Why
Every morning I want to know the same things about the switch network: is everything up, did anything change overnight, is spanning tree still sane, and which port goes where. Clicking through web UIs one switch at a time is slow, and a full NMS is a lot to run for a few dozen switches. SwitchDesk reads the switches over plain SSH and keeps everything on your machine. It started with a few dozen switches and is used on networks of several hundred.
Features
Dashboard
Online and offline counts, a problem list sorted by severity, and every switch drawn as a faceplate with one LED per port. Green is up, grey is down, a slashed outline is disabled, amber means spanning tree is blocking it. The faceplates follow the hardware: copper, SFP and module ports sit in separate blocks, and each member of a stack gets its own row.
Problems it catches
| Area | Checks |
|---|
| Reachability | Switch offline, SSH login failing, SSH host key changed |
| Spanning tree | STP disabled, topology changes since last check, root picked by default priority, more than one root in the network |
| Security | Telnet on, plain HTTP management on, default SNMP community, no manager password, outdated SSH ciphers, failed login attempts, local user accounts changed |
| Port access | Port authentication with no RADIUS server, 802.1X set on ports but off for the switch |
| Management | No NTP, no syslog, no time zone, local accounts only, unsaved config, wrong clock (Instant On) |
| Hardware | Fan, power supply and temperature faults, stack members missing, broken stack ring, high CPU or memory |
| Optics | SFP/QSFP receive power out of range, against the optic's own levels (AOS-CX) or its recent alarms (AOS-S) |
| Logs | Major and error events in the recent log, ports flapping |
Every switch, in detail
System facts, a management-access checklist, spanning tree (bridge, root, port roles and states), ports with their configured names and optical levels for SFPs, VLANs, LLDP and CDP neighbors, logs, the running config, and the raw output of every command it ran. Config copies are saved whenever the config changes, and any two can be compared side by side. A console runs show, ping and traceroute, and nothing else.
Web opens a switch's own web interface in your browser. SSH opens it in your own terminal, or in the client you pick in Settings: PuTTY, MobaXterm, SecureCRT, Windows Terminal, iTerm2 and others, or a command of your own.
Clients finds where a device is plugged in: type a MAC address and get the switch and the edge port, with the uplinks along the path told apart from it.
VLANs without the CLI
Create, rename and delete VLANs, and set port membership by clicking ports through untagged, tagged and off. Before anything is sent you see the exact commands. Sending stops at the first line the switch rejects, and write memory only runs when every line before it went through.
A network-wide matrix shows which switch carries which VLAN and flags names that don't match between switches. From there you can rename, add or remove a VLAN on many switches at once, and review every switch's commands before anything is sent.
Port access (802.1X and MAC authentication)
On AOS-S and AOS-CX, add or remove RADIUS servers and turn 802.1X and MAC authentication on or off per port, with the client limit and re-authentication period. On AOS-S you pick the VLAN for clients that don't log in. On AOS-CX you create local roles with their VLAN and choose per port which role a client gets after a login, after a rejected login, while RADIUS can't be reached and before a login. AOS-CX also lists the connected clients from show port-access clients detail: port, MAC address, user, IP address, login method, status, role and the VLAN the client was put in, read at each collection or with Refresh. Ports that link to another switch or an access point are marked, and you're warned before turning on a login there. Shared secrets never appear on screen, in the command preview or in the transcript.
Languages
The interface comes in English and German so far, and every language is welcome. Translations are plain JSON files that anyone can write or fix without building anything: drop one into the data folder and pick it in Settings. See Translating SwitchDesk, and claim your language in #17. Even a half-finished file helps, since anything left empty stays in English.
Optional app password
Off by default. Turn it on in Settings and SwitchDesk asks for a password when it starts. The saved switch passwords can't be read without it, not even from the data folder. The window can also lock itself after some idle time.
Network map
Built from LLDP and CDP and laid out top-down from the spanning-tree root. Drag switches wherever you like and the layout is kept. Blocked links are dashed amber, down links red. Firewalls, access points and switches you don't manage get their own shapes. Phones and hosts stay hidden until you turn them on. Hover a switch to see port numbers on its links, double-click to open it.
Status checks
Between full reads, SwitchDesk checks that each switch is still up, and Settings decides how. By default it opens a TCP connection to port 22 and closes it straight away. That works over most VPN and zero trust setups, but the switch logs every check as an SSH connection, which fills the log on a busy network. Switch the check to ping and no SSH connections are made, as long as ICMP reaches the switches. Turn it off and a switch's status only changes when it's read. With the read interval at 0 as well, SwitchDesk connects only when you click Collect now.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
