Hiveless

I scored a couple of Aerohive HiveAP 330 WiFi access points from eBay for an agreeable price. I do not want to pay ongoing licensing fees to manage these systems. They should be usable without a connection to big brother.

First things

HiveAP 330 is a fairly cute little box, about 7in x 7in x 1.75in in size.

On the back can be found a console port (Cisco console cables work great!), two gigabit Ethernet ports (ETH0 (PoE enabled) and ETH1), a power connector, and a small reset pinhole.

Attaching the console cable, configuring Kermit for 9600-8-n-1 and no flow control, and powering the AP on, we're greeted with:

U-Boot 2009.11 (Mar 18 2014 - 16:01:33)

CPU0:  P1020E, Version: 1.1, (0x80ec0011)
Core:  E500, Version: 5.1, (0x80212051)
Clock Configuration:
       CPU0:533.333 MHz, CPU1:533.333 MHz, 
       CCB:266.667 MHz,
       DDR:266.667 MHz (533.333 MT/s data rate) (Asynchronous), LBC:16.667 MHz
L1:    D-cache 32 kB enabled
       I-cache 32 kB enabled
I2C:   ready
SPI:   ready
DRAM:  Configuring DDR for 533.333 MT/s data rate
DDR: 256 MB
FLASH: 64 MB
L2:    256 KB enabled
MMC:  

    PCIE2 connected to Slot 1 as Root Complex (base addr ffe09000)
               Scanning PCI bus 01
        01  00  168c  0030  0280  ff
    PCIE2 on bus 00 - 01 

    PCIE1 connected to Slot 2 as Root Complex (base addr ffe0a000)
               Scanning PCI bus 03
        03  00  168c  0030  0280  ff
    PCIE1 on bus 02 - 03

In:    serial
Out:   serial
Err:   serial
Net:   eth0, eth1
current temperature is 21
Hit any key to stop autoboot:  0 
Password:

some quick Googling has found the U-Boot bootloader password to be administrator. (Simple is good, right?)

hardware info

CPU is an Freescale Semiconductor embedded dual core PowerPC, running at 533MHz. There are 256Mibytes of RAM and 64Mbytes of Flash on the board.

poking around in the boot loader

The boot loader is U-Boot, a free software boot loader. Plenty of documentation to be found scattered across the interwebs about it, but start at its home site.

More than 3 seconds before boot

• Power on device
• Interrupt boot loader
• Enter boot loader password (administrator or AhNf?d@ta06)
• change the environment setting:

=> setenv bootdelay 15
=> printenv
=> saveenv
=> reset

Watching it boot, should see the 3 second autoboot timeout now be 15 seconds in length.

messing around in the HiveOS CLI

Unable to log in with the default HiveOS credentials? (admin/aerohive)? Wipe the AP's config by holding the Reset switch for 10 seconds. Here's a console transcript of that happening:

ap10-sf login: ******get interrppt from irq 47
gpio ier 800000, imr 800000
****this my gpio interrupt
[board]: Reset-button pressed!
[board]: Reset-button pressed!
[board]: Reset-button pressed!
[board]: Reset-button pressed!
[board]: Reset-button pressed!
[board]: Pressed reset-button over 5 seconds, restore the default factory configuration! 
[board]: Reset-button pressed!
[board]: Reset-button pressed!
[board]: Reset-button pressed!
[board]: Reset-button pressed!
[board]: Reset-button pressed!
Restarting system. 


U-Boot 2009.11 (Mar 18 2014 - 16:01:33)

CPU0:  P1020E, Version: 1.1, (0x80ec0011)
Core:  E500, Version: 5.1, (0x80212051)
Clock Configuration:
       CPU0:533.333 MHz, CPU1:533.333 MHz, 
       CCB:266.667 MHz,
       DDR:266.667 MHz (533.333 MT/s data rate) (Asynchronous), LBC:16.667 MHz
L1:    D-cache 32 kB enabled
       I-cache 32 kB enabled
I2C:   ready
SPI:   ready
DRAM:  Configuring DDR for 533.333 MT/s data rate
DDR: 256 MB
FLASH: 64 MB
L2:    256 KB enabled
MMC:  

    PCIE2 connected to Slot 1 as Root Complex (base addr ffe09000)
               Scanning PCI bus 01
        01  00  168c  0030  0280  ff
    PCIE2 on bus 00 - 01 

    PCIE1 connected to Slot 2 as Root Complex (base addr ffe0a000)
               Scanning PCI bus 03
        03  00  168c  0030  0280  ff
    PCIE1 on bus 02 - 03

In:    serial
Out:   serial
Err:   serial
Net:   eth0, eth1
current temperature is 39
Hit any key to stop autoboot:  0

HiveOS configuration

This looks quite similar to a Cisco IOS configuration. (Funny how that works.)

Power on the device (without a LAN attached) and watch it boot. If it manages to have an internet connection, it will phone home to the Aerohive mothership and will try to register itself. On the console, log in as admin with password aerohive. Welcome to Aerohive Product

AH-998580 login: admin
Password: 

Decline the offer of running the initial setup wizard.