topic Re: AP R510 can't connect to ICX7150 "ICX Switch is Connecting" in RUCKUS Support for Lennar Homes

AP R510 can't connect to ICX7150 "ICX Switch is Connecting"

ohabib — Mon, 30 Jan 2023 07:47:32 GMT

I have one ICX7150 and two R510 AP .

ICX7150 - FW Version:09.0.10dT211 (SPS09010d.bin)

R510 - FW version: 200.13.6.1.319

R510 can't connect to the ICX switch and shows "ICX Switch is Connecting". It used to work with the old FW release, what is going on ? SSH is enabled, I can manually SSH to the Switch or AP

I saw a lot of other questions about the same topic but nothing there helped

Re: AP R510 can't connect to ICX7150 "ICX Switch is Connecting"

Vásquez_Fer — Tue, 31 Jan 2023 15:07:46 GMT

Hi @ohabib

Hope you are doing well !

Could you please log in to the switch and provide me the following command :

Enable

show logging

Best Regards

Fernando Vasquez

Re: AP R510 can't connect to ICX7150 "ICX Switch is Connecting"

ohabib — Tue, 31 Jan 2023 20:07:37 GMT

Hi @Vásquez_Fer

Below is the show logging

SSH@ICX7150-C12-SWITCH#show logging
Syslog logging: disabled ( 0 messages dropped, 0 flushes, 0 overruns)
Buffer logging: level ACDMEINW, 877 messages logged
level code: A=alert C=critical D=debugging M=emergency E=error
I=informational N=notification W=warning

Static Log Buffer:
Oct 06 19:50:30:I:System: Stack unit 1 POE PS 1, Internal Power supply with 124000 mwatts capacity is up

Dynamic Log Buffer (4000 lines):
Oct 06 17:54:42:I:sshd: Unable to negotiate with 192.168.1.3 port 41041: no matching host key type found. Their offer: ssh-rsa,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-dss
Oct 06 17:54:19:I:sshd: Unable to negotiate with 192.168.1.3 port 41040: no matching host key type found. Their offer: ssh-rsa,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-dss
Oct 06 17:53:57:I:sshd: Unable to negotiate with 192.168.1.3 port 41038: no matching host key type found. Their offer: ssh-rsa,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-dss
Oct 06 17:53:35:I:Security: Security: user r510 deleted by admin from SSH session. by admin user from ssh session

The concern I have is that I only have "admin" user not "super" -which is the default for the ICX switch. but when looking at the ip ssh. I see the 192.168.1.3 which is the R510 connection show up and disappears but trying to use "super" logging info. Not sure why is that, any idea ?

I tried to create user called "super" again but it does not let me chose the default password to create it

The last point here, From R510 Web interface, without having me going and manually adding the switch, it automatically seems to detect it and tries to connect to it but stays in "connecting state"

SSH@ICX7150-C12-SWITCH#show ip ssh

SSH-v2.0 enabled.
Connection Version Username IP Address
Inbound:
1 SSH-2 admin 192.168.1.16
2 SSH-2 super 192.168.1.3
Outbound:

Re: AP R510 can't connect to ICX7150 "ICX Switch is Connecting"

ohabib — Tue, 31 Jan 2023 20:23:19 GMT

Syslog from R510 side shows it's trying to log in using super but I removed super default account not sure how to restore it

Jan 31 12:20:12 RuckusAP 1st Floor sys_wrapper: icx_test_default():ICXD: ICX[id=1]: 192.168.1.4: start to access ICX as user "super".

Re: AP R510 can't connect to ICX7150 "ICX Switch is Connecting"

Vásquez_Fer — Tue, 31 Jan 2023 20:40:00 GMT

Hi @ohabib

Hope you are doing well !

1-Since your Switch is running 9010d the lasted version the SSH tunnel behavior is different on these versions in order to SYNC with the unleased .

Please run the following commands :

enable

config terminal

crypto key generate ec size 384

2-In order to re-create a username and password is using the following example:

Device>enable
Device#config terminal

3-Edit the current password and username

device(config)# username super password pass

Where the username is ’super’ and password ‘pass’

Best Regards

Fernando Vasquez

Re: AP R510 can't connect to ICX7150 "ICX Switch is Connecting"

ohabib — Tue, 31 Jan 2023 20:38:13 GMT

I've already done step 1

I've created user super with password "pass" but is that the default password R510 is trying to use for the "super" user?

Re: AP R510 can't connect to ICX7150 "ICX Switch is Connecting"

ohabib — Tue, 31 Jan 2023 20:42:41 GMT

I've already done step 1

I've created user super with password "pass" but is that the default password R510 is trying to use for the "super" user?

it did not make any difference at all

Re: AP R510 can't connect to ICX7150 "ICX Switch is Connecting"

Vásquez_Fer — Tue, 31 Jan 2023 20:52:06 GMT

Hi @ohabib

Hope you are doing well !

Once you have done the following command

crypto key generate ec size 384

basically what we need to know the username ands password from the Switch to add it correctly on the step 2 ( Doesn't matter the credentials of the access points )

On the Unleashed dashboard

Basically we are creating a tunnel , which we need to match the credentials accessing the Unleashed dashboard and telling it the username and password from Switch , the unleashed will try to access to Switch using those credentials and joining the ICX to the unleashed.

1-Hit Add on that dashboard

2-Put the IP address of the ICX switch (ICX-7150-C12P)

3-Username and password for Switch authentication that we created on the Switch

device(config)# username super password pass
Where the username is ’super’ and password ‘pass’

https://docs.commscope.com/bundle/unleashed-200.9-onlinehelp/page/GUID-30C6694A-6AEE-4DF8-9459-1AB189D415D2.html

To sync the data, it will take us a while, so after a couple of minutes it should say connected

Best Regards

Fernando Vasquez

Re: AP R510 can't connect to ICX7150 "ICX Switch is Connecting"

ohabib — Wed, 01 Feb 2023 03:20:19 GMT

Hi Vásquez_Fer

no luck, I tried to remove the user accounts and recreate new ones for the switch. I also removed the switch from the unleashed and manually added it by Ip/user/password

it does not move from connecting state. It asked me to enter credentials for the switch .. I did and it stays connecting

is there any other relative settings in the unleashes or switch side to control the authentication ?

Re: AP R510 can't connect to ICX7150 "ICX Switch is Connecting"

Vásquez_Fer — Wed, 01 Feb 2023 16:37:38 GMT

Hi @ohabib

Please run the following commands :

ICX7150-48ZP Router>enable

No password has been assigned yet...
ICX7150-48ZP Router#
ICX7150-48ZP Router#conf t
ICX7150-48ZP Router(config)#crypto key generate rsa

Generate the following users username super and password pass

device(config)# username super password pass

Where the username is ’super’ and password ‘pass’

Then delete the existing switch on the unleashed dhabsoard and add it back

Please wait for some time is not immediate if after 30 minutes the switch has not sync please sent me another

-Show logging

Fernando Vasquez

Best Regards

Re: AP R510 can't connect to ICX7150 "ICX Switch is Connecting"

ohabib — Thu, 02 Feb 2023 04:29:39 GMT

Hi Vásquez_Fer

No luck. After creating an RSA key along with the original ec384 key .. ssh is showing the following

client_input_hostkeys: received duplicated ssh-rsa host key

Anyway, here is the show logging saying that the SSH access is rejected

SSH@ICX7150-C12-SWITCH(config)#show logging
Syslog logging: enabled ( 0 messages dropped, 0 flushes, 0 overruns)
Buffer logging: level ACDMEINW, 150 messages logged
level code: A=alert C=critical D=debugging M=emergency E=error
I=informational N=notification W=warning

Static Log Buffer:
Oct 06 19:00:15:I:System: Stack unit 1 POE PS 1, Internal Power supply with 124000 mwatts capacity is up

Dynamic Log Buffer (4000 lines):
Oct 06 12:37:22:N:sshd: SSH access by user super from src 192.168.1.3 rejected, 0 attempt(s)
Oct 06 12:36:53:N:sshd: SSH access by user super from src 192.168.1.3 rejected, 0 attempt(s)
Oct 06 12:36:25:N:sshd: SSH access by user super from src 192.168.1.3 rejected, 0 attempt(s)
Oct 06 12:35:56:N:sshd: SSH access by user super from src 192.168.1.3 rejected, 0 attempt(s)
Oct 06 12:35:28:N:sshd: SSH access by user super from src 192.168.1.3 rejected, 0 attempt(s)
Oct 06 12:34:59:N:sshd: SSH access by user super from src 192.168.1.3 rejected, 0 attempt(s)
Oct 06 12:34:03:I:Security: Web login by super from src IP 192.168.1.48
Oct 06 12:34:03:I:Security: Web login by super from src IP 192.168.1.48
Oct 06 12:33:59:N:sshd: SSH access by user super from src 192.168.1.3 rejected, 0 attempt(s)
Oct 06 12:33:41:N:sshd: SSH access by user super from src 192.168.1.3 rejected, 0 attempt(s)
Oct 06 12:33:22:N:sshd: SSH access by user super from src 192.168.1.3 rejected, 0 attempt(s)
Oct 06 12:33:08:I:Security: ssh login by super from src IP 192.168.1.48 from src MAC a483.e7c4.9475 to PRIVILEGED EXEC mode
Oct 06 12:33:04:N:sshd: SSH access by user super from src 192.168.1.3 rejected, 0 attempt(s)
Oct 06 12:32:50:I:Security: ssh login by super from src IP 192.168.1.48 from src MAC a483.e7c4.9475 to USER EXEC mode
Oct 06 12:32:45:N:sshd: SSH access by user super from src 192.168.1.3 rejected, 0 attempt(s)
Oct 06 12:32:43:I:sshd: Failed publickey for super from 192.168.1.48 port 51190 ssh2
--More--, next page: Space, next line: Return key, quit: Control-c

Re: AP R510 can't connect to ICX7150 "ICX Switch is Connecting"

Vásquez_Fer — Thu, 02 Feb 2023 15:53:24 GMT

Hi @ohabib

Hope you are doing well !

Checking the RUCKUS data it appears that there is an ongoing issue from the unleashed side with this issue that should be fixed in future versions.

What I recommend is to be on the recommended version on Switch based on the support portal.

Best Regards

Fernando Vasquez