bootrom update on Huawei S5300 switch

Содержание

Bootrom update on huawei s5300 switch – labnario
Настройка hostname и ip адреса
Настройка snmp
Настройка ssh
Подключение к консоли коммутатора
Поднимаем веб-интерфейс
Спасибо!
Узнайте больше о Huawei

Bootrom update on huawei s5300 switch – labnario

Some time ago I had a case with damaged file system on Huawei S5300 switch. It had been caused by power failure on one site. The switch was not able to decompress VRP software and rebooted itself all the time.

BIOS LOADING ...
Copyright (c) 2008-2022 HUAWEI TECH CO., LTD.
(Ver107, Jan 18 2022, 22:52:53)

Press Ctrl B to enter BOOTROM menu... 1
Auto-booting...
Update Epld file ............................ None
Decompressing VRP software ..................

BIOS LOADING ...
Copyright (c) 2008-2022 HUAWEI TECH CO., LTD.
(Ver107, Jan 18 2022, 22:52:53)

Press Ctrl B to enter BOOTROM menu... 1
Auto-booting...
Update Epld file ............................ None
Decompressing VRP software ..................

To reactivate this switch we decided to upload a new software file to the flash of the switch. It was not enough space to do it, so format flash was necessary.

Press Ctrl B to enter BOOTROM menu...
password: 
          BOOTROM  MENU
    1. Boot with default mode
    2. Enter serial submenu
    3. Enter startup submenu
    4. Enter ethernet submenu
    5. Enter filesystem submenu
    6. Modify BOOTROM password
    7. Reboot

Enter your choice(1-7): 5

         FILESYSTEM SUBMENU

    1. Erase Flash            
    2. Format flash           
    3. Delete file from Flash 
    4. Rename file from Flash 
    5. Display Flash files    
    6. Update EPLD file       
    7. Update FansCard File   
    8. Return to main menu    

Enter your choice(1-8): 5
No. File Size(bytes)     Created Date       File Name
=================================================================                    
6:  14139156 bytes   Apr 26 2022 00:20:11   s5300ei-v200r001c00spc300.cc        
7:  384384   bytes   Oct 01 2008 00:12:05   bootrom009.bin                      
8:  15355    bytes   Oct 28 2022 12:36:13   vrpcfg.cfg                                        
11:  11113860 bytes   Apr 24 2022 14:37:10   s5300ei-v100r005c01spc100.cc        
12:  58044    bytes   Apr 26 2022 00:13:51   s5300ei-v200r001sph006.pat                   
Total: 30008KB(Free: 4240KB)

 FILESYSTEM SUBMENU

    1. Erase Flash            
    2. Format flash           
    3. Delete file from Flash 
    4. Rename file from Flash 
    5. Display Flash files    
    6. Update EPLD file       
    7. Update FansCard File   
    8. Return to main menu    

Enter your choice(1-8): 2

Note: Format flash will damage Flash file system.
      Format flash? Yes or No(Y/N): y

Formatting Flash, please waiting several minutes ............................................................................................................................................................. done

Let’s look at free space on the flash memory:

FILESYSTEM SUBMENU

    1. Erase Flash            
    2. Format flash           
    3. Delete file from Flash 
    4. Rename file from Flash 
    5. Display Flash files    
    6. Update EPLD file       
    7. Update FansCard File   
    8. Return to main menu    

Enter your choice(1-8): 5
No. File Size(bytes)     Created Date       File Name
=================================================================
Total: 30008KB(Free: 30000KB)

The memory has been freed.

Glad we started loading the new VRP file to the flash by FTP. How to upload a new file to S5300 you can see on the article: “console password recovery Huawei S5300“.

And we encountered the second problem. We were not able to upload this file due to lack of free space of the flash memory, even though it has been formatted. To solve this problem we decided to update bootrom. Below a whole procedure how to do this:

BOOTROM  MENU

    1. Boot with default mode
    2. Enter serial submenu
    3. Enter startup submenu
    4. Enter ethernet submenu
    5. Enter filesystem submenu
    6. Modify BOOTROM password
    7. Reboot

Enter your choice(1-7): 4

          ETHERNET  SUBMENU

    1. Download file to SDRAM through ethernet interface and reboot the system
    2. Download file to Flash through ethernet interface
    3. Modify ethernet interface boot parameter
    4. Return to main menu

Be sure to select 3 to modify boot parameter before downloading!

Enter your choice(1-4): 3

          BOOTLINE  SUBMENU

    1. Set TFTP protocol parameters
    2. Set FTP protocol parameters
    3. Return to ethernet menu

Enter your choice(1-3): 2
'.' = clear field;  '-' = go to previous field;  ^D = quit
Load File name      : SV100R002C02B152_for_5300.cc S5300EI-bootrom.bin
Switch IP address   : 192.168.130.53 
Server IP address   : 192.168.130.137 
FTP User Name       : a huawei
FTP User Password   : a huawei

Starting to write BOOTLINE into flash ... done

           BOOTLINE  SUBMENU

    1. Set TFTP protocol parameters
    2. Set FTP protocol parameters
    3. Return to ethernet menu

Enter your choice(1-3): 3

          ETHERNET  SUBMENU

    1. Download file to SDRAM through ethernet interface and reboot the system
    2. Download file to Flash through ethernet interface
    3. Modify ethernet interface boot parameter
    4. Return to main menu

Be sure to select 3 to modify boot parameter before downloading!
Enter your choice(1-4): 1
boot device          : mottsec
unit number          : 0 
processor number     : 0 
host name            : host
file name            : S5300EI-bootrom.bin
inet on ethernet (e) : 192.168.130.53
host inet (h)        : 192.168.130.137
user (u)             : huawei
ftp password (pw)    : huawei
flags (f)            : 0x0 

Attached TCP/IP interface to mottsec0.
Warning: no netmask specified.
Attaching network interface lo0... done.
Loading... 
Read file to sdram .Done
Warning: Don't Power-off or Reset the Device!!!
Update bootrom system ... done !

           ETHERNET  SUBMENU

    1. Download file to SDRAM through ethernet interface and reboot the system
    2. Download file to Flash through ethernet interface
    3. Modify ethernet interface boot parameter
    4. Return to main menu

Enter your choice(1-4): 4

          BOOTROM  MENU

    1. Boot with default mode
    2. Enter serial submenu
    3. Enter startup submenu
    4. Enter ethernet submenu
    5. Enter filesystem submenu
    6. Modify BOOTROM password
    7. Reboot

Enter your choice(1-7): 7
Reboot...

The bootrom has been updated.

After update you can see that the command for updating bootrom has also been changed. It looks more intuitively now:

BOOTROM  MENU

    1. Boot with default mode
    2. Enter serial submenu
    3. Enter startup submenu
    4. Enter ethernet submenu
    5. Enter filesystem submenu
    6. Modify BOOTROM password
    7. Clear password for console user 
    8. Reboot

Enter your choice(1-8): 4

          ETHERNET  SUBMENU

    1. Update BOOTROM system
    2. Download file to Flash through ethernet interface
    3. Upload Configuration file to Ftp through ethernet interface
    4. Modify ethernet interface boot parameter
    5. Return to main menu

Be sure to select 4 to modify boot parameter before downloading!
Enter your choice(1-5):

After bootrom update there was not any problem to upload the new VRP software file to the switche’s flash memory.

SNMPv1 and SNMPv2c protocols security model uses the community-based pseudo-authentication. That means that a password (called a community string) is sent in a clear text between a network management station and managed devices. Both SNMPv1 and v2c are subject to packet sniffing because they do not implement encryption. Security has been the biggest weakness of the SNMP since the beginning. More about SNMPv2c concepts, operation and configuration you can find at “SNMPv2c configuration on Huawei devices“.

What if we want SNMP to be used over a public network?

SNMPv3 can be implemented. It provides important security features, which are not available in both SNMPv1 and v2c:

Confidentiality – encryption of packets to prevent snooping by an unauthorized source
Integrity – to ensure that a packet has not been tampered while in transit using optional packet reply protection
Authentication – to verify that a packet comes from a valid source.

SNMPv3 defines some new concepts: security level, user and group. The following security levels exists:

A group defines the access policy for a user. Access policy defines which SNMP objects can be accessed or which SNMP objects can generate notifications to the members of a group. If the authentication and encryption mode are not specified, a user can only access views in non-authentication and non-encryption mode.

When using SNMPv3, system firstly verifies a user based on the configured authentication and encryption mode. After the user passes the authentication, the system verifies which SNMP views that user can access, based on the group to which the user was assigned.

A group can be configured using command syntax:

snmp-agent group v3 group-name { authentication | noauth | privacy } [ read-view read-view | write-view write-view | notify-view notify-view | acl acl-number ]

An SNMPv3 user can be assigned to the group using the following command syntax:

snmp-agent usm-user v3 user-name group-name [ authentication-mode { md5 | sha } authkey [ privacy-mode { aes128 | des56 } prikey | plain-text ] ] [ acl standard-acl ]

After an SNMPv3 group is configured, the system can effectively control the access rights of all users in the group, using the group settings. User access can be encrypted and authenticated, authenticated but not encrypted, or neither authenticated nor encrypted. If the access level of a user is lower than the security level of the specified group, the access fails. When the group, to which a user belongs, has multiple security levels, the user can select the group with the highest security level, among the groups that can be accessed, and access the view of the group.

Let’s configure SNMPv3 read access for NMS1 IP: 150.100.12.1. In order to do that, NMS1 user will be configured and added to the GROUP1. NMS1 user will use SHA algorithm with AUTHKEY1 key for authentication and AES128 with ENCRYPTKEY1 key for encryption. Access to the group GROUP1 will be allowed for NMS1 only. ACL 2001 will be configured for that restriction.

[LabnarioR1]snmp-agent
[LabnarioR1]snmp-agent sys-info version v3
[LabnarioR1]snmp-agent group v3 GROUP1 privacy acl 2001

[LabnarioR1]acl 2001
[LabnarioR1-acl-basic-2001]rule 10 permit source 150.100.12.1 0.0.0.0 
 
[LabnarioR1]snmp-agent usm-user v3 NMS1 GROUP1 authentication-mode sha AUTHKEY1 privacy-mode aes128 ENCRYPTKEY1

As a next step let’s configure trap messages to be sent from our LabnarioR1 router to the NMS1, using traps parameter sending list name NMSTRAPS1:

[LabnarioR1]snmp-agent trap enable

[LabnarioR1]snmp-agent target-host trap-hostname NMS1 address 150.100.12.1 trap-paramsname NMS1TRAPS

Traps will be authenticated at the receive end and encrypted at the transmit end (privacy keyword). Transmission protocol will be SNMPv3. Let’s configure traps parameter sending list NMS1TRAPS:

[LabnarioR1]snmp-agent target-host trap-paramsname NMS1TRAPS v3 securityname NMS1 privacy

As a source IP of traps generated, loopback1 address will be used:

[LabnarioR1]snmp-agent trap source LoopBack1

Equipment administrator’s contact information allows the NMS administrator to call equipment administrator in case of a failure:

[LabnarioR1]snmp-agent sys-info contact CALL 0800-123456789

For verification use the commands as below:

[LabnarioR1]dis snmp-agent group GROUP1

   Group name: GROUP1 
   Security model: v3 AuthPriv
   Readview: ViewDefault 
   Writeview:  
   Notifyview:  
   Storage type: nonVolatile 
   Acl: 2001

[LabnarioR1]dis snmp-agent usm-user 
   User name: NMS1 
   Engine ID: 800007DB03000000000000 
   Group name: GROUP1 
   Authentication mode: sha, Privacy mode: aes128 
   Storage type: nonVolatile 
   User status: active 
   Acl: 2001

   Total number is 1 

[LabnarioR1]dis snmp-agent target-host 
   Traphost list:
   Target host name: NMS1 
   Traphost address: 150.100.12.1 
   Traphost portnumber: 162   
   Target host parameter: NMS1TRAPS 

   Total number is 1 

   Parameter list trap target host:
   Parameter name of the target host: NMS1TRAPS 
   Message mode of the target host: SNMPV3 
   Trap version of the target host: v3 
   Security name of the target host: NMS1 
   Security level of the target host: privacy 

   Total number is 1 

[LabnarioR1]display snmp-agent sys-info contact 
   The contact person for this managed node: 
           CALL 0800-123456789

Настройка hostname и ip адреса

Для смены hostname воспользуйтесь командой:

Router(config)#sysname Quidway

Новый адрес применяется сразу, и в отличии от CISCO здесь не надо перезагружать интерфейс.

Настройка snmp

У коммутаторов Huawei есть две особенности, о которых надо помнить, настраивая snmp. Во первых, если у вас включен snmp v3, то snmp v2c работать не будет. Во-вторых для snmp v2c при настройке на коммутаторе в консоле имя community надо указывать в кавычках, и в мониторилке (например Dude) оно тоже должно быть указано в кавычках (использовал двойные кавычки).

[Quidway]acl number 2100[Quidway-acl-basic-2100]rule 1 permit source 172.20.0.33 0.0.0.0 // for one ip

[Quidway-acl-basic-2100] quit[Quidway]snmp-agent sys-info version v2c[Quidway]undo snmp-agent sys-info version v3[Quidway]snmp-agent community read «huawei» acl 2100

Опционально можно добавить контактные данные в snmp.

[Quidway]snmp-agent sys-info contact X Division[Quidway]snmp-agent sys-info location Kremlin

Настройка ssh

Генерим ключи, добавляем юзера, даём юзеру доступ к сервисам ssh(stelnet) telnet.

Подключение к консоли коммутатора

Т.к. в моем ультрабуке нет ни Ethernet порта, ни тем более COM порта я использовал свой адаптер QinHeng Electronics HL-340 USB-Serial adapter (Device 005: ID 1a86:7523). Радует он меня тем, что при подключении по USB сразу даёт вирутуальный COM-порт и не требует никаких драйверов ни под Windows, ни под Linux.

Для подключения использую gtkterm

> sudo gtkterm

Configuration -> Port:Port: /dev/ttyUSB0Baud rate: 9600Parity: noneBits: 8Stop bits: 1Flow control: none

После первого подключения возника проблема с тем, что оооочен сильно тормозила консоль. Потом выяснилось, что всемы виной консольный COM -> RJ45 кабель. Заменили его на Cisco-вский, и всё завелось.