Beginner’s Guide to HPE 5000 Series Switches

I don’t closely track the popularity of my blog. If what I share helps people in their day to day job, it’s already good enough to me. But I do look at site statistics now and then just out of curiosity and it seems that network-related posts get a lot of popularity. A blog post I wrote a while ago on Dell N4000 switches has quickly got in top five over the last year.

So it seems that there is a demand for entry-level switch configuration guides. I’ve worked with a quite a few different switch brands over the years, so I thought I will build on the success of the Dell blog post and this time write about HPE FlexNetwork/FlexFabric 5000 switch series.

Operating Systems

HPE has several network switch product lines. I won’t even try to cover all of them in this post. But it’s important to know that there are a few different operating systems you can encounter, while working with HPE network switches. There is a familiar ProCurve product portfolio (now merged with Aruba), which is based on ProVision operating system.

HPE FlexNetwork/FlexFabric 5000 series, on the other hand, is based on Comware operating system. It has a different CLI command set and can be a complete surprise if you’ve worked only with ProCurve switches before. So this blog post will be particularly valuable for those who’re dealing with HPE 5000 for the first time.

The following guide has been tested on a pair of HPE FlexFabric 5700-series switches. Even though commands are mostly the same, on other switch series, like FlexNetwork 5800, there might be some minor differences.

Initial Configuration

When the switch is booted for the first time it will start automatic configuration by trying to obtain settings over DHCP, which you can interrupt by Ctrl+C to get straight to CLI.

You start in user view where you can run display commands to review switch settings. To start the configuration, change to system view:

> system-view

Let’s start by configuring remote access to the switch. There are two ways you can do that. You either use the out-of-band management port:

> interface M-GigabitEthernet 0/0/0
> ip address
> ip route-static

Or you can configure a VLAN interface IP address:

> interface vlan-interface 1
> ip address
> ip route-static

Then configure switch name, enable SSH, set passwords and you can start managing the switch over SSH:

> sysname switchname

> public-key local create rsa
> ssh server enable
> user-interface vty 0 15
> authentication-mode scheme
> protocol inbound ssh

> super password simple yourpassword
> local-user admin
> password simple yourpassword
> authorization-attribute user-role level-0
> service-type ssh

User “admin” will have an unprivileged role. You will need to run the following command and enter password once logged in, to elevate to network admin rights:

> super

Intelligent Resilient Framework

In small non-business-critical environments one standalone switch is usually sufficient. In larger environments switches are typically deployed in pairs for redundancy. To simplify management and to avoid network loops most switches support some sort of MLAG or stacking. IRF is HPE’s version of it.

Determine what ports you’re going to use for IRF. There are two QSFP+ ports on 5700-series dedicated for it. And then on on the first switch (master) run the following commands (it’s recommended to shut down the ports before you set them up as IRF):

> irf member 1 priority 32
> int range FortyGigE 1/0/41 to FortyGigE 1/0/42
> shutdown
> irf-port 1/1
> port group interface FortyGigE 1/0/41
> irf-port 1/2
> port group interface FortyGigE 1/0/42
> int range FortyGigE 1/0/41 to FortyGigE 1/0/42
> undo shut
> save
> irf-port-configuration active

On the second switch (slave) run the following commands to change the IRF ID to 2:

> irf member 1 renumber 2
> reboot

When the switch comes up, configure IRF ports:

> irf member 2 priority 30
> int range FortyGigE 2/0/41 to FortyGigE 2/0/42
> shutdown
> irf-port 2/1
> port group interface FortyGigE 2/0/41
> irf-port 2/2
> port group interface FortyGigE 2/0/42
> int range FortyGigE 2/0/41 to FortyGigE 2/0/42
> undo shut
> save
> irf-port-configuration active

Now you can connect the physical IRF ports. IRF is a ring topology, that means (in my case) port 1/0/41 should connect to 2/0/42 and port 1/0/42 should connect to 2/0/41.

Second switch will automatically reboot and if all is configured correctly, you should see both switches join the IRF fabric. Member switch 1 has the highest priority of 32 and becomes the master:

> display irf

Firmware Upgrade

Firmware upgrade is the next logical step after you set up IRF. The latest firmware revision for the switches can be download from HPE web-site. Keep in mind you will need a HPE passport account, with a valid service agreement (SAID) added to it.

You will also need a TFTP server to upgrade the firmware. There are a few of them out there, but the most commonly used is probably Tftpd64.

When you get the TFTP server up and running and copy the firmware file to it, perform an upgrade:

> tftp get 5700-CMW710-R2432P03.ipe
> boot-loader file flash:/5700-CMW710-R2432P03.ipe slot 1 main
> boot-loader file flash:/5700-CMW710-R2432P03.ipe slot 2 main
> irf auto-update enable
> reboot

Confirm firmware has been updated:

> display version

VLANs, Aggregation Groups and Tagging

In Comware the term “aggregation group” is used to describe what is a “port channel” in Cisco world. Trunk/access ports are also called tagged/untagged ports throughout the documentation.

In this section we will discuss a few common port configuration scenarios:

  • Untagged ports, which can be your iSCSI storage array ports
  • Tagged ports, such as your VMware host uplinks
  • Aggregation groups, typically used for LAGs to upstream switches

First of all create all VLANs and give them descriptions:

> vlan 10
> description iSCSI
> vlan 20
> description Server
> vlan 30
> description Dev and test

Then specify untagged ports:

> vlan 10
> port te 1/0/1
> port te 2/0/1

To configure tagged ports and allow certain VLANs (ports will be added to the VLANs automatically):

> int te 1/0/2
> description ESX01 vmnic0
> port link-type trunk
> port trunk permit vlan 20 30
> int te 2/0/2
> description ESX02 vmnic0
> port link-type trunk
> port trunk permit vlan 20 30

And to create an LACP aggregation group:

> interface bridge-aggregation 1
> description Trunk to upstream switch
> link-aggregation mode dynamic
> port link-type trunk
> port trunk permit vlan 20 30

> interface te 1/0/3
> port link-aggregation group 1
> interface te 2/0/3
> port link-aggregation group 1

Common Commands

Other useful commands that don’t fall under any specific category, but handy to know.

Display switch configuration:

> display current-configuration

Save switch configuration:

> save

Shut down a port:

> int te 1/0/27
> shutdown

Undo a command:

> undo shutdown


Whether you are a network engineer new to the Comware operating system or a VMware administrator looking for a quick cheat sheet for FlexNetwork/FlexFabric switches, I hope this guide has helped you get the job done.

If this blog post gets the same amount of popularity, maybe it will turn into another series. But for now – over and out.


Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

23 Responses to “Beginner’s Guide to HPE 5000 Series Switches”

  1. Neil Anderson Says:

    Nick, this is really a helpful blog post! I appreciate this reading. Really useful thanks and keep up the great work!

  2. David Roberts Says:

    Hi Nick. A great post, thank you! With zero previous experience on these switches this allowed me to configure a pair of 5700s in an IRF, with multiple VLANs and Link Aggregation to my ESXi hosts.

  3. JavichuMeLlamo Says:

    Hi Nick, Great post. I’m dealing with some concerns related to 5000 series switches. The question is that I have some of them just doing L2 work, and now I want them to start routing and running ACL’s and so. I’ve defined several VLANs with assigned IP addresses, and one of them is for management only, but I don’t want the switches to route to management VLAN, this work will be done by firewalls. How can I do it? I’ve thought in M-GE0/0/0. If I assign an IP to this iface, will the switch route between it and the other subnets? if I cable this interfacte to a physical port in the mgmt vlan will this cause a loop?

    • niktips Says:

      If you want the firewall to route the management VLAN traffic, you would have to configure the gateway for the management subnet on the firewall. Or did I misunderstand your question?

      • javichumellamo Says:

        The problem with just defining a gateway for the mgmt VLAN, is when I have diferent IP addresses for diferent VLANS. I want the trafic from MGMT VLAN to those other VLANS to be routed to the firewall but while the switch has IP ifaces on all VLANS it will route the trafic itself not passing it to the firewall.

      • niktips Says:

        If some device has an IP address in a subnet, doesn’t mean it will route the traffic for this subnet (otherwise, all devices would automatically be routing). Router is the device that has the IP address used by all other devices on this subnet as default gateway. So if you configure your default gateway UP for the VLAN on the firewall, then firewall will do the routing. Not the switch, even if it also has an IP address on this subnet. Or did I misunderstand your question?

      • javichumellamo Says:

        AFAIK, if a L3 switch has IP address in two VLANs, it will route between them but also if the router has to send a reply packet it will be sent thru the less weighted route

  4. clint Says:

    Is it also possible to configure a different vlan for manage. Because i already have a manage switch vlan.

  5. Suhil Nazari Says:

    Hi there – can you confirm if the order for these commands needs to be changed;

    And to create an LACP aggregation group:

    > interface bridge-aggregation 1
    > description Trunk to upstream switch
    > link-aggregation mode dynamic
    > port link-type trunk
    > port trunk permit vlan 20 30

    > interface te 1/0/3
    > port link-aggregation group 1
    > interface te 2/0/3
    > port link-aggregation group 1

    I was having issues permitting VLANs and it only worked when I ran the permit VLAN command at the end (after adding interfaces to the aggregation group).

    • niktips Says:

      Not sure why. Order of commands shouldn’t matter as long you configure settings in the right place (i.e. trunk interface, individual port, etc). Can only think of STP blocking ports in case you accidentally created loops, while configuring your switches.

  6. Steve Says:

    Thanks Bro. This has been so helpful!!! Amazing!

  7. Jbcao Says:

    Very nice and helpfull !
    Thank you very much to have share your experience.

  8. Gerard Roy Says:

    Can these be managed by a webui?

  9. Nick Andre Says:


  10. Marius Sparby Says:

    This post was a godsend! We have two oooold 5800AFs (JG225As) that didn’t have anything other than webgui management on them, and the less said about that the better. Having access to the CLI is an absolute must.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: