Comware on vlan51

BFD Static Route Tracking on HPE Comware v7

Mon, 01 Jan 2024 00:00:00 +0000

How to use BFD echo mode with static route tracking on HPE Comware v7. When the primary path fails, BFD detects it rapidly and the tracked static route is withdrawn, activating the backup.

BFD echo mode does not require BFD support on the remote peer — packets loop back through the remote device, so this works with any upstream equipment.

Track is a detection module in Comware that reports positive or negative based on interface status, link status, reachability or performance. Here it’s paired with BFD to watch a remote IP, and static route preferences change the routing table when the far end becomes unreachable.

Hardening HPE Comware v5 Switches

Mon, 01 Jan 2024 00:00:00 +0000

How to harden HPE Comware v5 switches by restricting remote access to SSH and HTTPS only and using ACLs to limit management connections to specific hosts.

Note: HPE Comware v5 is end-of-sale on most platforms. These commands remain relevant for H3C and older HPE A/E-series switches still in service.

Disable insecure protocols #

cli

undo ip http server enable
undo telnet server enable

Enable SSH and HTTPS #

cli

ip https enable
ssh server enable

Restrict VTY to SSH only #

cli

user-interface vty 0 4
 protocol inbound ssh

Restrict management access with an ACL #

cli

acl number 2050
 rule 5 permit source 1.2.3.4 0
 rule 10 permit source 10.0.0.0 0.255.255.255
 rule 15 permit source 192.168.0.0 0.0.255.255

Apply to HTTPS and SSH:

IPsec VPN Between Cisco ASA and HPE MSR935 (Comware v5)

Mon, 01 Jan 2024 00:00:00 +0000

Full site-to-site IKEv1 IPsec VPN configuration between a Cisco ASA and an HP MSR935 (Comware v5).

IPsec VPN topology — Cisco ASA to HP MSR935

Tested versions: Cisco ASA 9.1(2), HP MSR935 Comware 5.20.106 Release 2513P09

Addressing: ASA WAN 89.89.89.89, MSR WAN 99.99.99.99, ASA LAN 10.0.0.0/24, MSR LAN 192.168.10.0/24

Phase 1 — IKE #

ASA:

cli

crypto ikev1 policy 5
 authentication pre-share
 encryption aes-192
 hash sha
 group 2
 lifetime 3600

group-policy GroupPolicy_99.99.99.99 internal
group-policy GroupPolicy_99.99.99.99 attributes
 vpn-tunnel-protocol ikev1

tunnel-group 99.99.99.99 type ipsec-l2l
tunnel-group 99.99.99.99 general-attributes
 default-group-policy GroupPolicy_99.99.99.99
tunnel-group 99.99.99.99 ipsec-attributes
 ikev1 pre-shared-key YOUR-PSK-HERE

MSR935:

NTP Configuration on HPE Comware v5 Switches

Mon, 01 Jan 2024 00:00:00 +0000

How to configure NTP on HPE Comware v5, including BST (British Summer Time) timezone handling for UK deployments.

cli

system-view
clock timezone BST add 01:00:00
clock summer-time BST repeating 02:00:00 2011 March last Sunday 02:00:00 2011 October last Sunday 02:00:00
ntp-service unicast-server 1.2.3.4 priority 1
ntp-service unicast-server 4.5.6.7 priority 2
save f
quit

The clock summer-time command handles automatic DST transitions (clocks forward last Sunday in March, back last Sunday in October).

NTP Configuration on HPE Comware v7 Switches

Mon, 01 Jan 2024 00:00:00 +0000

How to configure NTP on HPE Comware v7 with BST (British Summer Time) handling for UK deployments.

cli

system-view
clock summer-time BST 02:00:00 March last Sunday 02:00:00 October last Sunday 02:00:00
ntp-service unicast-server 1.2.3.4 priority 1
ntp-service unicast-server 4.5.6.7 priority 2
save f
quit

For Comware v5 syntax, see NTP on Comware v5.

Policy Based Routing (PBR) on HPE Comware v7

Mon, 01 Jan 2024 00:00:00 +0000

How to configure Policy Based Routing (PBR) on HPE Comware v7. Traffic is matched by ACLs and redirected to an alternative next-hop, overriding the routing table.

Scenario #

The setup is identical to the ArubaOS-Switch PBR guide. The switch (.254) has a default gateway of 2.2.2.1.

PBR topology: local breakout via the default gateway, internet via the firewall at 1.1.1.1

From 192.168.10.0/24: internal traffic (to 10.0.0.0/8 or 192.168.0.0/16) uses the normal routing table, internet traffic is sent to 1.1.1.1.

Policy Based Routing Within a VRF/VPN-Instance on HPE Comware v7

Mon, 01 Jan 2024 00:00:00 +0000

How to configure PBR within a VRF/VPN-Instance on HPE Comware v7. Useful in multi-tenant environments where traffic must be steered within an isolated routing domain.

PBR within a VRF is only supported on Comware v7 — not Comware v5.

Only a few changes are needed compared with PBR outside a VRF: the VPN-Instance has to be referenced in the next-hop and in the ACL rules. A VPN-Instance is Comware’s name for a VRF.

RADIUS Login Authentication on HPE Comware v7 Switches

Mon, 01 Jan 2024 00:00:00 +0000

How to configure RADIUS management login on HPE Comware v7 using Microsoft NPS.

This covers the Comware configuration only. For the NPS server setup, see the ArubaOS-Switch RADIUS login guide which covers the NPS side in full.

Configuration #

Create a RADIUS scheme:

cli

radius scheme nps
 primary authentication x.x.x.x
 primary accounting x.x.x.x
 key authentication simple reallysecurekey
 key accounting simple reallysecurekey
 user-name-format without-domain

Apply to the default domain:

Secure Remote Access on HPE Comware v5 Switches

Mon, 01 Jan 2024 00:00:00 +0000

By default, HPE Comware v5 has no remote access authentication configured. This guide covers local user setup, SSH, HTTPS, and console port protection.

Security note: Use 2048-bit RSA minimum. The 1024-bit size shown below is cryptographically weak and should not be used on switches still in active service.

Create a local user #

cli

system-view
 local-user admin
 password simple PASSWORD
 authorization-attribute level 3
 service-type web terminal
 service-type ssh

Use password cipher rather than password simple in production to store a hashed value.

VRF / VPN-Instance Inter-VLAN Routing on HPE Comware v7

Mon, 01 Jan 2024 00:00:00 +0000

How to route between VLANs that sit in different VPN-Instances (VRFs) on an HPE Comware switch.

A customer running VPN-Instances on HPE Comware 5500-HI switches needed the switch to act as the default gateway and route between two VPN-Instances. A VPN-Instance splits the routing table, the same as a VRF on Cisco, so this isn’t enabled by default. You can’t do it with static routing: it needs MP-BGP to leak routes between the instances using route targets.