Comware-V5 on vlan51

Hardening HPE Comware v5 Switches

Mon, 01 Jan 2024 00:00:00 +0000

How to harden HPE Comware v5 switches by restricting remote access to SSH and HTTPS only and using ACLs to limit management connections to specific hosts.

Note: HPE Comware v5 is end-of-sale on most platforms. These commands remain relevant for H3C and older HPE A/E-series switches still in service.

Disable insecure protocols #

cli

undo ip http server enable
undo telnet server enable

Enable SSH and HTTPS #

cli

ip https enable
ssh server enable

Restrict VTY to SSH only #

cli

user-interface vty 0 4
 protocol inbound ssh

Restrict management access with an ACL #

cli

acl number 2050
 rule 5 permit source 1.2.3.4 0
 rule 10 permit source 10.0.0.0 0.255.255.255
 rule 15 permit source 192.168.0.0 0.0.255.255

Apply to HTTPS and SSH:

IPsec VPN Between Cisco ASA and HPE MSR935 (Comware v5)

Mon, 01 Jan 2024 00:00:00 +0000

Full site-to-site IKEv1 IPsec VPN configuration between a Cisco ASA and an HP MSR935 (Comware v5).

IPsec VPN topology — Cisco ASA to HP MSR935

Tested versions: Cisco ASA 9.1(2), HP MSR935 Comware 5.20.106 Release 2513P09

Addressing: ASA WAN 89.89.89.89, MSR WAN 99.99.99.99, ASA LAN 10.0.0.0/24, MSR LAN 192.168.10.0/24

Phase 1 — IKE #

ASA:

cli

crypto ikev1 policy 5
 authentication pre-share
 encryption aes-192
 hash sha
 group 2
 lifetime 3600

group-policy GroupPolicy_99.99.99.99 internal
group-policy GroupPolicy_99.99.99.99 attributes
 vpn-tunnel-protocol ikev1

tunnel-group 99.99.99.99 type ipsec-l2l
tunnel-group 99.99.99.99 general-attributes
 default-group-policy GroupPolicy_99.99.99.99
tunnel-group 99.99.99.99 ipsec-attributes
 ikev1 pre-shared-key YOUR-PSK-HERE

MSR935:

NTP Configuration on HPE Comware v5 Switches

Mon, 01 Jan 2024 00:00:00 +0000

How to configure NTP on HPE Comware v5, including BST (British Summer Time) timezone handling for UK deployments.

cli

system-view
clock timezone BST add 01:00:00
clock summer-time BST repeating 02:00:00 2011 March last Sunday 02:00:00 2011 October last Sunday 02:00:00
ntp-service unicast-server 1.2.3.4 priority 1
ntp-service unicast-server 4.5.6.7 priority 2
save f
quit

The clock summer-time command handles automatic DST transitions (clocks forward last Sunday in March, back last Sunday in October).

Secure Remote Access on HPE Comware v5 Switches

Mon, 01 Jan 2024 00:00:00 +0000

By default, HPE Comware v5 has no remote access authentication configured. This guide covers local user setup, SSH, HTTPS, and console port protection.

Security note: Use 2048-bit RSA minimum. The 1024-bit size shown below is cryptographically weak and should not be used on switches still in active service.

Create a local user #

cli

system-view
 local-user admin
 password simple PASSWORD
 authorization-attribute level 3
 service-type web terminal
 service-type ssh

Use password cipher rather than password simple in production to store a hashed value.