The original AV installer is no longer available, and we do not have the administrator credentials or Wi-Fi password for the existing RUCKUS system.

Kind of funny, after having Cox come out today to check our internet, we realized that for the past six years we’ve actually been using the Wi-Fi from the Cox router instead of the RUCKUS whole-home system.

The access points are mounted on the ceiling, and we are not comfortable removing them, factory resetting them, or reconfiguring the system ourselves because we are concerned about losing the existing configuration or disrupting other connected AV/network devices.

We would prefer to have an experienced RUCKUS technician or authorized partner come on-site to inspect the system, regain management access if possible, verify that everything is working properly, and advise whether the current equipment should be kept or upgraded.

We’re in Orange County, CA.

Can RUCKUS recommend an authorized technician or partner who provides on-site residential support for an existing Lennar/RUCKUS installation?

Since the outage, the RUCKUS Wi-Fi has severe intermittent packet loss. Internet sometimes works normally and then becomes extremely slow or stops responding.

Troubleshooting already completed:

• AT&T gateway connection is approximately 1 Gbps up/down.
• When connected directly to the AT&T gateway Wi-Fi, I get 0% packet loss.
• Through the RUCKUS Wi-Fi, a 100-packet test to 8.8.8.8 showed 59% packet loss.
• More importantly, a 100-packet test directly to my local AT&T gateway (192.168.1.254) showed 81% packet loss, so the problem appears to be inside the local RUCKUS network.
• Wi-Fi signal to the RUCKUS AP is strong (approximately -49 dBm).
• I have already power-cycled the ICX/APs.
• I also performed the ICX 7150-C12P physical recovery procedure by powering it off, holding Reset while reconnecting power, waiting for the LEDs to flash amber, and releasing Reset. The problem remains.
• The ICX switch powers up normally and the APs come online.

Switch: RUCKUS ICX 7150-C12P / ICX7150-C12P-2X1G

Replacing the switch with a cheap unmanaged PoE switch has resolved the issue. All the same devices are connected, so this unit likely has faulty hardware.

Just trying to claim the lifetime warranty on the switch, so hopefully a support engineer can approve this. Thanks!

1. Username/password recovery
   After the switch boots, I receive:
   User Access Verification
   Please Enter Login Name:
   Leaving the username and password blank results in User login failure, and the previous credentials I tried do not work.
   What exact steps should I follow after using no password to gain CLI access and create a new administrator username/password? I want to make sure the new credentials are permanently saved.
2. NAND/ECC errors and future power outages
   Because the switch produced NAND/ECC errors and could not load the primary kernel image, I am concerned that the switch may fail to boot normally after the next power outage or restart.
   Can you please advise:
   Whether these NAND/ECC and Bad FIT kernel image format errors indicate a corrupted primary firmware image or possible flash-memory failure.
   Whether the primary firmware image should be repaired/reinstalled.
   How to verify that both primary and secondary images are healthy.
   Whether the switch should be considered for replacement/RMA if the NAND/ECC errors persist.
   How to make sure the switch will automatically recover and boot normally after a future power outage without requiring another serial-console intervention.
   The network is currently operational, so I would prefer not to factory-reset the switch or make changes that could disrupt the working configuration unless necessary.
   Thank you for your assistance.

I managed to both powercycle and factory reset the main switch and eventually got it to restart. However both APs were no longer set up and were showing up as Recover.Me wifi networks to connect with. I tried to log in using the printed password on the devices but that failed as well as every permutation of login (sp-admin, admin, Lennar, etc.).

I eventually pressed the hard reset button on one of the switches and it changed to Configure.Me. That AP is no longer accepting a wifi password and allows me to connect but is not transmitting any signal through the switch back to the main modem.

For reference no hardware was changed, shifted, or broken. I am not really certain was caused the issue. I have also deleted the router function within my switch, so it only operates as a switch. I am on AT&T gigabit fiber which is wired through the house to the ruckus switch.

NI need help accessing web UI of switch that I purchased for Lennar home. It was a pre-owned switch that was reset. I can't seem to access it via browser from IP or CLI via SSH. I don't have PuTTy or a console to connect directly. Can you help me access this so I can configure this device for my network?

Thanks

2: Run the Following command: "arp -a", now you can see the IP or internet address of the switch, and the physical address, however you need to know the physical address that can be located on a sticker in the Switch, so you can do the match with the information displayed in the CMD.

3: Now you know the IP or internet address, let's download the free Application that will allow you to gain the remote access.

Visit: https://putty.org/

4: Now open the putty application and enter the information inside the IP field, and choose between SSH or Telnet access, please test both options because the SSH access is not always active by default, but Telnet must work.

SSH:                                                                                        

 Telnet:

5: Access: whichever option you are using, if it asks for a password, enter the following, the enable command allows you to execute more commands to check the switch.

User:  “super”

Password: “sp-admin”

6: Helpful commands:

“Show flash”                        (check the flash)

“Show version”                 (check current version)

“show inline power”        (check the devices getting power)

By Yarenis Hernández

Technical Support Engineer | L2 TAC Wired

RICXI|RCNA|CCNA

I wanted to take a moment to look at spanning tree. By default, ICX switches run 802.1d spanning tree on a per-vlan basis. Ideally, we want to use a protocol with faster convergence such as rapid spanning tree (802.1w). I will go through some general configuration steps and a few best practices. These configurations will not suit all customers, but it is a good starting point for many. 

Enabling RSTP on vlan(s) 

ICX#conf t
ICX(config)#vlan 10 20 30 <--edits three vlans at once. You can edit vlans one at a time or using a range via the 'to' syntax (vlan 1 to 20)
ICX(config-mvlan-10*30)#spanning-tree 802-1w

Now that 802.1w is running, we will want to set a root bridge priority. If no priority is defined, the default of 32768 will be used. Let us assume you want this switch to be the root bridge. A lower priority number wins, so let us go ahead and set it to zero to ensure this switch becomes root bridge:

ICX(config-mvlan-10*30)#spanning-tree 802-1w priority 0

The resulting configuration will look like this:

vlan 10 by port 
tagged ethe 1/1/1 to 1/1/48 ethe 1/2/1 ethe 1/2/2 ethe 1/2/3 ethe 1/2/4 ethe 1/2/5 ethe 1/2/6 ethe 1/2/7 ethe 1/2/8 
spanning-tree 802-1w 
spanning-tree 802-1w priority 0
!
vlan 20 by port 
tagged ethe 1/1/1 to 1/1/48 ethe 1/2/1 ethe 1/2/2 ethe 1/2/3 ethe 1/2/4 ethe 1/2/5 ethe 1/2/6 ethe 1/2/7 ethe 1/2/8 
spanning-tree 802-1w 
spanning-tree 802-1w priority 0
!
vlan 30 by port 
tagged ethe 1/1/1 to 1/1/48 ethe 1/2/1 ethe 1/2/2 ethe 1/2/3 ethe 1/2/4 ethe 1/2/5 ethe 1/2/6 ethe 1/2/7 ethe 1/2/8 
spanning-tree 802-1w 
spanning-tree 802-1w priority 0

Now that our RSTP instances are running, let's take a look at a couple best practices.

Switch-to-switch connections should be defined as point-to-point links to optimize convergence times. In this example, let us assume ports 1/2/1 through 1/2/8 are all switch-to-switch links:

ICX#conf t
ICX(config)#interface ethernet 1/2/1 to 1/2/8
ICX(config-mif-1/2/1-1/2/8)#spanning-tree 802-1w admin-pt2pt-mac

The resulting configuration:

interface ethernet 1/2/1 port-name Switch-to-Switch-Connection 
spanning-tree 802-1w admin-pt2pt-mac

Switch-to-client (edge) connections should be defined as operational edge ports. In this example, let us assume ports 1/1/1 through 1/1/48 are all client edge ports:

ICX#conf t
ICX(config)#interface ethernet 1/1/1 to 1/1/48
ICX(config-mif-1/1/1-1/1/48)#spanning-tree 802-1w admin-edge-port

Client ports can also have STP BPDU Guard enabled. This will shut down the port if any BPDUs are received on the port. 

ICX#conf t
ICX(config)#interface ethernet 1/1/1 to 1/1/48
ICX(config)#stp-bpdu-guard

The resulting configuration:

interface ethernet 1/1/1 port-name Client-Port 
spanning-tree 802-1w admin-edge-port 
stp-bpdu-guard

To see RSTP information, you can use the following commands:

ICX#show 802-1w

ICX#show 802-1w detail

Note: If you are running 802.1d, you will use 'show spanning-tree' and 'show spanning-tree detail'. MSTP also has unique commands such as 'show mstp' and 'show mstp detail'

To see all available configuration options for spanning tree, please see our FastIron Layer 2 Switching Configuration Guide:

PDF Version (requires login)

Let us know if you have any questions!

When a 3m DAC cable connection is made in 7150 between port 1/3/1 to 2/3/3

The link remains down, and the two switches will not stack with each other.

Details from Ruckus optic guide:

Link to Ruckus optic guide for reference:

• https://www.commscope.com/globalassets/digizuite/61722-ds-ethernet-optics-family.pdf

Below is link to KBA which briefs about the problem:

• https://support.ruckuswireless.com/articles/000011828

Technical Bulletin link:

• https://support.ruckuswireless.com/technical_support_bulletins/607

Boot Loop Process

When a unit is stuck in a boot loop and fails to stabilize, the first step is to console into the unit directly and review the boot process. This can provide insights into why the unit is not booting correctly.

Example Error:

Booting image from Secondary

Wrong Image Format for bootm command

ERROR: can't get kernel image!

could not boot from secondary, no valid image; trying to boot from primary

Booting image from Primary

Wrong Image Format for bootm command

ERROR: can't get kernel image!

1. Console the Unit:
2. Connect to the unit via a console cable and monitor the boot process. Interrupt the boot process by pressing b at the boot counter.

   Ruckus Networks Bootloader: 10.1.26T215 (Nov 29 2022 - 04:42:59)

   Validate Shmoo parameters stored in flash ..... OK

   Restoring Shmoo parameters from flash .....

   Running simple memory test ..... OK

   ICX7450-24 Copper (Non-POE), PVT1

   SYS CPLD VER: 0x10, Released Ver: 0

   Enter 'b' to stop at boot monitor:  3 >>>> Press 'b' to stop the process.

   ICX7450-Boot>

1. Access Boot Mode:
2. Check the installed images using the show_image command.

   ICX7450-Boot> show_image

   ===========================

   Primary  : SPR08095k(33554432)

   Secondary: SPS08095j(31457280)

   ===========================

1. Set Up for Recovery:
2. Connect an Ethernet cable from the management port to the TFTP server.
3. Ensure the device is in boot mode for recovery.

Example:

1. Configure Environment Variables:
2. Set the TFTP server IP and other necessary network settings.

   ICX 7450-48> setenv serverip 10.10.10.21

   ICX 7450-48> setenv ipaddr 10.10.10.22

   ICX 7450-48> setenv gatewayip 10.10.10.1

   ICX 7450-48> setenv netmask 255.255.255.0

   ICX 7450-48> saveenv

• Verify the settings:

   ICX 7450-48> printenv

   baudrate=9600

   ipaddr=10.10.10.22

   gatewayip=10.10.10.1

   netmask=255.255.255.0

   serverip=10.10.10.21

   uboot=ruckus/ICX7450/bootcode/spz10115

   Version:10.1.06T215 (May 15 2015 - 11:28:23)

1. Test Connectivity:
2. Ping the TFTP server to ensure connectivity.
3. Disable the Windows Firewall

   ICX 7450-48> ping 10.10.10.21

   ethPortNo = 0

   Using egiga0 device

   host 10.10.10.21 is alive

1. Update the Flash:
2. Set the image file name and update the flash.

   ICX 7450-48> setenv image_name images/ICX/SPR08090.bin

   ICX 7450-48> update_primary

• For versions below 8080f, update the uboot file.

Provide the file name of the boot image to be copied from the tftp server.

   ICX 7450-48> setenv uboot <xxx.bin>

   ICX 7450-48> update_uboot

1. Boot the Unit:
2. Load the image from the primary or secondary flash.

   ICX 7450-48> boot_primary

Video Link as reference: https://www.youtube.com/watch?v=RHriOYYD_iI

Link as reference : https://docs.commscope.com/bundle/fastiron-09010-upgradeguide/page/GUID-9B5D5A56-039D-44FB-8FD2-B9B55E71ADE8.html

• For ICX-8200 models, boot from the golden image if necessary.

   boot_golden_primary - Flash the Golden UFI Image to Primary and boot from Primary

Name : sysDescr

OID : 1.3.6.1.2.1.1.1

Output / Value (OctetString): Ruckus Wireless, Inc. Stacking System ICX7750-48F, IronWare Version 08.0.90kT201 Compiled on Feb 22 2021 at 23:56:00 labeled as SWS08090k

Name : sysObjectID

OID : 1.3.6.1.2.1.1.2

Output / Value (OID): snFastIronStackICX7750Switch

Name : sysUpTime

OID : 1.3.6.1.2.1.1.3

Output / Value (TimeTicks): 2418 hours 16 minutes 35 seconds (870579500)

Name : sysName

OID : 1.3.6.1.2.1.1.5

Output / Value (OctetString): Superman1

Memory :

Name : snAgGblDynMemUtil

OID : 1.3.6.1.4.1.1991.1.1.2.1.53

Output / Value (Gauge): 14

Name : snAgGblDynMemTotal

OID : 1.3.6.1.4.1.1991.1.1.2.1.54

Output / Value (Gauge): 3853291520

Name : snAgGblDynMemFree

OID : 1.3.6.1.4.1.1991.1.1.2.1.55

Output / Value (Gauge): 3246243840

Hardware :

CPU :

Name : snAgGblCpuUtil1SecAvg

OID : 1.3.6.1.4.1.1991.1.1.2.1.50

Output/ Value (Gauge): 1

Name : snAgGblCpuUtil5SecAvg

OID : 1.3.6.1.4.1.1991.1.1.2.1.51

Output/ Value (Gauge): 1

Name : snAgGblCpuUtil1MinAvg

OID : 1.3.6.1.4.1.1991.1.1.2.1.52

Output/ Value (Gauge): 1

Power supply :

Without Stacking

Name : snChasPwrSupplyIndex

OID  : 1.3.6.1.4.1.1991.1.1.1.2.1.1.1

Output / Value (Integer): 1

Name : snChasPwrSupplyDescription

OID : 1.3.6.1.4.1.1991.1.1.1.2.1.1.2

Output / Value (OctetString): Power supply 1 (AC - Regular) present, status ok

       Model Number:  BRCD-10G

       Serial Number: CUB2V34L06M

       Firmware Ver: 2.1

Name : snChasPwrSupplyOperStatus

OID : 1.3.6.1.4.1.1991.1.1.1.2.1.1.3

output / Value (Integer): normal (2)

With Stacking :

Name : snChasPwrSupply2Unit

OID : 1.3.6.1.4.1.1991.1.1.1.2.2.1.1

Output :

Name/OID: snChasPwrSupply2Unit.1.1; Value (Integer): 1

Name/OID: snChasPwrSupply2Unit.2.1; Value (Integer): 2

Name/OID: snChasPwrSupply2Unit.3.1; Value (Integer): 3

Name : snChasPwrSupply2Index

OID : 1.3.6.1.4.1.1991.1.1.1.2.2.1.2

Output :

Name/OID: snChasPwrSupply2Index.1.1; Value (Integer): 1

Name/OID: snChasPwrSupply2Index.2.1; Value (Integer): 1

Name/OID: snChasPwrSupply2Index.3.1; Value (Integer): 1

Name : snChasPwrSupply2Description

OID : 1.3.6.1.4.1.1991.1.1.1.2.2.1.3

Output :

Name/OID: snChasPwrSupply2Description.1.1; Value (OctetString): Power supply 1

Name/OID: snChasPwrSupply2Description.2.1; Value (OctetString): Power supply 1

Name/OID: snChasPwrSupply2Description.3.1; Value (OctetString): Power supply 1

Name : snChasPwrSupply2OperStatus

OID : 1.3.6.1.4.1.1991.1.1.1.2.2.1.4

Output :

Name/OID: snChasPwrSupply2OperStatus.1.1; Value (Integer): normal (2)

Name/OID: snChasPwrSupply2OperStatus.2.1; Value (Integer): normal (2)

Name/OID: snChasPwrSupply2OperStatus.3.1; Value (Integer): normal (2)

Fan

Without stacking :

Name : snChasFanIndex

OID : 1.3.6.1.4.1.1991.1.1.1.3.1.1.1

Output :

Name/OID: snChasFanIndex.1; Value (Integer): 1

Name/OID: snChasFanIndex.2; Value (Integer): 2

Name/OID: snChasFanIndex.3; Value (Integer): 3

Name/OID: snChasFanIndex.4; Value (Integer): 4

Name : snChasFanDescription

OID : 1.3.6.1.4.1.1991.1.1.1.3.1.1.2

Output :

Name/OID: snChasFanDescription.1; Value (OctetString): Fan 1 (from left when facing back side)

Name/OID: snChasFanDescription.2; Value (OctetString): Fan 2 (from left when facing back side)

Name/OID: snChasFanDescription.3; Value (OctetString): Fan 3 (from left when facing back side)

Name/OID: snChasFanDescription.4; Value (OctetString): Fan 4 (from left when facing back side)

Name : snChasFanOperStatus

OID : 1.3.6.1.4.1.1991.1.1.1.3.1.1.3

Output :

Name/OID: snChasFanOperStatus.1; Value (Integer): normal (2)

Name/OID: snChasFanOperStatus.2; Value (Integer): normal (2)

Name/OID: snChasFanOperStatus.3; Value (Integer): normal (2)

Name/OID: snChasFanOperStatus.4; Value (Integer): normal (2)

With stacking

Name : snChasFan2Unit

OID : 1.3.6.1.4.1.1991.1.1.1.3.2.1.1

Output :

Name/OID: snChasFan2Unit.1.1; Value (Integer): 1

Name/OID: snChasFan2Unit.1.2; Value (Integer): 1

Name/OID: snChasFan2Unit.1.3; Value (Integer): 1

Name/OID: snChasFan2Unit.1.4; Value (Integer): 1

Name/OID: snChasFan2Unit.2.1; Value (Integer): 2

Name/OID: snChasFan2Unit.2.2; Value (Integer): 2

Name/OID: snChasFan2Unit.2.3; Value (Integer): 2

Name/OID: snChasFan2Unit.2.4; Value (Integer): 2

Name/OID: snChasFan2Unit.3.1; Value (Integer): 3

Name/OID: snChasFan2Unit.3.2; Value (Integer): 3

Name/OID: snChasFan2Unit.3.3; Value (Integer): 3

Name/OID: snChasFan2Unit.3.4; Value (Integer): 3

In 8200, The Switching image was deprecated with 10.0 and each platform will only use one image starting with 10.0.

ALL the L3 image support L2 features starting with 10.0, Only routing image are available for all supported models.
Switching features are still available in the routing image.

>The 8200 by design doesn't support l2 image so there is no ip default-gateway command.

>Instead we need to specify the route to forward the traffic to an external subnet. We can either use static routes, default routes or a routing protocol.

>If you want to use the ICX8200 switch as a L2 device follow the below steps:

You just need to add a default route to the device, And then add the VLANs you want. The ICX8200 model can only run L3 firmware images. That's why we need to add a default route for it to start behaving as an L2 switch, where it is only passing VLAN traffic in and out. We also need to identify the VLAN where this default route communication goes through. And then create a virtual interface and assign the IP that will be used for management and for communication with the default gateway.

Example:

-Create the virtual interface and assign the IP form MGMT and default route:

ICX8200-switch#conf t
ICX8200-switch(config)#vlan 10
ICX8200-switch(config-vlan10)#interface ve 10
ICX8200-switch(config-if-ve10)#ip address 10.10.10.2/24

Here's the command for the default route:

ICX8200-switch#conf t
ICX8200-switch(config)#ip route 0.0.0.0/0 10.10.10.1 (IP address of your ICX7850 router, which is the default gateway for the management vlan)

ICX8200 with the code 10.00, this code only came in routing, so you can configure the IP address under a VE, loopback or port.

Beginning with the 09.0.00 release, when a VLAN is configured, a virtual routing interface is statically mapped to the VLAN ID. However,
only when you issue the interface ve-num command does the virtual interface get created.

Please refer to the below link of the L3 Routing configuration Guide under Subheading "Assigning an IPv4 Address to an Ethernet Port"

https://support.ruckuswireless.com/documents/4466-fastiron-10-0-10-ga-layer-3-routing-configuration-guide

Please refer to the below link of the L3 Routing Configuration Guide under Subheading "Assigning an IP address to a virtual interface"

https://support.ruckuswireless.com/documents/4466-fastiron-10-0-10-ga-layer-3-routing-configuration-guide

Please refer to the below link of the L3 Routing Configuration Guide under Subheading "Assigning an IP address to a loopback interface"

https://support.ruckuswireless.com/documents/4466-fastiron-10-0-10-ga-layer-3-routing-configuration-guide

Port mirroring is an effective network traffic monitoring technique. It involves duplicating each packet entering or leaving a specific port on a network switch and sending this copy to another port for analysis. This technique is particularly useful for diagnostic and debugging purposes, as well as for enhancing network security.

To set up port mirroring, you designate a 'monitor port' from which packets are copied, and a 'mirror port' that receives these copies. Both incoming and outgoing packets from the monitor port are sent to the mirror port. A network analysis tool, like Wireshark, can then be connected to the mirror port to capture and analyze the traffic. This process allows for detailed examination of data packets without interfering with the normal operation of the network.

Standalone(config)# mirror-port ethernet x/x/x - This command designates the connection to the analyzer tool.
Standalone(config)# interface ethernet x/x/x - This command selects the specific interface from which data capture is desired.
Standalone(config-if-e1000-x/x/x)# monitor ethernet x/x/x both - This command establishes the monitoring of the specified interface and directs the traffic to the analyzer tool.

Verification of Configuration:

To verify the configuration, use the "show mirror" command. This will display the current mirror configuration, confirming the setup for traffic capture and analysis.

Here is an example using the given topology. Our objective is to capture traffic from port 1/2/1 and redirect it to an analyzer tool connected to port 1/1/1, where Wireshark is installed.

Device(config)#mirror-port ethernet 1/1/1
Device(config)#interface ethernet 1/2/1
Device(config-if-e25000-1/2/1)#monitor ethernet 1/1/1 both

Device(config-if-e25000-1/2/1)#show mirror
Mirror port 1/1/1
  Input monitoring      : (U1/M2)   1
  Output monitoring     : (U1/M2)   1

For additional details, please refer to our guides :

Official Guide Port Mirroring and Monitoring Configuration:

https://docs.commscope.com/bundle/fastiron-10010-monitoringguide/page/GUID-7165A5D9-141A-4F23-9965-2940D12A672E.html

Official Guide Configuration Notes for Port Mirroring and Monitoring:

https://docs.commscope.com/bundle/fastiron-10010-monitoringguide/page/GUID-8CDDEB0F-08D9-41A9-9681-B3C05D315BD7.html

Monitoring an Individual LAG Port:

https://docs.commscope.com/bundle/fastiron-08095-monitoringguide/page/GUID-35140D88-386B-438B-A700-59AFDE2297B7.html

Best Regards 

Fernando Vasquez 

Command “aaa authentication login privilege-mode” was removed in 9010 and 10.0.00 versions.

This command was missing in certain 9010 and 10.0.0 versions. Below is the example the output looked like.

ICX7850-48FS Router(config)#aaa authentication login

  default   The default authentication list

In the above output it is noticed that privilege mode option is missing.

Solution:

This command was added back in version 9010h and below is a example from lab output where 7650 switch is running on 9010h version

ICX7650_test(config)#aaa authentication login

  default          The default authentication list

  privilege-mode   Take user to privilege mode after successful authentication

ICX7650_test(config)#aaa authentication login privilege-mode 

For 8200 switches this command was added back in version 10.0.10b and above and below is an example

ICX8200_test(config)#aaa authentication login

  default          The default authentication list

  privilege-mode   Take user to privilege mode after successful authentication

If you are looking to enable privilege mode on the switch and switches are on 9010 and 10.0.00 versions then they would need a upgrade to 9010h and above or 10.0.10b and above.

Run “show ip ssh config” to view all SSH details.

Device#show ip ssh config

SSH server                 : Enabled

SSH port                   : tcp\22

Host Key                   : RSA 2048

Encryption                 : aes256-cbc, aes192-cbc, aes128-cbc, aes256-ctr, aes192-ctr, aes128-ctr, 3des-cbc

Permit empty password      : No

Authentication methods     : Password, Public-key, Interactive

Authentication retries     : 3

Login timeout (seconds)    : 120

Idle timeout (minutes)     : 5

SCP                        : Enabled

SSH IPv4 clients           : All

SSH IPv6 clients           : All

SSH IPv4 access-group      :

SSH IPv6 access-group      :

SSH Client Keys            :

Client Rekey               : 0 Minute, 0 KB

Server Rekey               : 0 Minute, 0 KB

To disable weak SSH cipher:

The diffie-hellman-group1-sha1 key exchange method is a weaker algorithm and can be disabled using the “no ip ssh key-exchange-method dh-group1-sha1” command.

Command:

• Device(config)#no ip ssh key-exchange-method dh-group1-sha1

To disable CBC encryption mode:

Command:

• Device(config)# ip ssh encryption disable-aes-cbc

Output after disabling CBC encryption mode:

ICX7150-24F Switch(config)#show ip ssh config

SSH server                 : Enabled

SSH port                   : tcp\22

Host Key                   : RSA 2048

Encryption                 : aes256-ctr, aes192-ctr, aes128-ctr

Permit empty password      : No

Authentication methods     : Password, Public-key, Interactive

Authentication retries     : 3

Login timeout (seconds)    : 120

Idle timeout (minutes)     : 5

SCP                        : Enabled

SSH IPv4 clients           : All

SSH IPv6 clients           : All

SSH IPv4 access-group      :

SSH IPv6 access-group      :

SSH Client Keys            :

Client Rekey               : 0 Minute, 0 KB

Server Rekey               : 0 Minute, 0 KB

Reference links below:

Enabling SSH

• https://docs.commscope.com/bundle/fastiron-09010-securityguide/page/GUID-8AAB14D8-A662-493A-8504-F7457B9BED02_1.html

Viewing SSH

• https://docs.commscope.com/bundle/fastiron-09010-securityguide/page/GUID-CA1D6AD1-861E-49B3-8CC3-2C14BBA51136.html

Disabling telnet Access

• https://docs.commscope.com/bundle/fastiron-08030-securityguide/page/GUID-0352E51C-3BF4-4F44-9853-466821A8E83E.html

Disable CBC

• https://docs.commscope.com/bundle/fastiron-08030-adminguide/page/GUID-FFF3988D-6510-4D9E-B134-D484DB6BFE7C.html

Disable weak SSH cipher:

• https://docs.commscope.com/bundle/fastiron-08090-securityguide/page/GUID-E6D5CCBB-B8BA-4818-B589-8FA464F2D4B6.html

This Article explains about how to setup QinQ in ICX switches. QinQ setup in used in networks like service provider, ISP’s etc. to help mange the network easily and provide more sublets independent of each other.

Question:

How to configure QinQ using tag profile in ICX switches

Customer Environment:

Customer environment would be mostly a service provider network.

Topology:

Note:

• Service provider switch model is 7550-24 port model.
• Client switch model is a 7150-24 port model.
• Firmware version running is SPR8095m.

Configuration:

Client switch 1 Configuration:

!
vlan 100 by port
tagged ethe 1/1/2
router-interface ve 100
spanning-tree 802-1w
!

!
interface ve 100
ip address 100.0.0.2 255.255.255.0
!

Client switch 2 Configuration:

!
vlan 100 by port
tagged ethe 1/1/1
router-interface ve 100
spanning-tree 802-1w
spanning-tree 802-1w priority 1
!

!
interface ve 100
ip address 100.0.0.1 255.255.255.0
!

Service provider switch 1 Configuration:

!
vlan 1000 by port
tagged ethe 1/1/3
untagged ethe 1/1/2
!
tag-profile 9100
!
!
interface ethernet 1/1/2
tag-profile enable
l2protocol dot1q-tunnel stp
l2protocol dot1q-tunnel lacp
l2protocol dot1q-tunnel cdp
l2protocol dot1q-tunnel lldp
!

Service provider switch 2 Configuration:

vlan 1000 by port
tagged ethe 1/1/3
untagged ethe 1/1/1
!
tag-profile 9100
!
interface ethernet 1/1/1
tag-profile enable
l2protocol dot1q-tunnel stp
l2protocol dot1q-tunnel lacp
l2protocol dot1q-tunnel cdp
l2protocol dot1q-tunnel lldp
!

Outputs:

Client Switch 1:

LLDP details:

client_sw1#show lldp ne
Lcl Port Chassis ID Port ID Port Description System Name
1/1/2 28b3.713f.bcec 28b3.713f.bced 2.5GigabitEthernet1/1/2 service_sw1
1/1/2 609c.9ffe.44d0 609c.9ffe.44d0 2.5GigabitEthernet1/1/1 client_sw2
client_sw1#

Ping details:
client_sw1#show ip int
Interface IP-Address OK? Method Status Protocol VRF
Eth mgmt1 10.176.193.210 YES manual up up default-vrf
Ve 100 100.0.0.2 YES manual up up default-vrf
client_sw1#

client_sw1#ping 100.0.0.1
Sending 1, 16-byte ICMP Echo to 100.0.0.1, timeout 5000 msec, TTL 64
Type Control-c to abort
Reply from 100.0.0.1 : bytes=16 time=3ms TTL=64
Success rate is 100 percent (1/1), round-trip min/avg/max=3/3/3 ms.

client_sw1#traceroute 100.0.0.1

Type Control-c to abort
Tracing the route to IP node 100.0.0.1(100.0.0.1) from 1 to 30 hops

1 1 ms 1 ms 5 ms 100.0.0.1

STP details:
client_sw1#show 802-1w

IEEE 802-1w is not configured on port-vlan 1

--- VLAN 100 [ STP Instance owned by VLAN 100 ] ----------------------------

Bridge IEEE 802.1W Parameters:

Bridge Bridge Bridge Bridge Force tx
Identifier MaxAge Hello FwdDly Version Hold
hex sec sec sec cnt
8000609c9fe853c0 20 2 15 Default 3

RootBridge RootPath DesignatedBri- Root Max Fwd Hel
Identifier Cost dge Identifier Port Age Dly lo
hex hex sec sec sec
0001609c9ffe44d0 20000 0001609c9ffe44d0 1/1/2 20 15 2

Port IEEE 802.1W Parameters:

<--- Config Params --><-------------- Current state ----------------->
Port Pri PortPath P2P Edge Role State Designa- Designated
Num Cost Mac Port ted cost bridge
1/1/2 128 20000 F F ROOT FORWARDING 0 0001609c9ffe44d0
client_sw1#

Client switch 2:
LLDP details:
client_sw2#show lldp ne
Lcl Port Chassis ID Port ID Port Description System Name
1/1/1 28b3.7129.9a4e 28b3.7129.9a4e GigabitEthernet1/1/1 service_sw2
1/1/1 609c.9fe8.53c0 609c.9fe8.53c1 GigabitEthernet1/1/2 client_sw1
client_sw2#

Ping details:
client_sw2#show ip int
Interface IP-Address OK? Method Status Protocol VRF
Eth mgmt1 10.176.194.211 YES NVRAM up up default-vrf
Ve 100 100.0.0.1 YES manual up up default-vrf
client_sw2#

client_sw2#ping 100.0.0.2
Sending 1, 16-byte ICMP Echo to 100.0.0.2, timeout 5000 msec, TTL 64
Type Control-c to abort
Reply from 100.0.0.2 : bytes=16 time=1ms TTL=64
Success rate is 100 percent (1/1), round-trip min/avg/max=1/1/1 ms.

client_sw2#traceroute 100.0.0.2

Type Control-c to abort
Tracing the route to IP node 100.0.0.2(100.0.0.2) from 1 to 30 hops

1 1 ms 1 ms 1 ms 100.0.0.2
client_sw2#

STP details:
client_sw2#show 802-1w

IEEE 802-1w is not configured on port-vlan 1

--- VLAN 100 [ STP Instance owned by VLAN 100 ] ----------------------------

Bridge IEEE 802.1W Parameters:

Bridge Bridge Bridge Bridge Force tx
Identifier MaxAge Hello FwdDly Version Hold
hex sec sec sec cnt
0001609c9ffe44d0 20 2 15 Default 3

RootBridge RootPath DesignatedBri- Root Max Fwd Hel
Identifier Cost dge Identifier Port Age Dly lo
hex hex sec sec sec
0001609c9ffe44d0 0 0001609c9ffe44d0 Root 20 15 2

Port IEEE 802.1W Parameters:

<--- Config Params --><-------------- Current state ----------------->
Port Pri PortPath P2P Edge Role State Designa- Designated
Num Cost Mac Port ted cost bridge
1/1/1 128 20000 F F DESIGNATED FORWARDING 0 0001609c9ffe44d0
client_sw2#

This Article explains about how to setup SNMPv2 and SNMPv3 Traps in ICX switches. SNMP traps are used to trace Issues related to switches using monitoring tools. This article will help with configuration and tracing SNMP traps using captures.

Question:

How to configure and troubleshooting SNMPv2 and SNMPv3 Traps in ICX switches

Customer Environment:

Monitoring tools would be used to capture SNMPv2 and SNMPv3 traps. These monitoring tool could be for example SolarWinds , PRTG etc.

SNMPv2 Configuration:

This configuration applies on all versions for a ICX switches.

Configuration:

snmp-server community public rw
snmp-server host 10.177.89.241 version v2c public

SNMPv2 trap troubleshooting: To troubleshoot and isolate if the polling and trap are working good use the Wireshark to run Packet capture in the uplink of the switch or on port which falls in path of traffic that helps lead the traffic to monitoring tool.

SNMPv2 request from SNMP tool:

SNMPv2 response from Switch:

SNMPv2 Trap Response from the switch:

Here port 1/1/23 is disabled and enabled to generate SNMPv2 trap:

Port disabled:

Port Enabled:

SNMPv3 Configuration:

This configuration applies on all versions for a ICX switches.

Configuration:

snmp-server enable ethernet 1/1/7
snmp-server host 10.177.89.241 version v3 auth test
snmp-server group admin v3 auth notify all read all write all
snmp-server user test admin v3 auth md5 testmd5123 priv des testdes123

SNMPv3 trap troubleshooting: To troubleshoot and isolate if the polling and trap are working good use the Wireshark to run Packet capture in the uplink of the switch or on port which falls in path of traffic that helps lead the traffic to monitoring tool.

SNMPv3 request from SNMP tool:

SNMPv3 response from Switch:

SNMPv3 Trap Response from the switch:

Here port 1/1/11 is disabled and enabled to generate SNMPv2 trap:

Port disabled:

Port Enabled:

How to Decrypt SNMPv3 packets in Wireshark

SNMPv3 Configuration used:

snmp-server enable ethernet 1/1/7
snmp-server host 10.177.89.241 version v3 auth test
snmp-server group admin v3 auth notify all read all write all
snmp-server user test admin v3 auth md5 testmd5123 priv des testdes123

When the SNMP packets are not decrypted it would look like below

Steps:

• Go to Edit > Preferences > Protocols.

• In protocols go to “SNMP” -> Edit “User Table”

• Click on “+” and add SNMPv3 details like Username, Authentication and privacy method and password

Once the details are added the decoded SNMPv3 traps would look like below picture in Wireshark

How can we check this?  The data sheet of the device(s) !.
Let’s consider, RUCKUS ICX 7150-48P Switch, which has the following hardware specifications: 

• 48× 10/100/1000 Mbps RJ-45 PoE+ ports  
• 370 W PoE budget  
• 2× 10/100/1000 Mbps uplink RJ-45 ports  
• 4× 1/10 GbE uplink/stacking SFP/SFP+ ports 

 Which shows that,  It has a PoE budget of 370 W and there are 48 ports that can support PoE+ or 802.3at.

For more reading, refer : https://www.commscope.com/globalassets/digizuite/61729-ds-icx-7150.pdf 
Note that in this example we have considered 7150, but for other models such as 8200, 7550, etc. Please refer to the data sheets for the respective switch families.

Number of devices it can deliver PoE to.  

This relates to the PoE budget of the device and the type of Powered Devices (PDs) used. Nowadays, PDs typically come with PoE+ capabilities, although there are still some that support only PoE. The crucial factor is understanding the PD's capability to determine how many of them the switch can accommodate or power up. For instance, consider an Access Point (AP) rated for PoE+. When negotiating for PoE, the device communicates with the switch through the LLDP TLV field, specifying its class and power requirements. Based on this class, the switch allocates power accordingly.

The above reference is as per IEEE Documentation for PoE standards 802.3at and 802.3bt.  
Based on this, considering that the PD is PoE+ capable, on RUCKUS ICX 7150-48P that has 370 W PoE budget. 
We can calculate the below:  
PSE's budget = 370W 
PD's PoE Class = PoE+ that reserves max. of 30W at PSE  
Number of devices = PSE's PoE budget / PoE Class of the device = 370 / 30 = 12.3333 
It can power up to 12 PDs at PoE+ power level. Any additional PDs would not activate due to insufficient remaining power in the budget.

Now the question arises, why not define the power limit manually?  
    Strict manipulation can indeed bring up more PDs, but it carries a risk. After all PDs are operational and receiving optimal power, reallocating power back to the budget pool is possible. However, if a reload or power cycle of the Power Sourcing Equipment (PSE) occurs unexpectedly, PDs may encounter power-up issues. During the initial power-up or startup phase, the PSE delivers full power to the PDs. Consequently, some connected PDs may experience power shortages and struggle to come online.

Can it be done? And how?  
To configure the power limit manually on a interface based on power limit.  
Please do refer.  
https://docs.commscope.com/bundle/fastiron-08095-managementguide/page/GUID-58622E67-07D7-41E4-B4C6-A9B6F3EA8C74.html 
To configure the power limit manually on a interface based on class of the PD. 
Please do refer. 
https://docs.commscope.com/bundle/fastiron-08095-managementguide/page/GUID-155FABD5-F3C2-4579-ADBB-CC240997524A.html 

How does Ruckus address this?
Ruckus offers two well-known ways for Power Management methods for ICX line that are PoE capable.
Static Power Management:
Power is set aside for each powered device (PD) connected to switch ports when in static PM. This approach adheres to the previously discussed procedure, wherein the maximum power is set aside according to the linked power device's class. If the power reservation is not possible, even when the overall usage is less than the entire power budget, no new PDs will be powered. 
The ICX devices are configured or made available in this mode for PoE management Out of the Box. 

To overcome this, we have Dynamic Power management.  
Dynamic Power Management: 
Where this helps via having the power allocation done based on the consumption of the PD that’s connected.  Here power is not set aside for any ports in dynamic PM. Until the overall power consumption is within the ICX device's total power budget, PDs are turned on automatically.  
However here the switch will immediately shut down any PDs with low priority ports or, if all ports have the same priority, shut down PDs attached to higher-numbered ports in order to keep the total power consumption within the total power budget if the power consumption increases, either by increasing the power consumption of connected PDs or by adding new PDs. 

How to go about setting this?  
Do refer here:  https://community.ruckuswireless.com/t5/RUCKUS-Self-Help/How-to-enable-Dynamic-PoE-power-on-the-ICX-switches/m-p/68751 

There however is a third way, that is Hybrid Power Management. 
This is a mix of the above 2 methods and can be achieved by configuring static PM for a few of the ports and dynamic PM for a few of the ports. The way this works to differentiate between the two methods is based on the priority that is set for the specific interfaces, priority of 1 dictate that it uses static PM, as priority of 2 or higher dictates it uses dynamin PM. This priority can be set per interface or globally as well.  

Under this method, after enabling dynamic poe, below settings are needed enable Hybrid PM,
(1) to enable Static PM, use "inline power ethernet unit/slot/port priority 1" on those specific ports. 
Example: in config mode,  
Inline power ethernet 1/1/1 priority 1 
(2) to enable Dynamic PM, use a priority of 2 or 3 instead of 1 on those specific ports. 
Example: in config mode,  
inline power ethernet 1/1/4 priority 2 

Apart from this, there is also Perpetual PoE and Fast Boot PoE.
Perpetual PoE, where PoE power delivery to the equipment is uninterrupted, when the device is rebooting or reloading.  
Fast Boot PoE, where the PoE is delivered as soon as the switch is turned on, where the PD would not have to wait until the system is up.  
To enable this, Use “inline power poe-ha” in interface configuration prompt.  

For Further reading on PoE features on the ICX line-up, Click here,  

Abbreviations used:
PD - Power Device. 
PSE - Power Source Equipment also known as Endspan device. 
PoE - Power over ethernet. 
PoE Injector is also known as Midspan device. 

ICX7750-26Q Router# show stack

T=1d17h49m48.5: alone: standalone, 😧 dynamic cfg, S: static

ID      Type                   Role             Mac Address            Pri     State       Comment

1 S ICX7750-26QXG active      cc4e.2438.7280            128     local         Ready

2 S ICX7750-26QXG member   748e.f8f9.6300           128     remote       Ready

3 S ICX7750-26QXG member   0000.0000.0000           0        reserve

4 D ICX7750-48XGF member   609c.9f7f.9400            128     remote      Ready

Reasons:

-If unit stuck in boot loop.    

-If there is a physical layer issue such as stacking cable, stacking module.

-If unit is faulty or hardware issue.

Recovery Steps:

If unit stuck in boot loop.

-Try software recovery by taking console access for this unit.

https://docs.commscope.com/bundle/fastiron-08095-upgradeguide/page/GUID-9B5D5A56-039D-44FB-8FD2-B9B55E71ADE8.html

-Try power cycling the switch after removing it from the stack.

-Check if it’s related to any known defect.

-Try factory resetting the switch.

-Try below steps by removing switch from the stack taking console access.

>>Enter switch boot mode
>>Give command: use default-configuration
>>Reload the switch.

If there is a physical layer issue such as stacking cable, stacking module.

-Try changing the stacking cables and stacking ports.

If unit is faulty or hardware issue

-Switch not powering on try checking the power cable and power source.

-Replace the switch with the same model if switch fails to power on.

For devices running FastIron release 09.0.10a to 09.0.10h, attempting to establish an SSH connection with a device running FastIron release 08.0.95 or earlier can lead to a mismatch in algorithms, preventing the SSH connection from being established. This problem occurs during the negotiation phase, where the server offers key exchange and host key algorithms that are not compatible with the default settings of the device running FastIron release 09.0.10a to 09.0.10h.

For devices running FastIron release 09.0.10j and later, RUCKUS recommends configuring specific key exchange and host key algorithms on the devices to resolve this issue and enable SSH communication. Please follow the procedure below to enable SSH communication with devices running FastIron release 08.0.95 or earlier:

device# configure terminal
device(config)# ip ssh key-exchange-method
ASCII string Enter algorithms separated by a space:
             diffie-hellman-group-exchange-sha256
             diffie-hellman-group14-sha256
             diffie-hellman-group16-sha512
             diffie-hellman-group18-sha512
             curve25519-sha256@libssh.org
             diffie-hellman-group14-sha1
             ecdh-sha2-nistp256
             ecdh-sha2-nistp384
             ecdh-sha2-nistp521
             curve25519-sha256
device(config)# ip ssh key-exchange-method diffie-hellman-group14-sha1
device(config)# ip ssh host
   host-key-method                 SSH host key method
device(config)# ip ssh host-key-method
ASCII string Enter algorithms separated by a space:
             ecdsa-sha2-nistp256
             ecdsa-sha2-nistp384
             rsa-sha2-512
             rsa-sha2-256
             ssh-rsa
device(config)# ip ssh host-key-method ssh-rsa

1. You must access the switch via console.
2. Press Ctrl + Y.
3. Enter "reset_login"
4. Exit the console.
5. Try logging in using the default credentials: username "super" and password "sp-admin."

OS> reset_login
This is a temporary login. Please reconfigure users once you login.
OS> exit

Trying to access ICX 7150 switch model through Web UI but getting an error “Server error. Will be fixed in few minutes”.

Tried different browsers such as Edge, Chrome, Firefox, but same issue.

Switch is up in Cloud Ruckus one and running version 9.0.10h_cd2.

Found Web-management is getting disabled automatically and it needs to be enabled by using below command but after few days it again gets disabled.

#No web-management disable

Solution:

There is a behavior change with the 9010h version onwards such as web-management disable get pushed from the Cloud (Ruckus one) or SmartZone when switches connect to it.

Link (Refer page no.11)
https://support.ruckuswireless.com/documents/4607

For workaround, Refer the below link.

Link (Refer page no. 253

https://support.ruckuswireless.com/documents/4031-fastiron-09-0-10-ga-management-configuration-guide

Note: Adding to above we can also manage the switch from R1, using remote cli if needed.

Issue noticed:

When the user chooses to downgrade from 9010 version and above to 8095 versions in ICX switches, they will notice that the “ve” commands and layer 3 related configurations within the “ve” are wiped out.

Lab output:

If the switch running 9010 version have the below configuration:

!

interface ve 1

 ip address 1.1.1.1 255.255.255.0

 no spanning-tree

!

interface ve 3

 ip address 2.2.2.1 255.255.255.0

 no spanning-tree

!

interface ve 5

 ip address 3.3.3.1 255.255.255.0

 no spanning-tree

!

When the customer would downgrade from 9010 and above to 8095 versions the configuration would be removed and any configurations included within the ve’s would also be removed.

Reason:

This is an expected behavior. The reason why this is noticed is because on 8095 versions, if we would have to configure “ve ” interface we use command “router-interface ve “ve ID””

Example:

device(config)# vlan 2

device(config-vlan-2)# untag ethernet 1 to 4

device(config-vlan-2)# router-interface ve 2

device(config-vlan-2)# interface ve 2

But from 9010 and above versions the “router-interface ve “ve ID”” command is deprecated and when a “vlan” is created a “ve” with same ID as vlan is also created.

Example:

device(config)# vlan 2

device(config-vlan-2)# interface ve 2

Due to the above changes when you upgrade from 8095 version to 9010 version or above you would not see a problem but when you downgrade from 9010 version and above to 8095 you will notice that since the command “router-interface ve “ve ID”” is not appended to the running configuration the “ve” interface would be completely deleted.

It is recommended to save the configuration as a backup when downgraded from 9010 and above to 8095 and have sufficient downtime to revert back the configurations.

SYSLOG: <14> Mar 17 15:10:57 Security: SSH login by super from src IP 10.177.95.153 from src MAC 50a7.3360.5054 to USER EXEC mode using RSA as Server Host Key.

SYSLOG: <14> Mar 17 15:10:57 scp -t flash:sec:SWR08095m.bin

 !!! Downloading this application image can result in application-boot image mismatch. Please use UFI image.

The code type 33 is not correct for the target hardware, abort!

It is noticed when a user is trying to upgrade the switch to a code from a destination which is a switch.

The user would try to upgrade the firmware using SCP method from switch to switch.

Reason the error message is noticed:

If the user is trying to upgrade from a switch model which is not the same switch model as the one user is trying to upgrade, the error would be noticed.

For example, if the user tries to upgrade 7150 secondary version from a destination switch which is a 7750 or other models then the error would be noticed.

The error also remains the same if the user is using incorrect firmware file which is for a different model switch.

Below is the scenario considered as an example:

Consider the customer is trying to upgrade 7150 switches from 7750 or using an incorrect firmware code of a different switch model.

ICX7150-48ZP Switch#copy flash scp 10.177.95.155 flash:sec:SWR08095m.bin secondary

User name:super

Password:

In 7750 switch you would see a below message:

ICX7750-48F Router#

SYSLOG: <14> Mar 17 15:10:57 Security: SSH login by super from src IP 10.177.95.153 from src MAC 50a7.3360.5054 to USER EXEC mode using RSA as Server Host Key.

SYSLOG: <14> Mar 17 15:10:57 scp -t flash:sec:SWR08095m.bin

 !!! Downloading this application image can result in application-boot image mismatch. Please use UFI image.

The code type 33 is not correct for the target hardware, abort!

SYSLOG: <14> Mar 17 15:10:57 Security: SSH logout by super from src IP 10.177.95.153 from src MAC 50a7.3360.5054 from USER EXEC mode using RSA as Server Host Key.

And in 7150 switch you would see the below message:

ICX7150-48ZP Switch#copy flash scp 10.177.95.155 flash:sec:SWR08095m.bin secondary

User name:super

Password:

Connecting to remote host......

Sending data (8192 bytes per dot)

Outbound Connection Closed

Solution:

The customer would need to validate the switch model he is trying to upgrade. User also must validate from which switch model he is trying to upgrade the firmware from.

It is important to check the code is specific to which model of the switch.

It is not recommended to copy firmware from one switch to another even if they are same model as below are few factors that will cause an issue when you are trying to upgrade the firmware from switch to switch.

• There could be mismatch of SSH Server host keys.
• You would notice a challenge with key exchange method if the same key exchange method is not supported on the switches.
• You could encounter “channel 0” issue which is noticed when the SSH port used is incorrect.

The customer can choose to upgrade the switch using TFTP method or USB method upgrade mentioned in the below links.

TFTP upgrade method link:

• https://community.ruckuswireless.com/t5/RUCKUS-Support-for-Lennar-Homes/How-to-Upgrade-a-Switch-ICX-7150-C12P-via-TFTP/td-p/47187

USB upgrade method link:

• https://community.ruckuswireless.com/t5/RUCKUS-Support-for-Lennar-Homes/How-to-Upgrade-a-Switch-ICX-7150-C12P-using-a-USB-flash-drive/td-p/46781

When we chose to replace or upgrade the network devices it is also very important to erase the sensitive data from being decoded by a 3rd party.

Secure wipe is one such feature which is introduced from 9010 and above versions which helps you wipe flash memory related contents permanently.

It only erases flash memory and does not erase EEPROM.

During this process except TPM keys, all the files, configurations, licenses, and other keys would be lost.

Difference between factory defaulting and secure wipe procedure used for the ICX switches:

When a switch is factory defaulted, it will restore the switch to its original default settings but does not completely erase the data.

When we factory default the switch, the data can still be recovered if a specialized software is being used by the 3rd party.

Secure wipe is a method were all the data is thoroughly wiped out from the flash memory of the switch.

This process would take about 30 to 40 min to completely wipe out the data from the switch.

Below is how you can wipe the data from the switches completely:

Device#securewipe 7pass

**************************************************************

*               SECUREWIPE Alert                             *

**************************************************************

* Please pay attention to the details listed below           *

* 1. U-Boot params will be erased                            *

* 2. All flash partitions will be erased and loose all files *

* 3. FIPS will be disabled and related keys will be erased   *

* 4. License and config files will be erased                 *

* 5. Only FI image, U-Boot and TPM keys will be restored.    *

* 6. All warm memory contents will be erased                 *

* 7. Device may fail to boot and/or fail to connect cloud if *

*    power cycled or power down during secure wipe process   *

* 8. Performing secure wipe frequently may reduce the flash  *

*    life cycle                                              *

**************************************************************

**************************************************************

* I have read the alert and SECUREWIPE can be performed now. *

* Please enter 'y' to confirm, 'n' to exit :                 *

**************************************************************

(enter 'y' or 'n'): y

Device boot source is :1

Current booted partition: Primary, UFI used for secure wipe: Primary

Prerequisite check success,securewipe is processing....

 ********************************************

 PLEASE WAIT SYSTEM WILL GO FOR RESTART....

 ********************************************

Process that would occur when you run “securewipe 7pass” command.

Secondary flash partition process may take 10 to 15 min.

Checking for secure wipe feature enable status...

******************************************************************

* 7-Pass Secure Wipe enabled, secure erase will be performed now *

* This may take some time, do NOT power down/cycle the device    *

* Device will be rebooted automatically after secure erase       *

* Interrupting secure wipe process may cause device to fail boot *

******************************************************************

proccessing securewipe for 7 pass

1+0 records in

1+0 records out

#############################

#       SESSION START       #

#############################

Uboot manager: Requested for command type 0

Platform type: (ICX8150) RODAN

set_uboot_partition:264 CMD: i2cset -y -f 0 0x33 0xe 0x2 1>/dev/null 2>&1

Secondary partition setting success

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

#############################

#       SESSION START       #

#############################

Primary flash partition process may take 10 to 15 min.

#############################

#       SESSION START       #

#############################

Uboot manager: Requested for command type 0

Platform type: (ICX8150) RODAN

set_uboot_partition:264 CMD: i2cset -y -f 0 0x33 0xe 0x1 1>/dev/null 2>&1

Primary partition setting success

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 3ff000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

Erasing 4 Kibyte @ 1f000 -- 100 % complete

#############################

#       SESSION START       #

#############################

Boot partition process may take 10 to 15 min.

Allocating group tables: done

Writing inode tables: done

Creating journal (4096 blocks): done

Writing superblocks and filesystem accounting information: done

securewipe started for fastiron  partition

mke2fs 1.43.4 (31-Jan-2017)

Discarding device blocks: done

Creating filesystem with 655360 4k blocks and 164160 inodes

Filesystem UUID: 2408ba58-7247-4cf0-ab4d-9e929399849a

Superblock backups stored on blocks:

        32768, 98304, 163840, 229376, 294912

Allocating group tables: done

Writing inode tables: done

Creating journal (16384 blocks): done

Writing superblocks and filesystem accounting information: done

securewipe started for boot partition

mke2fs 1.43.4 (31-Jan-2017)

Discarding device blocks: done

Creating filesystem with 131072 4k blocks and 32768 inodes

Filesystem UUID: b3a7ad8e-7514-47c3-8403-f51d8a280153

Superblock backups stored on blocks:

        32768, 98304

Allocating group tables: done

Writing inode tables: done

Creating journal (4096 blocks): done

Writing superblocks and filesystem accounting information: done

securewipe started for warm memory

securewipe done for warm memory

securewipe 7 pass completed

EEPROM Write Protect disable success

EEPROM Write success

EEPROM Write Protect enable success

INIT: Sending processes the TERM signal

Where the highlight shows the firmware they are currently on,.

Now to update the firmware:
First, to set the version :
Hence
Administration [ bottom left corner ] >> version management >>>

Here go to , Switch firmware and select the venue >> and click on Change Update Schedule:

Once there the below dialog-box will appear:

Where we select the code that’s needed.

And generally the code available on the cloud is the recommended releases for the cloud connected devices or devices that would be connected to the cloud.

Here in this example : the devices are already on the recommended release : 10.0.10c_cd1

However for one of them : we'll be selecting 9010j_cd1 and setting the date and time for the activity as well

Here once the version is selected and saved,:

Once done, click on save,

Below will be displayed :

That’s for scheduling the code update,

In an event, there needs to be an immediate update done : update now is the option you need :

once the version are selected : click on run update : that will initiate the file transfer to the switches and get the update done.

Do note :

• This option is only applicable if the ICX switches are connected to the cloud.
• During this activity as usual  downtime is needed as the switches will reload for the firmware to be applied.
• Also this process/procedure applied to specific venue and all switches under the venue will get the update : hence do consider the below points

  if you are an MSP :

  1. Make sure that the switches that are to be updated are of the specific venue.

  2 . If there are multiple locations managed under the same venue  and only a specific location needs to be updated : then this may not be the best option to follow.

  3 . In case, point 2 applied to you : then device local updates are best way to go about the upgradation. Via TFTP,USB etc.

  if you are not an MSP, and there are multiple locations of install : but all are devices are under the same venue.
  Then device local updates are best way to go about the upgradation. Via TFTP,USB etc.

  If different locations are managed under different venues, there should be no issues in following this process/procedure.

ICX7850-48F Router(config)#interface eth 1/1/1

ICX7850-48F Router(config-if-e25000-1/1/1)#speed-duplex 10g-full

This speed is not allowed on port 1/1/1 due to quad portgroup speed restriction(portgroup: 1/1/1 to 1/1/4)

ICX7850-48F Router(config-if-e25000-1/1/1)#

ICX7850-48F Router(config-if-e25000-1/1/1)#end

Applicable ICX switch model:

• 7850-48F

If the switches are running version 8095 and below, then the below details will help you configure the quad port setting:

If the switches are running version 8095 and below, then there is a workaround which will help you set individual ports to 10g or 1g.

Example:

In this case switch is running 8095m version

ICX7850-48F Router(config)#int e 1/1/9 to 1/1/12

ICX7850-48F Router(config-mif-1/1/9-1/1/12)#speed-duplex 10g-full

ICX7850-48F Router(config-mif-1/1/9-1/1/12)#exit

ICX7850-48F Router(config)#int e 1/1/9

ICX7850-48F Router(config-if-e25000-1/1/9)#speed-duplex 1000-full

ICX7850-48F Router(config-if-e25000-1/1/9)#exit

From running configuration 8095m

!

interface ethernet 1/1/9

 speed-duplex 1000-full

!

interface ethernet 1/1/10

 speed-duplex 10G-full

!

interface ethernet 1/1/11

 speed-duplex 10G-full

!

interface ethernet 1/1/12

 speed-duplex 10G-full

Port speed for port groups, cannot be changed individually. If required, the speed must be changed to all ports in the same quad-group and then we would be able to change speed to 1g on individual ports. This was a workaround in versions 8095 and below.

If the switches are running version 9010 and above versions, then the below details will help you configure the quad port setting:

If the switches are running version 9010 and above, then there is no workaround which will help change speed on interfaces. It is only considering four ports in group to be set to same speed.

Example:

In this case switch is running 10.0.10b version

ICX7850-48F Router(config)#int e 1/1/10

ICX7850-48F Router(config-if-e25000-1/1/10)#speed-duplex 1000-full

This speed is not allowed on port 1/1/10 due to quad portgroup speed restriction(portgroup: 1/1/9 to 1/1/12)

From versions 9010 and above in 7850-48F model speed settings is a design change to maintain consistency to the port group.

Details from documents:

Management guide for 8095 version:

Link: https://docs.commscope.com/bundle/fastiron-08095-managementguide/page/GUID-EDD7D44C-A627-4B76-A9FE-D7657FFF62D3.html

Management guide for 9010 version:

Link: https://docs.commscope.com/bundle/fastiron-09010-managementguide/page/GUID-EDD7D44C-A627-4B76-A9FE-D7657FFF62D3.html