topic Re: icx7150 upgrade to 09.0.10d breaks unleashed management of switch in ICX Switches

icx7150 upgrade to 09.0.10d breaks unleashed management of switch

matt_radecic — Tue, 01 Nov 2022 19:31:40 GMT

I know this seems to be a known issue with 09.0.10d but I haven't seen a workaround to get the ICX switch to properly connect in the unleashed AP.

sshd: Unable to negotiate with 192.168.x.x port xxxxx: no matching host key type found. Their offer: ssh-rsa,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-dss

is there a solution to ensuring that icx devices on the latest FW are compatible with R510 / R710

r710 unleashed AP: Current firmware version: 200.12.10.105.129

Re: icx7150 upgrade to 09.0.10d breaks unleashed management of switch

BenBeck — Tue, 01 Nov 2022 20:58:08 GMT

I was able to get it to work with:

SSH@ICX(config)#crypto key gen ec size 384

Re: icx7150 upgrade to 09.0.10d breaks unleashed management of switch

matt_radecic — Wed, 02 Nov 2022 03:01:04 GMT

any other configuration changes? I think I tried so many different things that I'm in a non-idea state. is there a latest and greatest optimal out of the box config? I need to reload the switch as I zeroized the keys and broke ssh. I might as well reset factory and then set up

the quick start guide is out of date now with the deprecated commands.

I assume the above command would go first before anything else?

device> enable
    device# configure terminal
    device(config)# crypto-ssl certificate generate
    device(config)# username <username> password <password>
    device(config)# aaa authentication login default local
    device(config)# aaa authentication web-server default local
    device(config # no telnet server
    device(config # enable aaa console
    device(config)# web-management https
    device(config)# password-change any
    device(config)# ip ssh timeout 30
    device(config)# ip ssh idle-time 20
    device(config)# console timeout 30
    device(config)# write memory
    device(config)# exit
    device#

Re: icx7150 upgrade to 09.0.10d breaks unleashed management of switch

BenBeck — Wed, 02 Nov 2022 03:16:39 GMT

That was the only change for me (creating EC key pair). What do you see in:

show ip ssh config

The command I gave will just generate an elliptical key pair. You can have RSA and EC both present on the device. More details on the command here:

https://docs.commscope.com/bundle/fastiron-09010-commandref/page/GUID-74724EE0-E8FB-46A1-8FBA-9E2F342D5B93.html

If you locked yourself out (no SSH keys and telnet disabled), you can just physically console to the device and create an SSH key (use the command I gave prior). You should then be able to access again.

Re: icx7150 upgrade to 09.0.10d breaks unleashed management of switch

vesalius — Thu, 03 Nov 2022 16:16:24 GMT

SSH@ICX(config)#crypto key gen ec size 384

This worked for me. Not immediately, but eventually unleashed now can login and see my icx7150. Upgraded to 200.13… tonight and the login persisted.

Re: icx7150 upgrade to 09.0.10d breaks unleashed management of switch

BenBeck — Thu, 03 Nov 2022 12:21:40 GMT

This is likely related to following change:

https://support.ruckuswireless.com/technical_support_bulletins/631