VSP5520 SSH/Mgmt

[bfaltys]

I’m trying to test one of our new VSP5520s. I had been under the impression that VOSS is VOSS regardless of which switch, but maybe I was wrong. I have configured a loopback with an IP and SPBM/ISIS. I have an adjacency and I can ping the switch via that loopback. However, I cannot SSH to the switch and pings from the switch only work if I specify the loopback as the source. We also have new VSP4900 and VSP7400 that didn’t require anything special to be able to SSH to the loopback IP. Pings from those models also didn’t require me to specify a source. What am I missing? SSHD is enabled. I see a route to the subnet I’m SSHing from. I’m guessing this has something to do with the mgmt VRF or something along those lines, but I’ve not been able to sort it out.

[bfaltys]

I’ll see if I can make sense of that. We’re using Windows Server for NPS and it has worked for all other Extreme models without setting other attributes.

I’m trying another switch this morning to see if it has the same issue. Of course now I get a different error. When trying to configure an IP on the mgmt CLIP it give the message “Error: Cannot use Dynamic nick-name subnet 172.16.0.0/12.”

**UPDATE**

I don’t get the error after a factory default and then configure the CLIP.

[Miguel-Angel_RO]

Please review this to be sure that you send the correct radius attributes with the NPS:

Filter-Id=Enterasys:version=1:%MANAGEMENT%policy=%POLICY_NAME%

Service-Type=%MGMT_SERV_TYPE%

Passport-Access-Priority=%CUSTOM1%

https://extremeportal.force.com/ExtrArticleDetail?an=000082104&q=voss%20radius%20attribute

[bfaltys]

I also see a message stating “x509v3 host certificate is unavailable”

[bfaltys]

Just did a confirmation. Both keys are the same. I would expect the server to not even get to the point of  access-accept if the switch had the wrong key. Here is the Wireshark capture that shows the success and the switch showing invalid credentials.

[Miguel-Angel_RO]

Usual suspect is the shared secret.

Could you double check?