8350 Stack Upgrade

[CliveAllen]

Hi

Completed a 3850 stack upgrade at the weekend. Everything is working as it should except for for one minor issue, which, unfortunately, is actually a big issue.... While in front of the equipment I could logon to the switches and check their operation, which was fine. However, this morning, when trying to login remotely I am getting the "Access Denied" message.

All that appeared to have changed after the upgrade is that switch 2 had now become the master. Would that affect the passwords for the systems? It is frustrating as someone now has to go back there to change this.

[Mark Malone]

it shouldn't did you do a diff of the config before and after to see if anything changed between software versions ?
are you consoled into the master switch port and still getting that ?

[CliveAllen]

Before the upgrade the stack was as follows:

Switch 1 - Active

Switch 2 - Standby

When the upgrade was completed the order was as follows:

Switch 1 - Standby

Switch 2- Active

I am remotely connecting from 120 Miles away so I cannot simply "Console" on to the switch.

It appears that the "Password" is not functioning correctly. We have an engineer, luckily, that is near the site and I am going to get him to reset the password as we cannot have any reboot of these switches occuring.... reset the password should be okay?

[Mark Malone]

As long as the console password is still accessible yes should be no problem resetting access to get back in , if your using AAA and it has locked up some how disconnect the connection back to your tacacs serer and it should release it to use console password once local enable is in place on it , upgrading it should not have effected it remotely just because it flipped over unless your using the MGMT port on one switch and not the other but if the ip is logical like a vlan it shouldn't have effected it , other thing which might have happened is the ssh keys didn't reset with upgrade and there screwed blocking access and you may need to regenerate them , did you check the show ip ssh before leaving site , crypto key generate rsa , then type 1024 and hit return to start them off again

[CliveAllen]

Hi Mark,

Thanks for your help. 

There appears to be a bug in the code version. What we have configured is vty 0 4 login etc etc and then vty 5 15 ssh etc etc.... so, the bug is that 0 - 4 get ignored, meaning you have to open a login dialogue 6 times to get to the first 5  - 15 vty line.... this then lets you login....

Thanks again

[Mark Malone]

That's interesting thanks for posting back what the root cause was in the end