I have three old Netgear GSM 7224 Ethernet switches that I use from time to time in my lab network. These switches run at 1Gbps on each port which is still plenty fast enough for my needs.
I purchased them second hand on eBay some years ago. Soon after my acquisition, I replaced the 40mm fans in two of them and upgraded the firmware. All of my GSM7224 switches now needed new fans. One had stopped altogether, while the others had become very noisy.
Having done this repair before, this time around, I carefully selected replacement fans with the correct 2-pin plug already installed. I had to cut the plugs off the old fans last time and soldered them to the replacements. Lesson learned. With the new fans I could have glued M3 nuts into the receptacles but I prefer to use brass inserts like the OEM fans for ease of installation and avoid the glue.
Six economically priced 5Vdc 40x40x10mm fans were purchased on eBay for £2.85 each, plus a bag of 50 M3 brass inserts for £2.19. The total cost of this repair was £19.29 in October 2024.
So why did I buy no name fans? A single Noctua fan costs £20, six of them would have set me back £120. I couldn’t justify spending an extra £100 on repairing these old switches. I would have to repair them five more times with cheap fans before breaking even on the cost of Noctua fans. If the switches were going to be used in a 24×7 production network, then better quality fans would make more sense. These switches are for a development lab and only powered on when needed.
Modification
I compared the fans on the switch that still had it’s original fans to those that I had repaired previously. All of the fans were installed the same way, sucking air out of the case. I have always been doubtful of the manufacturer’s choice to install them this way, so I decided to install the replacement fans blowing air onto the heatsinks instead. I am hoping that this will keep the case temperatures lower and make the fans last longer.
The new fans have all been installed and are still quiet. Only time will tell if I should have bought Noctua fans. So far, I am happy with my cheap repair.
A Future Project
The next project for these switches is to replace the awful configuration web app and equally awful text mode configuration. The older FSM726 switch had an easy to use terminal interface for setup. I still have a couple of them and it is far quicker to set one of these up over a serial terminal.
I am considering setting up a bastion host with SSH2 access over Ethernet and RS232C serial to the switch console port. I could create my own text mode interface that mimics the FSM726 which runs the appropriate sequence of commands on the switch to make the required changes. Alternatively, this could be a web app or an Ansible module. My Ansible controller could become the bastion host with the addition of a few more serial ports.
Originally written in 2018. This post was languishing in drafts for a couple of years. I may complete it someday.
I acquired three old Netgear GSM7224 switches for my lab network some time ago and I pulled them off the shelf recently to use in a project I am currently working on. I wish I had actually checked them out fully when I first acquired them because it has cost me a week or so in time to get them useable in a reasonably secure test network. I did not anticipate the problems getting older high-end Netgear products to work securely in a network environment with up to date patched hosts.
Netgear GSM7224 installed in test lab
If you are trying to make use of ageing Netgear GSM7224 Gigabit Ethernet Managed Switches you may find this article useful. Some of this may even be relevant to other network equipment running similar firmware Eg. Sun Netra.
Observations
I spent a little time getting familiar with one of the switches on my bench. I used a laptop running Ubuntu 18.04 with a USB Serial adapter and a 9-pin null modem serial cable connected to the switch’s console port on the front panel. As these were second hand switches I didn’t have knowledge of the existing admin password. Resetting the password was at the top of the task list but until then it was time to do some basic surveilance on the switch using nmap. These are my initial observations.
Noisy or failed fans
Slow start-up time
Old firmware. The latest 2007 version is still available for download
Log files are time and dated from 1 Jan 1970 at start-up
Awful Netgear documentation, lots of critical configuration information undocumented
Telnet running on tcp 23
No SSH v2 access
Unencrypted web management interface on tcp 80
No HTTPS for web interface
Mysterious tcp 4242 port listening
Web Management prompts for Java plugin but 2018 browsers are not able to run Java applets
Objectives
Reset passwords on all switch login accounts
Replace fans with new parts
Document out of band command line management via the serial console
Upgrade firmware to latest version
Fix the time stamps in the log files
Fix the Java plugin requirement
Configure in-band management only from the management VLAN 1 with no internet access
Enable SSH v1 safely via a bastion host running SSH v2
Enable HTTPS web interface only over management VLAN
Disable less secure management interfaces, telnet and unencrypted web management
Enable remote syslog
Enable SNMP
Tools and Equipment Required
Netgear GSM7224
The latest firmware for the switch. At the time of writing this was 6.2.0.14
Laptop or desktop computer that has a terminal emulator.
Oracle VirtualBox to host an old distro that has an SSH v1 client or a Windows PC with PuTTY.
CD-ROM or ISO image file for an old 32-bit Linux or FreeBSD distribution that was released between 2006 and 2007. This is primarily for using OpenSSL and OpenSSH from this period to fully configure the switch. I used Ubuntu 6.06 LTS x86 as this was still downloadable in 2018
9-pin serial null modem cable.
USB to Serial adapter if your computer does not have a native serial port.
VT100 terminal emulation program that can connect to the switch’s console session via your serial connection. I used Minicom that was installable from the Ubuntu repos.
A compatible Java Plugin for a web browser that shipped with your 2006 Linux distro. If you want to try the Java applet function in the switch’s web interface
Wireshark if you want or need to decode further the SSH protocol between your switch and ssh clients
Replace the Noisy Fans
All three of my switches had noisy fans. Each has two 40x40x10mm 5VDC 2-pin fans inside and one in each had partially seized which was causing a lot of noise.
Opening the case was just a bit of screwdriver work to remove the rack mounting ears and then the screws holding the case together. All of the externally visible screws have to be removed to open the case. The cover slides off rearwards with a slight upward tilt. Once inside I could see the fans that need replacing.
I opted for cheap replacement fans sourced from eBay but I probably should have put more thought into that decision at the time. Within a few months the replacement fans started getting noisy.
I wish I had documented the fan replacement fully as I am going to use one of these switches again in November 2024. I originally installed brass inserts into the plastic housings of the 40mm fans to enable them to attached with screws to the chassis. I am guessing that the inserts are M3 thread and approximately 4mm deep. I have ordered some more for another set of new fans.
Gain Console Access
I connected a 9-pin null modem serial cable that I use for console access to the switch and to a USB serial adapter plugged into my laptop.
I use Minicom as a terminal emulator to access my switch consoles. Ctrl-A in Minicom gains access to its configuration menu. The connection was configured for /dev/ttyUSB0 at 9600,n,8,1. After saving the settings the switch console login prompt appeared.
My Netgear switches were all purchased used without documentation or being reset to factory defaults. I tried logging in as admin with various popular passwords without luck. Fortunately, rebooting the switches with Minicom still connected and running reveals a boot menu. Select option 2 to access a configuration menu. From here the switch can be reset to factory defaults without needing a password.
Update Firmware
I downloaded the ‘latest’ firmware from Netgear and setup a TFTP server on my laptop to serve the new firmware image. The firmware’s README describes the process to upgrade and although it takes a while silently updating there is eventually some confirmation on screen and the job is done.
I was having problem getting the SNTP client to synchronise time with the NTP servers that I had specified to use. That was until I tried this configuration command that worked…
(GSM7224) (config)# sntp client mode unicast
I also had some problems getting recent SSH clients to work. PuTTY on a Windows machine was useful as is still support SSH v1.
Port scanning the switch revealed that tcp 4242 appears to be used by the switch’s Java client interface. As I am not using the Java client it can be closed using:
