Login failure after datetime set

[whodis_new_acct]

hello. I am running two JG336A HP5900's (Comware 7)  in IRF configuration. All was well until I implemented NTP. NTP Server (Stratum 1) is connected directly to HP5900. HP5900 becomes Stratum 2, which will serve time to attached servers.  After activating this feature, when the console admin acct times out I attempt to log back in but receive this error:

Failed to log in because the idle timer expired. Login Failed.

I can pull the power from the switches, allow reboot, and can log in again. Current time now shows 00:00:00 1/1/2011. I change datetime to current. In 10-15 min, it times out and I have the same problem.  I upgraded the software to the latest version available, last week. 2432P03. Problem returned.

So I disabled NTP. saved config. rebooted. Time was reset to 00:00:00 1/1/2011.  in 10-15 min after the login timeout, I am able to log back in, time out, log back in, without fail....

BUT if I change the time back to current, and wait for my timeout period to kick me out, I cannot log in again. I get the original error I posted above.

I am running FIPS mode.

I am not in the native vlan, but all devices including the NTP server which is connected directly to the switch, are all in the same /24 subnet. .. (i.e all servers, my iLo switch, everything connected to this IRF configured switch is in the same vlan and in the same /24 subnet.)

I cannot continue to reboot my switches every time i need to log into the console.

ssh fails too. tried that already. here is my config.sys... It has been sanitized.

Also, I want to be very clear in what I am requesting because I have seen several people asking about this sort of thing but no one seems to have an answer. My main concern at this moment is that there is a timeout occuring and I cannot log into the switch after the timeout occurs. I need to find a fix. Ultimately, after that is fixed, I need to make sure that my NTP settings are right. x.x.x.x is the ip assigned to my stratum 1 ntp server which is directly connected to the switch. in the same vlan and the same /24 network as everything else in the network. This is a stand-alone dev environment, but it will be the model for identical production system. The switch will be Stratum 2 and the servers that are connected via lacp will pull ntp time from the switch. I dont want the servers pulling time directly from the directly connected ntp server.  Thats the end goal.. but right now, I need to find an answer on my login failure problem.  Any help is appreciated.  Also if you have other questions, please post and I will do my best to answer quickly. Thanks in advance.

Also I will note that as you view this config, each server has four 10G ports which connect to 2 respective ports per physical 5900 switch, BAGG/LACP to create 40G bandwidth connections to the servers.

***UPDATE: The problem occured with2422P01 after configuring NTP. As mentioned above, I disabled NTP, updated the software to 2432P03; I have followed other advice from other similar posts: removed admin account, re-added. Created new (2nd) admin account, and the problem continues. Also if I manually logout, if the time is correct, I get the idle timer login failure on both accounts. If I keep the default 01/01/2011 after hard reboot, login functions properly after timeout or after manual logout.

#

 version 7.1.045, Release 2432P03

#

 sysname switch1

#

 clock timezone UTC add 00:00:00

 clock protocol none

#

 irf domain 1

 irf mac-address persistent timer

 irf auto-update enable

 undo irf link-delay

 irf member 1 priority 32

 irf member 2 priority 1

 irf mode normal

#

 tcp syn-cookie enable

 tcp timer syn-timeout 10

#

 ip unreachables enable

 ip ttl-expires enable

#

 lldp global enable

#

 interface range name ALL_10G_DOWNLINKS interface Ten-GigabitEthernet1/0/1 to Ten-GigabitEthernet1/0/44

 interface range name ALL_10G_DOWNLINKS_2 interface Ten-GigabitEthernet2/0/1 to Ten-GigabitEthernet2/0/44

 interface range name IRF_PORTS interface Ten-GigabitEthernet1/0/45 to Ten-GigabitEthernet1/0/48

 interface range name IRF_PORTS_2 interface Ten-GigabitEthernet2/0/45 to Ten-GigabitEthernet2/0/48

#

 system-working-mode standard

 password-recovery enable

#

vlan 1

#

vlan 101

#

irf-port 1/1

 port group interface Ten-GigabitEthernet1/0/45

 port group interface Ten-GigabitEthernet1/0/46

 port group interface Ten-GigabitEthernet1/0/47

 port group interface Ten-GigabitEthernet1/0/48

#

irf-port 2/2

 port group interface Ten-GigabitEthernet2/0/45

 port group interface Ten-GigabitEthernet2/0/46

 port group interface Ten-GigabitEthernet2/0/47

 port group interface Ten-GigabitEthernet2/0/48

#

 stp global enable

#

interface Bridge-Aggregation1

  link-aggregation mode dynamic

#

interface Bridge-Aggregation2

  link-aggregation mode dynamic

#

interface Bridge-Aggregation3

  link-aggregation mode dynamic

#

interface Bridge-Aggregation4

 link-aggregation mode dynamic

#

interface Bridge-Aggregation5
 link-aggregation mode dynamic
 
#

interface Bridge-Aggregation6

 

 link-aggregation mode dynamic

#

interface Bridge-Aggregation7

 

 link-aggregation mode dynamic

#

interface Bridge-Aggregation8

 

 link-aggregation mode dynamic

#

interface Bridge-Aggregation9

 

 link-aggregation mode dynamic

#

interface Bridge-Aggregation10

 

 link-aggregation mode dynamic

#

interface Bridge-Aggregation11

 

 link-aggregation mode dynamic

#

interface NULL0

#

interface Vlan-interface1

#

interface Vlan-interface101

 ip address x.x.x.x 255.255.255.0

#

interface FortyGigE1/0/49

 port link-mode bridge

#

interface FortyGigE1/0/50

 port link-mode bridge

#

interface FortyGigE1/0/51

 port link-mode bridge

#

interface FortyGigE1/0/52

 port link-mode bridge

#

interface FortyGigE2/0/49

 port link-mode bridge

#

interface FortyGigE2/0/50

 port link-mode bridge

#

interface FortyGigE2/0/51

 port link-mode bridge

#

interface FortyGigE2/0/52

 port link-mode bridge

#

interface M-GigabitEthernet0/0/0

#

interface Ten-GigabitEthernet1/0/1

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 1

#

interface Ten-GigabitEthernet1/0/2

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 1

#

interface Ten-GigabitEthernet1/0/3

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 2

#

interface Ten-GigabitEthernet1/0/4

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 2

#

interface Ten-GigabitEthernet1/0/5

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 3

#

interface Ten-GigabitEthernet1/0/6

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 3

#

interface Ten-GigabitEthernet1/0/7

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 4

#

interface Ten-GigabitEthernet1/0/8

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 4

#

interface Ten-GigabitEthernet1/0/9

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 5

#

interface Ten-GigabitEthernet1/0/10

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 5

#

interface Ten-GigabitEthernet1/0/11

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 6

#

interface Ten-GigabitEthernet1/0/12

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 6

#

interface Ten-GigabitEthernet1/0/13

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 7

#

interface Ten-GigabitEthernet1/0/14

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 7

#

interface Ten-GigabitEthernet1/0/15

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 8

#

interface Ten-GigabitEthernet1/0/16

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 8

#

interface Ten-GigabitEthernet1/0/17

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 9

#

interface Ten-GigabitEthernet1/0/18

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 9

#

interface Ten-GigabitEthernet1/0/19

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 10

#

interface Ten-GigabitEthernet1/0/20

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 10

#

interface Ten-GigabitEthernet1/0/21

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 11

#

interface Ten-GigabitEthernet1/0/22

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 11

#

interface Ten-GigabitEthernet1/0/23

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/24

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/25

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/26

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/27

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/28

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/29

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/30

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/31

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/32

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/33

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/34

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/35

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/36

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/37

 port link-mode bridge

 port access vlan 101

 speed 10000

#

interface Ten-GigabitEthernet1/0/38

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/39

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/40

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/41

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/42

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/43

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/44

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan 1 101

 speed 1000

 duplex full

#

interface Ten-GigabitEthernet2/0/1

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 1

#

interface Ten-GigabitEthernet2/0/2

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 1

#

interface Ten-GigabitEthernet2/0/3

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 2

#

interface Ten-GigabitEthernet2/0/4

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 2

#

interface Ten-GigabitEthernet2/0/5

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 3

#

interface Ten-GigabitEthernet2/0/6

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 3

#

interface Ten-GigabitEthernet2/0/7

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 4

#

interface Ten-GigabitEthernet2/0/8

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 4

#

interface Ten-GigabitEthernet2/0/9

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 5

#

interface Ten-GigabitEthernet2/0/10

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 5

#

interface Ten-GigabitEthernet2/0/11

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 6

#

interface Ten-GigabitEthernet2/0/12

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 6

#

interface Ten-GigabitEthernet2/0/13

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 7

#

interface Ten-GigabitEthernet2/0/14

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 7

#

interface Ten-GigabitEthernet2/0/15

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 8

#

interface Ten-GigabitEthernet2/0/16

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 8

#

interface Ten-GigabitEthernet2/0/17

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 9

#

interface Ten-GigabitEthernet2/0/18

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 9

#

interface Ten-GigabitEthernet2/0/19

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 10

#

interface Ten-GigabitEthernet2/0/20

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 10

#

interface Ten-GigabitEthernet2/0/21

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 11

#

interface Ten-GigabitEthernet2/0/22

 port link-mode bridge

 port access vlan 101

 port link-aggregation group 11

#

interface Ten-GigabitEthernet2/0/23

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/24

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/25

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/26

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/27

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/28

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/29

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/30

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/31

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/32

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/33

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/34

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/35

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/36

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/37

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/38

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/39

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/40

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/41

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/42

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/43

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet2/0/44

 port link-mode bridge

 port access vlan 101

#

interface Ten-GigabitEthernet1/0/45

#

interface Ten-GigabitEthernet1/0/46

#

interface Ten-GigabitEthernet1/0/47

#

interface Ten-GigabitEthernet1/0/48

#

interface Ten-GigabitEthernet2/0/45

#

interface Ten-GigabitEthernet2/0/46

#

interface Ten-GigabitEthernet2/0/47

#

interface Ten-GigabitEthernet2/0/48

#

 scheduler logfile size 16

#

line class aux

#

line class vty

#

line aux 0 1

#

line vty 0 63

#

 ssh server enable

 sftp server enable

#

 ntp-service enable

 ntp-service source Vlan-interface101

 ntp-service refclock-master 2

 ntp-service refclock-master 127.127.1.1 2

 ntp-service unicast-server x.x.x.x

#

 header legal %
sanitized header%

#

 password-control aging 60

 password-control composition type-number 4 type-length 4

 password-control history 5

 password-control super composition type-number 4 type-length 4

#

radius scheme system

 user-name-format without-domain

#

domain system

#

 domain default enable system

#

role name level-0

 description Predefined level-0 role

#

role name level-1

 description Predefined level-1 role

#

role name level-2

 description Predefined level-2 role

#

role name level-3

 description Predefined level-3 role

#

role name level-4

 description Predefined level-4 role

#

role name level-5

 description Predefined level-5 role

#

role name level-6

 description Predefined level-6 role

#

role name level-7

 description Predefined level-7 role

#

role name level-8

 description Predefined level-8 role

#

role name level-9

 description Predefined level-9 role

#

role name level-10

 description Predefined level-10 role

#

role name level-11

 description Predefined level-11 role

#

role name level-12

 description Predefined level-12 role

#

role name level-13

 description Predefined level-13 role

#

role name level-14

 description Predefined level-14 role

#

user-group system

#

local-user USERNAME class manage

 service-type ssh terminal

 authorization-attribute user-role network-admin

 authorization-attribute user-role network-operator

#

 fips mode enable

#

return

[pattap]

I wish I could answer but so far I'm having very similar problem on 3600 switches 

[LucasSilva]

I had the same problem with an HPE 5510 HI switch. What happened in my case is that with password-control enabled, the "Maximum account idle time" function is activated by default, with a value of 90 days. After this period, the account becomes invalid, giving the message "Failed to log in because the idle timer expired" when trying to log in. To disable this behavior, enter the System view and use the command: password-control login idle-time 0.