Switch management that asks before it acts.
Switch Manager Pro backs up every AOS-S and AOS-CX switch each night, tells you when a config changed behind your back, and runs a change only after a person has read the exact commands.
No CLI to type.
Nothing sent you haven’t read.
A small agent on your network does the talking to your switches. The portal never builds commands and never reaches in — it asks, and the agent answers.
Ask
Pick the switches and the change — a VLAN, a port, PoE, a description. No CLI to type.
Plan
The agent on your network builds the exact commands for each switch’s OS, without connecting to it.
Approve
A person reads the commands and approves them. What you approve is what runs — nothing is rebuilt afterwards.
Apply & back up
The agent applies, saves only if the switch rejected nothing, and takes a fresh backup of the result.
The jobs you used to do in PuTTY,
with a record of every one.
Nightly config backups
Every switch backed up every night, encrypted at rest. Open any version, or compare it with any earlier one — not just last night’s.
Changed outside Switch Manager Pro
When a backup shows a change nobody made through the portal, you get an email naming the switch and the window. Someone consoled in on Friday? You’ll know on Saturday.
Put a switch back to any backup
Open a backup and restore it. The agent works out the commands from the switch as it is now, a person approves them, and they run under the switch’s own undo timer. It is saved only once it reads back as the backup, DHCP scopes included; otherwise it is put back as it was.
Bulk changes, one switch at a time
One change across a whole rack, released switch by switch. Each waits for the last to finish, and the run stops itself if too many fail.
Scheduled & recurring
Approve at lunchtime, run at 17:30. Or “PoE off every weekday at 18:00”, bound to the exact commands you approved — if they ever differ, it doesn’t run and it tells you.
Ports & PoE
Every port’s status, speed, VLAN and PoE draw in one table. Select ports, enable, disable, set PoE or describe them — all through the same approval.
Find a MAC address
Which port is this device on? The agent searches the MAC tables on site and returns only the line you asked for — the table itself never leaves your network.
Search every config
Find which switches still carry an old VLAN or SNMP setting, across the backups you already hold. No switch is contacted.
Access lists
See every access list on a switch; create, change and delete lists that aren’t applied; apply one to a VLAN, its routed traffic or a port, remove it, or change the entries of one that’s already applied — each approved first and run under the switch’s own undo timer. Applying to a trunk or LAG is in Beta.
Run show commands
Search the common show commands for each switch family, or type your own, and read the switch’s answer in your browser. Read-only: anything that would print the configuration, a password or a key is refused. An optional filter keeps just the lines you want before the answer leaves your network, and it is shown only to you, then deleted.
Open in PuTTY, logged in
With our installer on your PC, one click in the portal opens a session already logged in. The password never appears on a command line, and the switch’s host key is pinned.
Also included
- Switches found by sweeping a subnet from the agent, and added in one go
- A network map drawn from what your switches report over LLDP
- Optic light levels, and port errors flagged when they are rising
- A command guide showing the exact commands behind every read and change
- Day-zero profiles kept with your organisation
- Switch reports with CSV export
- Runs alongside WiFiAnchor on the same agent
See what you’re managing.
Before you change any of it.
Screens from Switch Manager Pro, shown with sample data from a fictional school. Click any of them to see it full size.
Every switch, drawn as it is
Each switch’s front panel, built from what the switch itself reports: link and PoE on every port, the optics fitted, plug-in modules, and the device found on each port over LLDP.
Network map
How your switches are cabled, drawn from what each one reports over LLDP. A device that isn’t one of your switches, like the firewall here, is marked as such.
Approve before it runs
The agent plans the exact commands for each switch’s OS. A person reads them and approves; what you approve is what runs, and the change says who asked for it.
Changed outside Switch Manager Pro
Each night’s backup is compared with the one before. Lines someone changed on the switch directly are picked out, and you get an email.
Firmware, one switch at a time
Update several switches from one image you upload. They go one at a time, each written to the bank it isn’t running from, and you can watch the image being sent and written.
DHCP on your core switch
Scopes on the switch you already have, with each scope’s range, lease time and how full it is right now.
Every port, in detail
Status, VLANs, PoE draw and what is plugged in, port by port, with the PoE power the switch has left.
Update every switch,
one restart at a time.
For AOS-S and AOS-CX. The agent on your network sends the image to each switch itself, so nobody has to be in the building with a laptop.
Your own image, checked twice
Upload the image you download from HPE. It’s checked before any switch sees it, and the agent on your network checks it again before sending it.
Written beside the running one
The image goes to the bank the switch isn’t running from and is read back before the switch is told to start from it. The old version stays as your way back, and nothing restarts until you choose.
Restarts one at a time
In a run, each switch has to come back running the new version before the next one restarts. If one doesn’t, the run stops and emails you, and the rest are left as they were.
Out of hours, without you
Start the run at a time you choose. School hours are checked again before each switch, and you can watch the progress as the image is sent and written.
Serve DHCP from your core switch,
not a Windows server.
For schools moving off an on-site server: your scopes live on the switch you already have, and you manage them here like everything else.
Everything a scope needs
Address ranges, options with presets, reservations and relay, per VLAN — on AOS-S and AOS-CX core switches. You can give a VLAN its own address first, which a layer-2 core needs before it can serve.
Know before it fills
How full each scope is now and at its busiest hour, and who holds a lease right now. Leases are read live when you look and never kept.
Changes you can read
Each change is described in plain English with what it will interrupt, and approved like any other. If the switch refuses part of it, the change is put back, and the DHCP server is never left switched off.
Bring your Windows scopes over
Choose the file Export-DhcpServer writes, or a DHCP console backup. It is read in your browser, and the scopes you pick become one change you approve, reservations and options included. Anything a switch cannot do, such as MAC filters, is listed rather than dropped quietly.
Made by people who’ve locked themselves out of a switch.
A network change at 10am is somebody’s lesson. So the defaults are the cautious ones, and the tool says no when it isn’t sure.
School hours are protected
Anything that can interrupt the network needs a recorded reason to run between 08:00 and 16:00 on a weekday. Scheduled runs are checked again at the moment they fire.
Late means cancelled, never “sent anyway”
A scheduled change that misses its slot by more than 30 minutes is cancelled with the reason recorded — it never lands in the middle of the next school day.
Refuses what hasn’t been proven
Every operation is reviewed per OS. Anything not yet verified on real hardware is marked Beta, and the agent refuses to send it until it is.
Passwords stay out of logs
Switch logins and secret values are stored encrypted and fetched by the agent once, for one command. They never sit in the command history.
The switch is the one you know
Each switch’s SSH host key is pinned on first contact. A different key is refused and flagged — not quietly trusted.
Every action is recorded
Who asked, who approved, what was sent and what the switch replied — kept against the change and in the audit log.
New switches on site, configured before you leave.
Works offline on site
Plug a laptop into new switches, find them, and give them a first-time configuration from a saved site profile — no internet needed.
Checks its own work
After configuring each switch it logs in again with the new admin password, so nothing is left with a login nobody can use.
Licensed by approval, not keys
Someone in your organisation approves the laptop from the portal. No licence key to share, and a leaver’s laptop is revoked in a click.
Every school you look after,
from one account.
Switch Manager Pro has a mode for the partners and technicians who run schools’ networks. Add each school as a site, manage all their switches from a single sign-in, and keep every engineer scoped to the sites they work on.
One account, every site
See and manage each school’s switches — its backups, DHCP, firmware and changes — from one sign-in. Add a new school within the allowance we agree, without waiting on us.
What needs looking at, estate-wide
One view across every site: agents gone quiet, switches that can’t be reached, changes waiting for approval, licences running down — worst first, each linking to the site it’s at.
Engineers scoped to their sites
Give each engineer only the sites they look after; viewers get read-only. Partner staff sign in with multi-factor every time, with no “remember this device”.
Seats you hand out
The offline installer’s seats are yours. Approve an engineer’s laptop from the portal, revoke a leaver’s in a click — no licence keys to pass around.
Alerts come to you
A site’s alerts — a backup changed outside Switch Manager Pro, a silent agent, a scope filling up — go to your team, not lost in a school inbox.
Agreed once, as the partner
We set each site’s switch limit and your installer seats with you, and you accept our terms and DPA once, as the partner, covering the schools whose switches you run.
Better with WiFiAnchorYour access points and your switches, in one place.
WiFiAnchor is our school WiFi platform — per-person sign-in with 802.1X and Passpoint, guest vouchers and KCSIE evidence, on HPE Aruba Networking and Ubiquiti UniFi. Run both and they share one agent and one portal.
Which switch port is each AP on?
See the switch and port every access point is plugged into. Confirmed when the AP announces itself over LLDP; otherwise worked out from the switches’ address tables and labelled as a best estimate — never a guess shown as fact.
PoE at a glance
Each switch’s power budget — used, available and remaining — and a drawn front panel showing which ports are up and powering a device.
Switches backed up every night
Switch configurations backed up nightly and compared, with an email when one changes outside the portal. Every change is shown as the exact commands and approved by a person before it runs.
One agent, one sign-in
Switch Manager Pro runs on the same on-site agent as WiFiAnchor and in the same portal — no second install, no second login, one audit trail.
The things IT teams ask first.
Something not here? Ask us — we’re a small UK team and we reply ourselves.
Which switches does it support?
HPE Aruba Networking switches running AOS-S or AOS-CX: the 2530, 2540, 2920, 2930F, 2930M, 3810M and 5400R series, and the CX 6000 to 8400 series. Each switch’s OS is identified automatically, and the commands are built for it.
Do we need to open a port on our firewall?
No. A small agent runs on a Windows machine on your network and connects out over HTTPS, so nothing on the internet needs to reach in. It talks to your switches over SSH from inside your network.
Where is our data?
In the UK and EU — the database and servers are in London. Switch configs are encrypted before they are stored. We don’t keep MAC or ARP tables, switch logs or SNMP output. If a show command you run prints one, the answer is held encrypted, shown only to you and deleted as it is shown; one not opened within ten minutes can no longer be read and is then deleted.
Can it change something without us knowing?
No. Every change is previewed as the exact commands and approved by a person before it runs, and recorded afterwards. The only unattended runs are schedules you approved, and they are refused if the commands ever differ.
Can it update switch firmware?
Yes, on AOS-S and AOS-CX. Upload the image you download from HPE; the agent writes it to the bank the switch isn’t running from, checks it, and sets it to start next time. Restarting is a separate step you choose: now, at a set time, or across several switches one at a time, each coming back on the new version before the next one restarts.
Can it put a switch back to an earlier config?
Yes. Pick any backup, and the agent works out the commands that change the switch back to it, from the switch as it is at that moment. You approve them like any change. They run under the switch’s own undo timer, and the switch is saved only once it reads back exactly as the backup. A restore never changes logins, passwords or keys, or how the switch is reached and managed, and a backup taken while the switch ran other software is refused.
Can our core switch take over from a Windows DHCP server?
That’s what our DHCP feature is for: scopes, reservations, options and relay on your AOS-S or AOS-CX core switch, with live leases and how full each scope gets. Your Windows scopes can be brought over from an Export-DhcpServer file or a DHCP console backup, approved as one change.
We’re an IT partner looking after several schools. Can we run them together?
Yes — Switch Manager Pro has a partner mode. Each school is a site under your account; you manage all their switches from one sign-in, scope each engineer to the sites they look after, and get one view of what needs attention across the estate. Installer seats are yours to approve and revoke. Tell us about your estate and we’ll set it up.
We already use WiFiAnchor. Is this separate?
It’s a separate product that lives in the same portal and uses the same agent. Buy either or both — with both, you can also see which switch port each access point is plugged into.
Questions about your switches? Ask us.
Tell us what you run and what you need. We’re a small UK team and reply ourselves, usually the same day.