Brocade ICX Series (cheap & powerful 10gbE/40gbE switching)

windwalka1990

New Member
Aug 7, 2020
2
0
1
Very new to Brocade switches, I've followed the guide for initial setup and was just about to begin configuring this new switch as my core but I'm pretty stumped on these syslogs I'm getting in the console...


SYSLOG: <14> Aug 7 09:31:54 CORE-POE1 System: SSL server 45.33.2.79:443 is disconnected
SYSLOG: <14> Aug 7 09:32:24 CORE-POE1 System: SSL server 45.33.23.183:443 is disconnected
SYSLOG: <14> Aug 7 09:32:54 CORE-POE1 System: SSL server 45.56.79.23:443 is disconnected
SYSLOG: <14> Aug 7 09:33:24 CORE-POE1 System: SSL server 45.79.19.196:443 is disconnected
SYSLOG: <14> Aug 7 09:33:54 CORE-POE1 System: SSL server 96.126.123.244:443 is disconnected
SYSLOG: <14> Aug 7 09:34:24 CORE-POE1 System: SSL server 198.58.118.167:443 is disconnected

I've gone over a command guide and looked over my running-config and nothing is jumping out at me. Any ideas to check?

EDIT: In case it matters this is an ICX 7250p-24p model.

Really appreciate any help on this!
 
Last edited:

Spearfoot

Member
Apr 22, 2015
65
25
18
62
Very new to Brocade switches, I've followed the guide for initial setup and was just about to begin configuring this new switch as my core but I'm pretty stumped on these syslogs I'm getting in the console...


SYSLOG: <14> Aug 7 09:31:54 CORE-POE1 System: SSL server 45.33.2.79:443 is disconnected
SYSLOG: <14> Aug 7 09:32:24 CORE-POE1 System: SSL server 45.33.23.183:443 is disconnected
SYSLOG: <14> Aug 7 09:32:54 CORE-POE1 System: SSL server 45.56.79.23:443 is disconnected
SYSLOG: <14> Aug 7 09:33:24 CORE-POE1 System: SSL server 45.79.19.196:443 is disconnected
SYSLOG: <14> Aug 7 09:33:54 CORE-POE1 System: SSL server 96.126.123.244:443 is disconnected
SYSLOG: <14> Aug 7 09:34:24 CORE-POE1 System: SSL server 198.58.118.167:443 is disconnected

I've gone over a command guide and looked over my running-config and nothing is jumping out at me. Any ideas to check?

EDIT: In case it matters this is an ICX 7250p-24p model.

Really appreciate any help on this!
Strange. Those are all hosts on the linode.com domain:
Code:
45.33.2.79 : li956-79.members.linode.com
45.33.23.183 : li977-183.members.linode.com
45.56.79.23 : li929-23.members.linode.com
45.79.19.196 : li1118-196.members.linode.com
96.126.123.244 : li372-244.members.linode.com
198.58.118.167 : li647-167.members.linode.com
I noticed something similar when I was setting up my ICX 7150-C12P switches. I looked up the IPs and they were AWS servers. I speculated that the switch was reaching out and downloading POE firmware, or something like that. Here are some of the entries from my SSH log, all showing disconnections from port 443 just like your switch:
Code:
34.208.35.231 : ec2-34-208-35-231.us-west-2.compute.amazonaws.com
54.191.58.33 :  ec2-54-191-58-33.us-west-2.compute.amazonaws.com 
54.186.0.83 : ec2-54-186-0-83.us-west-2.compute.amazonaws.com
I never saw anything odd like this setting up my ICX 6610s.

I have no idea what's going on here, and it's a little alarming.
 
  • Like
Reactions: tommybackeast

windwalka1990

New Member
Aug 7, 2020
2
0
1
Hmm, I'd be more comfortable if it were some AWS servers but when I saw linode I immediately disconnected it from my LAN. I don't see any traffic on other hosts to these domains so I'm pretty sure it's the switch. What gets me is I can't find any trace in the configuration, it's pretty much default except a few VLANs I created. Where would something like this be configured if not there, the OS??

I'll be honest I'm likely going to return this for a Cisco switch, I'm just over my head on these Brocades..
 

fohdeesha

Kaini Industries
Nov 20, 2016
1,907
1,713
113
29
fohdeesha.com
It's part of their new SmartZone central management thing, the IP's it's contacting are ruckus services. This behavior should be off by default in the 8080 firmware on my guide, I believe it was 8090 where they enabled it by default. It can be completely disabled and turned off with the following commands:

Code:
enable
conf t
no sz registrar
sz disable
write mem
you can confirm it's disabled by running "show sz status", the top line should have "Operation Status: Disabled" and below that "State: DISABLED"

This should not be required on v8080, however if it is, let me know so I can add those commands to the guide. However my money is on the two of you skipping ahead to v8090 or above
 

infoMatt

Active Member
Apr 16, 2019
157
60
28
I'd be more comfortable if it were some AWS servers but when I saw linode I immediately disconnected it from my LAN.
Why should it be any different if the cloud service is hosted on AWS rather than Linode?

Everybody can spn up a EC2 instance on AWS, there aren't many more checks and validations, AFAIK...
 

Spearfoot

Member
Apr 22, 2015
65
25
18
62
It's part of their new SmartZone central management thing, the IP's it's contacting are ruckus services. This behavior should be off by default in the 8080 firmware on my guide, I believe it was 8090 where they enabled it by default. It can be completely disabled and turned off with the following commands:

Code:
enable
conf t
no sz registrar
sz disable
write mem
you can confirm it's disabled by running "show sz status", the top line should have "Operation Status: Disabled" and below that "State: DISABLED"

This should not be required on v8080, however if it is, let me know so I can add those commands to the guide. However my money is on the two of you skipping ahead to v8090 or above
I'm running 8080e on both of my 7150-C12Ps:
Code:
SSH@ruckus-7150-u2.spearfoot.net#show vers
  Copyright (c) 2017 Ruckus Wireless, Inc. All rights reserved.
    UNIT 1: compiled on Apr  9 2019 at 03:20:17 labeled as SPR08080e
      (29826604 bytes) from Primary SPR08080e.bin
        SW: Version 08.0.80eT213
      Compressed Boot-Monitor Image size = 786944, Version:10.1.14T225 (mnz10114)
       Compiled on Thu Nov 15 06:59:22 2018
Thanks for the info and commands. I'm going to add them to my startup settings.
 

fohdeesha

Kaini Industries
Nov 20, 2016
1,907
1,713
113
29
fohdeesha.com
I'm running 8080e on both of my 7150-C12Ps:
Code:
SSH@ruckus-7150-u2.spearfoot.net#show vers
  Copyright (c) 2017 Ruckus Wireless, Inc. All rights reserved.
    UNIT 1: compiled on Apr  9 2019 at 03:20:17 labeled as SPR08080e
      (29826604 bytes) from Primary SPR08080e.bin
        SW: Version 08.0.80eT213
      Compressed Boot-Monitor Image size = 786944, Version:10.1.14T225 (mnz10114)
       Compiled on Thu Nov 15 06:59:22 2018
Thanks for the info and commands. I'm going to add them to my startup settings.
well I'll be damned - can't believe SZ registration is on by default in 8080 (maybe added in the e revision?). I'll add the disable settings to the guide
 

LodeRunner

Member
Apr 27, 2019
49
26
18
This is my 7150 with 8080e, I never touched SZ settings. I'll check the 7150 that I got new in box and see what it's got enabled; I haven't done a factory default on it or any config.
Code:
SSH@office-sw#sh sz st

============    SZ Agent State Info     ===================
Config Status: None     Operation Status: Disabled
State: INIT                 Prev State: INIT                 Event: NONE                

SWR List            : None
Active List         : None
DHCP Option 43      : No
DHCP Opt 43 List    : None
Passive List        : None
Merged List         : None
Merged Idx: 0    IP : 0.0.0.0
Switch registrar host: sw-registrar.ruckuswireless.com

SZ IP Used          : 0.0.0.0
SZ Query Status     : 
        Not Initiated

SSH Tunnel Status - :
  Tunnel Status     : Not Initiated
  CLI IP/Port       : /0
  SNMP IP/Port      : /0
  Syslog IP/Port    : /0
                                                                  
Timer Status        : Not Running
 

nickf1227

Member
Sep 23, 2015
71
40
18
29
I am having a strange spanning tree problem I cannot explain.
I have an HP E3800 stack as my core.

It's spanning tree is turned on globally and set as the root:
spanning-tree mode rapid-pvst
spanning-tree root primary priority 0
The Brocade ICX 6450 Switch I have is uplinked to port 2/50. It is not designated as a
Fusco-MDF-New(config)# show run interface ethernet 2/50

Running configuration:

interface 2/50
tagged vlan 99
untagged vlan 1
exit
If I turn on spanning-tree root guard I lose connectivity to the Brocade switch. This is because the Brocade seems to be winning the root bridge election on VLAN 1:

1596988662933.png

My Brocade's config is as follows:
SSH@STH_LAB(config)#show run
Current configuration:
!
ver 08.0.30tT313
!
stack unit 1
module 1 icx6450-24p-poe-port-management-module
module 2 icx6450-sfp-plus-4port-40g-module
!
global-stp
!
!
!
spanning-tree single
!
vlan 1 name DEFAULT-VLAN by port
router-interface ve 1
spanning-tree
!
vlan 99 name TestBench by port
tagged ethe 1/2/1 to 1/2/4
untagged ethe 1/1/2 to 1/1/24
router-interface ve 99
spanning-tree
!
!
spanning-tree single 802-1w
spanning-tree single 802-1w priority 65535
!
!
!
!
and the uplink:

SSH@STH_LAB(config)#show run interface ethernet 1/2/1
interface ethernet 1/2/1
dual-mode
!
and span:

SSH@STH_LAB(config)#show span

Spanning-tree is not configured on port-vlan 4094

L2 VLAN 1 99 are members of single spanning tree.
Additionally, on the brocade I attempted to run:
SH@STH_LAB(config)#spanning-tree single 802-1w ethernet 1/2/1 priority 240
But It made no differance

Any ideas what I've done wrong? What makes this even weirder, is that the HP Switch is root for VLAN 99, as it should be. It is only VLAN 1 that is the problem.

Also, to be clear it is definitely flip-flopping between them.
1596990044873.png
 
Last edited:

Spearfoot

Member
Apr 22, 2015
65
25
18
62
Hmm, I'd be more comfortable if it were some AWS servers but when I saw linode I immediately disconnected it from my LAN. I don't see any traffic on other hosts to these domains so I'm pretty sure it's the switch. What gets me is I can't find any trace in the configuration, it's pretty much default except a few VLANs I created. Where would something like this be configured if not there, the OS??

I'll be honest I'm likely going to return this for a Cisco switch, I'm just over my head on these Brocades..
Don't give up on them so quickly, @windwalka1990 -- especially now that we know what the SSL connections were and how to disable them! These Brocade/Ruckus units are great switches. And I wouldn't be at all surprised if Cisco (and other) switches also 'phone home'.
 
  • Like
Reactions: fohdeesha

jzeus

New Member
Jan 22, 2017
19
4
3
This is my 7150 with 8080e, I never touched SZ settings. I'll check the 7150 that I got new in box and see what it's got enabled; I haven't done a factory default on it or any config.
Code:
SSH@office-sw#sh sz st

============    SZ Agent State Info     ===================
Config Status: None     Operation Status: Disabled
State: INIT                 Prev State: INIT                 Event: NONE               

SWR List            : None
Active List         : None
DHCP Option 43      : No
DHCP Opt 43 List    : None
Passive List        : None
Merged List         : None
Merged Idx: 0    IP : 0.0.0.0
Switch registrar host: sw-registrar.ruckuswireless.com

SZ IP Used          : 0.0.0.0
SZ Query Status     :
        Not Initiated

SSH Tunnel Status - :
  Tunnel Status     : Not Initiated
  CLI IP/Port       : /0
  SNMP IP/Port      : /0
  Syslog IP/Port    : /0
                                                                 
Timer Status        : Not Running
I did "sz dis" on 7150 with device certificate wiped. The complaint about certs went away.
 
  • Like
Reactions: fohdeesha

fohdeesha

Kaini Industries
Nov 20, 2016
1,907
1,713
113
29
fohdeesha.com
This is my 7150 with 8080e, I never touched SZ settings. I'll check the 7150 that I got new in box and see what it's got enabled; I haven't done a factory default on it or any config.
Code:
SSH@office-sw#sh sz st

============    SZ Agent State Info     ===================
Config Status: None     Operation Status: Disabled
State: INIT                 Prev State: INIT                 Event: NONE               

SWR List            : None
Active List         : None
DHCP Option 43      : No
DHCP Opt 43 List    : None
Passive List        : None
Merged List         : None
Merged Idx: 0    IP : 0.0.0.0
Switch registrar host: sw-registrar.ruckuswireless.com

SZ IP Used          : 0.0.0.0
SZ Query Status     :
        Not Initiated

SSH Tunnel Status - :
  Tunnel Status     : Not Initiated
  CLI IP/Port       : /0
  SNMP IP/Port      : /0
  Syslog IP/Port    : /0
                                                                 
Timer Status        : Not Running
"State: INIT" tells me it's still trying to phone home and register - make sure to run BOTH "no sz registrar" and "sz disable" - then run status again and state should now show disabled like below:

Code:
============    SZ Agent State Info     ===================
Config Status: Disabled Operation Status: Disabled
State: DISABLED             Prev State: INIT                 Event: NONE
 

tommybackeast

Active Member
Jun 10, 2018
247
80
28
I'll check it, I know it does SMB3. Having both set doesn't immediately boot me off the console so that's a good sign. This NAS only has dual Gb connections.
I saw your included URL of Synology+10GB+SMB 3.1+Windows 10

What about Windows 7 Pro boxes and SMB3.1 + Synology with 10GB Nics + Brocade ?

To the best of my knowledge, a Windows 7 Pro box cannot use SMB 3.1 - please correct me if wrong
 

tommybackeast

Active Member
Jun 10, 2018
247
80
28
It's part of their new SmartZone central management thing, the IP's it's contacting are ruckus services. This behavior should be off by default in the 8080 firmware on my guide, I believe it was 8090 where they enabled it by default. It can be completely disabled and turned off with the following commands:

Code:
enable
conf t
no sz registrar
sz disable
write mem
you can confirm it's disabled by running "show sz status", the top line should have "Operation Status: Disabled" and below that "State: DISABLED"

This should not be required on v8080, however if it is, let me know so I can add those commands to the guide. However my money is on the two of you skipping ahead to v8090 or above
In the attempt to help you help "us" ; I am on 8080e (downloaded from you); and "show sz status" does give "Operation Status : Disabled" -however -- "State:" shows INIT (and not the State:Disabled) you mentioned.

I followed your original install guide to the letter : switch was wiped, and your copy of 8080e installed.

Screengrab attached

PS: There is a Ruckus r510AP attached to this Brocade 7250-48P using POE
 

Attachments

Last edited:

tommybackeast

Active Member
Jun 10, 2018
247
80
28
It's part of their new SmartZone central management thing, the IP's it's contacting are ruckus services. This behavior
I googled but didn't learn much - can you talk a bit on what exactly this "SmartZone" central management is exactly?

I know there's some type of single pane of glass if you have Brocade Switch + a Ruckus AP ; but it seems "SmartZone" management is something else. /thanks
 

tommybackeast

Active Member
Jun 10, 2018
247
80
28
noob Question: I have a Brocade 7250-48p. if I run 10Gig fiber cable from it to a " Brocade ICX7150-C12P " that is two stories up from the Brocade 7250.

My use case is : plugging a 10GBe Workstation into the 7150-C12P via DAC cable; and plugging 3 CAT6 cables as well to run 3 Workstations.

I know this is not called a stacked switch config; but is it called a 'branch switch' config?

(sorry for not knowing the correct term) -

QUESTION: can i just plug cables in and be good to go; or must I do "something" on the 7250 Top-of-Rack switch to properly setup the 7150-C12P as the "branch switch"?
 

kapone

Well-Known Member
May 23, 2015
783
381
63
noob Question: I have a Brocade 7250-48p. if I run 10Gig fiber cable from it to a " Brocade ICX7150-C12P " that is two stories up from the Brocade 7250.

My use case is : plugging a 10GBe Workstation into the 7150-C12P via DAC cable; and plugging 3 CAT6 cables as well to run 3 Workstations.

I know this is not called a stacked switch config; but is it called a 'branch switch' config?

(sorry for not knowing the correct term) -

QUESTION: can i just plug cables in and be good to go; or must I do "something" on the 7250 Top-of-Rack switch to properly setup the 7150-C12P as the "branch switch"?
As long as you don't expect any Layer 3 stuff on the 7150, it's plug and play for Layer 2 (no different than sticking a switch into another switch's ethernet port).

Edit: Minor correction. Plug and play as long as the TOR switch port is in "some" VLAN, not the default VLAN (although that could be worked as well, but that's a whole another story). All your devices on the 7150 will be in "that" VLAN that is defined on the 7250.
 
  • Like
Reactions: tommybackeast