. LLDP is disabled out of the box, so you need to enable that. If the switch is on a different subnet to your Unleashed master you also need to configure LLDP to advertise its management IP address via `lldp advertise management-address ipv4 ports `.
7. SNMP is disabled out of the box, so you need to enable that. Because Unleashed gets a response from its grep of "snmp-server" it never actually commits any config to enable it and even if it did, grepping for `snmp-server` does **not** tell you if the SNMP server is enabled.

It is counter intuitive but Fastiron has always required you to run `snmp-server` without anything proceeding to actually start the process, which isn't included in `show run` and you can only see the SNMP server status via `#show snmp ser | inc Status` which returns `Status: Enabled` or `Status: Disabled` if factory default.

To enable SNMPv2, at a minimum, you need to have committed:

`snmp-server community public ro`

`snmp-server`

---

So what this all amounts to is a feature implemented by someone who poorly understands Fastiron, and further, sucks at writng error handling routines as Unleashed will, assuming LLDP is enabled on your ICX, fail forever trying to connect.

To get this feature to work is pretty simple when it comes down to it, ignoring the debacle above. Simply ensure the following:

1. Create a user (or change the password if the user you'd be created matches the one you use for Unleashed) with the same password as you use to login to Unleashed (via the GUI or CLI).
2. Enable LLDP and advertise the management IP address if it's on a different subnet, ensuring Unleashed has SSH/SNMP access to your ICX.
3. Enable the SNMP server on ICX (do not create the public ro community I listed above, that is an example only and often the default for most devices - it's bad practise at best and a security risk at worst). Exact config snippet:

``
snmp-server enable
snmp-server community ro
snmp-server
``
4. Assuming you don't have SSH enabled, enable it by generating a RSA public/private key pair for the ICX (`crypto key generate rsa modulus 2048`).
5. If you've disabled password authentication and use public key authentication only, too bad, enable it again via `(config)#ip ssh password-authentication yes`.
6. If the **super** user exists for whatever reason, nuke it via `(config)#no user super`.
7. Set up AAA so it automatically puts any user that has the privileges enabled (in this case, the Unleashed user) into priv exec mode via `aaa authentication login privilege-mode`.
8. Finally, save your config `write memory`.

If it all goes well you'll get something like this in the Unleashed GUI after a little while:

Image_ images_messages_5f91c45a135b77e247a3c306_44700448f26f27599fd24ef048d3fe6a_RackMultipart2020020338053c8nj-b0e54f18-1cec-4c73-8b4e-05a7c73708fc-1882695667.png1580729236

Image_ images_messages_5f91c45a135b77e247a3c306_44700448f26f27599fd24ef048d3fe6a_RackMultipart2020020338053c8nj-b0e54f18-1cec-4c73-8b4e-05a7c73708fc-1882695667.png1580729236

unknown

Well, I didn't realise the forum didn't support markdown so all my codeblocks, emphasis and other punctuation is broken. Apologies.

unknown

Thanks for the info, I'll try and get mine to work this way when I get a minute

unknown

Can ruckus fix the issue on next Unleashed firmware?

unknown

as per this thread:
https://forums.ruckuswireless.com/ruckuswireless/topics/unable-to-add-icx-7150-c12p-switch-to-unleashed-dashboard

after updating the switch to 8.0.9, reset everything and let the Unleashed network sign in using the default super credentials, then unleashed resets the switch credentials to match the unleashed credentials and you're golden. This worked for me using unleashed 200.8.10.3.278

ricardo_navarre

Update the firmware using SPSxxxx.bin file, it is for L2 ( only switch ) configuration, with this firmware, unleashed automatically detects and add the switch to unleashed network.

unknown

well, this was really helpful.

I should also note unleashed in 200.11 now removed other snmp community strings on joining. And it removes other logging hosts that you may have configured.

You can add back them after it joins, just something to be aware of. (you can view what it removed in Unleashed events/alarms area)

brian_hiatt_529

Hi Russell, I realize this is 3 years old, but I was looking to get my Unleased units to stop "complaining" about the ICX6450 switches I have, when I came across this post. You post makes me think that the 8.0.90 firmware really isn't needed if the unleashed is just running SSH commands, but when I followed your instructions it didn't seem to make any difference. The logging changed, but the GUI didn't show anything different. Have you dug into this anymore since 2020?

gentilagji

Thank you!!
Anonymous post fixed my issue with recent Unleashed 200.19.7.112.238 and 08.0.95t.
I had tried multiple rabbit holes online but had not

deleted super,
looked into snmp, or
enabled aaa authentication login privilege-mode.

sanjiva_srivast

Glad it was helpful!