Hardening HPE Comware v5 Switches

How to harden HPE Comware v5 switches — disable Telnet and HTTP, enable SSH and HTTPS only, and restrict management access with ACLs.

1 min readUpdated KNET Ltd

Legacy platform. Comware v5 is end-of-sale on most platforms. This guide is kept for anyone still running it; check syntax against your software release, and see the Comware v7 guides for current platforms.

How to harden HPE Comware v5 switches by restricting remote access to SSH and HTTPS only and using ACLs to limit management connections to specific hosts.

Note: HPE Comware v5 is end-of-sale on most platforms. These commands remain relevant for H3C and older HPE A/E-series switches still in service.

Disable insecure protocols #

cli
undo ip http server enable
undo telnet server enable

Enable SSH and HTTPS #

cli
ip https enable
ssh server enable

Restrict VTY to SSH only #

cli
user-interface vty 0 4
 protocol inbound ssh

Restrict management access with an ACL #

cli
acl number 2050
 rule 5 permit source 1.2.3.4 0
 rule 10 permit source 10.0.0.0 0.255.255.255
 rule 15 permit source 192.168.0.0 0.0.255.255

Apply to HTTPS and SSH:

cli
ip https acl 2050

user-interface vty 0 4
 acl 2050 inbound

Related article #