The management switch that arrived from a previous life, locked
- date
- 20260818
- what happened
- sw-mgmt1, a used Netgear PoE+ switch bought as Node0's out-of-band management switch, arrived from a prior deployment with its access control list still active, permitting management traffic only from source addresses that no longer existed. It answered pings normally from four independent hosts and silently dropped every management protocol, with no connection refused in reply.
- what it cost
- None of the normal recovery paths worked. The vendor's own discovery and recovery protocol was itself covered by the access list and answered neither unicast nor broadcast queries. SNMP gave nothing on the default community. The switch had to be factory reset, discarding an unknown prior configuration, before it could be used at all.
- what changed
- A documented recovery procedure: hold reset for roughly ten seconds, expect the switch to come up as a DHCP client rather than at its documented static fallback address, then configure it fresh into its management role. Two operator traps were documented at the same time: the web interface is strictly single-session with a silent lockout on a second login, and it locks out for about five minutes after repeated failed logins.
- the check now
- When inheriting used network hardware, test whether management ports are refused or filtered. Pingable but silently dropping every management protocol from multiple sources is the signature of a leftover access list, not a broken service.
Buying used enterprise network gear carries the same risk as buying used enterprise servers. Configuration left by a previous owner can still be active and enforcing itself. This switch arrived on 20260818 completely unmanageable through any of the normal channels, including the vendor’s own purpose-built recovery tool, because an access control list from a previous deployment was still enforcing itself against source addresses that had not existed for years.
The diagnostic tell worth keeping is the distinction between refused and filtered. A service that is off or has crashed answers a connection attempt with a reset, immediately and unambiguously. A service that exists but is blocked by policy answers nothing at all, while everything else on the device, in this case plain ping, keeps working normally. Four hosts on different segments all saw the same thing, which ruled out anything local to one of them.
That distinction pointed straight at a policy rule rather than a failed device, and it made the decision easy. Nothing in the switch’s existing configuration was wanted anyway, so a factory reset cost nothing and solved everything that a slower console-cable recovery would also have solved. The surprise after the reset is worth knowing about too. The switch came up as a DHCP client rather than at the static fallback address its documentation promises, because Node0’s network offered it a lease and it took one. Looking for a device at its documented recovery address, and not finding it, is not evidence that the reset failed.
Source: node0 lessons v0.1, lesson 4.5. Sanitized: checklist v0.1, 20260921; discovered address, MAC, credentials; voice pass 20260921. Part of oznog.com/node0.