[Insider Sharing] You have lost access to CLI/Web Gui management? Highlighted

Hi Guys, 

It may happen to lose access to your system, it's very possible to encounter this kind of situation before. SSH is not working, telnet was disabled long time ago, webGUI was not activated, bootrom password is long forgotten. So what are theoptions now? 

You may belucky if you still have SNMP connection with the system. Let’s consider thatyou still have the equipment installed in eSight, the Huawei NMS.
The nextthing to do is to backup the configuration file using eSight.

1. Go to  Configuration > Configuration Management > ConfigurationFile Management.

 

2.Then in the navigation tree, choose Manual Config Files > Backup Tasks -then Create button to install a backup task.
 


Youcan run the task immediately, or you can choose the schedule mode.

3. If the task runs successful you should be able to download the configurationfile of the system to your computer.



So, now you have the configuration file, YEY, but once you open the file you will find out that the passwords are encrypted,no in clear text. So, how to decrypt the passwords?
You can't because AES algorithm it's used to hide them.
 
But that's not a problem, you can edit the passwords in the cfgdocument, save it on your computer, upload in eSight and then restore it to the system.

Hopefully you have SNMP write rights to the system so you can apply a restore task on it. How to do this? We will use eSight, check the guidelines:

1.  Go the Configuration File management > Config Files. Click on Import button to upload the new edited configuration file.
2. Click on Restore button as below

3.Then restore the new configuration to Running as below



At this moment, each line stored in the new configuration file will becopied one by one over live configuration file, and finally the lines containing the new password will be overwritten.
 
So that should be all. It's easy, fast and without impact on the services.
 
You can do many things via SNMP protocol especially when you have write rightsenabled. Let's consider a funny example, don't use this on real life network.
 
Let's try to shutdown a physical interface remotely.
We consider a S5700 switch with version V200R005C00SPC500 for this test.

Firstly we will need a tool to generate SET request SNMP packets toquery the switch. You will have to choose one from the many tools available on the internet.



Next, we will need to find a OID. This is the correct one.
1.3.6.1.2.1.2.2.1.7.14

What this string means:

1.3.6.1.2.1.2.2.1 is the ifEntry table which describes differentcharacteristics of an interface. Check below more relevant subtables:

1.3.6.1.2.1.2.2.1.1 - ifIndex 
1.3.6.1.2.1.2.2.1.2 - ifDescr 
1.3.6.1.2.1.2.2.1.3 - ifType 
1.3.6.1.2.1.2.2.1.4 - ifMtu 
1.3.6.1.2.1.2.2.1.5 - ifSpeed 
1.3.6.1.2.1.2.2.1.6 - ifPhysAddress 
1.3.6.1.2.1.2.2.1.7 - ifAdminStatus 
1.3.6.1.2.1.2.2.1.8 - ifOperStatus 
1.3.6.1.2.1.2.2.1.9 - ifLastChange 
1.3.6.1.2.1.2.2.1.10 - ifInOctets 
1.3.6.1.2.1.2.2.1.11 - ifInUcastPkts 
1.3.6.1.2.1.2.2.1.12 - ifInNUcastPkts 
1.3.6.1.2.1.2.2.1.13 - ifInDiscards 
1.3.6.1.2.1.2.2.1.14 - ifInErrors 
1.3.6.1.2.1.2.2.1.15 - ifInUnknownProtos 
1.3.6.1.2.1.2.2.1.16 - ifOutOctets 
1.3.6.1.2.1.2.2.1.17 - ifOutUcastPkts 
1.3.6.1.2.1.2.2.1.18 - ifOutNUcastPkts 
1.3.6.1.2.1.2.2.1.19 - ifOutDiscards 
1.3.6.1.2.1.2.2.1.20 - ifOutErrors 
1.3.6.1.2.1.2.2.1.21 - ifOutQLen 
1.3.6.1.2.1.2.2.1.22 - ifSpecific 

The one  we are interested it's subtable 7, ifAdminStatus [7] whichdefines the status of the interface.

The last number for the string is 14 and it defines the interface index.To see the index of the interface please insert the below command :
[sw]diagnose 
[sw]display ifnet index-map

then we can see that interface g0/0/10 has index 14 associated.


 
What value 2 of  ”ASN1_INT” represents?  it's the SET requestinteger value that it's used to trigger a specific interface state. It has 3possible states {up (1),down (2),testing (3)}. We will pick 2 for this.
Finally this is how the set-request packet should look like.




The result is successful theinterface is down.

Of course you can use this approach to setdifferent parameters, MTU, IP addresses on the interfaces and so on. It has alot of potential and it's pretty useful on some specific situations.

I hope you enjoy reading this!

bye