[Insider Sharing] You have lost access to CLI/Web Gui management? Highlighted

Latest reply: Jun 5, 2018 18:45:53 1662 2 3 0

Hi Guys, 

It may happen to lose access to your system, it's very possible to encounter this kind of situation before. SSH is not working, telnet was disabled long time ago, webGUI was not activated, bootrom password is long forgotten. So what are theoptions now? 

You may belucky if you still have SNMP connection with the system. Let’s consider thatyou still have the equipment installed in eSight, the Huawei NMS.
The nextthing to do is to backup the configuration file using eSight.


1. Go to  Configuration > Configuration Management > ConfigurationFile Management.


 

2.Then in the navigation tree, choose Manual Config Files > Backup Tasks -then Create button to install a backup task.
 


Youcan run the task immediately, or you can choose the schedule mode.

3. If the task runs successful you should be able to download the configurationfile of the system to your computer.




So, now you have the configuration file, YEY, but once you open the file you will find out that the passwords are encrypted,no in clear text. So, how to decrypt the passwords?
You can't because AES algorithm it's used to hide them.
 
But that's not a problem, you can edit the passwords in the cfgdocument, save it on your computer, upload in eSight and then restore it to the system.


Hopefully you have SNMP write rights to the system so you can apply a restore task on it. How to do this? We will use eSight, check the guidelines:


1.  Go the Configuration File management > Config Files. Click on Import button to upload the new edited configuration file.
2. Click on Restore button as below




3.Then restore the new configuration to Running as below



At this moment, each line stored in the new configuration file will becopied one by one over live configuration file, and finally the lines containing the new password will be overwritten.
 
So that should be all. It's easy, fast and without impact on the services.
 
You can do many things via SNMP protocol especially when you have write rightsenabled. Let's consider a funny example, don't use this on real life network.
 
Let's try to shutdown a physical interface remotely.

We consider a S5700 switch with version V200R005C00SPC500 for this test.

Firstly we will need a tool to generate SET request SNMP packets toquery the switch. You will have to choose one from the many tools available on the internet.




Next, we will need to find a OID. This is the correct one.
1.3.6.1.2.1.2.2.1.7.14


What this string means:

1.3.6.1.2.1.2.2.1 is the ifEntry table which describes differentcharacteristics of an interface. Check below more relevant subtables:

1.3.6.1.2.1.2.2.1.1 - ifIndex 
1.3.6.1.2.1.2.2.1.2 - ifDescr 
1.3.6.1.2.1.2.2.1.3 - ifType 
1.3.6.1.2.1.2.2.1.4 - ifMtu 
1.3.6.1.2.1.2.2.1.5 - ifSpeed 
1.3.6.1.2.1.2.2.1.6 - ifPhysAddress 
1.3.6.1.2.1.2.2.1.7 - ifAdminStatus 
1.3.6.1.2.1.2.2.1.8 - ifOperStatus 
1.3.6.1.2.1.2.2.1.9 - ifLastChange 
1.3.6.1.2.1.2.2.1.10 - ifInOctets 
1.3.6.1.2.1.2.2.1.11 - ifInUcastPkts 
1.3.6.1.2.1.2.2.1.12 - ifInNUcastPkts 
1.3.6.1.2.1.2.2.1.13 - ifInDiscards 
1.3.6.1.2.1.2.2.1.14 - ifInErrors 
1.3.6.1.2.1.2.2.1.15 - ifInUnknownProtos 
1.3.6.1.2.1.2.2.1.16 - ifOutOctets 
1.3.6.1.2.1.2.2.1.17 - ifOutUcastPkts 
1.3.6.1.2.1.2.2.1.18 - ifOutNUcastPkts 
1.3.6.1.2.1.2.2.1.19 - ifOutDiscards 
1.3.6.1.2.1.2.2.1.20 - ifOutErrors 
1.3.6.1.2.1.2.2.1.21 - ifOutQLen 
1.3.6.1.2.1.2.2.1.22 - ifSpecific 


The one  we are interested it's subtable 7, ifAdminStatus [7] whichdefines the status of the interface.

The last number for the string is 14 and it defines the interface index.To see the index of the interface please insert the below command :
[sw]diagnose 
[sw]display ifnet index-map


then we can see that interface g0/0/10 has index 14 associated.


 
What value 2 of  ”ASN1_INT” represents?  it's the SET requestinteger value that it's used to trigger a specific interface state. It has 3possible states {up (1),down (2),testing (3)}. We will pick 2 for this.
Finally this is how the set-request packet should look like.




The result is successful theinterface is down.




Of course you can use this approach to setdifferent parameters, MTU, IP addresses on the interfaces and so on. It has alot of potential and it's pretty useful on some specific situations.

I hope you enjoy reading this!

bye




 
From group: Switch This post was last edited by b00745015 at 2018-03-30 20:13.

This article contains more resources

You need to log in to download or view. No account?Register

x
  • x
  • convention:

Admin Created Mar 31, 2018 08:34:12 Helpful(0) Helpful(0)

[Insider Sharing] You have lost access to CLI/Web Gui management?-2644027-1good
  • x
  • convention:

Come on!
MVE Created Jun 5, 2018 18:45:53 Helpful(0) Helpful(0)

useful document, thanks
  • x
  • convention:

Telecommunications%20Engineer%2C%20currently%20senior%20project%20manager%20of%20the%20radio%20access%20network%20and%20partner%20of%20Huawei%20de%20Tunisia.

Reply

Reply
You need to log in to reply to the post Login | Register

Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " Privacy."
If the attachment button is not available, update the Adobe Flash Player to the latest version!

Login and enjoy all the member benefits

Login
Fast reply Scroll to top