Huawei S5720-LI: How to generate a compliance / drift report

Topology deep dive: where the S5720-LI sits in the network

My typical Huawei S5720-LI series access switch deployment in the BSNL state-data-centre floor runs forty-eight 1GE access ports per switch, stacked five high using iStack on 10G SFP+ uplinks. The stack faces a pair of S12700E core chassis upstream via 2x10G LACP, and downstream the access ports trunk voice (Airtel SIP), data (Reliance Jio backhaul), and PoE+ for surveillance. iStack master is locked to the bottom unit because the top of the rack moves more often during cabling churn, and you do not want a master re-election every time someone reseats an SFP+.

The Layer 2 / lite-L3 access switch (24 or 48 GE + 4 SFP+) role matters because the failure-impact blast radius scales with it. A floor-closet outage on a S5720-LI is annoying. A core-aggregation outage on the same S5720-LI family takes down a BFSI trading desk for the minutes it takes to RMA. I price the spare accordingly: cold spare for access, hot spare on a maintenance contract for core.

Cabling note that bites people: VRP labels physical ports as 10GE1/0/1 on a fixed switch and 10GE2/0/0/1 on a chassis (slot/sub-slot/card/port). When you copy a config between platforms, the interface namespace breaks silently. I keep a `sed` script in my git repo that translates between the two forms for exactly this reason.

Configuration walkthrough on VRP

For a fleet of S5720-LI units across three sites, I drive config from a Git repo with a CI runner that uses Netmiko's huawei_vrp driver. The key configuration choices on the device are:

system-view
 stelnet server enable
 ssh user automation authentication-type password
 ssh user automation service-type stelnet
 ssh user automation assign vrf management
 aaa
  local-user automation password irreversible-cipher [hash]
  local-user automation privilege level 15
  local-user automation service-type ssh
 #
 snmp-agent sys-info version v3
 snmp-agent group v3 ro-secure privacy
 snmp-agent usm-user v3 nmsro group ro-secure authentication-mode sha [hash] privacy-mode aes128 [hash]
quit

On the runner side, every push is a three-step pipeline: render with Jinja2, dry-run with display this, then commit with save. I never push directly to the running config; the diff goes through a `git diff --stat` review first. For the BFSI fleet, the runner refuses to touch a device if the last config-commit hash on the switch does not match the Git HEAD, which catches out-of-band changes some weekend admin made through the console.

Troubleshooting commands by platform layer

The shortest path from symptom to root cause on a S5720-LI is to start at the highest layer that still reports clean and walk down. I keep this command bundle in a saved tmux paste-buffer:

display version
display device
display device pic-status
display environment
display fan
display power
display memory-usage
display cpu-usage
display logbuffer | include WARN|ERR|FAULT
display alarm active
display diagnostic-information

The Huawei error format I look for is %%01IFNET/4/IF_STATE, %%01DEVM/2/BOARD_REMOVE, or the dreaded %%01SYSTEM/1/HARDWAREFAULT. Those numeric prefixes are stable across VRP V200 releases; my Splunk parser keys off them.

For port-layer faults specifically, the trio that almost always tells the story is:

display interface brief
display interface 10GE1/0/24
display transceiver interface 10GE1/0/24 verbose
display port vlan
display elabel slot 1

The display elabel output gives you the line card's BOM number, serial, and Huawei-side manufacture date. That is the field the TAC engineer always asks for on a hardware case, so capture it before you have to call.

For chassis or stack issues, layer in display stack, display stack peers, display mad detail, and display switching-frame-utilization. The MAD (Multi-Active Detection) output tells you whether a stack split has happened or is at risk.

India compliance and deployment notes

If your Huawei S5720-LI series access switch sits in an Indian regulated environment, three rule-sets apply regardless of vendor:

• MeitY procurement guidance: Huawei kit is permitted for non-strategic enterprise use but excluded from some Trusted Telecom Portal categories. Check whether your circuit is classified under the trusted-source list before procurement, especially for BSNL/MTNL backbone roles.
• DPDP Act 2026 alignment: Logs from S5720-LI units carrying user-attributable IPs (PoE phones, BYOD laptops) count as personal data under the DPDP definition. Push to a central SIEM that has data-localisation guarantees; do not stream telemetry to a Huawei eSight tenant hosted outside India unless the data-residency clause is in the BoQ.
• TEC certification: The SKUs commonly bid on GeM carry TEC GR numbers (TEC/GR/IT/SWP-016/06 for L2/L3 switches). Match the GR number against the device's elabel when you receive shipment; mismatched grey-market units have shown up in tier-2 city tenders.

Pricing reality from my last three procurements: list price on the Huawei Enterprise India catalogue ran 35-45 percent higher than the closing tender price; expect tender discounting around INR 78,000-1.45 lakh per unit on GeM tender (24-port vs 48-port, PoE+ vs non-PoE). CarePack AMC: budget INR 9,500 / year for 8x5xNBD; INR 17,200 / year for 24x7x4-hour. Spares retention rule of thumb for BFSI: one cold MPU per ten chassis, one hot fan tray per rack.

For STQC labs, RBI-regulated banks, and SEBI-supervised stock exchanges (NSE colo at BKC, BSE colo at PJ Towers), the deployment must also satisfy the cyber-resilience framework: change-control logged in an immutable store, vulnerability bulletins tracked against the Huawei PSIRT feed, and quarterly recovery drills documented. The S5720-LI integrates with Huawei iMaster NCE for those, but most BFSI teams I work with run Solarwinds or a home-grown Ansible-driven setup because procurement of iMaster carries its own approval cycle.

A real-world deployment I ran

At a BSNL state-data-centre user floor in Pune and a Reliance Jio NOC stack in Navi Mumbai, I wired up the Ansible run against thirty-eight S5720-LI switches in three days. The Python venv ran ansible-core 2.16 with the `community.network` collection. Inventory came from a Bengaluru-hosted NetBox behind Cloudflare, and the runner sat in the same colo so SSH RTT stayed under 6ms. First production change rolled a small VLAN-name standardisation across the fleet, 38 commits in 4 minutes 12 seconds, zero failures. The only gotcha: Huawei's VTY has a habit of dropping idle sessions before the connection-cleanup runs, and Ansible's default keepalive is too lazy. Setting connection_options.ssh_keepalive=30 in the host_vars file fixed it.

Two patterns I extracted from that incident and now bake into every S5720-LI runbook: (1) every reload, controlled or panic, gets a logbuffer dump pushed to FTP before the reload runs, because the post-reload buffer rolls fast; (2) every TAC case opens with the elabel, the version, the patch list, and the last 200 lines of logbuffer attached, because the TAC engineer's first three questions are always the same. Saving them up front cuts the case time roughly in half.

Extended FAQs from real S5720-LI cases

Does VRP V200R023 break compatibility with V200R021 configurations?

No, the config grammar is forward-compatible within the V200 family. The migration scripts in Huawei's release notes call out a handful of deprecated knobs (legacy STP timers, old IS-IS authentication modes); review those before the cutover but a clean V200R021 config will parse on V200R023 without rewriting.

How long does the S5720-LI hold logs in the buffer before they roll?

Default logbuffer size is 1024 entries on the S5720-LI, which in a noisy access-layer environment can roll in under an hour. Bump it: info-center logbuffer size 4096. Always feed an external rsyslog regardless of buffer size; the buffer is a peek-window, not a system of record.

Can I run the S5720-LI without a Huawei CarePack contract?

Yes, but you lose access to firmware downloads, PSIRT advisory notifications, and TAC. For lab and non-revenue gear that is fine. For BFSI or telco production, the cost of CarePack is negligible against a single SLA breach.

What is the right SNMP / Telemetry mix for S5720-LI in 2026?

SNMPv3 for slow-changing inventory (boards present, serials, uptime). gRPC dial-out telemetry for fast counters (interface stats every 10 seconds, CPU and memory every 30). Run both; the SNMP feed is the inventory truth, the telemetry feed is the operational truth.

Will Huawei eSight or iMaster NCE work in an air-gapped Indian government network?

Yes. both ship as on-prem installable products. Procurement requires a separate license and the install footprint is non-trivial (multi-VM, separate Oracle or MySQL). For most enterprise users, a leaner stack of Grafana + InfluxDB + a Telegraf instance speaking gNMI to the S5720-LI solves the same monitoring requirement at a fraction of the licence cost.