I don’t closely track the popularity of my blog. If what I share helps people in their day to day job, it’s already good enough to me. But I do look at site statistics now and then just out of curiosity and it seems that network-related posts get a lot of popularity. A blog post I wrote a while ago on Dell N4000 switches has quickly got in top five over the last year.
So it seems that there is a demand for entry-level switch configuration guides. I’ve worked with a quite a few different switch brands over the years, so I thought I will build on the success of the Dell blog post and this time write about HPE FlexNetwork/FlexFabric 5000 switch series.
Operating Systems
HPE has several network switch product lines. I won’t even try to cover all of them in this post. But it’s important to know that there are a few different operating systems you can encounter, while working with HPE network switches. There is a familiar ProCurve product portfolio (now merged with Aruba), which is based on ProVision operating system.
HPE FlexNetwork/FlexFabric 5000 series, on the other hand, is based on Comware operating system. It has a different CLI command set and can be a complete surprise if you’ve worked only with ProCurve switches before. So this blog post will be particularly valuable for those who’re dealing with HPE 5000 for the first time.
The following guide has been tested on a pair of HPE FlexFabric 5700-series switches. Even though commands are mostly the same, on other switch series, like FlexNetwork 5800, there might be some minor differences.
Initial Configuration
When the switch is booted for the first time it will start automatic configuration by trying to obtain settings over DHCP, which you can interrupt by Ctrl+C to get straight to CLI.
You start in user view where you can run display commands to review switch settings. To start the configuration, change to system view:
> system-view
Let’s start by configuring remote access to the switch. There are two ways you can do that. You either use the out-of-band management port:
> interface M-GigabitEthernet 0/0/0
> ip address 10.10.10.10 255.255.255.0
> ip route-static 0.0.0.0 0.0.0.0 10.10.10.1
Or you can configure a VLAN interface IP address:
> interface vlan-interface 1
> ip address 10.10.10.10 255.255.255.0
> ip route-static 0.0.0.0 0.0.0.0 10.10.10.1
Then configure switch name, enable SSH, set passwords and you can start managing the switch over SSH:
> sysname switchname
> public-key local create rsa
> ssh server enable
> user-interface vty 0 15
> authentication-mode scheme
> protocol inbound ssh> super password simple yourpassword
> local-user admin
> password simple yourpassword
> authorization-attribute user-role level-0
> service-type ssh
User “admin” will have an unprivileged role. You will need to run the following command and enter password once logged in, to elevate to network admin rights:
> super
Intelligent Resilient Framework
In small non-business-critical environments one standalone switch is usually sufficient. In larger environments switches are typically deployed in pairs for redundancy. To simplify management and to avoid network loops most switches support some sort of MLAG or stacking. IRF is HPE’s version of it.
Determine what ports you’re going to use for IRF. There are two QSFP+ ports on 5700-series dedicated for it. And then on on the first switch (master) run the following commands (it’s recommended to shut down the ports before you set them up as IRF):
> irf member 1 priority 32
> int range FortyGigE 1/0/41 to FortyGigE 1/0/42
> shutdown
> irf-port 1/1
> port group interface FortyGigE 1/0/41
> irf-port 1/2
> port group interface FortyGigE 1/0/42
> int range FortyGigE 1/0/41 to FortyGigE 1/0/42
> undo shut
> save
> irf-port-configuration active
On the second switch (slave) run the following commands to change the IRF ID to 2:
> irf member 1 renumber 2
> reboot
When the switch comes up, configure IRF ports:
> irf member 2 priority 30
> int range FortyGigE 2/0/41 to FortyGigE 2/0/42
> shutdown
> irf-port 2/1
> port group interface FortyGigE 2/0/41
> irf-port 2/2
> port group interface FortyGigE 2/0/42
> int range FortyGigE 2/0/41 to FortyGigE 2/0/42
> undo shut
> save
> irf-port-configuration active
Now you can connect the physical IRF ports. IRF is a ring topology, that means (in my case) port 1/0/41 should connect to 2/0/42 and port 1/0/42 should connect to 2/0/41.
Second switch will automatically reboot and if all is configured correctly, you should see both switches join the IRF fabric. Member switch 1 has the highest priority of 32 and becomes the master:
> display irf
Firmware Upgrade
Firmware upgrade is the next logical step after you set up IRF. The latest firmware revision for the switches can be download from HPE web-site. Keep in mind you will need a HPE passport account, with a valid service agreement (SAID) added to it.
You will also need a TFTP server to upgrade the firmware. There are a few of them out there, but the most commonly used is probably Tftpd64.
When you get the TFTP server up and running and copy the firmware file to it, perform an upgrade:
> tftp 10.10.10.20 get 5700-CMW710-R2432P03.ipe
> boot-loader file flash:/5700-CMW710-R2432P03.ipe slot 1 main
> boot-loader file flash:/5700-CMW710-R2432P03.ipe slot 2 main
> irf auto-update enable
> reboot
Confirm firmware has been updated:
> display version
VLANs, Aggregation Groups and Tagging
In Comware the term “aggregation group” is used to describe what is a “port channel” in Cisco world. Trunk/access ports are also called tagged/untagged ports throughout the documentation.
In this section we will discuss a few common port configuration scenarios:
- Untagged ports, which can be your iSCSI storage array ports
- Tagged ports, such as your VMware host uplinks
- Aggregation groups, typically used for LAGs to upstream switches
First of all create all VLANs and give them descriptions:
> vlan 10
> description iSCSI
> vlan 20
> description Server
> vlan 30
> description Dev and test
Then specify untagged ports:
> vlan 10
> port te 1/0/1
> port te 2/0/1
To configure tagged ports and allow certain VLANs (ports will be added to the VLANs automatically):
> int te 1/0/2
> description ESX01 vmnic0
> port link-type trunk
> port trunk permit vlan 20 30
> int te 2/0/2
> description ESX02 vmnic0
> port link-type trunk
> port trunk permit vlan 20 30
And to create an LACP aggregation group:
> interface bridge-aggregation 1
> description Trunk to upstream switch
> link-aggregation mode dynamic
> port link-type trunk
> port trunk permit vlan 20 30> interface te 1/0/3
> port link-aggregation group 1
> interface te 2/0/3
> port link-aggregation group 1
Common Commands
Other useful commands that don’t fall under any specific category, but handy to know.
Display switch configuration:
> display current-configuration
Save switch configuration:
> save
Shut down a port:
> int te 1/0/27
> shutdown
Undo a command:
> undo shutdown
Conclusion
Whether you are a network engineer new to the Comware operating system or a VMware administrator looking for a quick cheat sheet for FlexNetwork/FlexFabric switches, I hope this guide has helped you get the job done.
If this blog post gets the same amount of popularity, maybe it will turn into another series. But for now – over and out.
Tags: Aruba, CLI, Comware, firmware, FlexFabric, FlexNetwork, HP, HPE, Intelligent Resilient Framework, IRF, lag, loop, management, MLAG, OOB, out-of-band, port channel, ProCurve, ProVision, QSFP+, remote, SFP+, ssh, switch, tag, tagged, tagging, TFTP, trunk, untagged, update, upgrade, VLAN
October 29, 2017 at 8:24 pm |
Nick, this is really a helpful blog post! I appreciate this reading. Really useful thanks and keep up the great work!
October 31, 2017 at 4:01 am |
Thanks, Neil. Much appreciated!
December 12, 2017 at 10:28 pm |
Hi Nick. A great post, thank you! With zero previous experience on these switches this allowed me to configure a pair of 5700s in an IRF, with multiple VLANs and Link Aggregation to my ESXi hosts.
January 6, 2018 at 6:11 am |
Wow, amazing! Thanks for letting me know, David. When I see that my blog’s helped someone out there, it motivates me to write more.
March 10, 2018 at 5:28 pm |
Hi Nick, Great post. I’m dealing with some concerns related to 5000 series switches. The question is that I have some of them just doing L2 work, and now I want them to start routing and running ACL’s and so. I’ve defined several VLANs with assigned IP addresses, and one of them is for management only, but I don’t want the switches to route to management VLAN, this work will be done by firewalls. How can I do it? I’ve thought in M-GE0/0/0. If I assign an IP to this iface, will the switch route between it and the other subnets? if I cable this interfacte to a physical port in the mgmt vlan will this cause a loop?
Thanks
November 25, 2018 at 4:36 am |
If you want the firewall to route the management VLAN traffic, you would have to configure the gateway for the management subnet on the firewall. Or did I misunderstand your question?
November 26, 2018 at 9:34 am
The problem with just defining a gateway for the mgmt VLAN, is when I have diferent IP addresses for diferent VLANS. I want the trafic from MGMT VLAN to those other VLANS to be routed to the firewall but while the switch has IP ifaces on all VLANS it will route the trafic itself not passing it to the firewall.
December 5, 2018 at 11:48 pm
If some device has an IP address in a subnet, doesn’t mean it will route the traffic for this subnet (otherwise, all devices would automatically be routing). Router is the device that has the IP address used by all other devices on this subnet as default gateway. So if you configure your default gateway UP for the VLAN on the firewall, then firewall will do the routing. Not the switch, even if it also has an IP address on this subnet. Or did I misunderstand your question?
December 14, 2018 at 7:54 am
AFAIK, if a L3 switch has IP address in two VLANs, it will route between them but also if the router has to send a reply packet it will be sent thru the less weighted route
October 2, 2018 at 2:14 pm |
Is it also possible to configure a different vlan for manage. Because i already have a manage switch vlan.
November 18, 2018 at 4:21 am |
Yes, you can configure a VLAN interface IP address on any VLAN. It doesn’t have to be VLAN 1.
September 24, 2019 at 1:45 am |
Hi there – can you confirm if the order for these commands needs to be changed;
And to create an LACP aggregation group:
> interface bridge-aggregation 1
> description Trunk to upstream switch
> link-aggregation mode dynamic
> port link-type trunk
> port trunk permit vlan 20 30
> interface te 1/0/3
> port link-aggregation group 1
> interface te 2/0/3
> port link-aggregation group 1
I was having issues permitting VLANs and it only worked when I ran the permit VLAN command at the end (after adding interfaces to the aggregation group).
November 2, 2019 at 8:56 pm |
Not sure why. Order of commands shouldn’t matter as long you configure settings in the right place (i.e. trunk interface, individual port, etc). Can only think of STP blocking ports in case you accidentally created loops, while configuring your switches.
October 2, 2019 at 4:43 pm |
Thanks Bro. This has been so helpful!!! Amazing!
October 4, 2019 at 11:27 am |
Glad it helped!
October 5, 2019 at 6:32 am |
Hi,
Very nice and helpfull !
Thank you very much to have share your experience.
October 7, 2019 at 8:27 am |
Thanks, Jbcao!
December 9, 2019 at 8:28 pm |
Can these be managed by a webui?
July 28, 2020 at 12:17 am |
They certainly can. Most HPE switches (if not all) can be managed from a web browser.
December 22, 2020 at 12:04 pm |
Perfect.
December 23, 2020 at 1:46 am |
Nice to hear it was helpful!
September 30, 2021 at 11:08 am |
This post was a godsend! We have two oooold 5800AFs (JG225As) that didn’t have anything other than webgui management on them, and the less said about that the better. Having access to the CLI is an absolute must.
Thanks!!
April 2, 2022 at 4:41 am |
Good to see it’s still helping people almost 5 years later.