HPE Comware OS Basics: FlexFabric Switch CLI Guide

从 Cisco 环境转到 HPE FlexFabric（Comware OS）的工程师往往被视图切换、hybrid/trunk 等概念困扰。本文以 HPE 5700 交换机（JG894A）为例，讲解 Comware 7 的核心操作：视图模式切换、配置保存、带外管理（OOBM）、SSH 配置、trunk 上联与 SVI 创建，全部附带可直接照抄的命令。

If you are coming from Cisco IOS or ArubaOS-CX, HPE Comware feels different before it feels familiar. The commands are similar enough to be dangerous - interface, vlan and ip address all exist - while the operational model underneath them does not match. This guide walks through the parts that actually trip people up on a Comware 7 switch such as the HPE FlexFabric 5700 (JG894A): the mandatory system-view step, how configuration is saved, how to reach the device out of band, how SSH and user roles work, and how access, trunk and hybrid ports behave. It is written as a companion to the Chinese reference section below, with copy-paste prompts for every command.

Comware CLI Model: Views, Not Modes

Every configuration task on Comware starts with a view change. The prompt tells you where you are, and almost every failure to type a command comes from being in the wrong view rather than from a syntax error.

Three habits make the view model painless:

• return (or Ctrl+Z) jumps straight back to user view from anywhere; quit (or Ctrl+Q) steps up one level.
• display current-configuration works from any view and is the equivalent of show running-config.
• To remove a line you have configured, prefix it with undo - for example undo ip address or undo port trunk permit vlan 10. There is no no keyword.

Comware also has a strict undo discipline: undo without arguments removes the configuration at the current level, which is convenient and occasionally alarming. Read the prompt before pressing Enter.

视图模式与配置保存

登录后默认处于显示模式（提示符为 >），只能查看配置；输入 system-view 进入配置模式（提示符变为 #）：

hpswitch> system-view
hpswitch#

保存运行配置到启动配置使用 save 命令，force 参数跳过确认与文件名提示：

hpswitch# save force

On Comware, save is the moment configuration becomes permanent; until then it lives only in RAM and is lost on reload. Make save force the last line of every change script, and record the output - it prints the target file name and a success message you can attach to a change ticket.

配置带外管理（OOBM）

1. 配置管理接口 IP

[hpswitch] interface M-GigabitEthernet0/0/0
[hpswitch-M-GigabitEthernet0/0/0] ip address 192.168.1.1 24

2. 配置默认路由

[hpswitch] ip route-static 0.0.0.0 0 M-GigabitEthernet 0/0/0 192.168.1.254 permanent

3. 创建本地用户并授予 network-admin 权限

[hpswitch] local-user admin
[hpswitch-luser-admin] password simple <PASSWORD>
[hpswitch-luser-admin] service-type ssh
[hpswitch-luser-admin] authorization-attribute user-role network-admin

4. 启用 SSH 并生成密钥

[hpswitch] ssh server enable
[hpswitch] public-key local create rsa

5. 配置 VTY 仅允许 SSH

[hpswitch] line vty 0 15
[hpswitch-line-vty0-15] authentication-mode scheme
[hpswitch-line-vty0-15] protocol inbound ssh

Out-of-Band Management: Why It Matters on Comware

The dedicated management port (M-GigabitEthernet0/0/0 or M-Ethernet on older platforms) is not part of the switching fabric. That separation is valuable: a VLAN misconfiguration, a spanning-tree loop or a broadcast storm in the data plane cannot cut your management path, and you keep console-free access during a build-out.

Four points are worth knowing before you rely on it:

• Routing needs an explicit static route. The management port has its own routing table context on several Comware builds, so the default route must reference the OOBM interface, and the permanent keyword keeps it installed even if the outgoing interface would otherwise be considered down - important when the port is administratively up but has no link yet.
• Set the management VLAN off the data path. A management network that shares VLAN 1 with users will be reachable from user ports. Keep OOBM on its own subnet and block it at the distribution layer.
• Use schemes, not passwords alone. authentication-mode scheme forces AAA (local or RADIUS/TACACS+). authentication-mode password with a single shared password is a lab-only setting.
• Restrict the protocols. protocol inbound ssh removes Telnet from the VTYs entirely. Do the same to the console if your security policy requires it.

Local Users, Roles and Passwords

Comware separates a user's authentication (who they are) from their authorization (what they may do). The user-role attribute is what grants access to the views described earlier.

[hpswitch] local-user readonly
[hpswitch-luser-readonly] password simple <PASSWORD>
[hpswitch-luser-readonly] service-type ssh terminal
[hpswitch-luser-readonly] authorization-attribute user-role network-operator
[hpswitch-luser-readonly] quit
[hpswitch] local-user admin
[hpswitch-luser-admin] password simple <PASSWORD>
[hpswitch-luser-admin] service-type ssh terminal
[hpswitch-luser-admin] authorization-attribute user-role network-admin

Key role values you will use:

Prefer a hashed secret rather than cleartext where the platform supports it (password hash or a configured password-control policy), and never leave password simple with a default credential in production. Comware also supports password complexity and ageing through password-control, which satisfies most audit checklists without an external AAA server.

SSH Details Worth Getting Right

[hpswitch] public-key local create rsa
[hpswitch] public-key local create ecdsa secp256r1
[hpswitch] public-key local destroy rsa
[hpswitch] ssh server enable
[hpswitch] ssh server authentication-retries 3
[hpswitch] ssh server rekey-interval 24
[hpswitch] ssh server compatible-ssh1x disable

• Generate the key before enabling the server; a missing host key makes SSH fail to negotiate while Telnet still works, which sends people down the wrong diagnostic path.
• RSA 2048 or an ECDSA curve is the modern minimum. Destroy the small RSA key once ECDSA is in place, or configure the key length explicitly.
• ssh server compatible-ssh1x disable removes the legacy protocol version; keep it disabled unless an ancient management station leaves you no choice.
• Source-interface and ACL restrictions (ssh server acl) limit who may even attempt a login - cheap, effective hardening.

VLAN 与 SVI 配置

trunk 上联放通全部 VLAN

[hpswitch] interface GigabitEthernet1/0/48
[hpswitch-GigabitEthernet1/0/48] port link-type trunk
[hpswitch-GigabitEthernet1/0/48] port trunk permit vlan all

创建 VLAN 的三层接口（SVI）

[hpswitch] interface Vlan-interface 10
[hpswitch-Vlan-interface10] ip address 10.10.10.1 24

注意：Comware 的 hybrid 模式支持 untagged/tagged 混用，可配合 port hybrid vlan 实现原生 VLAN 与多 VLAN tagged 并存，这在对接 ProVision（ArubaOS-Switch）设备时尤其常用。

Port Link Types: Access, Trunk and Hybrid

Comware exposes three link types, and the third one has no equivalent on ArubaOS-CX:

[hpswitch] interface GigabitEthernet1/0/1
[hpswitch-GigabitEthernet1/0/1] port link-type access
[hpswitch-GigabitEthernet1/0/1] port access vlan 10
[hpswitch-GigabitEthernet1/0/1] quit

[hpswitch] interface GigabitEthernet1/0/48
[hpswitch-GigabitEthernet1/0/48] port link-type trunk
[hpswitch-GigabitEthernet1/0/48] port trunk permit vlan 10 20 99
[hpswitch-GigabitEthernet1/0/48] port trunk pvid vlan 99
[hpswitch-GigabitEthernet1/0/48] quit

[hpswitch] interface GigabitEthernet1/0/2
[hpswitch-GigabitEthernet1/0/2] port link-type hybrid
[hpswitch-GigabitEthernet1/0/2] port hybrid vlan 10 untagged
[hpswitch-GigabitEthernet1/0/2] port hybrid vlan 100 tagged
[hpswitch-GigabitEthernet1/0/2] port hybrid pvid vlan 10

Two rules prevent most VLAN faults on Comware. First, the PVID must match the peer's PVID for untagged traffic to land in the same VLAN at both ends - the hybrid port above sends VLAN 10 untagged and VLAN 100 tagged, so the far end must treat VLAN 10 as untagged. Second, port trunk permit vlan is an explicit filter: on many builds the default is VLAN 1 only, so a trunk configured but not permitted carries nothing, and the symptom is complete silence rather than partial connectivity.

On hybrid ports the untagged VLAN and the PVID are separate settings that must agree. Setting port hybrid vlan 10 untagged without port hybrid pvid vlan 10 leaves incoming untagged frames in the old PVID while egress strips tags for VLAN 10 - a configuration that looks correct in a diff and fails in production.

Layer 3 on Comware: SVIs and Static Routes

[hpswitch] vlan 10
[hpswitch-vlan10] name Users
[hpswitch-vlan10] quit
[hpswitch] interface Vlan-interface 10
[hpswitch-Vlan-interface10] ip address 10.10.10.1 24
[hpswitch-Vlan-interface10] description "Users gateway"
[hpswitch-Vlan-interface10] quit
[hpswitch] ip route-static 0.0.0.0 0 10.10.10.254

A VLAN interface comes up only when at least one port in that VLAN is up, unless you disable that dependency with undo shutdown on the interface and the platform supports an always-up SVI. Check with display ip interface brief - a Vlan-interface showing DOWN almost always means no access port in the VLAN is forwarding.

For inter-VLAN traffic, the switch needs an IP on each VLAN interface and either a default route or specific static routes. Comware does not require an ip routing global enable on the 5700 series when VLAN interfaces have addresses, which is one place the model differs from Cisco, where forgetting ip routing is a classic first-week mistake in the other direction.

IRF: Stacking Beyond the Single Chassis

Comware's stacking feature is called IRF (Intelligent Resilient Framework). It lets two or more physical switches behave as one logical device with one control plane, which is what makes cross-member link aggregation possible.

[hpswitch] irf member 1 priority 32
[hpswitch] interface Ten-GigabitEthernet1/0/49
[hpswitch-Ten-GigabitEthernet1/0/49] shutdown
[hpswitch-Ten-GigabitEthernet1/0/49] quit
[hpswitch] irf-port 1/2
[hpswitch-irf-port1/2] port group interface Ten-GigabitEthernet1/0/49
[hpswitch-irf-port1/2] quit
[hpswitch] interface Ten-GigabitEthernet1/0/49
[hpswitch-Ten-GigabitEthernet1/0/49] undo shutdown

Points that matter in the field: the physical IRF port must be shut down before binding it (and re-enabled after), member IDs must be unique and are changed with irf member <id> renumber followed by a reboot, and the higher-priority member becomes the master. Sizing an odd number of members or mis-cabling the IRF links is the usual cause of a split; detection and recovery follow the same logic as any stacked platform, and the commands to verify are display irf, display irf topology and display irf configuration.

Verification Commands You Will Actually Use

When a port will not pass traffic, the fastest disambiguation is display interface plus display vlan: the first proves the physical link and shows error counters, the second proves which VLANs the port actually carries. Nine times out of ten, the port is up and in the wrong link type.

Comware vs Huawei VRP vs ArubaOS-CX

Comware and Huawei VRP share a common ancestry - the view model, undo instead of no, and the word display instead of show are all recognisably the same family. That makes cross-training between HPE and Huawei switches cheap, and it makes the command-mapping references on this site directly useful. If you regularly touch H3C/HPE and Huawei side by side, see Huawei VRP vs H3C Comware CLI comparison and the detailed Huawei/H3C/Cisco command equivalents table. For the command basics on H3C-branded Comware, the Comware CLI command basics guide covers views, undo and saving in more depth.

Where Comware and ArubaOS-CX diverge is the VLAN model itself. AOS-CX has no hybrid link type; it splits the world into access and trunk and replaces ProVision's per-VLAN tagged/untagged membership with vlan trunk native plus vlan trunk allowed. The practical consequence is that a migration plan must map hybrid ports explicitly - a Comware port carrying an untagged management VLAN and a tagged data VLAN becomes, on AOS-CX, either two ports or a trunk with a tagged native VLAN.

Common Pitfalls for Engineers Arriving from Cisco

1. Forgetting system-view. The prompt > means display-only. Nothing about the error message says "wrong view", which is why this is the number one time-waster.
2. Typing show instead of display. Some builds accept the abbreviation, many do not.
3. Typing no instead of undo. On a Comware line this produces a syntax error rather than an unexpected change, so it is annoying but safe.
4. Stopping at save and pressing Enter. Without force the command asks for a file name and a confirmation; scripted changes appear to hang. Use save force.
5. Assuming trunk ports carry all VLANs by default. On Comware the permit list is a positive filter; an empty list carries VLAN 1 only.
6. Overlooking the OOBM static route. The management port can have an IP, a link and a gateway and still be unreachable because the route was not installed against the OOBM interface.
7. Enabling SSH before generating host keys. The symptom is a negotiation failure on port 22 while everything else looks healthy.

Quick-Start Sequence for a New FlexFabric Switch

system-view
sysname FLEX-SW01
interface M-GigabitEthernet0/0/0
 ip address 192.168.1.10 24
 quit
ip route-static 0.0.0.0 0 M-GigabitEthernet 0/0/0 192.168.1.254 permanent
local-user admin
 password simple <PASSWORD>
 service-type ssh terminal
 authorization-attribute user-role network-admin
 quit
public-key local create ecdsa secp256r1
ssh server enable
ssh server compatible-ssh1x disable
line vty 0 15
 authentication-mode scheme
 protocol inbound ssh
 quit
vlan 10
 name Users
 quit
interface Vlan-interface 10
 ip address 10.10.10.1 24
 quit
interface GigabitEthernet1/0/48
 port link-type trunk
 port trunk permit vlan 10 20 99
 port trunk pvid vlan 99
 quit
save force

Adjust the VLAN list and address scheme to your design, then save, then verify with display current-configuration | include vlan and display ip interface brief. Everything else is incremental.

相关阅读

Comware 设备的 VLAN 互通问题可参考本站 华为路由器交换机常用配置命令与排障大全（VRP 与 Comware 命令高度相似）；HPE 新一代 AOS-CX 平台入门见 HPE Aruba AOS-CX Initial Configuration Guide。IRF 堆叠的完整配置与故障排查见 H3C 交换机 IRF 堆叠配置与故障排查，与华为 VRP 的命令对照见 H3C Comware 与华为 VRP 命令对照表。

原文链接：https://kral2.fr/working-with-comware-os-hpe-flexfabric-switching-basics/