topic Re: Can't assign management vlan? in ICX Switches

Can't assign management vlan?

lespea — Thu, 04 Jan 2024 08:36:20 GMT

Hello,

I recently acquired an ICX 7250 and am attempting to setup the management vlan but it seems the command isn't available? Here are the steps I took:

Updated to the latest router version (9.0.10h_cd2)
Did a factory reset
Created VLAN
Assigned vlan ip (via the ve)
Tried making the vlan a management vlan while in the vlan config

According to the documentation there should be a command `management-vlan` that I enter in the vlan config but it isn't listed? I'm not sure what I'm doing wrong; maybe I did something in the wrong order I really misunderstand how this works. I need the ssh and web interfaces to only be accessible via that specific vlan. I'm not very knowledgeable about this stuff yet so I'm probably doing something obviously wrong.

Tab completion:

SSH@switch(config-vlan-1234)# clear Clear table/statistics/keys end End Configuration level and go to Privileged level ethernet Set ethernet loopback interface exit Exit current level loop-detection shut down ports if receiving packets from myself mac Apply MAC ACL metro-ring metro ring configuration mode monitor Monitor Ingress Traffic on this VLAN (Enable VLAN Mirroring) multicast IGMP snooping on this VLAN multicast6 IPv6 MLD snooping on this VLAN no Undo/disable commands pvlan Define private vlan type and mapping quit Exit to User level remove-tagged-ports remove all tagged ports from VLAN remove-untagged-ports remove all untagged ports from VLAN show Show system information source-guard IP source guard spanning-tree Set spanning tree for this VLAN static-mac-address Configure static MAC for this VLAN tagged 802.1Q tagged port untagged Port with only untagged frame in/out vsrp Configure VSRP vsrp-aware Configure VSRP Aware parameters webauth Set web authentication write Write running configuration to flash or terminal <cr>

Version:

Copyright (c) Ruckus Networks, Inc. All rights reserved. UNIT 1: compiled on Oct 3 2023 at 04:57:57 labeled as SPR09010h_cd2 (33554432 bytes) from Primary SPR09010h_cd2.bin (UFI) SW: Version 09.0.10h_cd2T213 Compressed Primary Boot Code size = 786944, Version:10.1.26T215 (spz10126) Compiled on Tue Nov 29 06:43:15 2022

Re: Can't assign management vlan?

Chandini — Thu, 04 Jan 2024 16:56:40 GMT

Hi Lespea

Thank you for reaching us.

I tried to check for command "management-vlan" in a 7650 switch running TNS09010h_cd2.bin (UFI). This a switch code denoted as "S". I could see the command "management-vlan" in a switch code. You are running a router code "SPR"

Below are the details from Lab switch:

ICX7650_test(config)#vlan 1
ICX7650_test(config-vlan-1)#man
management-vlan Dedicate this vlan for management purpose
ICX7650_test(config-vlan-1)#management-vlan

If the switch is new you can follow the below steps and check. Make sure save your configuration using "show run"

Before you follow the below steps.

Run "show flash" and check if your secondary image is a switch image which is "SPS09010h"
If yes then use "boot system flash secondary" to boot from secondary image

Once you boot from switch code check if you can execute "management-vlan" command.

I hope the above details help

Thanks

Re: Can't assign management vlan?

lespea — Thu, 04 Jan 2024 16:58:43 GMT

Is there no way to set the management vlan on the router image?

Re: Can't assign management vlan?

Orlando_Elias — Thu, 04 Jan 2024 21:53:35 GMT

Hello @lespea ,

The conpect of management VLAN is not present in the rotuer image of ICX switches. Instead, it could be accessible through any of its configured IP addresseses. Use the command 'show ip interface' to check the configured IPs in the ICX. Management access like SmartZone, SSH, web, Telnet etc. can be restricted individually to specific interfaces, VLANs or specific allowed clients.

Below are more details about restricting access:
https://docs.commscope.com/bundle/fastiron-08095-securityguide/page/GUID-DBD99084-E085-448A-AB87-4E2E92C028AD.html

https://docs.commscope.com/bundle/fastiron-08095-securityguide/page/GUID-C5005CC1-30AB-42B4-B991-A994435CD1A5.html

https://docs.commscope.com/bundle/fastiron-08095-securityguide/page/GUID-6E5CB508-D556-4FDB-9594-D4EB872CF297.html

https://docs.commscope.com/bundle/fastiron-09010-commandref/page/GUID-086C381B-CB6C-466E-A5B7-0569AF3A9444.html

https://docs.ruckuswireless.com/fastiron/08.0.60/fastiron-08060-l3guide/GUID-B5B5D58A-721F-499D-9858-CED3A42F4793.html

Re: Can't assign management vlan?

lespea — Fri, 05 Jan 2024 09:15:47 GMT

Awesome that will work perfectly, thanks for all the links!