The device provides multiple methods for entering the CLI, such as through the console port, through Telnet, and through SSH. For more information, see the chapter “Logging in to the CLI.”

Command conventions

Command conventions help you understand command meanings. Commands in product manuals comply with the conventions listed in Table 1.

Table 1 Command conventions

Convention	Description
Boldface	Bold text represents commands and keywords that you enter literally as shown.
Italic	Italic text represents arguments that you replace with actual values.
[ ]	Square brackets enclose syntax choices (keywords or arguments) that are optional.
{ x \| y \| ... }	Braces enclose a set of required syntax choices separated by vertical bars, from which you select one.
[ x \| y \| ... ]	Square brackets enclose a set of optional syntax choices separated by vertical bars, from which you select one or none.
{ x \| y \| ... } *	Asterisk marked braces enclose a set of required syntax choices separated by vertical bars, from which you select at least one.
[ x \| y \| ... ] *	Asterisk marked square brackets enclose optional syntax choices separated by vertical bars, from which you select one choice, multiple choices, or none.
&<1-n>	The argument or keyword and argument combination before the ampersand (&) sign can be entered 1 to n times.
#	A line that starts with a pound (#) sign is comments.

NOTE:

The keywords of command lines are case insensitive.

Take the clock datetime time date command as an example to understand the meaning of the command line parameters according to Table 1.

Figure 2 Understanding command line parameters

For example, you can type the following command line at the CLI of your device and press Enter to set the device system time to 10 o’clock 30 minutes 20 seconds, February 23, 2010.

<Sysname> clock datetime 10:30:20 2/23/2010

You can read any command that is more complicated according to Table 1.

Using the undo form of a command

The undo form of a command restores the default, disables a function, or removes a configuration.

Almost all configuration commands have an undo form. For example, the info-center enable command enables the information center, and the undo info-center enable command disables the information center.

CLI views

CLI view introduction

Commands are grouped into different classes by function. To use a command, you must enter the class view of the command.

CLI views adopt a hierarchical structure, as shown in Figure 3.

· After logging in to the switch, you are in user view. The prompt of user view is <device name>. In user view, you can perform display, debugging, and file management operations, set the system time, restart your device, and perform FTP and Telnet operations. To change the device name, use the sysname command. For information about this command, see Fundamentals Command Reference.

· You can enter system view from user view. In system view, you can configure parameters such as daylight saving time, banners, and short-cut keys.

· From system view, you can enter different function views. For example, enter interface view to configure interface parameters, create a VLAN and enter its view, enter user interface view to configure login user attributes, create a local user and enter local user view to configure the password and level of the local user.

NOTE:

Enter ? in any view to display all the commands that can be executed in this view.

Figure 3 Command line views

Entering system view

When you log in to the device, you automatically enter user view, where <device name> is displayed. You can perform limited operations in user view, for example, display operations, file operations, and Telnet operations. To perform further configuration for the device, enter system view.

To enter system view:

Task	Command	Remarks
Enter system view from user view.	system-view	Available in user view

Exiting the current view

The CLI is divided into different command views. Each view has a set of specific commands and defines the effective scope of the commands. The commands available to you at any given time depend on the view you are in.

To exit the current view:

Task	Command	Remarks
Return to the parent view from the current view.	quit	Available in any view.

NOTE:

· The quit command in user view terminates the current connection between the terminal and the device.

· In public key code view, use the public-key-code end command to return to the parent view (public key view). In public key view, use the peer-public-key end command to return to system view.

Returning to user view

This feature allows you to return to user view from any other view, without using the quit command repeatedly. You can also press Ctrl+Z to return to user view from the current view.

To exit to user view:

Task	Command	Remarks
Return to user view.	return	Available in any view except user view

Accessing the CLI online help

Enter a question mark (?) to access online help. See the following examples.

1. Enter ? in any view to display all commands available in this view and brief descriptions of these commands. For example:

<Sysname> ?

cfd Connectivity fault detection (IEEE 802.1ag)

display Display current system information

ping Ping function

quit Exit from current command view

ssh2 Establish a secure shell client connection

super Set the current user priority level

telnet Establish one TELNET connection

tracert Trace route function

…Part of the output omitted…

2. When you enter part of a command and a ? separated by a space.

If ? is at the position of a keyword, the CLI displays all possible keywords with a brief description for each keyword. For example:

<Sysname> terminal ?

debugging Send debug information to terminal

logging Send log information to terminal

monitor Send information output to current terminal

trapping Send trap information to terminal

If ? is at the position of an argument, the CLI displays a description about this argument. For example:

<Sysname> system-view

[Sysname] interface vlan-interface ?

<1-4094> VLAN interface number

[Sysname] interface vlan-interface 1 ?

<cr>

[Sysname] interface vlan-interface 1

The string <cr> indicates that the command is a complete command, and you can execute the command by pressing Enter.

3. If you enter an incomplete character string followed by a ?, the CLI displays all commands starting with the typed character(s).

<Sysname> f?

fdisk

fixdisk

format

free

ftp

<Sysname> display ftp?

ftp

ftp-server

ftp-user

Entering commands

Editing command lines

Table 2 lists some shortcut keys you can use to edit command lines.

Table 2 Editing functions

Key	Function
Common keys	If the edit buffer is not full, pressing a common key inserts the character at the position of the cursor and moves the cursor to the right.
Backspace	Deletes the character to the left of the cursor and moves the cursor back one character.
Left arrow key or Ctrl+B	The cursor moves one character space to the left.
Right arrow key or Ctrl+F	The cursor moves one character space to the right.
Tab	If you press Tab after entering part of a keyword, the system automatically completes the keyword: · If finding a unique match, the system substitutes the complete keyword for the incomplete one and displays it in the next line. · If there is more than one match, you can press Tab repeatedly to display in cycles all the keywords starting with the character string that you typed. · If there is no match, the system does not modify the incomplete keyword and displays it again in the next line.

Entering incomplete keywords

You can input a command comprising incomplete keywords that can uniquely identify the complete command.

In user view, for example, commands starting with an s include startup saved-configuration and system-view.

· To go to system view, enter sy.

· To set the configuration file to be used at the next startup, enter st s.

You can also press Tab to have an incomplete keyword automatically completed.

Configuring command keyword aliases

The command keyword alias function allows you to replace the first keyword of a non-undo command or the second keyword of an undo command with your preferred keyword. For example, if you configure show as the alias for the display keyword, you can enter show instead of display to execute a display command.

Configuration guide

· When you define a keyword alias, you must enter the cmdkey and alias arguments in their complete form.

· When you enter a keyword alias, the system displays and saves the keyword instead of its alias.

· When you press Tab after entering part of an alias, the keyword is displayed.

· If you enter a string that partially matches a keyword and an alias, the command indicated by the alias is executed. To execute the command indicated by the keyword, enter the complete keyword.

· When you enter a string that partially matches multiple aliases, the system gives you prompts.

· You can substitute an alias for only the first keyword of a non-undo command or the second keyword of an undo command.

Configuration procedure

To configure command keyword aliases:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable the command keyword alias function.	command-alias enable	By default, the command keyword alias function is disabled.
3. Configure a command keyword alias.	command-alias mapping cmdkey alias	Not configured by default.

Configuring CLI hotkeys

To configure CLI hotkeys:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Configure CLI hotkeys.	hotkey { CTRL_G \| CTRL_L \| CTRL_O \| CTRL_T \| CTRL_U } command	Optional. The Ctrl+G, Ctrl+L and Ctrl+O hotkeys are specified at the CLI by default.
3. Display hotkeys.	display hotkey [ \| { begin \| exclude \| include } regular-expression ]	Available in any view. See Table 3 for hotkeys reserved by the system.

NOTE:

By default, the Ctrl+G, Ctrl+L and Ctrl+O hotkeys are associated with pre-defined commands and the Ctrl+T and Ctrl+U hotkeys are not.

· Ctrl+G corresponds to the display current-configuration command.

· Ctrl+L corresponds to the display ip routing-table command.

· Ctrl+O corresponds to the undo debugging all command.

Table 3 Hotkeys reserved by the system

Hotkey	Function
Ctrl+A	Moves the cursor to the beginning of the current line.
Ctrl+B	Moves the cursor one character to the left.
Ctrl+C	Stops performing a command.
Ctrl+D	Deletes the character at the current cursor position.
Ctrl+E	Moves the cursor to the end of the current line.
Ctrl+F	Moves the cursor one character to the right.
Ctrl+H	Deletes the character to the left of the cursor.
Ctrl+K	Terminates an outgoing connection.
Ctrl+N	Displays the next command in the history command buffer.
Ctrl+P	Displays the previous command in the history command buffer.
Ctrl+R	Redisplays the current line information.
Ctrl+V	Pastes the content in the clipboard.
Ctrl+W	Deletes all the characters in a continuous string to the left of the cursor.
Ctrl+X	Deletes all the characters to the left of the cursor.
Ctrl+Y	Deletes all the characters to the right of the cursor.
Ctrl+Z	Exits to user view.
Ctrl+]	Terminates an incoming connection or a redirect connection.
Esc+B	Moves the cursor to the leading character of the continuous string to the left.
Esc+D	Deletes all the characters of the continuous string at the current cursor position and to the right of the cursor.
Esc+F	Moves the cursor to the front of the next continuous string to the right.
Esc+N	Moves the cursor down by one line (available before you press Enter)
Esc+P	Moves the cursor up by one line (available before you press Enter)
Esc+<	Specifies the cursor as the beginning of the clipboard.
Esc+>	Specifies the cursor as the ending of the clipboard.

NOTE:

The hotkeys in the table above are defined by the switch. If the same hotkeys are defined by the terminal software that you use to interact with the switch, the hotkeys defined by the terminal software take effect.

Enabling redisplaying of entered but not submitted commands

After you enable redisplaying of entered but not submitted commands:

· If you entered nothing at the command-line prompt before the system outputs system information such as logs, the system does not display the command-line prompt after the output.

· If you entered some information (except Yes or No for confirmation), the system displays a line break and then displays what you have entered after the output.

To enable redisplaying of entered but not submitted commands:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable redisplaying of entered but not submitted commands.	info-center synchronous	Disabled by default.

NOTE:

For more information about the info-center synchronous command, see Network Management and Monitoring Command Reference.

Understanding command-line errors

If a command line contains syntax errors, the CLI reports error messages. Table 4 lists some common command-line messages.

Table 4 Common command-line error messages

Error message	Cause
% Unrecognized command found at '^' position.	The command was not found.
% Incomplete command found at '^' position.	Incomplete command
% Ambiguous command found at '^' position.	Ambiguous command
Too many parameters	Too many parameters
% Wrong parameter found at '^' position.	Wrong parameters

Using the command history function

The CLI automatically saves the commands recently used in the history command buffer. You can access and execute them again.

Accessing history commands

Task	Command
Display history commands.	display history-command [ \| { begin \| exclude \| include } regular-expression ]
Display the previous history command.	Up arrow key or Ctrl+P
Display the next history command.	Down arrow key or Ctrl+N

NOTE:

You can use arrow keys to access history commands in Windows 200X and XP Terminal or Telnet. However, in Windows 9X HyperTerminal, you need to use Ctrl+P or Ctrl+N, because they are defined differently and the up and down arrow keys are invalid.

· The commands saved in the history command buffer are in the same format in which you typed the commands. If you enter an incomplete command, the command saved in the history command buffer is also incomplete.

· If you execute the same command repeatedly, the switch saves the earliest record. However, if you execute the same command in different formats, the system saves them as different commands. For example, if you execute the display cu command repeatedly, the system saves only one command in the history command buffer. If you execute the command in the format of display cu and display current-configuration respectively, the system saves them as two commands.

· By default, the CLI can save up to 10 commands for each user. To set the capacity of the history command buffer for the current user interface, use the history-command max-size command. (For more information about the history-command max-size command, see Fundamentals Command Reference.

Configuring the history buffer size

To configure the history buffer size:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter user interface view.	user-interface { first-num1 [ last-num1 ] \| { aux \| console \| tty \| vty } first-num2 [ last-num2 ] }	N/A
3. Set the maximum number of commands that can be saved in the history buffer.	history-command max-size size-value	Optional. By default, the history buffer can save up to 10 commands.

NOTE:

For more information about the user-interface and history-command max-size commands, see Fundamentals Command Reference.

Controlling the CLI output

Pausing between screens of output

If the output information is more than one screen, the system automatically pauses after displaying a screen. By default, up to 24 lines can be displayed on a screen. To change the screen length, use the screen-length command. For more information about the screen-length command, see Fundamentals Command Reference.

Keys for controlling output

Table 5 Keys for controlling output

Keys	Function
Space	Displays the next screen.
Enter	Displays the next line.
Ctrl+C	Stops the displaying and aborts the command execution.
<PageUp>	Displays the previous page.
<PageDown>	Displays the next page.

Disabling pausing between screens of output

Use the following command to disable pausing between screens of output for the current session. Then, all output information is displayed at one time and the screen is refreshed continuously until the last screen is displayed.

To disable pausing between screens of output for the current session:

Task	Command	Remarks
Disable pausing between screens of output for the current session.	screen-length disable	By default, a login user uses the settings of the screen-length command. The default settings of the screen-length command are: pausing between screens of output is enabled and up to 24 lines are displayed on the next screen. This command is executed in user view, and takes effect for the current session only. When you relogs into the switch, the default configuration is restored.

Task

Command

Remarks

Disable pausing between screens of output for the current session.

screen-length disable

By default, a login user uses the settings of the screen-length command. The default settings of the screen-length command are: pausing between screens of output is enabled and up to 24 lines are displayed on the next screen.

This command is executed in user view, and takes effect for the current session only. When you relogs into the switch, the default configuration is restored.

Filtering the output information of a display command

Introduction

You can filter output information of a display command by using the following methods:

· Following the display command, enter the begin, exclude, or include keyword plus a regular expression .

· When the system pauses after displaying a screen of output information, use /, - or + plus a regular expression to filter subsequent output information. / equals the keyword begin, - equals the keyword exclude, and + equals the keyword include.

The following definitions apply to the begin, exclude, and include keywords:

· begin—Displays the first line that matches the specified regular expression and all lines that follow.

· exclude—Displays all lines that do not match the specified regular expression.

· include—Displays all lines that match the specified regular expression.

A regular expression is a case-sensitive string of 1 to 256 characters, and supports some special characters.

Table 6 Special characters supported in a regular express

Character	Meaning	Remarks
^string	Starting sign. string appears only at the beginning of a line.	For example, regular expression “^user” only matches a string beginning with “user”, not “Auser”.
string$	Ending sign. string appears only at the end of a line.	For example, regular expression "user$” only matches a string ending with “user”, not “userA”.
.	Matches any single character, such as a single character, a special character, and a blank.	For example, “s” matches both “as” and “bs”.
*	Matches the preceding character or character group zero or multiple times.	For example, “zo” matches “z” and “zoo”; “(zo)” matches “zo” and “zozo”.
+	Matches the preceding character or character group one or multiple times	For example, “zo+” matches “zo” and “zoo”, but not “z”.
\|	Matches the preceding or succeeding character string	For example, “def\|int” only matches a character string containing “def” or “int”.
_	If it is at the beginning or the end of a regular expression, it equals ^ or $. In other cases, it equals comma, space, round bracket, or curly bracket.	For example, “a_b” matches “a b” or “a(b”; “_ab” only matches a line starting with “ab”; “ab_” only matches a line ending with “ab”.
-	It connects two values (the smaller one before it and the bigger one after it) to indicate a range together with [ ].	For example, “1-9” means 1 to 9 (inclusive); “a-h” means a to h (inclusive).
[ ]	Matches a single character contained within the brackets.	For example, [16A] matches a string containing any character among 1, 6, and A; [1-36A] matches a string containing any character among 1, 2, 3, 6, and A (- is a hyphen). “]” can be matched as a common character only when it is put at the beginning of characters within the brackets, for example [ ]string]. There is no such limit on “[”.
( )	A character group. It is usually used with “+” or “*”.	For example, (123A) means a character group “123A”; “408(12)+” matches 40812 or 408121212. But it does not match 408.
\index	Repeats the character string specified by the index. A character string refers to the string within () before \. index refers to the sequence number (starting from 1 from left to right) of the character group before \. If only one character group appears before \, index can only be 1; if n character groups appear before index, index can be any integer from 1 to n.	For example, (string)\1 repeats string, and a matching string must contain stringstring. (string1)(string2)\2 repeats string2, and a matching string must contain string1string2string2. (string1)(string2)\1\2 repeats string1 and string2 respectively, and a matching string must contain string1string2string1string2.
[^]	Matches a single character not contained within the brackets.	For example, [^16A] means to match a string containing any character except 1, 6 or A, and the matching string can also contain 1, 6 or A, but cannot contain these three characters only. For example, [^16A] matches “abc” and “m16”, but not 1, 16, or 16A.
\<string	Matches a character string starting with string.	For example, “\<do” matches word “domain” and string “doa”.
string\>	Matches a character string ending with string.	For example, “do\>” matches word “undo” and string “abcdo”.
\bcharacter2	Matches character1character2. character1 can be any character except number, letter or underline, and \b equals [^A-Za-z0-9_].	For example, “\ba” matches “-a” with “-“ being character1, and “a” being character2, but it does not match “2a” or “ba”.
\Bcharacter	Matches a string containing character, and no space is allowed before character.	For example, “\Bt” matches “t” in “install”, but not “t” in “big top”.
character1\w	Matches character1character2. character2 must be a number, letter, or underline, and \w equals [^A-Za-z0-9_].	For example, “v\w” matches “vlan”, with “v” being character1, and “l” being character2. v\w also matches “service”, with “i” being character2.
\W	Equals \b.	For example, “\Wa” matches “-a”, with “-” being character1, and “a” being character2, but does not match “2a” or “ba”.
\	Escape character. If a special character listed in this table follows \, the specific meaning of the character is removed.	For example, “\\” matches a string containing “\”, “\^” matches a string containing “^”, and “\\b” matches a string containing “\b”.

Output information filtering examples

1. Example for using the begin keyword

# Display the configuration from the line containing “user-interface” to the last line in the current configuration (the output information depends on the current configuration).

<Sysname> display current-configuration | begin user-interface

user-interface con 0

user-interface aux 0

user-interface vty 0 4

authentication-mode none

user privilege level 3

return

2. Example for using the exclude keyword

# Display the non-direct routes in the routing table (the output depends on the current configuration).

<Sysname> display ip routing-table | exclude Direct

Routing Tables: Public

Destination/Mask Proto Pre Cost NextHop Interface

1.1.1.0/24 Static 60 0 192.168.0.0 Vlan1

3. Example for using the include keyword

# Display the route entries that contain Vlan in the routing table (the output depends on the current configuration).

<Sysname> display ip routing-table | include Vlan

Routing Tables: Public

Destination/Mask Proto Pre Cost NextHop Interface

192.168.1.0/24 Direct 0 0 192.168.1.42 Vlan999

Configuring user privilege and command levels

Introduction

To avoid unauthorized access, the switch defines user privilege levels and command levels. User privilege levels correspond to command levels. When a user at a specific privilege level logs in, the user can only use commands at that level, or lower levels.

All the commands are categorized into four levels: visit, monitor, system, and manage, and are identified from low to high, respectively by 0 through 3. Table 7 describes the command levels.

Table 7 Default command levels

Level	Privilege	Description
0	Visit	Involves commands for network diagnosis and commands for accessing an external device. Configuration of commands at this level cannot survive a device restart. Upon device restart, the commands at this level will be restored to the default settings. Commands at this level include ping, tracert, telnet and ssh2.
1	Monitor	Involves commands for system maintenance and service fault diagnosis. Commands at this level are not saved after being configured. After the switch is restarted, the commands at this level will be restored to the default settings. Commands at this level include debugging, terminal, refresh, and send.
2	System	Provides service configuration commands, including routing configuration commands and commands for configuring services at different network levels. By default, commands at this level include all configuration commands except for those at manage level.
3	Manage	Involves commands that influence the basic operation of the system and commands for configuring system support modules. By default, commands at this level involve the configuration commands of file system, FTP, TFTP, Xmodem download, user management, level setting, and parameter settings within a system (which are not defined by any protocols or RFCs).

Configuring the user privilege level

A user privilege level can be configured by using AAA authentication parameters or under a user interface.

Configure the user privilege level by using AAA authentication parameters

If the authentication mode of a user interface is scheme, the user privilege level of users logging into the user interface is specified in AAA authentication configuration.

To configure the user privilege level by using AAA authentication parameters:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter user interface view.	user-interface { first-num1 [ last-num1 ] \| { aux \| console \| vty } first-num2 [ last-num2 ] }	N/A
3. Specify the scheme authentication mode.	authentication-mode scheme	By default, the authentication mode for VTY and AUX users is password, and no authentication is needed for console and TTY login users.
4. Return to system view.	quit	N/A
5. Configure the authentication mode for SSH users as password.	For more information, see Security Configuration Guide.	Required if users use SSH to log in, and username and password are needed at authentication.
6. Configure the user privilege level by using AAA authentication parameters.	· To use local authentication: a. Use the local-user command to create a local user and enter local user view. b. Use the level keyword in the authorization-attribute command to configure the user privilege level. · To use remote authentication (RADIUS, HWTACACS, or LDAP): Configure the user privilege level on the authentication server	User either approach. For local authentication, if you do not configure the user privilege level, the user privilege level is 0. For remote authentication, if you do not configure the user privilege level, the user privilege level depends on the default configuration of the authentication server.

Example for configuring the user privilege level by using AAA authentication parameters

# You are required to authenticate the users that telnet to the switch through VTY 1, verify their username and password, and specify the user privilege level as 3.

<Sysname> system-view

[Sysname] user-interface vty 1

[Sysname-ui-vty1] authentication-mode scheme

[Sysname-ui-vty1] quit

[Sysname] local-user test

[Sysname-luser-test] password cipher 12345678

[Sysname-luser-test] service-type telnet

When users telnet to the switch through VTY 1, they must enter username test and password 12345678. After passing the authentication, the users can only use the commands of level 0. If the users want to use commands of levels 0, 1, 2 and 3, the following configuration is required:

[Sysname-luser-test] authorization-attribute level 3

Configure the user privilege level under a user interface

· If the authentication mode of a user interface is scheme, and SSH publickey authentication type (only username is needed for this authentication type) is adopted, the user privilege level of users logging into the user interface is the user interface level.

· If the authentication mode of a user interface is none or password, the user privilege level of users logging into the user interface is the user interface level.

To configure the user privilege level under a user interface (SSH publickey authentication type):

Step	Command	Remarks
1. Configure the authentication type for SSH users as publickey.	For more information, see Security Configuration Guide.	Required if the SSH login mode is adopted, and only username is needed during authentication. After the configuration, the authentication mode of the corresponding user interface must be set to scheme.
2. Enter system view.	system-view	N/A
3. Enter user interface view.	user-interface { first-num1 [ last-num1 ] \| vty first-num2 [ last-num2 ] }	N/A
4. Configure the authentication mode for any user that uses the current user interface to log in to the switch.	authentication-mode scheme	By default, the authentication mode for VTY and AUX users is password, and no authentication is needed for console and TTY users.
5. Configure the privilege level for users that log in through the current user interface.	user privilege level level	Optional. By default, the user privilege level for users logged in through the console user interface is 3, and that for users logged in through the other user interfaces is 0.

To configure the user privilege level under a user interface (none or password authentication mode):

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter user interface view.	user-interface { first-num1 [ last-num1 ] \| { aux \| console \| tty \| vty } first-num2 [ last-num2 ] }	N/A
3. Configure the authentication mode for any user that uses the current user interface to log in to the switch.	authentication-mode { none \| password }	Optional. By default, the authentication mode for VTY and AUX user interfaces is password, and no authentication is needed for console and TTY login users.
4. Configure the privilege level of users logged in through the current user interface.	user privilege level level	Optional. By default, the user privilege level for users logged in through the console user interface is 3, and that for users logged in through the other user interfaces is 0.

Example for configuring the user privilege level under a user interface

# Display the commands that a Telnet user can use after login by default.

<Sysname> ?

User view commands:

display Display current system information

ping Ping function

quit Exit from current command view

ssh2 Establish a secure shell client connection

super Set the current user priority level

telnet Establish one TELNET connection

# Configure the switch to perform no authentication for Telnet users, and to authorize authenticated Telnet users to use the commands of privilege levels 0 and 1. (Use no authentication mode only in a secure network environment.)

<Sysname> system-view

[Sysname] user-interface vty 0 4

[Sysname-ui-vty0-4] authentication-mode none

[Sysname-ui-vty0-4] user privilege level 1

# Display the commands that a Telnet user can use after login. Because the user privilege level is 1, a Telnet user can use more commands now.

<Sysname> ?

User view commands:

debugging Enable system debugging functions

dialer Dialer disconnect

graceful-restart Graceful restart

ipc Interprocess communication

oap Open application platform operation

ping Ping function

quit Exit from current command view

refresh Do soft reset

reset Reset operation

screen-length Specify the lines displayed on one screen

send Send information to other user terminal interface

ssh2 Establish a secure shell client connection

super Set the current user priority level

telnet Establish one TELNET connection

terminal Set the terminal line characteristics

tracert Trace route function

undo Cancel current setting

# Configure the switch to perform password authentication for Telnet users, and to authorize authenticated Telnet users to use the commands of privilege levels 0, 1. and 2.

<Sysname> system-view

[Sysname] user-interface vty 0 4

[Sysname-ui-vty1] authentication-mode password

[Sysname-ui-vty0-4] set authentication password cipher 12345678

[Sysname-ui-vty0-4] user privilege level 2

After the configuration, when users telnet to the switch, they need to input the password 12345678. After passing authentication, they can use commands of levels 0, 1, and 2.

NOTE:

· For more information about user interfaces, see the chapter “Logging in to the CLI.” For more information about the user-interface, authentication-mode, and user privilege level commands, see Fundamentals Command Reference.

· For more information about AAA authentication, see Security Configuration Guide. For more information about the local-user and authorization-attribute commands, see Security Command Reference.

· For more information about SSH, see Security Configuration Guide.

Switching the user privilege level

Introduction

Users can switch to a different user privilege level temporarily without logging out and terminating the current connection. After the privilege level switching, users can continue to configure the switch without relogging in, but the commands that they can execute have changed. For example, if the current user privilege level is 3, the user can configure system parameters. After switching to user privilege level 0, the user can only execute simple commands, like ping and tracert, and only a few display commands. The switching operation is effective for the current login. After the user relogs in, the user privilege restores to the original level.

· To avoid problems, H3C recommends that administrators log in to the switch by using a lower privilege level and view switch operating parameters, and when they have to maintain the switch, they can switch to a higher level temporarily

· If the administrators need to leave for a while or ask someone else to manage the switch temporarily, they can switch to a lower privilege level before they leave to restrict the operation by others.

Setting the authentication mode for user privilege level switching

· A user can switch to a privilege level equal to or lower than the current one unconditionally and is not required to input a password (if any).

· For security, a user is required to input the password (if any) to switch to a higher privilege level. The authentication falls into one of the following four categories:

Authentication mode	Meaning	Description
local	Local password authentication	The switch authenticates a user by using the privilege level switching password input by the user. When this mode is applied, you need to set the password for privilege level switching with the super password command.
scheme	Remote AAA authentication through HWTACACS or RADIUS	The switch sends the username and password for privilege level switching to the HWTACACS or RADIUS server for remote authentication. When this mode is applied, you need to perform the following configurations: · Configure HWTACACS or RADIUS scheme and reference the created scheme in the ISP domain. For more information, see Security Configuration Guide. · Create the corresponding user and configure password on the HWTACACS or RADIUS server.
local scheme	Performs the local password authentication first and then the remote AAA authentication	The switch authenticates a user by using the local password first, and if no password for privilege level switching is set, for the user logged in from the console port, the privilege level is switched directly; for the user logged in from any of the AUX, TTY, or VTY user interfaces, the AAA authentication is performed.
scheme local	Performs remote AAA authentication first and then the local password authentication	AAA authentication is performed first, and if the remote HWTACACS or RADIUS server does not respond or AAA configuration on the switch is invalid, the local password authentication is performed.

To set the authentication mode for user privilege level switching:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set the authentication mode for user privilege level switching.	super authentication-mode { local \| scheme } *	Optional. local by default.
3. Configure the password for user privilege level switching.	super password [ level user-level ] { simple \| cipher } password	Required if the authentication mode is set to local (specify the local keyword when setting the authentication mode) By default, no privilege level switching password is configured.

CAUTION:

· If no user privilege level is specified when you configure the password for switching the user privilege level with the super password command, the user privilege level defaults to 3.

· If you specify the simple keyword, the password is saved in the configuration file in plain text, which is easy to be stolen. If you specify the cipher keyword, the password is saved in the configuration file in cipher text, which is safer.

· If the user logs in from the console user interface (the console port or the AUX port used as the console port), the privilege level can be switched to a higher level, although the authentication mode is local, and no user privilege level password is configured.

Switching the user privilege level

To switch the user privilege level:

Task	Command	Remarks
Switch the user privilege level.	super [ level ]	When logging in to the switch, a user has a user privilege level, which depends on user interface or authentication user level. Available in user view.

Task

Command

Remarks

Switch the user privilege level.

super [ level ]

When logging in to the switch, a user has a user privilege level, which depends on user interface or authentication user level.

Available in user view.

When you switch the user privilege level, the information you must provide varies with combinations of the user interface authentication mode and the super authentication mode.

Table 8 Information input for user privilege level switching

User interface authentication mode	User privilege level switching authentication mode	Information input for the first authentication mode	Information input after the authentication mode changes
none/password	local	Local user privilege level switching password (configured on the switch).	N/A
	local scheme	Local user privilege level switching password.	Username and password for privilege level switching (configured on the AAA server).
	scheme	Username and password for privilege level switching.	N/A
	scheme local	Username and password for privilege level switching.	Local user privilege level switching password.
scheme	local	Local user privilege level switching password.	N/A
	local scheme	Local user privilege level switching password.	Password for privilege level switching (configured on the AAA server). The system uses the username used for logging in as the privilege level switching username.
	scheme	Password for privilege level switching (configured on the AAA server). The system uses the username used for logging in as the privilege level switching username.	N/A
	scheme local	Password for privilege level switching (configured on the AAA server). The system uses the username used for logging in as the privilege level switching username.	Local user privilege level switching password.

CAUTION:

· When the authentication mode is set to local, configure the local password before switching to a higher user privilege level.

· When the authentication mode is set to scheme, configure AAA related parameters before switching to a higher user privilege level.

· The privilege level switching fails after three consecutive unsuccessful password attempts.

· For more information about user interface authentication, see the chapter “Configuring user interfaces.”

Modifying the level of a command

All the commands in a view default to different levels. The administrator can change the default level of a command to a lower level or a higher level as needed.

To modify the command level:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Configure the command level in a specified view.	command-privilege level level view view command	See Table 7 for the default settings.

CAUTION:

H3C recommends you to use the default command level or modify the command level under the guidance of professional staff. An improper change of the command level may bring inconvenience to your maintenance and operation, or even potential security problems.

Saving the current configuration

You can input the save command in any view to save all the submitted and executed commands into the configuration file. Commands saved in the configuration file can survive a reboot. The save command does not take effect on one-time commands, such as display commands, which display specified information, and the reset commands, which clear specified information. The one-time commands executed are never saved.

Displaying and maintaining CLI

Task	Command	Remarks
Display defined command aliases and the corresponding commands.	display command-alias [ \| { begin \| exclude \| include } regular-expression ]	Available in any view
Display the clipboard information.	display clipboard [ \| { begin \| exclude \| include } regular-expression ]	Available in any view

01-Fundamentals Configuration Guide

Accessing the CLI online help

Configuration guide

Configuration procedure

Controlling the CLI output

Pausing between screens of output

Keys for controlling output

Disabling pausing between screens of output

Filtering the output information of a display command

Introduction

Output information filtering examples

Configure the user privilege level by using AAA authentication parameters

Example for configuring the user privilege level by using AAA authentication parameters

Configure the user privilege level under a user interface

Example for configuring the user privilege level under a user interface

Introduction

Setting the authentication mode for user privilege level switching

Switching the user privilege level

Saving the current configuration

Cloud & AI

InterConnect

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Resources

Partner Business Management

Company Information

News & Events

Contact Us