HP Procurve switch issue

ruffneck · 10 Sep 2009 at 10:54

Hi all, wondered if you could help, one of our Procurve switches is not playing ball!

Got a HP Procurve 3400cl switch here, it’s the core switch for our warehouse. Now for some reason the only way I can access it is via the console. telnet-server and web-management are both enabled yet are un-responsive. telnet connects but shows nothing, and I just get a page cannot be displayed error on the web side.

I have tried disabling these services and re-enabling them to no avail. Unfortunately this is not the kind of switch I can reboot during the day.

Any ideas?

Andyt_uk · 10 Sep 2009 at 11:05

can you post the config?

are there any ACLs, FW's that may be restricting access to it?

ruffneck · 10 Sep 2009 at 11:16

The switch doesn't have any ACLs setup.

here is the config.

Code:

tartup configuration:

; J4905A Configuration Editor; Created on release #M.10.06

hostname "we_dray_core" 
qos dscp-map 101110 priority 5 
interface 20 
   speed-duplex 10-full 
exit
interface 21 
   name "we_dray_switch1" 
exit
interface 22 
   name "we_dray_switch2" 
exit
interface 24 
   name "to_network" 
exit
ip routing 
snmp-server community "public" Unrestricted 
vlan 1 
   name "DEFAULT_VLAN" 
   untagged 1-19,21-24 
   ip address 192.168.111.100 255.255.255.0 
   ip helper-address 10.10.1.205 
   ip helper-address 10.10.1.206 
   no untagged 20 
   exit 
vlan 2 
   name "voice" 
   ip address 192.168.112.100 255.255.255.0 
   qos priority 5 
   ip helper-address 10.10.1.205 
   ip helper-address 10.10.1.206 
   tagged 21-22 
   exit 
vlan 3 
   name "management" 
   ip address 192.168.113.100 255.255.255.0 
   tagged 21-22 
   exit 
vlan 4 
   name "10MB_LES" 
   untagged 20 
   ip address 172.16.100.2 255.255.255.252 
ip authorized-managers 
ip route 0.0.0.0 0.0.0.0 192.168.111.254 
ip route 10.10.0.0 255.255.0.0 172.16.100.1 
spanning-tree priority 1
password manager
password operator

Andyt_uk · 10 Sep 2009 at 11:20

been ages since i used any procurve gear but is the management(or vlan your connecting to) vlan actually up? thats quite often the issue with cisco's

ruffneck · 10 Sep 2009 at 11:33

yes all vlans are up and accessible, im almost certain the cliche i.t fix will remedy this situation I'd just hoped that perhaps there was somthing else I could do.

Andyt_uk · 10 Sep 2009 at 12:05

have you been able to telnet it before? if so it could be that there are still active sessions and a max-limit which is stopping you from connecting.

To close the open Telnet sessions, it is necessary to either access the switch over the serial console port, or else reboot.

By default, ProCurve switches support a total of three open Telnet sessions and do not automatically terminate sessions that were not properly exited.

When you access the switch through a serial console session, issue the command: “kill” at the prompt. This closes the open Telnet sessions. Next, configure an inactivity timer setting that will serve to automatically close inactive Telnet sessions in the future:

ProCurve Switch(config)# console inactivity-timer <0 – 120 minutes>
ProCurve Switch(config)# write mem

ruffneck · 10 Sep 2009 at 12:42

there are no active telnet connections, and I had previously tried the kill command anyway.

I've only been at this current role for less then 2 months so I can't say whether telnet was working before. I know we have a 3400cl as our core switch this end and I have no problem using telnet

mdjmcnally · 10 Sep 2009 at 13:04

Is the HP Procurve like Cisco kit now where you need to configure the console to allow telnet or web.

By default when you get a new box from Cisco you cannot web in or telnet in until at least set a password on the vty.

I ask as I see nothing under the ip authorise manager and there seems to be nothing set for the manager or operater users in terms of password.

ruffneck · 10 Sep 2009 at 13:17

there are manager and operator passwords set, showing the running config doesn't display them.

ruffneck · 10 Sep 2009 at 14:59

mdjmcnally said:
Is the HP Procurve like Cisco kit now where you need to configure the console to allow telnet or web.

By default when you get a new box from Cisco you cannot web in or telnet in until at least set a password on the vty.

I ask as I see nothing under the ip authorise manager and there seems to be nothing set for the manager or operater users in terms of password.

I managed to fix it with a lot of help from this thanks!

I investigated the ip-authroized managers settings and it just had a net mask of 255.255.255.255 setup, hence why nothing could access any of the management filters via IP, removed that and now I can access it!

it turns out the 255.255.255.255 is default.

Obviously it was a silly assumption to think that someone might of used the ip management features at some point on a core switch thats over 2 years old!!