Huawei S5720-LI: Upgrade Path to the next major release

Topology deep dive: where the S5720-LI sits in the network

My typical Huawei S5720-LI series access switch deployment in the BSNL state-data-centre floor runs forty-eight 1GE access ports per switch, stacked five high using iStack on 10G SFP+ uplinks. The stack faces a pair of S12700E core chassis upstream via 2x10G LACP, and downstream the access ports trunk voice (Airtel SIP), data (Reliance Jio backhaul), and PoE+ for surveillance. iStack master is locked to the bottom unit because the top of the rack moves more often during cabling churn, and you do not want a master re-election every time someone reseats an SFP+.

The Layer 2 / lite-L3 access switch (24 or 48 GE + 4 SFP+) role matters because the failure-impact blast radius scales with it. A floor-closet outage on a S5720-LI is annoying. A core-aggregation outage on the same S5720-LI family takes down a BFSI trading desk for the minutes it takes to RMA. I price the spare accordingly: cold spare for access, hot spare on a maintenance contract for core.

Cabling note that bites people: VRP labels physical ports as 10GE1/0/1 on a fixed switch and 10GE2/0/0/1 on a chassis (slot/sub-slot/card/port). When you copy a config between platforms, the interface namespace breaks silently. I keep a `sed` script in my git repo that translates between the two forms for exactly this reason.

Configuration walkthrough on VRP

The controlled-upgrade pattern I use on a S5720-LI runs in five blocks that map cleanly to a maintenance window:

1. Capture the current state with display version, display startup, display patch-information, and display device. Save to a timestamped file: save logfile followed by an FTP push to the jump host.
2. Stage the new image on flash. From system-view: startup system-software V200R023C00SPC500.cc next. Confirm with display startup that the next-boot row updated.
3. Stage the patch hot-fix (if any): install-module slot 1 file flash:/V200R022SPH032.PAT and patch load all run.
4. Schedule the reload: schedule reboot at 01:30 2026/06/15 so it fires inside the window even if the SSH session is killed by Airtel MPLS flapping.
5. Post-reboot, verify with display version, run an ICMP sweep from the NMS, and only then run delete startup-saved-configuration backup.

If the upgrade goes sideways, the rollback is one line on each MPU: startup system-software flash:/V200R021C00SPC500.cc and reboot. Keep the previous image on flash for at least two maintenance windows; do not garbage-collect it on day one.

Troubleshooting commands by platform layer

The shortest path from symptom to root cause on a S5720-LI is to start at the highest layer that still reports clean and walk down. I keep this command bundle in a saved tmux paste-buffer:

display version
display device
display device pic-status
display environment
display fan
display power
display memory-usage
display cpu-usage
display logbuffer | include WARN|ERR|FAULT
display alarm active
display diagnostic-information

The Huawei error format I look for is %%01IFNET/4/IF_STATE, %%01DEVM/2/BOARD_REMOVE, or the dreaded %%01SYSTEM/1/HARDWAREFAULT. Those numeric prefixes are stable across VRP V200 releases; my Splunk parser keys off them.

For port-layer faults specifically, the trio that almost always tells the story is:

display interface brief
display interface 10GE1/0/24
display transceiver interface 10GE1/0/24 verbose
display port vlan
display elabel slot 1

The display elabel output gives you the line card's BOM number, serial, and Huawei-side manufacture date. That is the field the TAC engineer always asks for on a hardware case, so capture it before you have to call.

For chassis or stack issues, layer in display stack, display stack peers, display mad detail, and display switching-frame-utilization. The MAD (Multi-Active Detection) output tells you whether a stack split has happened or is at risk.

India compliance and deployment notes

If your Huawei S5720-LI series access switch sits in an Indian regulated environment, three rule-sets apply regardless of vendor:

• MeitY procurement guidance: Huawei kit is permitted for non-strategic enterprise use but excluded from some Trusted Telecom Portal categories. Check whether your circuit is classified under the trusted-source list before procurement, especially for BSNL/MTNL backbone roles.
• DPDP Act 2026 alignment: Logs from S5720-LI units carrying user-attributable IPs (PoE phones, BYOD laptops) count as personal data under the DPDP definition. Push to a central SIEM that has data-localisation guarantees; do not stream telemetry to a Huawei eSight tenant hosted outside India unless the data-residency clause is in the BoQ.
• TEC certification: The SKUs commonly bid on GeM carry TEC GR numbers (TEC/GR/IT/SWP-016/06 for L2/L3 switches). Match the GR number against the device's elabel when you receive shipment; mismatched grey-market units have shown up in tier-2 city tenders.

Pricing reality from my last three procurements: list price on the Huawei Enterprise India catalogue ran 35-45 percent higher than the closing tender price; expect tender discounting around INR 78,000-1.45 lakh per unit on GeM tender (24-port vs 48-port, PoE+ vs non-PoE). CarePack AMC: budget INR 9,500 / year for 8x5xNBD; INR 17,200 / year for 24x7x4-hour. Spares retention rule of thumb for BFSI: one cold MPU per ten chassis, one hot fan tray per rack.

For STQC labs, RBI-regulated banks, and SEBI-supervised stock exchanges (NSE colo at BKC, BSE colo at PJ Towers), the deployment must also satisfy the cyber-resilience framework: change-control logged in an immutable store, vulnerability bulletins tracked against the Huawei PSIRT feed, and quarterly recovery drills documented. The S5720-LI integrates with Huawei iMaster NCE for those, but most BFSI teams I work with run Solarwinds or a home-grown Ansible-driven setup because procurement of iMaster carries its own approval cycle.

A real-world deployment I ran

Last quarter I ran a controlled V200R021 → V200R022 upgrade on twelve S5720-LI units across a BSNL state-data-centre user floor in Pune and a Reliance Jio NOC stack in Navi Mumbai. The plan was three batches over three weekends. Batch one went textbook. Batch two had a single unit that booted into the new image but lost its OSPF adjacency to the upstream router for 47 seconds during MPU sync, long enough that the BFSI VoIP team paged me at 02:08. Root cause: graceful-restart-helper was disabled on the upstream Cisco ASR. After the upstream change went in, batch three completed without a single adjacency drop. The lesson I pinned to the runbook: every controlled VRP upgrade now includes an upstream-peer feature audit as a precondition, not a recovery step.

Two patterns I extracted from that incident and now bake into every S5720-LI runbook: (1) every reload, controlled or panic, gets a logbuffer dump pushed to FTP before the reload runs, because the post-reload buffer rolls fast; (2) every TAC case opens with the elabel, the version, the patch list, and the last 200 lines of logbuffer attached, because the TAC engineer's first three questions are always the same. Saving them up front cuts the case time roughly in half.

Extended FAQs from real S5720-LI cases

Does VRP V200R023 break compatibility with V200R021 configurations?

No, the config grammar is forward-compatible within the V200 family. The migration scripts in Huawei's release notes call out a handful of deprecated knobs (legacy STP timers, old IS-IS authentication modes); review those before the cutover but a clean V200R021 config will parse on V200R023 without rewriting.

How long does the S5720-LI hold logs in the buffer before they roll?

Default logbuffer size is 1024 entries on the S5720-LI, which in a noisy access-layer environment can roll in under an hour. Bump it: info-center logbuffer size 4096. Always feed an external rsyslog regardless of buffer size; the buffer is a peek-window, not a system of record.

Can I run the S5720-LI without a Huawei CarePack contract?

Yes, but you lose access to firmware downloads, PSIRT advisory notifications, and TAC. For lab and non-revenue gear that is fine. For BFSI or telco production, the cost of CarePack is negligible against a single SLA breach.

What is the right SNMP / Telemetry mix for S5720-LI in 2026?

SNMPv3 for slow-changing inventory (boards present, serials, uptime). gRPC dial-out telemetry for fast counters (interface stats every 10 seconds, CPU and memory every 30). Run both; the SNMP feed is the inventory truth, the telemetry feed is the operational truth.

Will Huawei eSight or iMaster NCE work in an air-gapped Indian government network?

Yes. both ship as on-prem installable products. Procurement requires a separate license and the install footprint is non-trivial (multi-VM, separate Oracle or MySQL). For most enterprise users, a leaner stack of Grafana + InfluxDB + a Telegraf instance speaking gNMI to the S5720-LI solves the same monitoring requirement at a fraction of the licence cost.