Two X440 stacked random access to management

[Magnus_Isaksson]

Hello

I'm quite new to Extreme and have yet some limited knowledge about XOS.

But the story is that i have replaced our core router (X440-24t) with two "new" X440-24t in stack.
Firmware version 16.2.2.4 as Extreme recommends for the X440.
I have copied most of the configuration from the old one.

Management port connected with cable to switch port 1:1 with untagged VLAN401

I did run the stack config-guide-thingie and it went wonderful, and at the lab where i set them up it worked perfectly.
I have it set them to act as router for 3 ip ranges.
But when i moved the switches to the server room i began to get random access to the mgmt interface. Tho all traffic to and from configured VLANs are working perfect.

After a lot of troubleshooting i noticed that i can access the mgmt-cli via our external IP's that i have configured in the switch, now, i thought this was not possible after reading a lot on vr-mgmt access.
I have also random access for outgoing traffic from vr-mgmt to any, basically, for ex. ping google it works sometime but most of the time it does not.

But when i access SSH thru our external IP i get no errors or disconnect from cli as i get when connected thru the internal IP i have setup on the mgmt vlan.
I can access the mgmt-cli thru any of the VLAN105X ip addresses.

Now, what have i done wrong?

Config:
configure vlan default delete ports all
configure vr VR-Default delete ports 1:1-24,2:1-24
configure vr VR-Default add ports 1:1-24,2:1-24
configure vlan default delete ports 1:1-24,2:1-24
enable jumbo-frame ports all
configure vman ethertype 0x8100 secondaryconfigure iproute add default 172.16.254.1 vr VR-Mgmt
configure iproute add default xx.xxx.88.93
configure vlan Mgmt ipaddress 172.16.254.254 255.255.255.0 configure vlan WAN ipaddress xx.xxx.88.94 255.255.255.252 enable ipforwarding vlan WAN configure vlan VLAN1052 ipaddress xx.xxx.60.193 255.255.255.224 enable ipforwarding vlan VLAN1052 configure vlan VLAN1053 ipaddress xxx.xxx.115.129 255.255.255.240 enable ipforwarding vlan VLAN1053 configure vlan VLAN1054 ipaddress xxx.xxx.115.145 255.255.255.240 enable ipforwarding vlan VLAN1054 configure vlan VLAN1055 ipaddress xxx.xxx.115.161 255.255.255.224 enable ipforwarding vlan VLAN1055
I also noticed that when im doing an arping from an linux machine i get this

# arping -D -I ens32 -c 6 172.16.254.254
ARPING 172.16.254.254 from 0.0.0.0 ens32
Unicast reply from 172.16.254.254 [00:04:96:98:04:B6] 0.904ms
Sent 1 probes (1 broadcast(s))
Received 1 response(s)
# arping -I ens32 -c 2 172.16.254.254
ARPING 172.16.254.254 from 172.16.254.41 ens32
Unicast reply from 172.16.254.254 [02:04:96:6D:59:9B] 0.916ms
Sent 2 probes (1 broadcast(s))
Received 1 response(s)
and on the switch i get this from iparp
# sh iparp vr "VR-Mgmt"
VR Destination Mac Age Static VLAN VID Port
VR-Mgmt 172.16.254.41 00:50:56:b6:ac:1e 2 NO Mgmt 4095
Dynamic Entries : 6 Static Entries : 0
Pending Entries : 1
In Request : 15389 In Response : 1671
Out Request : 30438 Out Response : 3924
Failed Requests : 4656
Proxy Answered : 3913
Rx Error : 0 Dup IP Addr : 172.16.254.254
Rejected Count : 307 Rejected IP : 172.16.254.41
Rejected Port : Rejected I/F :
Max ARP entries : 4096 Max ARP pending entries : 256
ARP address check: Enabled ARP refresh : Enabled
Timeout : 20 minutes ARP Sender-Mac Learning : Disabled
Locktime : 1000 milliseconds
Retransmit Time : 1000 milliseconds
Reachable Time : 900000 milliseconds (Auto)
Fast Convergence : Off
I'm going mad soon 

[Magnus_Isaksson]

Thank you so much for your help!

[Patrick_Voss]

Can you send us a "show vlan" output?

[Drew_C]

Here's another, similar article:
https://gtacknowledge.extremenetworks.com/articles/How_To/Create-an-ACL-on-an-XOS-switch-for-SSH2-se...

[Patrick_Voss]

Yes as long as you can reach the IP you can telnet or SSH to it. There is a way to limit who can access the switch using an access profile for SSH:

https://gtacknowledge.extremenetworks.com/articles/Q_A/SSH-Access-Profile