This feature enables the system to record information about users that go offline abnormally. These records help the administrator analyze the causes and resolve the issues for abnormal user offline events. To display user abnormal offline records, use the display aaa abnormal-offline-record command.

This feature takes effect only when user offline recording is enabled.

The device can record a maximum of 32768 user abnormal offline records. When the maximum number is reached, a new record overwrites the oldest record.

To reduce the memory usage, you can disable this feature.

Examples

# Enable user abnormal offline recording.

<Sysname> system-view

[Sysname] aaa abnormal-offline-record enable

Related commands

aaa offline-record enable

display aaa abnormal-offline-record

aaa author-profile

Use aaa author-profile to create an authorization profile and enter its view, or enter the view of an existing authorization profile.

Use undo aaa author-profile to delete an authorization profile.

Syntax

aaa author-profile profile-name

undo aaa author-profile profile-name

Default

No authorization profiles exist.

Views

System view

Predefined user roles

network-admin

Parameters

profile-name: Specifies the name of the authorization profile, a case-insensitive string of 1 to 31 characters.

Usage guidelines

Application scenarios

A user in an ISP domain can use the following authorization attributes:

· Attributes assigned by the server.

· Attributes configured in the authentication domain.

· Attributes defined in the authorization profile applied to the authentication domain.

The priorities of the attributes are in descending order.

An authorization profile defines a set of authorization attributes and can be used to authorize network resources on a VPN basis, for example, assigning different microsegments to different VPN users. If you apply an authorization profile to an authentication domain, all users in the domain can obtain network resources defined in the profile.

Restrictions and guidelines

You can configure a maximum of 16 authorization profiles.

Deleting or changing an authorization profile does not affect users that are using the profile. The configuration change takes effect only on new clients that come online afterward.

Examples

# Create authorization profile abc and enter its view.

<Sysname> system-view

[Sysname] aaa author-profile abc

[Sysname-author-profile-abc]

Related commands

display aaa author-profile

aaa critical-profile

Use aaa critical-profile to create a critical profile and enter its view, or enter the view of an existing critical profile.

Use undo aaa critical-profile to delete a critical profile.

Syntax

aaa critical-profile profile-name

undo aaa critical-profile profile-name

Default

No critical profiles exist.

Views

System view

Predefined user roles

network-admin

Parameters

profile-name: Specifies the name of the critical profile, a case-insensitive string of 1 to 31 characters.

Usage guidelines

A critical profile applied to a port allows users on the port to access network resources in the profile when all authentication servers in the ISP domain of the users are unreachable.

The system supports a maximum of 16 critical profiles.

Examples

# Create critical profile abc and enter its view.

<Sysname> system-view

[Sysname] aaa critical-profile abc

[Sysname-critical-profile-abc]

Related commands

dot1x critical profile

mac-authentication critical profile

aaa nas-id

Use aaa nas-id to set the NAS-ID on an interface.

Use undo aaa nas-id to restore the default.

Syntax

aaa nas-id nas-identifier

undo aaa nas-id

Default

No NAS-ID is set on an interface.

Views

Layer 3 interface view

Predefined user roles

network-admin

Parameters

nas-identifier: Specifies a NAS-ID, a case-sensitive string of 1 to 253 characters.

Usage guidelines

During RADIUS authentication, the device uses a NAS-ID to set the NAS-Identifier attribute of RADIUS packets so that the RADIUS server can identify the access location of users.

You can configure a NAS-ID in VSRP instance view, in NAS-ID profile view, in interface view, or in ISP domain view. The device selects the NAS-ID for the NAS-Identifier attribute in the following order:

1. NAS-ID in a VSRP instance.

2. NAS-ID bound with VLANs in a NAS-ID profile.

3. NAS-ID on an interface.

4. NAS-ID in an ISP domain.

If no NAS-ID is selected, the device uses the device name as the NAS-ID.

The NAS-ID on an interface is applicable only to portal, PPP, and IPoE users.

Examples

# Set the NAS-ID to test on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] aaa nas-id test

Related commands

aaa nas-id profile

nas-id

nas id (High Availability Command Reference)

aaa nas-id profile

Use aaa nas-id profile to create a NAS-ID profile and enter its view, or enter the view of an existing NAS-ID profile.

Use undo aaa nas-id profile to delete a NAS-ID profile.

Syntax

aaa nas-id profile profile-name

undo aaa nas-id profile profile-name

Default

No NAS-ID profiles exist.

Views

System view

Predefined user roles

network-admin

Parameters

profile-name: Specifies the NAS-ID profile name, a case-insensitive string of 1 to 31 characters.

Usage guidelines

Configure a NAS-ID profile to maintain NAS-ID and VLAN bindings on the device.

During RADIUS authentication, the device uses a NAS-ID to set the NAS-Identifier attribute of RADIUS packets so that the RADIUS server can identify the access location of users.

The device selects the NAS-ID for the NAS-Identifier attribute in the following order:

1. NAS-ID in a VSRP instance.

2. NAS-ID bound with VLANs in a NAS-ID profile.

3. NAS-ID on an interface.

4. NAS-ID in an ISP domain.

Examples

# Create a NAS-ID profile named aaa and enter its view.

<Sysname> system-view

[Sysname] aaa nas-id profile aaa

[Sysname-nas-id-prof-aaa]

Related commands

aaa nas-id

aaa nas-id-profile

nas id (High Availability Command Reference)

nas-id bind

port-security nas-id-profile

portal nas-id-profile

aaa nas-id-profile

Use aaa nas-id-profile to specify a NAS-ID profile for an interface.

Use undo aaa nas-id-profile to restore the default.

Syntax

aaa nas-id-profile profile-name

undo aaa nas-id-profile

Default

No NAS-ID profile is specified for an interface.

Views

Layer 3 interface view

Predefined user roles

network-admin

Parameters

profile-name: Specifies a NAS-ID profile by its name, a case-sensitive string of 1 to 31 characters.

Usage guidelines

This command takes effect only on portal, PPP, and IPoE users.

For portal users on an interface, the NAS-ID profile specified by using the portal nas-id-profile command takes priority over that specified by using the aaa nas-id-profile command. For more information about the portal nas-id-profile command, see "Portal commands."

Examples

# Specify NAS-ID profile bbb for GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname–GigabitEthernet1/0/1] aaa nas-id-profile bbb

Related commands

aaa nas-id profile

nas-id bind

portal nas-id-profile

aaa normal-offline-record enable

Use aaa normal-offline-record enable to enable user normal offline recording.

Use undo aaa normal-offline-record enable to disable user normal offline recording.

Syntax

aaa normal-offline-record enable

undo aaa normal-offline-record enable

Default

User normal offline recording is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

This feature enables the system to record information about users that go offline normally. These records help the administrator analyze causes of user offline events. To display user normal offline records, use the display aaa normal-offline-record command.

This feature takes effect only when user offline recording is enabled.

The device can record a maximum of 32768 user normal offline records. When the maximum number is reached, a new record overwrites the oldest record.

To reduce the memory usage, you can disable this feature.

Examples

# Enable user normal offline recording.

<Sysname> system-view

[Sysname] aaa normal-offline-record enable

Related commands

aaa offline-record enable

display aaa normal-offline-record

aaa offline-record enable

Use aaa offline-record enable to enable user offline recording.

Use undo aaa offline-record enable to disable user offline recording.

Syntax

aaa offline-record enable

undo aaa offline-record enable

Default

User offline recording is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

You must enable this feature so that user abnormal offline recording and user normal offline recording can take effect. Then, the system can record information about users that go offline normally and abnormally. To display user offline records, use the display aaa offline-record command.

The device can record a maximum of 65536 user offline records. When the maximum number is reached, a new record overwrites the oldest record.

To reduce the memory usage, you can disable this feature.

Examples

# Enable user offline recording.

<Sysname> system-view

[Sysname] aaa offline-record enable

Related commands

aaa abnormal-offline-record enable

aaa normal-offline-record enable

display aaa offline-record

aaa online-fail-record enable

Use aaa online-fail-record enable to enable user online failure recording.

Use undo aaa online-fail-record enable to disable user online failure recording.

Syntax

aaa online-fail-record enable

undo aaa online-fail-record enable

Default

User online failure recording is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

This feature enables the system to record information about users that fail to come online. These records help the administrator identify causes of user online failures and check for malicious users. To display user online failure records, use the display aaa online-fail-record command.

The device can record a maximum of 32768 user online failure records. When the maximum number is reached, a new record overwrites the oldest record.

To reduce the memory usage, you can disable this feature.

Examples

# Enable user online failure recording.

<Sysname> system-view

[Sysname] aaa online-fail-record enable

Related commands

display aaa online-fail-record

aaa session-id mode

Use aaa session-id mode to specify the format for attribute Acct-Session-Id.

Use undo aaa session-id mode to restore the default.

Syntax

aaa session-id mode { common | simplified }

undo session-id mode

Default

The device uses the common mode for attribute Acct-Session-Id.

Views

System view

Predefined user roles

network-admin

Parameters

common: Specifies the common format for attribute Acct-Session-Id. In this format, the Acct-Session-Id attribute is a string of 37 characters. This string contains the prefix (indicating the access type), date and time, sequence number, LIP address of the access node, device ID, and job ID of the access process.

simplified: Specifies the simple format for attribute Acct-Session-Id. In this format, the Acct-Session-Id attribute is a string of 16 characters. This string contains the prefix (indicating the access type), month, sequence number, device ID, and LIP address of the access node.

Usage guidelines

Configure the format for attribute Acct-Session-Id to meet the requirements of the RADIUS servers.

Examples

# Specify the simple format for attribute Acct-Session-Id.

<Sysname> system-view

[Sysname] aaa session-id mode simplified

aaa session-limit

Use aaa session-limit to set the maximum number of concurrent users that can log on to the device through the specified method.

Use undo aaa session-limit to restore the default maximum number of concurrent users for the specified login method.

Syntax

In non-FIPS mode:

aaa session-limit { ftp | http | https | ssh | telnet } max-sessions

undo aaa session-limit { ftp | http | https | ssh | telnet }

In FIPS mode:

aaa session-limit { https | ssh } max-sessions

undo aaa session-limit { https | ssh }

Default

The maximum number of concurrent users is 32 for each user type.

Views

System view

Predefined user roles

network-admin

Parameters

ftp: FTP users.

http: HTTP users.

https: HTTPS users.

ssh: SSH users.

telnet: Telnet users.

max-sessions: Specifies the maximum number of concurrent login users. The value range is 1 to 32 for SSH and Telnet services, and is 1 to 64 for FTP, HTTP, and HTTPS services.

Usage guidelines

After the maximum number of concurrent login users for a user type exceeds the upper limit, the system denies the subsequent users of this type.

For HTTP and HTTPS services, the number of concurrent users of an application is separately limited. For example, if the maximum number of concurrent HTTP users is 20, a maximum of 20 concurrent users are allowed for each HTTP-based application, such as RESTful, Web, and NETCONF.

Examples

# Set the maximum number of concurrent FTP users to 4.

<Sysname> system-view

[Sysname] aaa session-limit ftp 4

accounting 5g

Use accounting 5g to specify accounting methods for 5G users.

Use undo accounting 5g to restore the default.

Syntax

accounting 5g { none | radius-scheme radius-scheme-name [ none ] }

undo accounting 5g

Default

The default accounting methods are used for 5G users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

none: Does not perform accounting.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

To have the AAA module perform RADIUS accounting first and then not perform accounting when RADIUS accounting is invalid, execute the accounting 5g radius-scheme radius-scheme-name none command.

Examples

# Configure ISP domain test not to perform accounting for 5G users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting 5g none

# Configure ISP domain test to perform RADIUS accounting for 5G users based on scheme rd and not to perform accounting when RADIUS accounting is invalid.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting 5g radius-scheme rd none

Related commands

display domain

radius scheme

accounting advpn

Use accounting advpn to specify accounting methods for ADVPN users.

Use undo accounting advpn to restore the default.

Syntax

In non-FIPS mode:

accounting advpn { local [ radius-scheme radius-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo accounting advpn

In FIPS mode:

accounting advpn { local [ radius-scheme radius-scheme-name ] | radius-scheme radius-scheme-name [ local ] }

undo accounting advpn

Default

The default accounting methods of the ISP domain are used for ADVPN users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

local: Performs local accounting.

none: Does not perform accounting.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary accounting method and multiple backup accounting methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the accounting advpn radius-scheme radius-scheme-name local none command specifies a primary RADIUS accounting method and two backup methods (local accounting and no accounting). The device performs RADIUS accounting by default and performs local accounting when RADIUS accounting is invalid. The device does not perform accounting when both of the previous methods are invalid.

The remote accounting method is invalid in the following situations:

· The specified accounting scheme does not exist.

· Accounting packet sending fails.

· The device does not receive any accounting response packets from an accounting server.

The local accounting method is invalid if the device fails to find the matching local user configuration.

When the primary accounting method is local, the following rules apply to the accounting of a user:

· The device uses the backup accounting methods in sequence only if local accounting is invalid for one of the following reasons:

¡ An exception occurs in the local accounting process.

¡ The user account is not configured on the device or the user is not allowed to use the ADVPN service.

· The device does not turn to the backup accounting methods if local accounting is invalid because of any other reason. Accounting fails for the user.

Examples

# In ISP domain test, perform local accounting for ADVPN users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting advpn local

# In ISP domain test, perform RADIUS accounting for ADVPN users based on scheme rd and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting advpn radius-scheme rd local

Related commands

accounting default

local-user

radius scheme

accounting command

Use accounting command to specify the command line accounting method.

Use undo accounting command to restore the default.

Syntax

accounting command hwtacacs-scheme hwtacacs-scheme-name

undo accounting command

Default

The default accounting methods of the ISP domain are used for command line accounting.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The command line accounting feature works with the accounting server to record valid commands that have been successfully executed on the device.

· When the command line authorization feature is disabled, the accounting server records all valid commands that have been successfully executed.

· When the command line authorization feature is enabled, the accounting server records only authorized commands that have been successfully executed.

Command line accounting can use only a remote HWTACACS server.

Examples

# In ISP domain test, perform command line accounting based on HWTACACS scheme hwtac.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting command hwtacacs-scheme hwtac

Related commands

accounting default

command accounting (Fundamentals Command Reference)

hwtacacs scheme

accounting default

Use accounting default to specify default accounting methods for an ISP domain.

Use undo accounting default to restore the default.

Syntax

In non-FIPS mode:

accounting default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }

undo accounting default

In FIPS mode:

accounting default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }

undo accounting default

Default

The default accounting method of an ISP domain is local.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local accounting.

none: Does not perform accounting.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The default accounting method is used for all users that support this method and do not have an accounting method configured.

Local accounting is only used for monitoring and controlling the number of local user connections. It does not provide the statistics function that the accounting feature generally provides.

You can specify one primary default accounting method and multiple backup default accounting methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the accounting default radius-scheme radius-scheme-name local none command specifies the primary default RADIUS accounting method and two backup methods (local accounting and no accounting). The device performs RADIUS accounting by default and performs local accounting when RADIUS accounting is invalid. The device does not perform accounting when both of the previous methods are invalid.

The remote accounting method is invalid in the following situations:

· The specified accounting scheme does not exist.

· Accounting packet sending fails.

· The device does not receive any accounting response packets from an accounting server.

The local accounting method is invalid if the device fails to find the matching local user configuration.

When the primary accounting method is local, the following rules apply to the accounting of a user:

· The device uses the backup accounting methods in sequence only if local accounting is invalid for one of the following reasons:

¡ An exception occurs in the local accounting process.

¡ The user account is not configured on the device or the user is not allowed to use the access service.

· The device does not turn to the backup accounting methods if local accounting is invalid because of any other reason. Accounting fails for the user.

Examples

# In ISP domain test, use RADIUS scheme rd as the primary default accounting method and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting default radius-scheme rd local

Related commands

hwtacacs scheme

local-user

radius scheme

accounting dual-stack

Use accounting dual-stack to specify the accounting method for dual-stack users.

Use undo accounting dual-stack to restore the default.

Syntax

accounting dual-stack { merge | separate }

undo accounting dual-stack

Default

The merge method applies.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

merge: Merges IPv4 data with IPv6 data for accounting.

separate: Separates IPv4 data from IPv6 data for accounting.

Usage guidelines

If the charging rates are different for IPv4 and IPv6 data, use the separate method for the accounting of dual-stack users.

If the separate method is used for the accounting of dual-stack users, the authorization CAR action is also separately applied to IPoE users' basic IPv4 traffic and basic IPv6 traffic.

Examples

# In ISP domain test, configure the device to separate IPv4 data from IPv6 data for the accounting of dual-stack users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting dual-stack separate

accounting ipoe

Use accounting ipoe to specify accounting methods for IPoE users.

Use undo accounting ipoe to restore the default.

Syntax

In non-FIPS mode:

accounting ipoe { broadcast radius-scheme radius-scheme-name1 radius-scheme radius-scheme-name2 [ local ] [ none ] | local [ radius-scheme radius-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo accounting ipoe

In FIPS mode:

accounting ipoe { broadcast radius-scheme radius-scheme-name1 radius-scheme radius-scheme-name2 [ local ] | local [ radius-scheme radius-scheme-name ] | radius-scheme radius-scheme-name [ local ] }

undo accounting ipoe

Default

The default accounting methods of the ISP domain are used for IPoE users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

broadcast: Broadcasts accounting requests to servers in RADIUS schemes.

radius-scheme radius-scheme-name1: Specifies the primary broadcast RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

radius-scheme radius-scheme-name2: Specifies the backup broadcast RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local accounting.

none: Does not perform accounting.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary accounting method and multiple backup accounting methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the accounting ipoe radius-scheme radius-scheme-name local none command specifies a primary RADIUS accounting method and two backup methods (local accounting and no accounting). The device performs RADIUS accounting by default and performs local accounting when RADIUS accounting is invalid. The device does not perform accounting when both of the previous methods are invalid.

The remote accounting method is invalid in the following situations:

· The specified accounting scheme does not exist.

· Accounting packet sending fails.

· The device does not receive any accounting response packets from an accounting server.

The local accounting method is invalid if the device fails to find the matching local user configuration.

The following guidelines apply to broadcast accounting:

· The device sends accounting requests to the primary accounting servers in the specified broadcast RADIUS schemes at the real-time accounting interval set in the primary broadcast RADIUS scheme. If the primary server is unavailable in a scheme, the device sends accounting requests to the secondary servers of the scheme in the order the servers are configured.

· The accounting result is determined by the primary broadcast RADIUS scheme. The accounting result from the backup scheme is used as reference only. If the primary scheme does not return any result, the device considers the accounting as a failure.

When the primary accounting method is local, the following rules apply to the accounting of a user:

· The device uses the backup accounting methods in sequence only if local accounting is invalid for one of the following reasons:

¡ An exception occurs in the local accounting process.

¡ The user account is not configured on the device or the user is not allowed to use the IPoE service.

· The device does not turn to the backup accounting methods if local accounting is invalid because of any other reason. Accounting fails for the user.

Examples

# In ISP domain test, perform local accounting for IPoE users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting ipoe local

# In ISP domain test, perform RADIUS accounting for IPoE users based on scheme rd and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting ipoe radius-scheme rd local

# In ISP domain test, broadcast accounting requests of IPoE users to RADIUS servers in schemes rd1 and rd2, and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting ipoe broadcast radius-scheme rd1 radius-scheme rd2 local

Related commands

accounting default

local-user

radius scheme

timer realtime-accounting

accounting lan-access

Use accounting lan-access to specify accounting methods for LAN users.

Use undo accounting lan-access to restore the default.

Syntax

In non-FIPS mode:

accounting lan-access { broadcast radius-scheme radius-scheme-name1 radius-scheme radius-scheme-name2 [ local ] [ none ] | local [ radius-scheme radius-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo accounting lan-access

In FIPS mode:

accounting lan-access { broadcast radius-scheme radius-scheme-name1 radius-scheme radius-scheme-name2 [ local ] | local [ radius-scheme radius-scheme-name ] | radius-scheme radius-scheme-name [ local ] }

undo accounting lan-access

Default

The default accounting methods of the ISP domain are used for LAN users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

broadcast: Broadcasts accounting requests to servers in RADIUS schemes.

radius-scheme radius-scheme-name1: Specifies the primary broadcast RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

radius-scheme radius-scheme-name2: Specifies the backup broadcast RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local accounting.

none: Does not perform accounting.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary accounting method and multiple backup accounting methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the accounting lan-access radius-scheme radius-scheme-name local none command specifies a primary RADIUS accounting method and two backup methods (local accounting and no accounting). The device performs RADIUS accounting by default and performs local accounting when RADIUS accounting is invalid. The device does not perform accounting when both of the previous methods are invalid.

The remote accounting method is invalid in the following situations:

· The specified accounting scheme does not exist.

· Accounting packet sending fails.

· The device does not receive any accounting response packets from an accounting server.

The local accounting method is invalid if the device fails to find the matching local user configuration.

The following guidelines apply to broadcast accounting:

When the primary accounting method is local, the following rules apply to the accounting of a user:

· The device uses the backup accounting methods in sequence only if local accounting is invalid for one of the following reasons:

¡ An exception occurs in the local accounting process.

¡ The user account is not configured on the device or the user is not allowed to use the LAN access service.

· The device does not turn to the backup accounting methods if local accounting is invalid because of any other reason. Accounting fails for the user.

Examples

# In ISP domain test, perform local accounting for LAN users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting lan-access local

# In ISP domain test, perform RADIUS accounting for LAN users based on scheme rd and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting lan-access radius-scheme rd local

# In ISP domain test, broadcast accounting requests of LAN users to RADIUS servers in schemes rd1 and rd2, and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting lan-access broadcast radius-scheme rd1 radius-scheme rd2 local

Related commands

accounting default

local-user

radius scheme

timer realtime-accounting

accounting login

Use accounting login to specify accounting methods for login users.

Use undo accounting login to restore the default.

Syntax

In non-FIPS mode:

accounting login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }

undo accounting login

In FIPS mode:

accounting login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }

undo accounting login

Default

The default accounting methods of the ISP domain are used for login users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local accounting.

none: Does not perform accounting.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

Accounting is not supported for FTP, SFTP, and SCP users.

You can specify one primary accounting method and multiple backup accounting methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the accounting login radius-scheme radius-scheme-name local none command specifies a primary default RADIUS accounting method and two backup methods (local accounting and no accounting). The device performs RADIUS accounting by default and performs local accounting when RADIUS accounting is invalid. The device does not perform accounting when both of the previous methods are invalid.

The remote accounting method is invalid in the following situations:

· The specified accounting scheme does not exist.

· Accounting packet sending fails.

· The device does not receive any accounting response packets from an accounting server.

The local accounting method is invalid if the device fails to find the matching local user configuration.

When the primary accounting method is local, the following rules apply to the accounting of a user:

· The device uses the backup accounting methods in sequence only if local accounting is invalid for one of the following reasons:

¡ An exception occurs in the local accounting process.

¡ The user account is not configured on the device.

· The device does not turn to the backup accounting methods if local accounting is invalid because of any other reason. Accounting fails for the user.

Examples

# In ISP domain test, perform local accounting for login users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting login local

# In ISP domain test, perform RADIUS accounting for login users based on scheme rd and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting login radius-scheme rd local

Related commands

accounting default

hwtacacs scheme

local-user

radius scheme

accounting portal

Use accounting portal to specify accounting methods for portal users.

Use undo accounting portal to restore the default.

Syntax

In non-FIPS mode:

accounting portal { broadcast radius-scheme radius-scheme-name1 radius-scheme radius-scheme-name2 [ local ] [ none ] | local [ radius-scheme radius-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo accounting portal

In FIPS mode:

accounting portal { broadcast radius-scheme radius-scheme-name1 radius-scheme radius-scheme-name2 [ local ] | local [ radius-scheme radius-scheme-name ] | radius-scheme radius-scheme-name [ local ] }

undo accounting portal

Default

The default accounting methods of the ISP domain are used for portal users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

broadcast: Broadcasts accounting requests to servers in RADIUS schemes.

radius-scheme radius-scheme-name1: Specifies the primary broadcast RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

radius-scheme radius-scheme-name2: Specifies the backup broadcast RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local accounting.

none: Does not perform accounting.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary accounting method and multiple backup accounting methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the accounting portal radius-scheme radius-scheme-name local none command specifies a primary default RADIUS accounting method and two backup methods (local accounting and no accounting). The device performs RADIUS accounting by default and performs local accounting when RADIUS accounting is invalid. The device does not perform accounting when both of the previous methods are invalid.

The remote accounting method is invalid in the following situations:

· The specified accounting scheme does not exist.

· Accounting packet sending fails.

· The device does not receive any accounting response packets from an accounting server.

The local accounting method is invalid if the device fails to find the matching local user configuration.

The following guidelines apply to broadcast accounting:

When the primary accounting method is local, the following rules apply to the accounting of a user:

· The device uses the backup accounting methods in sequence only if local accounting is invalid for one of the following reasons:

¡ An exception occurs in the local accounting process.

¡ The user account is not configured on the device or the user is not allowed to use the portal service.

· The device does not turn to the backup accounting methods if local accounting is invalid because of any other reason. Accounting fails for the user.

Examples

# In ISP domain test, perform local accounting for portal users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting portal local

# In ISP domain test, perform RADIUS accounting for portal users based on scheme rd and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting portal radius-scheme rd local

# In ISP domain test, broadcast accounting requests of portal users to RADIUS servers in schemes rd1 and rd2, and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting portal broadcast radius-scheme rd1 radius-scheme rd2 local

Related commands

accounting default

local-user

radius scheme

timer realtime-accounting

accounting ppp

Use accounting ppp to specify accounting methods for PPP users.

Use undo accounting ppp to restore the default.

Syntax

In non-FIPS mode:

accounting ppp { broadcast radius-scheme radius-scheme-name1 radius-scheme radius-scheme-name2 [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] | hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }

undo accounting ppp

In FIPS mode:

accounting ppp { broadcast radius-scheme radius-scheme-name1 radius-scheme radius-scheme-name2 [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] | hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }

undo accounting ppp

Default

The default accounting methods of the ISP domain are used for PPP users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

broadcast: Broadcasts accounting requests to servers in RADIUS schemes.

radius-scheme radius-scheme-name1: Specifies the primary broadcast RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

radius-scheme radius-scheme-name2: Specifies the backup broadcast RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local accounting.

none: Does not perform accounting.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary accounting method and multiple backup accounting methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the accounting ppp radius-scheme radius-scheme-name local none command specifies a primary RADIUS accounting method and two backup methods (local accounting and no accounting). The device performs RADIUS accounting by default and performs local accounting when RADIUS accounting is invalid. The device does not perform accounting when both of the previous methods are invalid.

The remote accounting method is invalid in the following situations:

· The specified accounting scheme does not exist.

· Accounting packet sending fails.

· The device does not receive any accounting response packets from an accounting server.

The local accounting method is invalid if the device fails to find the matching local user configuration.

The following guidelines apply to broadcast accounting:

· The device sends accounting requests to the primary accounting servers in the specified broadcast RADIUS schemes at the real-time accounting interval set in the primary broadcast RADIUS scheme. If the primary server is unavailable for a scheme, the device sends accounting requests to the secondary servers of the scheme in the order the servers are configured.

When the primary accounting method is local, the following rules apply to the accounting of a user:

· The device uses the backup accounting methods in sequence only if local accounting is invalid for one of the following reasons:

¡ An exception occurs in the local accounting process.

¡ The user account is not configured on the device or the user is not allowed to use the PPP service.

· The device does not turn to the backup accounting methods if local accounting is invalid because of any other reason. Accounting fails for the user.

Examples

# In ISP domain test, perform local accounting for PPP users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting ppp local

# In ISP domain test, perform RADIUS accounting for PPP users based on scheme rd and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting ppp radius-scheme rd local

# In ISP domain test, broadcast accounting requests of PPP users to RADIUS servers in schemes rd1 and rd2, and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting ppp broadcast radius-scheme rd1 radius-scheme rd2 local

Related commands

accounting default

hwtacacs scheme

local-user

radius scheme

timer realtime-accounting

accounting quota-out

Use accounting quota-out to configure access control for users that have used up their data or time accounting quotas.

Use undo accounting quota-out to restore the default.

Syntax

accounting quota-out { offline | online | redirect-url url-string [ stop-accounting ] [ user-profile profile-name ] } [ no-accounting-update ]

undo accounting quota-out

Default

The device sends accounting-update packets to the server to request new quotas for the users that have used up their accounting quotas. A user is logged off if the device does not receive any new quota for the user.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

offline: Logs off users that have used up their accounting quotas.

online: Allows users that have used up their accounting quotas to stay online.

redirect-url url-string: Specifies the URL to which users are redirected when they have used up their accounting quotas. The url-string argument is a case-sensitive string of 1 to 255 characters. This option is applicable only to PPPoE users.

stop-accounting: Sends stop-accounting packets for users that have used up their accounting quotas. If you do not specify this keyword, the device does not send stop-accounting packets for users that have used up their accounting quotas.

user-profile profile-name: Specifies a user profile to restrict behavior of users that have used up their accounting quotas. The profile-name argument is a case-sensitive string of 1 to 31 characters. Valid characters include letters, digits, underscores (_), minus signs (-), and dots (.). The string can begin with a letter or digit, but it cannot be all digits. If you do not specify a user profile, the users that have used up their accounting quotas are not restricted by any user profile before they obtain new accounting quotas.

no-accounting-update: Disables the device from sending accounting-update requests to refresh the users' quotas.

Usage guidelines

If the server notifies the device of portal users' remaining accounting quotas, the time that the device logs out portal users that have used up their accounting quotas might be inaccurate.

The server might divide the accounting quota of a user into multiple portions and assign a portion to the user each time. If the server does not support dividing user accounting quota, specify the no-accounting-update keyword to decrease the burden of the server as a best practice.

Examples

# In ISP domain test, configure the device to allow users that have used up their accounting quotas to stay online.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting quota-out online

accounting start-fail

Use accounting start-fail to configure access control for users that encounter accounting-start failures.

Use undo accounting start-fail to restore the default.

Syntax

accounting start-fail { offline | online }

undo accounting start-fail

Default

The device allows users that encounter accounting-start failures to stay online.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

offline: Logs off users that encounter accounting-start failures.

online: Allows users that encounter accounting-start failures to stay online.

Examples

# In ISP domain test, configure the device to allow users that encounter accounting-start failures to stay online.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting start-fail online

accounting update-fail

Use accounting update-fail to configure access control for users that have failed all their accounting-update attempts.

Use undo accounting update-fail to restore the default.

Syntax

accounting update-fail { [ max-times max-times ] offline | online }

undo accounting update-fail

Default

The device allows users that have failed all their accounting-update attempts to stay online.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

max-times max-times: Specifies the maximum number of consecutive accounting-update failures allowed by the device for each user. The value range for the times argument is 1 to 255, and the default value is 1. The setting for this parameter takes effect only on IPoE, PPP, and portal users. Its value is fixed at 1 for other types of users, regardless of the setting for this parameter.

offline: Logs off users that have failed all their accounting-update attempts.

online: Allows users that have failed all their accounting-update attempts to stay online.

Usage guidelines

For an IPoE, PPP, or portal user, the NAS takes the action specified by using this command when the maximum number of consecutive accounting-update failures is reached.

For any other types of users, the device takes the action specified by using this command immediately after an accounting-update fails.

The device determines the failure of an accounting-update attempt based on the following factors:

· Maximum number of transmission attempts for a RADIUS packet (set by using the retry command).

· Real-time accounting interval (set by using the timer realtime-accounting command).

· Maximum number of real-time accounting request attempts (set by using the retry realtime-accounting command).

The following information describes the process that the device uses to determine the failure of an accounting-update failure:

1. The device sends accounting request packets at real-time accounting intervals set by using the timer realtime-accounting command.

2. If the device has not received a response to a request packet when the response timeout timer expires, the device resends the request packet.

3. When the number of consecutive transmission attempts for the request reaches the limit set by using the retry command, the device determines that the real-time accounting request fails.

4. When the number of consecutive real-time accounting request failures reaches the limit set by using the retry realtime-accounting command, the device determines that an accounting-update fails.

5. The system determines the action to take upon an accounting-update failure depending on the user type:

¡ For an IPoE, PPP, or portal user, the system will count the failure. If the number of consecutive accounting-update failures reaches the limit set by using the accounting update-fail command, it takes the action specified by using the same command.

¡ For other users, the system immediately takes the action specified by using the accounting update-fail command.

Examples

# In ISP domain test, configure the device to allow users that have failed all their accounting-update attempts to stay online.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] accounting update-fail online

Related commands

retry

retry realtime-accounting

timer realtime-accounting

authen-fail

Use authen-fail to configure the authentication failure policy for users in an ISP domain.

Use undo authen-fail to restore the default.

Syntax

authen-fail { offline | online domain new-isp-name no-authen }

undo authen-fail

Default

The device logs out users in an ISP domain if the users fail authentication.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

offline: Logs out users that fail authentication.

online: Enables the authen-fail online feature to allow users that fail authentication to stay online.

domain new-isp-name: Specifies an authentication-fail (auth-fail) domain to accommodate users that fail authentication. The new-isp-name argument represents the name of the auth-fail domain, a case-insensitive string of 1 to 255 characters. The specified domain must already exist. The domain name cannot contain a forward slash (/), backslash (\), vertical bar (|), quotation marks ("), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).

no-authen: Enables the user to join the auth-fail domain without reauthentication. The system will only do reauthorization and accounting for them.

Usage guidelines

By default, users cannot come online if they fail authentication. To have authentication-failed users in an authentication domain stay online and access a limited set of network resources, specify an auth-fail domain to accommodate them. In the auth-fail domain, you can specify a set of authorization and accounting schemes to assign resources to the authentication-failed users.

You cannot delete an ISP domain if it is used as the auth-fail domain for an authentication domain. To delete it, you must first execute the undo authen-fail command to remove its binding with the authentication domain.

The authen-fail online feature is available only for wired port security users.

The authen-fail online feature does not apply to users that fail authentication for one of the following reasons:

· Authentication times out, for example, because no authentication servers respond.

· The authentication ISP domain is in blocked state or is a denied domain.

Examples

# Specify ISP domain dm1 as the auth-fail domain to accommodate users that fail authentication in ISP domain test.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authen-fail online domain dm1 no-authen

Related commands

display domain

authen-radius-recover

Use authen-radius-recover to specify an action to take on users in the critical domain when a RADIUS server becomes available.

Use undo authen-radius-recover to restore the default.

Syntax

authen-radius-recover { offline | online domain new-isp-name | re-authen }

undo authen-radius-recover

Default

No action is specified to take on users in the critical domain when a RADIUS server becomes available.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

offline: Logs off users in the critical domain.

online: Allows users in the critical domain to stay online and assigns the users to the recovery domain.

domain new-isp-name: Specifies a recovery domain to accommodate users in the critical domain when a RADIUS server becomes available. The new-isp-name argument represents the domain name, a case-insensitive string of 1 to 255 characters. The name must exist and cannot contain a forward slash (/), backslash (\), vertical bar (|), quotation marks ("), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).

re-authen: Reauthenticates the users in the original authentication domain. This keyword is applicable only to 802.1X and MAC authentication users.

Usage guidelines

This command takes effect only on 802.1X authentication, Web authentication, and MAC authentication users.

Depending on the network requirements, specify the action to take on users in the critical domain when a RADIUS server in the users' original authentication domain becomes available.

· To perform authentication, authorization, and accounting for the users, log off the users.

· To allow the users to stay online without being authenticated, specify a recovery domain. When a RADIUS server becomes available, the users are assigned to the recovery domain from the critical domain.

· To reauthenticate users in the original authentication domain without users being aware of the process, specify the reauthentication action.

When you use the online domain new-isp-name option to specify a recovery domain, the device does not immediately assign users in the critical domain to the specified recovery domain. The device assigns these users to the recovery domain when a RADIUS server becomes available.

When you specify a recovery domain for an ISP domain, follow these restrictions and guidelines:

· If the none method is configured as the backup authentication method in the original authentication domain before the users are assigned to the critical domain, the users are still assigned to the recovery domain when a RADIUS server becomes available.

· As a best practice to accurately identify whether a RADIUS authentication server is available and the recovery configuration can take effect in time, configure RADIUS server status detection.

· To delete the ISP domain that has been specified as a recovery domain, you must first use the undo authen-radius-recover command to remove the recovery domain setting from the ISP domain.

· In the current software version, you can specify only an ISP domain as its own recovery domain in the view of the ISP domain.

Examples

# In ISP domain test, log off users in the critical domain when a RADIUS server becomes available.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authen-radius-recover offline

Related commands

authen-radius-unavailable online domain

display domain

radius-server test-profile

authen-radius-unavailable online domain

Use authen-radius-unavailable online domain to specify a critical domain (also known as fail-permit domain) for an ISP domain to accommodate users that access the ISP domain when all RADIUS servers are unavailable.

Use undo authen-radius-unavailable online domain to restore the default.

Syntax

authen-radius-unavailable online domain new-isp-name

undo authen-radius-unavailable online domain

Default

No critical domain is specified for an ISP domain to accommodate users that access the ISP domain when all RADIUS servers are unavailable.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

new-isp-name: Specifies an ISP domain name, a case-insensitive string of 1 to 255 characters. The name must exist and cannot contain a forward slash (/), backslash (\), vertical bar (|), quotation marks ("), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).

Usage guidelines

This command takes effect only on 802.1X authentication, Web authentication, and MAC authentication users.

Users in an ISP domain cannot come online correctly if no responses are received for the RADIUS authentication requests sent by the device when all RADIUS authentication servers are unavailable. To resolve this issue, specify a critical domain for this ISP domain to accommodate users that access this ISP domain when all RADIUS servers are unavailable. The users can come online in the critical domain without being authenticated when all RADIUS servers are unavailable.

Users assigned to the critical domain are removed from the critical domain only when the following requirements are met:

· A RADIUS authentication server in the original authentication domain becomes available.

· A recovery domain is specified for the original authentication domain.

When you specify a critical domain for an ISP domain, follow these restrictions and guidelines:

· If an ISP domain has been specified as a critical domain, do not specify a critical domain for that ISP domain. If you do so, the critical domain specified for that ISP domain cannot take effect.

· If a critical domain has been specified for an ISP domain, do not specify that ISP domain as a critical domain. If you do so, that ISP domain cannot act as a critical domain.

· To delete the ISP domain that has been specified as a critical domain, you must first use the undo authen-radius-unavailable online domain command to remove the critical domain setting from the ISP domain.

· If non-none authentication, authorization, or accounting methods are configured in the critical domain for an ISP domain, the non-none authentication or authorization methods cannot take effect on users. However, the non-none accounting methods in the critical domain can take effect on users. As a best practice to reduce user management cost, do not configure non-none authentication, authorization, or accounting methods in the critical domain.

Examples

# Specify critical domain dm1 to accommodate users that access ISP domain test when all RADIUS servers are unavailable.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authen-radius-unavailable online domain dm1

Related commands

authen-radius-recover

display domain

authentication 5g

Use authentication 5g to specify authentication methods for 5G users.

Use undo authentication 5g to restore the default.

Syntax

authentication 5g { none | radius-scheme radius-scheme-name [ none ] }

undo authentication 5g

Default

The default authentication methods are used for 5G users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

none: Does not perform authentication.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

To have the AAA module perform RADIUS authentication first and then not perform authentication for 5G users when RADIUS authentication is invalid, execute the authentication 5g radius-scheme radius-scheme-name none command.

Examples

# Configure ISP domain test not to perform authentication for 5G users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication 5g none

# Configure ISP domain test to perform RADIUS authentication for 5G users based on scheme rd and not to perform authentication when RADIUS accounting is invalid.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication 5g radius-scheme rd none

Related commands

display domain

radius scheme

authentication advpn

Use authentication advpn to specify authentication methods for ADVPN users.

Use undo authentication advpn to restore the default.

Syntax

In non-FIPS mode:

authentication advpn { local [ radius-scheme radius-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo authentication advpn

In FIPS mode:

authentication advpn { local | radius-scheme radius-scheme-name } *

undo authentication advpn

Default

The default authentication methods of the ISP domain are used for ADVPN users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

local: Performs local authentication.

none: Does not perform authentication.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary authentication method and multiple backup authentication methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authentication advpn radius-scheme radius-scheme-name local none command specifies a primary RADIUS authentication method and two backup methods (local authentication and no authentication). The device performs RADIUS authentication by default and performs local authentication when RADIUS authentication is invalid. The device does not perform authentication when both of the previous methods are invalid.

The remote authentication method is invalid in the following situations:

· The specified authentication scheme does not exist.

· Authentication packet sending fails.

· The device does not receive any authentication response packets from an authentication server.

The local authentication method is invalid if the device fails to find the matching local user configuration.

When the primary authentication method is local, the following rules apply to the authentication of a user:

· The device uses the backup authentication methods in sequence only if local authentication is invalid for one of the following reasons:

¡ An exception occurs in the local authentication process.

¡ The user account is not configured on the device or the user is not allowed to use the ADVPN service.

· The device does not turn to the backup authentication methods if local authentication is invalid because of any other reason. Authentication fails for the user.

Examples

# In ISP domain test, perform local authentication for ADVPN users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication advpn local

# In ISP domain test, perform RADIUS authentication for ADVPN users based on scheme rd and use local authentication as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication advpn radius-scheme rd local

Related commands

authentication default

local-user

radius scheme

authentication default

Use authentication default to specify default authentication methods for an ISP domain.

Use undo authentication default to restore the default.

Syntax

In non-FIPS mode:

authentication default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | ldap-scheme ldap-scheme-name [ local ] [ none ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * [ none ] | local [ ldap-scheme ldap-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }

undo authentication default

In FIPS mode:

authentication default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] | ldap-scheme ldap-scheme-name [ local ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * | local [ ldap-scheme ldap-scheme-name ] | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }

undo authentication default

Default

The default authentication method of an ISP domain is local.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

ldap-scheme ldap-scheme-name: Specifies an LDAP scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local authentication.

none: Does not perform authentication.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The default authentication method is used for all users that support this method and do not have an authentication method configured.

You can specify one primary default authentication method and multiple backup default authentication methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authentication default radius-scheme radius-scheme-name local none command specifies a primary default RADIUS authentication method and two backup methods (local authentication and no authentication). The device performs RADIUS authentication by default and performs local authentication when RADIUS authentication is invalid. The device does not perform authentication when both of the previous methods are invalid.

The remote authentication method is invalid in the following situations:

· The specified authentication scheme does not exist.

· Authentication packet sending fails.

· The device does not receive any authentication response packets from an authentication server.

The local authentication method is invalid if the device fails to find the matching local user configuration.

When the primary authentication method is local, the following rules apply to the authentication of a user:

· The device uses the backup authentication methods in sequence only if local authentication is invalid for one of the following reasons:

¡ An exception occurs in the local authentication process.

¡ The user account is not configured on the device or the user is not allowed to use the access service.

· The device does not turn to the backup authentication methods if local authentication is invalid because of any other reason. Authentication fails for the user.

Examples

# In ISP domain test, use RADIUS scheme rd as the primary default authentication method and use local authentication as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication default radius-scheme rd local

Related commands

hwtacacs scheme

ldap scheme

local-user

radius scheme

authentication ike

Use authentication ike to specify extended authentication methods for IKE users.

Use undo authentication ike to restore the default.

Syntax

In non-FIPS mode:

authentication ike { local [ radius-scheme radius-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo authentication ike

In FIPS mode:

authentication ike { local | radius-scheme radius-scheme-name } *

undo authentication ike

Default

The default authentication methods of the ISP domain are used for IKE extended authentication.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

local: Performs local authentication.

none: Does not perform authentication.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary authentication method and multiple backup authentication methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authentication ike radius-scheme radius-scheme-name local none command specifies a primary RADIUS authentication method and two backup methods (local authentication and no authentication). The device performs RADIUS authentication by default and performs local authentication when RADIUS authentication is invalid. The device does not perform authentication when both of the previous methods are invalid.

The remote authentication method is invalid in the following situations:

· The specified authentication scheme does not exist.

· Authentication packet sending fails.

· The device does not receive any authentication response packets from an authentication server.

The local authentication method is invalid if the device fails to find the matching local user configuration.

When the primary authentication method is local, the following rules apply to the authentication of a user:

· The device uses the backup authentication methods in sequence only if local authentication is invalid for one of the following reasons:

¡ An exception occurs in the local authentication process.

¡ The user account is not configured on the device or the user is not allowed to use the IKE service.

· The device does not turn to the backup authentication methods if local authentication is invalid because of any other reason. Authentication fails for the user.

Examples

# In ISP domain test, configure the device to perform local authentication through IKE extended authentication.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication ike local

# In ISP domain test, perform IKE extended authentication based on RADIUS scheme rd and use local authentication as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication ike radius-scheme rd local

Related commands

authentication default

local-user

radius scheme

authentication ipoe

Use authentication ipoe to specify authentication methods for IPoE users.

Use undo authentication ipoe to restore the default.

Syntax

In non-FIPS mode:

authentication ipoe { local [ radius-scheme radius-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo authentication ipoe

In FIPS mode:

authentication ipoe { local | radius-scheme radius-scheme-name } *

undo authentication ipoe

Default

The default authentication methods of the ISP domain are used for IPoE users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

local: Performs local authentication.

none: Does not perform authentication.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary authentication method and multiple backup authentication methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authentication ipoe radius-scheme radius-scheme-name local none command specifies a primary RADIUS authentication method and two backup methods (local authentication and no authentication). The device performs RADIUS authentication by default and performs local authentication when RADIUS authentication is invalid. The device does not perform authentication when both of the previous methods are invalid.

The remote authentication method is invalid in the following situations:

· The specified authentication scheme does not exist.

· Authentication packet sending fails.

· The device does not receive any authentication response packets from an authentication server.

The local authentication method is invalid if the device fails to find the matching local user configuration.

When the primary authentication method is local, the following rules apply to the authentication of a user:

· The device uses the backup authentication methods in sequence only if local authentication is invalid for one of the following reasons:

¡ An exception occurs in the local authentication process.

¡ The user account is not configured on the device or the user is not allowed to use the IPoE service.

· The device does not turn to the backup authentication methods if local authentication is invalid because of any other reason. Authentication fails for the user.

Examples

# In ISP domain test, perform local authentication for IPoE users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication ipoe local

# In ISP domain test, perform RADIUS authentication for IPoE users based on scheme rd and use local authentication as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication ipoe radius-scheme rd local

Related commands

authentication default

local-user

radius scheme

authentication lan-access

Use authentication lan-access to specify authentication methods for LAN users.

Use undo authentication lan-access to restore the default.

Syntax

In non-FIPS mode:

authentication lan-access { ldap-scheme ldap-scheme-name [ local ] [ none ] | local [ ldap-scheme ldap-scheme-name | radius-scheme radius-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo authentication lan-access

In FIPS mode:

authentication lan-access { ldap-scheme ldap-scheme-name [ local ] | local [ ldap-scheme ldap-scheme-name | radius-scheme radius-scheme-name ] | radius-scheme radius-scheme-name [ local ] }

undo authentication lan-access

Default

The default authentication methods of the ISP domain are used for LAN users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

ldap-scheme ldap-scheme-name: Specifies an LDAP scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local authentication.

none: Does not perform authentication.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary authentication method and multiple backup authentication methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authentication lan-access radius-scheme radius-scheme-name local none command specifies a primary RADIUS authentication method and two backup methods (local authentication and no authentication). The device performs RADIUS authentication by default and performs local authentication when RADIUS authentication is invalid. The device does not perform authentication when both of the previous methods are invalid.

The remote authentication method is invalid in the following situations:

· The specified authentication scheme does not exist.

· Authentication packet sending fails.

· The device does not receive any authentication response packets from an authentication server.

The local authentication method is invalid if the device fails to find the matching local user configuration.

When the primary authentication method is local, the following rules apply to the authentication of a user:

· The device uses the backup authentication methods in sequence only if local authentication is invalid for one of the following reasons:

¡ An exception occurs in the local authentication process.

¡ The user account is not configured on the device or the user is not allowed to use the LAN access service.

· The device does not turn to the backup authentication methods if local authentication is invalid because of any other reason. Authentication fails for the user.

Examples

# In ISP domain test, perform local authentication for LAN users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication lan-access local

# In ISP domain test, perform RADIUS authentication for LAN users based on scheme rd and use local authentication as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication lan-access radius-scheme rd local

Related commands

authentication default

ldap scheme

local-user

radius scheme

authentication login

Use authentication login to specify authentication methods for login users.

Use undo authentication login to restore the default.

Syntax

In non-FIPS mode:

authentication login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | ldap-scheme ldap-scheme-name [ local ] [ none ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * [ none ] | local [ ldap-scheme ldap-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }

undo authentication login

In FIPS mode:

authentication login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] | ldap-scheme ldap-scheme-name [ local ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * | local [ ldap-scheme ldap-scheme-name ] | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }

undo authentication login

Default

The default authentication methods of the ISP domain are used for login users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

ldap-scheme ldap-scheme-name: Specifies an LDAP scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local authentication.

none: Does not perform authentication.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary authentication method and multiple backup authentication methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authentication login radius-scheme radius-scheme-name local none command specifies the default primary RADIUS authentication method and two backup methods (local authentication and no authentication). The device performs RADIUS authentication by default and performs local authentication when RADIUS authentication is invalid. The device does not perform authentication when both of the previous methods are invalid.

The remote authentication method is invalid in the following situations:

· The specified authentication scheme does not exist.

· Authentication packet sending fails.

· The device does not receive any authentication response packets from an authentication server.

The local authentication method is invalid if the device fails to find the matching local user configuration.

When the primary authentication method is local, the following rules apply to the authentication of a user:

· The device uses the backup authentication methods in sequence only if local authentication is invalid for one of the following reasons:

¡ An exception occurs in the local authentication process.

¡ The user account is not configured on the device or the user is not allowed to use the service for accessing the device.

· The device does not turn to the backup authentication methods if local authentication is invalid because of any other reason. Authentication fails for the user.

Examples

# In ISP domain test, perform local authentication for login users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication login local

# In ISP domain test, perform RADIUS authentication for login users based on scheme rd and use local authentication as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication login radius-scheme rd local

Related commands

authentication default

hwtacacs scheme

ldap scheme

local-user

radius scheme

authentication onu

Use authentication onu to specify authentication methods for ONU users.

Use undo authentication onu to restore the default.

Syntax

In non-FIPS mode:

authentication onu { local [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo authentication onu

In FIPS mode:

authentication onu { local | radius-scheme radius-scheme-name [ local ] }

undo authentication onu

Default

The default authentication methods of the ISP domain are used for ONU users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

local: Performs local authentication.

none: Does not perform authentication.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary authentication method and multiple backup authentication methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authentication onu radius-scheme radius-scheme-name local none command specifies a primary default RADIUS authentication method and two backup methods (local authentication and no authentication). The device performs RADIUS authentication by default and performs local authentication when RADIUS authentication is invalid. The device does not perform authentication when both of the previous methods are invalid.

The remote authentication method is invalid in the following situations:

· The specified authentication scheme does not exist.

· Authentication packet sending fails.

· The device does not receive any authentication response packets from an authentication server.

The local authentication method is invalid if the device fails to find the matching local user configuration.

Examples

# In ISP domain test, perform local authentication for ONU users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication onu local

# In ISP domain test, perform RADIUS authentication for ONU users based on scheme rd and use local authentication as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication onu radius-scheme rd local

Related commands

authentication default

local-user

radius scheme

authentication portal

Use authentication portal to specify authentication methods for portal users.

Use undo authentication portal to restore the default.

Syntax

In non-FIPS mode:

authentication portal { ldap-scheme ldap-scheme-name [ local ] [ none ] | local [ ldap-scheme ldap-scheme-name | radius-scheme radius-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo authentication portal

In FIPS mode:

authentication portal { ldap-scheme ldap-scheme-name [ local ] | local [ ldap-scheme ldap-scheme-name | radius-scheme radius-scheme-name ] | radius-scheme radius-scheme-name [ local ] }

undo authentication portal

Default

The default authentication methods of the ISP domain are used for portal users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

ldap-scheme ldap-scheme-name: Specifies an LDAP scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local authentication.

none: Does not perform authentication.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary authentication method and multiple backup authentication methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authentication portal radius-scheme radius-scheme-name local none command specifies the default primary RADIUS authentication method and two backup methods (local authentication and no authentication). The device performs RADIUS authentication by default and performs local authentication when RADIUS authentication is invalid. The device does not perform authentication when both of the previous methods are invalid.

The remote authentication method is invalid in the following situations:

· The specified authentication scheme does not exist.

· Authentication packet sending fails.

· The device does not receive any authentication response packets from an authentication server.

The local authentication method is invalid if the device fails to find the matching local user configuration.

When the primary authentication method is local, the following rules apply to the authentication of a user:

· The device uses the backup authentication methods in sequence only if local authentication is invalid for one of the following reasons:

¡ An exception occurs in the local authentication process.

¡ The user account is not configured on the device or the user is not allowed to use the portal service.

· The device does not turn to the backup authentication methods if local authentication is invalid because of any other reason. Authentication fails for the user.

Examples

# In ISP domain test, perform local authentication for portal users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication portal local

# In ISP domain test, perform RADIUS authentication for portal users based on scheme rd and use local authentication as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication portal radius-scheme rd local

Related commands

authentication default

ldap scheme

local-user

radius scheme

authentication ppp

Use authentication ppp to specify authentication methods for PPP users.

Use undo authentication ppp to restore the default.

Syntax

In non-FIPS mode:

authentication ppp { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }

undo authentication ppp

In FIPS mode:

authentication ppp { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }

undo authentication ppp

Default

The default authentication methods of the ISP domain are used for PPP users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local authentication.

none: Does not perform authentication.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary authentication method and multiple backup authentication methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authentication ppp radius-scheme radius-scheme-name local none command specifies a primary RADIUS authentication method and two backup methods (local authentication and no authentication). The device performs RADIUS authentication by default and performs local authentication when RADIUS authentication is invalid. The device does not perform authentication when both of the previous methods are invalid.

The remote authentication method is invalid in the following situations:

· The specified authentication scheme does not exist.

· Authentication packet sending fails.

· The device does not receive any authentication response packets from an authentication server.

The local authentication method is invalid if the device fails to find the matching local user configuration.

When the primary authentication method is local, the following rules apply to the authentication of a user:

· The device uses the backup authentication methods in sequence only if local authentication is invalid for one of the following reasons:

¡ An exception occurs in the local authentication process.

¡ The user account is not configured on the device or the user is not allowed to use the PPP service.

· The device does not turn to the backup authentication methods if local authentication is invalid because of any other reason. Authentication fails for the user.

Examples

# In ISP domain test, perform local authentication for PPP users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication ppp local

# In ISP domain test, perform RADIUS authentication for PPP users based on scheme rd and use local authentication as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authentication ppp radius-scheme rd local

Related commands

authentication default

hwtacacs scheme

local-user

radius scheme

authentication super

Use authentication super to specify a method for user role authentication.

Use undo authentication super to restore the default.

Syntax

authentication super { hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name } *

undo authentication super

Default

The default authentication methods of the ISP domain are used for user role authentication.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

To enable a user to obtain another user role without reconnecting to the device, you must configure user role authentication. The device supports local and remote methods for user role authentication. For more information about user role authentication, see RBAC configuration in Fundamentals Configuration Guide.

You can specify one authentication method and one backup authentication method to use in case that the previous authentication method is invalid.

Examples

# In ISP domain test, perform user role authentication based on HWTACACS scheme tac.

<Sysname> system-view

[Sysname] super authentication-mode scheme

[Sysname] domain name test

[Sysname-isp-test] authentication super hwtacacs-scheme tac

Related commands

authentication default

hwtacacs scheme

radius scheme

authorization 5g

Use authorization 5g to specify authorization methods for 5G users.

Use undo authorization 5g to restore the default.

Syntax

authorization 5g { none | radius-scheme radius-scheme-name [ none ] }

undo authorization 5g

Default

The default authorization methods are used for 5G users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

none: Does not perform authorization.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

To have the AAA module perform RADIUS authorization first and then not perform authorization when RADIUS authorization is invalid, execute the authorization 5g radius-scheme radius-scheme-name none command.

Examples

# Configure ISP domain test not to perform authorization for 5G users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization 5g none

# Configure ISP domain test to perform RADIUS authorization for 5G users based on scheme rd and not to perform authorization when RADIUS authorization is invalid.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization 5g radius-scheme rd none

Related commands

display domain

radius scheme

authorization advpn

Use authorization advpn to specify authorization methods for ADVPN users.

Use undo authorization advpn to restore the default.

Syntax

In non-FIPS mode:

authorization advpn { local [ radius-scheme radius-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo authorization advpn

In FIPS mode:

authorization advpn { local | radius-scheme radius-scheme-name } *

undo authorization advpn

Default

The default authorization methods of the ISP domain are used for ADVPN users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

local: Performs local authorization.

none: Does not perform authorization.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The RADIUS authorization configuration takes effect only when authentication and authorization methods of the ISP domain use the same RADIUS scheme.

You can specify one primary authorization method and multiple backup authorization methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authorization advpn radius-scheme radius-scheme-name local none command specifies a primary RADIUS authorization method and two backup methods (local authorization and no authorization). The device performs RADIUS authorization by default and performs local authorization when RADIUS authorization is invalid. The device does not perform authorization when both of the previous methods are invalid.

The remote authorization method is invalid in the following situations:

· The specified authorization scheme does not exist.

· Authorization packet sending fails.

· The device does not receive any authorization response packets from an authorization server.

The local authorization method is invalid if the device fails to find the matching local user configuration.

When the primary authorization method is local, the following rules apply to the authorization of a user:

· The device uses the backup authorization methods in sequence only if local authorization is invalid for one of the following reasons:

¡ An exception occurs in the local authorization process.

¡ The user account is not configured on the device or the user is not allowed to use the ADVPN service.

· The device does not turn to the backup authorization methods if local authorization is invalid because of any other reason. Authorization fails for the user.

Examples

# In ISP domain test, perform local authorization for ADVPN users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization advpn local

# In ISP domain test, perform RADIUS authorization for ADVPN users based on scheme rd and use local authorization as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization advpn radius-scheme rd local

Related commands

authorization default

local-user

radius scheme

authorization command

Use authorization command to specify command authorization methods.

Use undo authorization command to restore the default.

Syntax

In non-FIPS mode:

authorization command { hwtacacs-scheme hwtacacs-scheme-name [ local ] [ none ] | local [ none ] | none }

undo authorization command

In FIPS mode:

authorization command { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local }

undo authorization command

Default

The default authorization methods of the ISP domain are used for command authorization.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local authorization.

none: Does not perform authorization. The authorization server does not verify whether the entered commands are permitted by the user role. The commands are executed successfully if the user role has permission to the commands.

Usage guidelines

Command authorization restricts login users to execute only authorized commands by employing an authorization server to verify whether each entered command is permitted.

When local command authorization is configured, the device compares each entered command with the user's configuration on the device. The command is executed only when it is permitted by the user's authorized user roles.

The commands that can be executed are controlled by both the access permission of user roles and command authorization of the authorization server. Access permission only controls whether the authorized user roles have access to the entered commands, but it does not control whether the user roles have obtained authorization to these commands. If a command is permitted by the access permission but denied by command authorization, this command cannot be executed.

You can specify one primary command authorization method and multiple backup command authorization methods.

When the default authorization method is invalid, the device attempts to use the backup authorization methods in sequence. For example, the authorization command hwtacacs-scheme hwtacacs-scheme-name local none command specifies the default HWTACACS authorization method and two backup methods (local authorization and no authorization). The device performs HWTACACS authorization by default and performs local authorization when the HWTACACS server is invalid. The device does not perform command authorization when both of the previous methods are invalid.

The remote authorization method is invalid in the following situations:

· The specified authorization scheme does not exist.

· Authorization packet sending fails.

· The device does not receive any authorization response packets from an authorization server.

The local authorization method is invalid if the device fails to find the matching local user configuration.

Examples

# In ISP domain test, configure the device to perform local command authorization.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization command local

# In ISP domain test, perform command authorization based on HWTACACS scheme hwtac and use local authorization as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization command hwtacacs-scheme hwtac local

Related commands

command authorization (Fundamentals Command Reference)

hwtacacs scheme

local-user

authorization default

Use authorization default to specify default authorization methods for an ISP domain.

Use undo authorization default to restore the default.

Syntax

In non-FIPS mode:

authorization default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }

undo authorization default

In FIPS mode:

authorization default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }

undo authorization default

Default

The default authorization method of an ISP domain is local.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local authorization.

none: Does not perform authorization. The following default authorization information applies after users pass authentication:

· Login users obtain the level-0 user role. Login users include the Telnet, FTP, SFTP, SCP, and terminal users. Terminal users can access the device through the console or asyn port. For more information about the level-0 user role, see RBAC configuration in Fundamentals Configuration Guide.

· The working directory for FTP, SFTP, and SCP login users is the root directory of the NAS. However, the users do not have permission to access the root directory.

· Non-login users can access the network.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The default authorization method is used for all users that support this method and do not have an authorization method configured.

The RADIUS authorization configuration takes effect only when the authentication method and authorization method of the ISP domain use the same RADIUS scheme.

You can specify one primary authorization method and multiple backup authorization methods.

When the default authorization method is invalid, the device attempts to use the backup authorization methods in sequence. For example, the authorization default radius-scheme radius-scheme-name local none command specifies the default RADIUS authorization method and two backup methods (local authorization and no authorization). The device performs RADIUS authorization by default and performs local authorization when RADIUS authorization is invalid. The device does not perform authorization when both of the previous methods are invalid.

The remote authorization method is invalid in the following situations:

· The specified authorization scheme does not exist.

· Authorization packet sending fails.

· The device does not receive any authorization response packets from an authorization server.

The local authorization method is invalid if the device fails to find the matching local user configuration.

When the primary authorization method is local, the following rules apply to the authorization of a user:

· The device uses the backup authorization methods in sequence only if local authorization is invalid for one of the following reasons:

¡ An exception occurs in the local authorization process.

¡ The user account is not configured on the device or the user is not allowed to use the access service.

· The device does not turn to the backup authorization methods if local authorization is invalid because of any other reason. Authorization fails for the user.

Examples

# In ISP domain test, use RADIUS scheme rd as the primary default authorization method and use local authorization as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization default radius-scheme rd local

Related commands

hwtacacs scheme

local-user

radius scheme

authorization ike

Use authorization ike to specify authorization methods for IKE extended authentication.

Use undo authorization ike to restore the default.

Syntax

In non-FIPS mode:

authorization ike { local [ none ] | none }

undo authorization ike

In FIPS mode:

authorization ike local

undo authorization ike

Default

The default authorization methods of the ISP domain are used for IKE extended authentication.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

local: Performs local authorization.

none: Does not perform authorization.

Usage guidelines

You can specify one primary authorization method and one backup authorization method.

When the primary method is invalid, the device attempts to use the backup method.

Examples

# In ISP domain test, perform local authorization for IKE extended authentication.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization ike local

Related commands

authorization default

local-user

authorization ipoe

Use authorization ipoe to specify authorization methods for IPoE users.

Use undo authorization ipoe to restore the default.

Syntax

In non-FIPS mode:

authorization ipoe { local [ radius-scheme radius-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo authorization ipoe

In FIPS mode:

authorization ipoe { local | radius-scheme radius-scheme-name }*

undo authorization ipoe

Default

The default authorization methods of the ISP domain are used for IPoE users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

local: Performs local authorization.

none: Does not perform authorization.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The RADIUS authorization configuration takes effect only when authentication and authorization methods of the ISP domain use the same RADIUS scheme.

You can specify one primary authorization method and multiple backup authorization methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authorization ipoe radius-scheme radius-scheme-name local none command specifies a primary RADIUS authorization method and two backup methods (local authorization and no authorization). The device performs RADIUS authorization by default and performs local authorization when RADIUS authorization is invalid. The device does not perform authorization when both of the previous methods are invalid.

The remote authorization method is invalid in the following situations:

· The specified authorization scheme does not exist.

· Authorization packet sending fails.

· The device does not receive any authorization response packets from an authorization server.

The local authorization method is invalid if the device fails to find the matching local user configuration.

When the primary authorization method is local, the following rules apply to the authorization of a user:

· The device uses the backup authorization methods in sequence only if local authorization is invalid for one of the following reasons:

¡ An exception occurs in the local authorization process.

¡ The user account is not configured on the device or the user is not allowed to use the IPoE service.

· The device does not turn to the backup authorization methods if local authorization is invalid because of any other reason. Authorization fails for the user.

Examples

# In ISP domain test, perform local authorization for IPoE users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization ipoe local

# In ISP domain test, perform RADIUS authorization for IPoE users based on scheme rd and use local authorization as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization ipoe radius-scheme rd local

Related commands

authorization default

local-user

radius scheme

authorization lan-access

Use authorization lan-access to specify authorization methods for LAN users.

Use undo authorization lan-access to restore the default.

Syntax

In non-FIPS mode:

authorization lan-access { local [ radius-scheme radius-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo authorization lan-access

In FIPS mode:

authorization lan-access { local | radius-scheme radius-scheme-name } *

undo authorization lan-access

Default

The default authorization methods of the ISP domain are used for LAN users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

local: Performs local authorization.

none: Does not perform authorization. An authenticated LAN user directly accesses the network.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The RADIUS authorization configuration takes effect only when authentication and authorization methods of the ISP domain use the same RADIUS scheme.

You can specify one primary authorization method and multiple backup authorization methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authorization lan-access radius-scheme radius-scheme-name local none command specifies a primary RADIUS authorization method and two backup methods (local authorization and no authorization). The device performs RADIUS authorization by default and performs local authorization when RADIUS authorization is invalid. The device does not perform authorization when both of the previous methods are invalid.

The remote authorization method is invalid in the following situations:

· The specified authorization scheme does not exist.

· Authorization packet sending fails.

· The device does not receive any authorization response packets from an authorization server.

The local authorization method is invalid if the device fails to find the matching local user configuration.

When the primary authorization method is local, the following rules apply to the authorization of a user:

· The device uses the backup authorization methods in sequence only if local authorization is invalid for one of the following reasons:

¡ An exception occurs in the local authorization process.

¡ The user account is not configured on the device or the user is not allowed to use the LAN access service.

· The device does not turn to the backup authorization methods if local authorization is invalid because of any other reason. Authorization fails for the user.

Examples

# In ISP domain test, perform local authorization for LAN users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization lan-access local

# In ISP domain test, perform RADIUS authorization for LAN users based on scheme rd and use local authorization as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization lan-access radius-scheme rd local

Related commands

authorization default

local-user

radius scheme

authorization login

Use authorization login to specify authorization methods for login users.

Use undo authorization login to restore the default.

Syntax

In non-FIPS mode:

authorization login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }

undo authorization login

In FIPS mode:

authorization login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }

undo authorization login

Default

The default authorization methods of the ISP domain are used for login users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local authorization.

none: Does not perform authorization. The following default authorization information applies after users pass authentication:

· The working directory for FTP, SFTP, and SCP login users is the root directory of the NAS. However, the users do not have permission to access the root directory.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The RADIUS authorization configuration takes effect only when the authentication method and authorization method of the ISP domain use the same RADIUS scheme.

You can specify one primary authorization method and multiple backup authorization methods.

When the default authorization method is invalid, the device attempts to use the backup authorization methods in sequence. For example, the authorization login radius-scheme radius-scheme-name local none command specifies the default RADIUS authorization method and two backup methods (local authorization and no authorization). The device performs RADIUS authorization by default and performs local authorization when RADIUS authorization is invalid. The device does not perform authorization when both of the previous methods are invalid.

The remote authorization method is invalid in the following situations:

· The specified authorization scheme does not exist.

· Authorization packet sending fails.

· The device does not receive any authorization response packets from an authorization server.

The local authorization method is invalid if the device fails to find the matching local user configuration.

When the primary authorization method is local, the following rules apply to the authorization of a user:

· The device uses the backup authorization methods in sequence only if local authorization is invalid for one of the following reasons:

¡ An exception occurs in the local authorization process.

¡ The user account is not configured on the device or the user is not allowed to use the service for accessing the device.

· The device does not turn to the backup authorization methods if local authorization is invalid because of any other reason. Authorization fails for the user.

Examples

# In ISP domain test, perform local authorization for login users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization login local

# In ISP domain test, perform RADIUS authorization for login users based on scheme rd and use local authorization as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization login radius-scheme rd local

Related commands

authorization default

hwtacacs scheme

local-user

radius scheme

authorization portal

Use authorization portal to specify authorization methods for portal users.

Use undo authorization portal to restore the default.

Syntax

In non-FIPS mode:

authorization portal { local [ radius-scheme radius-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo authorization portal

In FIPS mode:

authorization portal { local | radius-scheme radius-scheme-name } *

undo authorization portal

Default

The default authorization methods of the ISP domain are used for portal users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

local: Performs local authorization.

none: Does not perform authorization. An authenticated portal user directly accesses the network.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The RADIUS authorization configuration takes effect only when the authentication method and authorization method of the ISP domain use the same RADIUS scheme.

You can specify one primary authorization method and multiple backup authorization methods.

When the default authorization method is invalid, the device attempts to use the backup authorization methods in sequence. For example, the authorization portal radius-scheme radius-scheme-name local none command specifies the default RADIUS authorization method and two backup methods (local authorization and no authorization). The device performs RADIUS authorization by default and performs local authorization when RADIUS authorization is invalid. The device does not perform authorization when both of the previous methods are invalid.

The remote authorization method is invalid in the following situations:

· The specified authorization scheme does not exist.

· Authorization packet sending fails.

· The device does not receive any authorization response packets from an authorization server.

The local authorization method is invalid if the device fails to find the matching local user configuration.

When the primary authorization method is local, the following rules apply to the authorization of a user:

· The device uses the backup authorization methods in sequence only if local authorization is invalid for one of the following reasons:

¡ An exception occurs in the local authorization process.

¡ The user account is not configured on the device or the user is not allowed to use the portal service.

· The device does not turn to the backup authorization methods if local authorization is invalid because of any other reason. Authorization fails for the user.

Examples

# In ISP domain test, perform local authorization for portal users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization portal local

# In ISP domain test, perform RADIUS authorization for portal users based on scheme rd and use local authorization as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization portal radius-scheme rd local

Related commands

authorization default

local-user

radius scheme

authorization ppp

Use authorization ppp to specify authorization methods for PPP users.

Use undo authorization ppp to restore the default.

Syntax

In non-FIPS mode:

authorization ppp { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }

undo authorization ppp

In FIPS mode:

authorization ppp { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] | local [ hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name ] * | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }

undo authorization ppp

Default

The default authorization methods of the ISP domain are used for PPP users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local authorization.

none: Does not perform authorization.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The RADIUS authorization configuration takes effect only when the authentication method and authorization method of the ISP domain use the same RADIUS scheme.

You can specify one primary authorization method and multiple backup authorization methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authorization ppp radius-scheme radius-scheme-name local none command specifies a primary RADIUS authorization method and two backup methods (local authorization and no authorization). The device performs RADIUS authorization by default and performs local authorization when RADIUS authorization is invalid. The device does not perform authorization when both of the previous methods are invalid.

The remote authorization method is invalid in the following situations:

· The specified authorization scheme does not exist.

· Authorization packet sending fails.

· The device does not receive any authorization response packets from an authorization server.

The local authorization method is invalid if the device fails to find the matching local user configuration.

When the primary authorization method is local, the following rules apply to the authorization of a user:

· The device uses the backup authorization methods in sequence only if local authorization is invalid for one of the following reasons:

¡ An exception occurs in the local authorization process.

¡ The user account is not configured on the device or the user is not allowed to use the PPP service.

· The device does not turn to the backup authorization methods if local authorization is invalid because of any other reason. Authorization fails for the user.

Examples

# In ISP domain test, perform local authorization for PPP users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization ppp local

# In ISP domain test, perform RADIUS authorization for PPP users based on scheme rd and use local authorization as the backup.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization ppp radius-scheme rd local

Related commands

authorization default

hwtacacs scheme

local-user

radius scheme

authorization-attribute (ISP domain view)

Use authorization-attribute to configure authorization attributes for users in an ISP domain.

Use undo authorization-attribute to restore the default of an authorization attribute.

Syntax

authorization-attribute { acl acl-number | author-profile profile-name | car inbound cir committed-information-rate [ pir peak-information-rate ] outbound cir committed-information-rate [ pir peak-information-rate ] | idle-cut minutes [ flow ] [ traffic { both | inbound | outbound } ] | igmp max-access-number max-access-number | ip-pool ipv4-pool-name | ipv6-pool ipv6-pool-name | ipv6-prefix ipv6-prefix prefix-length | mld max-access-number max-access-number | { primary-dns | secondary-dns } { ip ipv4-address | ipv6 ipv6-address } | session-group-profile session-group-profile-name | session-timeout timeout | url url-string | user-group user-group-name | user-priority { inbound | outbound } priority | user-profile profile-name | vlan vlan-id | vpn-instance vpn-instance-name | vsi vsi-name }

undo authorization-attribute { acl | author-profile | car | idle-cut | igmp | ip-pool | ipv6-pool | ipv6-prefix | mld | { primary-dns | secondary-dns } { ip | ipv6 }| session-group-profile | session-timeout | url | user-group | user-priority { inbound | outbound } | user-profile | vlan | vpn-instance | vsi }

Default

The idle cut feature is disabled.

An IPv4 user can concurrently join a maximum of four IGMP multicast groups.

An IPv6 user can concurrently join a maximum of four MLD multicast groups.

No other authorization attributes exist.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

acl acl-number: Specifies an ACL to filter traffic for users. The value range for the acl-number argument varies by device model. This option is applicable only to portal and LAN users. The device processes the traffic that matches the rules in the authorization ACL based on the permit or deny statement in the rules.

author-profile profile-name: Specifies the name of an authorization profile, a case-insensitive string of 1 to 31 characters. An authorization profile defines a set of authorization attributes and can be used to authorize network resources on a VPN basis. This option takes effect only on 802.1X, MAC, and Web authentication users. For Web authorization users, only the microsegments and the VPN instances defined in an authorization profile takes effect, and the VSI configuration is not supported.

car: Specifies a CAR action for users. Typically, the attribute applies to authenticated users. If you configure the attribute in a portal preauthentication domain, the CAR action applies before portal authentication. This keyword is applicable only to IPoE, LAN, portal, and PPP users.

inbound: Specifies the upload rate of users.

outbound: Specifies the download rate of users.

cir committed-information-rate: Specifies the committed information rate in kbps. The value range for this argument varies by device model.

pir peak-information-rate: Specifies the peak information rate in kbps. The peak information rate cannot be smaller than the committed information rate. If you do not specify this option, the CAR action does not restrict users by peak information rate. The value range for this argument varies by device model.

idle-cut minutes: Specifies an idle timeout period in minutes. The value range for the minutes argument is 1 to 129600. This option is applicable only to IPoE, wireless LAN, and PPP users.

flow: Specifies the minimum traffic that must be generated in the idle timeout period in bytes. The value range is 1 to 10240000, and the default value is 10240.

traffic: Specifies the traffic direction for the idle cut feature. If you do not specify this keyword, the idle cut feature applies to both traffic directions.

both: Specifies both traffic directions.

inbound: Specifies the inbound direction.

outbound: Specifies the outbound direction.

igmp max-access-number max-access-number: Specifies the maximum number of IGMP groups that an IPv4 user can join concurrently. The value range for the max-access-number argument is 1 to 64. This option is applicable only to IPoE, portal, and PPP users.

ip-pool ipv4-pool-name: Specifies an IPv4 pool for users. The ipv4-pool-name argument is a case-insensitive string of 1 to 63 characters. This option is applicable only to PPP, IKE, IPoE, and portal users.

ipv6-pool ipv6-pool-name: Specifies an IPv6 pool for users. The ipv6-pool-name argument is a case-insensitive string of 1 to 63 characters. This option is applicable only to IPoE, portal, and PPP users.

ipv6-prefix ipv6-prefix prefix-length: Specifies an IPv6 address prefix for users. The value range for the prefix-length argument is 1 to 128. This option is applicable only to IPoE and PPP users.

mld max-access-number max-access-number: Specifies the maximum number of MLD groups that an IPv6 user can join concurrently. The value range for the max-access-number argument is 1 to 64. This option is applicable only to IPoE, portal, and PPP users.

primary-dns ip ipv4-address: Specifies the IPv4 address of the primary DNS server for users. This option is applicable only to IPoE and PPP users.

primary-dns ipv6 ipv6-address: Specifies the IPv6 address of the primary DNS server for users. This option is applicable only to IPoE and PPP users.

secondary-dns ip ipv4-address: Specifies the IPv4 address of the secondary DNS server for users. This option is applicable only to IPoE and PPP users.

secondary-dns ipv6 ipv6-address: Specifies the IPv6 address of the secondary DNS server for users. This option is applicable only to IPoE and PPP users.

session-group-profile session-group-profile-name: Specifies an authorization session group profile for users. The session-group-profile-name argument is a case-sensitive string of 1 to 31 characters and can contain only letters, digits, underscores (_), minus signs (-), and dots (.). The string can begin with a letter or a digit, but it cannot be all digits. Typically, the attribute applies to authenticated users. If you configure the attribute in a portal preauthentication domain, the session group profile applies before portal authentication. This option is applicable only to IPoE, portal, and PPP users.

session-timeout timeout: Sets the session timeout timer for users, in seconds. The value range for the timeout argument is 1 to 4294967294. The device logs out a user when the session timeout timer expires for that user. If the RADIUS server assigns that user the Session-Timeout attribute, the value in the assigned attribute takes precedence over the session timeout timer set on the device. The session timeout timer attribute is applicable only to PPP, IPoE, portal, and LAN users.

url url-string: Specifies a redirect URL for users. The url-string argument is a case-sensitive string of 1 to 255 characters. The URL must start with http:// or https://. You can configure the redirect URL attribute to push advertisements or notifications to users after the users pass authentication or push bill overdue notifications to users. This option is applicable only to IPoE and LAN users. For IPoE users, you must specify a URL with port number 80 or 443.

user-group user-group-name: Specifies a user group for users. The user-group-name argument is a case-insensitive string of 1 to 32 characters. Authenticated users obtain all attributes of the user group.

user-priority: Specifies a user priority for users. The device uses the specified user priority to perform QoS priority mapping on user packets, and then assigns the user packets to a queue based on the target priority. Packets in a high-priority queue are preferentially scheduled when congestion occurs. In addition to priority mapping, the device replaces the value of the IP Precedence field in upstream packets of users with the specified user priority. You can set the upstream user priority in conjunction with the downstream user priority. By default, no user priority is assigned to users. The user priority attribute is applicable to portal and IPoE users.

inbound: Applies the user priority to upstream packets of users.

outbound: Applies the user priority to downstream packets of users.

priority: Specifies a user priority in the range of 0 to 7. The greater the value, the higher the priority.

user-profile profile-name: Specifies an authorization user profile by its name. The profile-name argument is a case-sensitive string of 1 to 31 characters. Valid characters include letters, digits, underscores (_), minus signs (-), and dots (.). The string can begin with a letter or digit, but it cannot be all digits. Typically, the attribute applies to authenticated users. If you configure the attribute in a portal preauthentication domain, the user profile applies before portal authentication. This option is applicable only to PPP, portal, IPoE, and LAN users.

vlan vlan-id: Specifies an authorization VLAN for users. The vlan-id argument represents a VLAN ID in the range of 1 to 4094. This attribute takes effect only on wired 802.1X, Web authentication, and MAC authentication users.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the users belong. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. When a user passes authentication, it has permission to access the network resources in the specified VPN. This option is applicable only to PPP and IPoE users.

vsi vsi-name: Specifies an authorization VSI for users. The vsi-name represents a VSI name, a case-sensitive string of 1 to 31 characters. This attribute takes effect only on wired 802.1X and MAC authentication users.

Usage guidelines

When the idle cut feature is configured, the device periodically detects the traffic of each online user. The device logs out users that do not meet the minimum traffic requirement in the idle timeout period. When the idle cut feature is disabled on the device, the idle cut feature of the server takes effect. The server considers a user idle if the user's traffic is less than 10240 bytes in a configurable idle timeout period.

If authorization attributes are configured in an IPoE preauthentication domain, the device assigns the attributes to the users after the users pass preauthentication and obtain IP addresses. The attributes restrict access behaviors of the users before the users pass Web authentication.

If the server or NAS does not authorize any attributes to an authenticated user, the device authorizes the attributes in the ISP domain to the user. However, if the server authorizes the CAR action attribute only for one direction, the device does not authorize the CAR action attribute of the ISP domain for the other direction.

You can configure multiple authorization attributes for users in an ISP domain. If you execute the command multiple times with the same attribute specified, the most recent configuration takes effect.

When you specify an authorization ACL, the following restrictions apply:

· The authorization ACL is invalid if it does not exist or does not contain rules. If strict checking on authorization ACLs is enabled for portal users in this situation, portal users will be forced offline.

· Support for the VPN instance parameter in the ACL rules for LAN users depends on the device model.

· Support for the VPN instance parameter in the ACL rules for portal users depends on the device model.

· For portal users to come online after passing authentication, make sure ACLs assigned to portal users do not have rules specified with a source IP or MAC address.

To avoid user logoff caused by authorization attribute conflicts, do not assign an authorization VSI and an authorization VLAN at the same time. The conflict occurs in the following cases:

· The server authorizes a VSI through session control or CoA messages to an online user that is authorized with a VLAN at association.

· The server authorizes a VLAN through session control or CoA messages to an online user that is authorized with a VSI at association.

· The server authorizes a VSI through session control or CoA messages to an online user that uses the default authorization VLAN because no VLAN or VSI is authorized at association.

Examples

# Specify user group abc as the authorization user group for users in ISP domain test.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] authorization-attribute user-group abc

Related commands

display domain

basic-service-ip-type

Use basic-service-ip-type to specify the types of IP addresses that PPPoE and L2TP users must rely on to use the basic services.

Use undo basic-service-ip-type to restore the default.

Syntax

basic-service-ip-type { ipv4 | ipv6 | ipv6-pd } *

undo basic-service-ip-type

Default

PPPoE and L2TP users do not rely on any types of IP addresses to use the basic services.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

ipv4: Specifies the IPv4 address type.

ipv6: Specifies the IPv6 address type.

ipv6-pd: Specifies the IPv6-PD address type. This type of IPv6 addresses are generated based on the DHCPv6 server-assigned prefix.

Usage guidelines

This command takes effect only when the device acts as a PPPoE server or L2TP LNS.

A PPPoE or L2TP user might request multiple services of different IP address types. The device logs off the user if the user does not obtain the IP addresses of all types for the services. This command enables the device to allow the user to come online if the user has obtained IP addresses of the specified types for the basic services.

The device does not allow a PPPoE or L2TP user to come online if the user does not obtain IP addresses of all the specified types for the basic services. For example, if you execute the basic-service-ip-type ipv6 command, the device does not allow a PPPoE or L2TP user to come online if the user does not obtain an IPv6 address.

If you specify both the ipv6 and ipv6-pd keywords, the device does not allow a PPPoE or L2TP user that fails IPv6 address negotiation or PD negotiation to come online.

Examples

# In ISP domain test, specify PPPoE and L2TP users to rely on IPv4 addresses to use the basic services.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] basic-service-ip-type ipv4

Related commands

display domain

dhcpv6-follow-ipv6cp

Use dhcpv6-follow-ipv6cp to set the IPv6 address wait timer for PPPoE and L2TP users.

Use undo dhcpv6-follow-ipv6cp to restore the default.

Syntax

dhcpv6-follow-ipv6cp timeout delay-time

undo dhcpv6-follow-ipv6cp

Default

No IPv6 address wait timer is set for PPPoE and L2TP users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

timeout delay-time: Sets the IPv6 address wait timer, in the range of 30 to 1000 seconds.

Usage guidelines

This command takes effect only when the device acts as a PPPoE server or L2TP LNS.

The IPv6 address wait timer defines the maximum amount of time that a user can wait before the device determines that the user fails to obtain an IPv6 address or PD prefix.

The device starts an IPv6 address wait timer for a user after it finishes IPv6CP negotiation with the user. If the user's basic service relies on an IPv6 address or PD prefix but it fails to obtain any IPv6 address or PD prefix when the timer expires, the user cannot come online.

As a best practice, increase the IPv6 address wait timer in the following situations:

· The network connectivity is unstable.

· The device uses DHCPv6 to assign IPv6 addresses to users.

· The ISP domain serves a large number of PPPoE and L2TP users.

Examples

# In ISP domain test, set the IPv6 address wait timer to 90 seconds for PPPoE and L2TP users.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] dhcpv6-follow-ipv6cp timeout 90

Related commands

basic-service-ip-type

display domain

display aaa abnormal-offline-record

Use display aaa abnormal-offline-record to display user abnormal offline records.

Syntax

display aaa abnormal-offline-record { access-type { ipoe | lan-access | login | portal | ppp } | domain domain-name | interface interface-type interface-number | { ip ipv4-address | ipv6 ipv6-address } | mac-address mac-address | s-vlan svlan-id [ c-vlan cvlan-id ] | slot slot-number | username user-name [ fuzzy-match ] } * [ brief | count count ]

display aaa abnormal-offline-record offline-reason { idle-cut | quota-out | realtime-acct-fail | session-timeout | user-detect-fail } [ brief ]

display aaa abnormal-offline-record time begin-time end-time [ date begin-date end-date ] [ brief ]

display aaa abnormal-offline-record

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

access-type: Specifies users by the access type.

ipoe: Specifies IPoE users.

lan-access: Specifies LAN users, such as 802.1X users and MAC authentication users.

portal: Specifies portal users.

ppp: Specifies PPP users.

domain domain-name: Specifies an ISP domain by its name, a case-insensitive string of 1 to 255 characters.

interface interface-type interface-number: Specifies an interface by its interface type and interface number.

ip ipv4-address: Specifies a user by its IPv4 address.

ipv6 ipv6-address: Specifies a user by its IPv6 address.

mac-address mac-address: Specifies a user by its MAC address in the format of H-H-H.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays user abnormal offline records for all cards.

s-vlan svlan-id: Specifies an SVLAN by its VLAN ID in the range of 1 to 4094.

c-vlan cvlan-id: Specifies a CVLAN by its VLAN ID in the range of 1 to 4094.

username user-name: Specifies users using the specified username, a case-sensitive string of 1 to 253 characters.

fuzzy-match: Matches the username in fuzzy mode. In fuzzy mode, a user matches if the user's username includes the specified username. If you do not specify this keyword, the device matches the username in exact mode. In exact mode, a user matches if the user's username is the same as the specified username.

offline-reason: Specifies a user offline reason.

idle-cut: Specifies the reason as session idle timeout.

quota-out: Specifies the reason as data quota out.

realtime-acct-fail: Specifies the reason as realtime accounting failure.

session-timeout: Specifies the reason as session timeout.

user-detect-fail: Specifies the reason as user online detection failure.

time: Specifies user abnormal offline records generated in a time range.

begin-time: Specifies the start time in the format of hh:mm:ss. The value range for the hh argument is 0 to 23. The value range for the mm and ss arguments is 0 to 59.

end-time: Specifies the end time in the format of hh:mm:ss. The value range for the hh argument is 0 to 23. The value range for the mm and ss arguments is 0 to 59.

date: Specifies a date range. If you do not specify a date range, this command displays user abnormal offline records on the current day.

begin-date: Specifies the start date in the format of MM/DD/YYYY or YYYY/MM/DD. The value range for the MM argument is 1 to 12. The value range for the DD argument varies with the specified month. The value range for the YYYY argument is 2000 to 2035.

end-date: Specifies the end date in the format of MM/DD/YYYY or YYYY/MM/DD. The value range for the MM argument is 1 to 12. The value range for the DD argument varies with the specified month. The value range for the YYYY argument is 2000 to 2035.

brief: Displays brief information about user abnormal offline records. If you do not specify this keyword, the command displays detailed information about user abnormal offline records.

count count: Specifies the number of user abnormal offline records to be displayed. The value range for the count argument is 1 to 32768.

Usage guidelines

You can specify multiple query criteria to filter user abnormal offline records. This command displays the most recent user abnormal offline records that match the specified criteria in reverse chronological order.

If user abnormal offline records exist in the system, you can use this command to display the records regardless of whether user abnormal offline recording is enabled or not.

If you do not specify any parameters, this command displays detailed information about user abnormal offline records for all users.

If the usernames that the server sends to the device include invisible characters, for the device to display the records for users with such usernames, you must specify the fuzzy-match keyword in this command.

Examples

# Display detailed information about abnormal offline records for all users.

<Sysname> display aaa abnormal-offline-record

Total count: 1

Username: jay

Domain: dm1

MAC address: -

Access type: SSH

Access interface: GigabitEthernet1/0/1

SVLAN/CVLAN: -/-

IP address: 19.19.0.2

IPv6 address: -

Online request time: 2020/01/02 15:20:33

Offline time: 2020/02/28 15:20:56

Offline reason: User disconnected from the server.

# Display brief information about abnormal offline records for login users.

<Sysname> display aaa abnormal-offline-record access-type login brief

Username: jay

MAC address: -

IP address: 11.2.2.41

IPv6 address: -

Offline reason: User disconnected from the server.

Table 1 Command output

Field	Description
Total count	Total number of matching user abnormal offline records.
Username	Name of the user. This field does not display anything if the system failed to obtain the username.
Domain	Name of the ISP domain to which the user belongs. This field does not display anything if the system failed to obtain the ISP domain.
MAC address	MAC address of the user. This filed displays a hyphen (-) if the system failed to obtain the MAC address.
Access type	Access type of the user: · · PPPoPhy—PPP over physical link. · PPPoE. · PPPoL2TP—PPP over L2TP. · PPPoFR—PPP over Frame Relay. · VPPP—L2TP auto dial-up. · MAC authentication. · 802.1X. · Web authentication. · Telnet. · FTP. · SSH. · Portal. · IPoE. · IPoE interface leased. · IPoE subnet leased. · IPoE L2VPN leased. · NETCONF over SOAP. · NETCONF over RESTful. · Web—Web login. · Terminal—Terminal login such as console login.
Access interface	Interface through which the user accesses the network. This field displays a hyphen (-) if the system failed to obtain the access interface.
SVLAN/CVLAN	SVLAN and CVLAN to which the user belongs. This field displays a hyphen (-) for the SVLAN or CVLAN in the following situations: · The user does not belong to an SVLAN. · The system failed to obtain the SVLAN or CVLAN of the user.
IP address	IPv4 address of the user. This field displays a hyphen (-) if the system failed to obtain the IPv4 address.
IPv6 address	IPv6 address of the user. This field displays a hyphen (-) if the system failed to obtain the IPv6 address.
Online request time	Time when the user requested to come online.
Offline time	Time when the user went offline.
Offline reason	Reason that the user went offline. For more information about the reasons, see Table 2.

‌

Table 2 shows the reasons that users fail to come online and that users go offline. Support for the reasons depends on device type.

Table 2 User online failure reasons and user offline reasons

Reason	Description
Lost carrier.	The physical link went down.
Lost service.	The service that the user requested is not supported.
NAS error.	An error occurred on the device.
NAS reboot.	The device rebooted.
Admin reboot.	The administrator rebooted the device.
Process exit.	The access process exited.
NAS request.	The device requested to log out the user.
Cut command.	The administrator manually logged out the user at the CLI.
Logged off by the RADIUS server.	The RADIUS server logged out the user.
User request.	The user requested to go offline.
Authentication failed	Authentication failed.
Authorization failed.	Authorization failed.
Start accounting failed.	The device failed to start accounting for the user.
No AAA response during authentication.	The device did not receive a response from the remote authentication server within the authentication timeout time.
RADIUS authentication rejected.	The user failed RADIUS authentication because the username or password was inconsistent with that on the RADIUS server.
AAA authorization information invalid.	The authorization information was invalid or the device did not have configuration of the authorized items.
No AAA response for accounting start.	The device did not receive a response for the start-accounting request sent to the remote server within the start-accounting timeout time.
Authentication request to AAA failed.	The device failed to send the authentication request to the RADIUS server because the route between the device and the RADIUS server is unreachable.
Accounting request to AAA failed.	The device failed to send the accounting request to the RADIUS server because the route between the device and the RADIUS server is unreachable.
TACACS authentication rejected.	The user failed HWTACACS authentication because the username or password was inconsistent with that on the HWTACACS server.
Authentication method error.	The authentication method of the user was inconsistent with the authentication method configured on the access interface.
No AAA response for accounting stop.	The device did not receive a response for the stop-accounting request sent to the server.
The local user doesn't exist.	The local user does not exist on the device.
Local authentication request was rejected.	The user failed local authentication because of incorrect password.
IP assignment failed.	IP address assignment for the user failed.
Concurrent user login limit reached.	Maximum number of concurrent local users that use the username already reached.
NAS interface access limit reached.	Maximum number of online users on the interface already reached.
Maximum number of concurrent users that use this account already reached.	Maximum number of concurrent users that use the username already reached.
PPP negotiation terminated.	PPP negotiation for the user failed.
Insufficient hardware resources.	Hardware resources were insufficient.
Failed to obtain IPv6 prefix.	No IPv6 prefix was available to be assigned to the user.
No response from DHCP server.	The device did not receive a response for the request sent to the DHCP server to apply an IP address for the user.
DHCP IP address allocation failure.	DHCPv6 address assignment for the user failed. Possible reasons include: · No authorization IPv6 pool is configured in the ISP domain. · The IPv6 pool is being locked.
DHCP session conflict.	The DHCP session to be created conflicted with an existing DHCP session.
DHCP user request.	The DHCP user requested to go offline.
DHCP lease timeout.	The allocated IP address lease of the DHCP user expired.
DHCP declined.	The device received a DHCP-decline packet from the DHCP user because the allocated IP address was being used by another DHCP user.
DHCP configuration changed.	The DHCP configuration changed.
NAK from the DHCP server or tenant duration is 0.	The IP address that the DHCP user requested was not on the network segment specified for IP assignment on the device or the lease duration of the address was not extended.
IP conflict on DHCP server.	The device detected an IP address conflict.
DHCP server notified.	The DHCP server instructed the device to log out the user.
DHCP server notified, and the device deleted the user.	The DHCP server instructed the device to log out the user and the device deleted the user.
The static session already exists.	The dynamic IPoE session to be created conflicted with an existing static IPoE session.
NAT444 failed.	IPoE failed to collaborate with NAT444.
The ND RS session is updated.	The device received a new ND RS session request for the user when the user was online.
L2TP tunnel terminated by the peer.	The peer device terminated the L2TP tunnel. It might because the peer device determined that the user had gone offline.
The peer did not respond to control packets.	The peer device did not respond to the PPP control packet from the device.
Failed to set up an L2TP session.	An L2TP session was failed to be created.
Repeated LCP negotiation packets.	The device received a duplicated LCP negotiation packet. It might because the user terminated the connection and then initiated a connection again.
Failed to assign a user rule.	The device failed to issue a portal user rule to the user.
COA failure.	The device failed to process a CoA message for the user.
Failed to update authorization information.	The device failed to update the authorization information for the user.
Realtime accounting request to AAA failed.	The real-time accounting request for the user failed.
Session timeout.	The session of the user timed out.
Data quota limit reached.	The data quotas of the user were used up.
Session idle cut.	The device logged out of the user because the user's traffic in the idle timeout period at the specified direction is less than the specified minimum traffic.
User online detection failure.	The user failed online detection.
Port was removed from VLAN.	The access interface of the user was removed from the VLAN.
Port error.	A port error occurred.
Interface down or deactive.	The protocol of the interface went down, the link on the interface went down, or the interface was deactivated.
VSRP status changed.	VSRP status changed.
Backup device deleted user data that is inconsistent with data on the master device.	The backup device in the VSRP group deleted user data inconsistent with data on the master device.
MAC address change.	The MAC address of the user changed.
Failed to recover AAA resources.	The device failed to recover AAA resources for the user.
Deleted users because of inter-card session conflict.	The device deleted the user because sessions on different cards conflict.
User aged out before coming online.	The online wait timer for the user expired.
MPU-LPU data synchronization failure.	Inter-card data smoothing failed.
Failed to synchronize data with DHCP server.	The device failed to synchronize data with the DHCP server.
Failed to synchronize data with portal server.	The device failed to synchronize data with the portal server.
Failed to synchronize user information with the server.	The device failed to synchronize user data with the DHCP server.
User recovery failure.	User data recovery failed.
Failed to obtain physical information.	The device failed to obtain physical information of the user.
Authorization ACL for the online user changed.	The authorization ACL for the user changed.
Authorization user profile for the online user changed.	The authorization user profile for the user changed.
Magic number check failed.	Magic number check failed.
Reauthentication failed.	Reauthentication for the user failed.
No AAA response during realtime accounting.	The device did not receive a response for the real-time accounting request sent to the server.
Portal notified.	Portal instructed the device to log out the user.
Invalid username or password.	Invalid username or password.
The lock flag of the local user is lock in the password control blacklist	The user is locked in the password control blacklist.
No VTY line available.	No available VTY line because the maximum number of users that use VTY lines already reached.
SSH server received a packet with an incorrect message authentication code.	The message authentication code in the packet from the SSH client was incorrect.
User disconnected from the server.	The SSH or FTP user disconnected from the server.
No working directory available.	No working directory is available.
PTY allocation failed.	PTY allocation failed.
FTP server error.	The user failed to log in to the FTP server because an error existed on the FTP server.
Server is disabled.	The service was disabled.
Service type not supported.	The type of the service that the user requested was not supported.
RBAC denied file management operations in the login command.	RBAC denied file management operations in the login command.
Failed to issue RBAC access permissions to the login user.	The device failed to issue RBAC access permissions to the login user.
NETCONF inner error.	An internal NETCONF error occurred.
NETCONF session was terminated by another NETCONF session.	The NETCONF session of the user was terminated by another NETCONF session.
Failed to allocate public network ports in a CGN network.	Public network port allocation failed on the CGN network.
Failed to obtain an IP address of the type specified for basic services of users.	The user failed to obtain an IP address of the type specified for the basic services of the user.
UserGroup configuration changed.	The configuration of the user group changed.
Service-type mismatch.	Failed to find the service type configuration of the local user.
The local user is blocked.	The local user is in blocked state.
The local user is in the password control blacklist.	The local user is in the password control blacklist.
Binding attributes mismatch.	The attributes of the local user do not match the binding attributes.
The ISP domain does not exist.	The authentication ISP domain does not exist.
The ISP domain is blocked.	The ISP domain is in blocked state.
HWTACACS authorization server is unreachable or the server configuration does not exist.	HWTACACS authorization server is unreachable or the server configuration does not exist.

‌

Related commands

reset aaa abnormal-offline-record

display aaa author-profile

Use display aaa author-profile to display authorization profile information.

Syntax

display aaa author-profile [ name profile-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

name profile-name: Specifies an authorization profile by its name, a case-insensitive string of 1 to 31 characters. If you do not specify this option, this command displays information about all authorization profiles.

Examples

# Display information about all authorization profiles.

<Sysname> display aaa author-profile

Total 2 aaa author-profiles

aaa author-profile: a

default microsegment 1 vsi 1

Total 3 match criteria.

if match vpn-instance 2 microsegment 2 vsi 2

if match vpn-instance 3 microsegment 3 vsi 3

if match vpn-instance 4 microsegment 3 vsi 4

aaa author-profile: b

default microsegment 1 vsi 1

Total 2 match criteria.

if match vpn-instance 2 microsegment 2 vsi 2

if match vpn-instance 3 microsegment 3 vsi 3

# Display information about authorization profile a.

<Sysname> display aaa author-profile a

aaa author-profile: a

default microsegment 1 vsi 1

Total 3 match criteria.

if match vpn-instance 2 microsegment 2 vsi 2

if match vpn-instance 3 microsegment 3 vsi 3

if match vpn-instance 4 microsegment 3 vsi 4

Table 3 Command output

Field	Description
aaa author-profile	Authorization profile name.
default microsegment xxx vsi xxx	Default microsegment and the corresponding VSI.
Total xx match criteria.	Number of VPN and microsegment bindings in the profile.
if match vpn-instance xxx microsegment xxx vsi xxx	VPN instance, the corresponding microsegment, and the corresponding VSI.

‌

Related commands

aaa author-profile

display aaa normal-offline-record

Use display aaa normal-offline-record to display user normal offline records.

Syntax

display aaa normal-offline-record { access-type { ipoe | lan-access | login | portal | ppp } | domain domain-name | interface interface-type interface-number | { ip ipv4-address | ipv6 ipv6-address } | mac-address mac-address | s-vlan svlan-id [ c-vlan cvlan-id ] | slot slot-number | username user-name [ fuzzy-match ] } * [ brief | count count ]

display aaa normal-offline-record time begin-time end-time [ date begin-date end-date ] [ brief ]

display aaa normal-offline-record

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

access-type: Specifies users by the access type.

ipoe: Specifies IPoE users.

lan-access: Specifies LAN users, such as 802.1X users and MAC authentication users.

portal: Specifies portal users.

ppp: Specifies PPP users.

domain domain-name: Specifies an ISP domain by its name, a case-insensitive string of 1 to 255 characters.

interface interface-type interface-number: Specifies an interface by its interface type and interface number.

ip ipv4-address: Specifies a user by its IPv4 address.

ipv6 ipv6-address: Specifies a user by its IPv6 address.

mac-address mac-address: Specifies a user by its MAC address in the format of H-H-H.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays user normal offline records for all cards.

s-vlan svlan-id: Specifies an SVLAN by its VLAN ID in the range of 1 to 4094.

c-vlan cvlan-id: Specifies a CVLAN by its VLAN ID in the range of 1 to 4094.

username user-name: Specifies users using the specified username, a case-sensitive string of 1 to 253 characters.

time: Specifies user normal offline records generated in a time range.

begin-time: Specifies the start time in the format of hh:mm:ss. The value range for the hh argument is 0 to 23. The value range for the mm and ss arguments is 0 to 59.

end-time: Specifies the end time in the format of hh:mm:ss. The value range for the hh argument is 0 to 23. The value range for the mm and ss arguments is 0 to 59.

date: Specifies a date range. If you do not specify a date range, this command displays user abnormal offline records on the current day.

brief: Displays brief information about user normal offline records. If you do not specify this keyword, the command displays detailed information about user normal offline records.

count count: Specifies the number of user normal offline records to be displayed. The value range for the count argument is 1 to 32768.

Usage guidelines

You can specify multiple query criteria to filter user normal offline records. This command displays the most recent user normal offline records that match the specified criteria in reverse chronological order.

If user normal offline records exist in the system, you can use this command to display the records regardless of whether user normal offline recording is enabled or not.

If you do not specify any parameters, this command displays detailed information about user normal offline records for all users.

Examples

# Display detailed information about normal offline records for all users.

<Sysname> display aaa normal-offline-record

Total count: 1

Username: jay

Domain: dm1

MAC address: -

Access type: Telnet

Access interface: GigabitEthernet1/0/1

SVLAN/CVLAN: -/-

IP address: 19.19.0.2

IPv6 address: -

Online request time: 2020/01/02 15:20:33

Offline time: 2020/02/28 15:20:56

Offline reason: User request.

# Display brief information about normal offline records for login users.

<Sysname> display aaa normal-offline-record access-type login brief

Username: jay

MAC address: -

IP address: 11.2.2.41

IPv6 address: -

Offline reason: User request.

Table 4 Command output

Field	Description
Total count	Total number of matching user normal offline records.
Username	Name of the user. This field does not display anything if the system failed to obtain the username.
Domain	Name of the ISP domain to which the user belongs. This field does not display anything if the system failed to obtain the ISP domain.
MAC address	MAC address of the user. This filed displays a hyphen (-) if the system failed to obtain the MAC address.
Access type	Access type of the user: · PPPoPhy—PPP over physical link. · PPPoE. · PPPoL2TP—PPP over L2TP. · PPPoFR—PPP over Frame Relay. · VPPP—L2TP auto dial-up. · MAC authentication. · 802.1X. · Web authentication. · Telnet. · FTP. · SSH. · Portal. · IPoE. · IPoE interface leased. · IPoE subnet leased. · IPoE L2VPN leased. · NETCONF over SOAP. · NETCONF over RESTful. · Web—Web login. · Terminal—Terminal login such as console login.
Access interface	Interface through which the user accesses the network. This field displays a hyphen (-) if the system failed to obtain the access interface.
SVLAN/CVLAN	SVLAN and CVLAN to which the user belongs. This field displays a hyphen (-) for the SVLAN or CVLAN in the following situations: · The user does not belong to an SVLAN. · The system failed to obtain the SVLAN or CVLAN of the user.
IP address	IPv4 address of the user. This field displays a hyphen (-) if the system failed to obtain the IPv4 address.
IPv6 address	IPv6 address of the user. This field displays a hyphen (-) if the system failed to obtain the IPv6 address.
Online request time	Time when the user requested to come online.
Offline time	Time when the user went offline.
Offline reason	Reason that the user went offline. For more information about the reasons, see Table 2.

‌

Related commands

reset aaa normal-offline-record

display aaa offline-record

Use display aaa offline-record to display user offline records.

Syntax

display aaa offline-record { access-type { ipoe | lan-access | login | portal | ppp } | domain domain-name | interface interface-type interface-number | { ip ipv4-address | ipv6 ipv6-address } | mac-address mac-address | s-vlan svlan-id [ c-vlan cvlan-id ] | slot slot-number | username user-name [ fuzzy-match ] } * [ brief | count count ]

display aaa offline-record time begin-time end-time [ date begin-date end-date ] [ brief ]

display aaa offline-record

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

access-type: Specifies users by the access type.

ipoe: Specifies IPoE users.

lan-access: Specifies LAN users, such as 802.1X users and MAC authentication users.

portal: Specifies portal users.

ppp: Specifies PPP users.

domain domain-name: Specifies an ISP domain by its name, a case-insensitive string of 1 to 255 characters.

interface interface-type interface-number: Specifies an interface by its interface type and interface number.

ip ipv4-address: Specifies a user by its IPv4 address.

ipv6 ipv6-address: Specifies a user by its IPv6 address.

mac-address mac-address: Specifies a user by its MAC address in the format of H-H-H.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays user offline records for all cards.

s-vlan svlan-id: Specifies an SVLAN by its VLAN ID in the range of 1 to 4094.

c-vlan cvlan-id: Specifies a CVLAN by its VLAN ID in the range of 1 to 4094.

username user-name: Specifies users using the specified username, a case-sensitive string of 1 to 253 characters.

time: Specifies user offline records generated in a time range.

begin-time: Specifies the start time in the format of hh:mm:ss. The value range for the hh argument is 0 to 23. The value range for the mm and ss arguments is 0 to 59.

end-time: Specifies the end time in the format of hh:mm:ss. The value range for the hh argument is 0 to 23. The value range for the mm and ss arguments is 0 to 59.

date: Specifies a date range. If you do not specify a date range, this command displays user abnormal offline records on the current day.

brief: Displays brief information about user offline records. If you do not specify this keyword, the command displays detailed information about user offline records.

count count: Specifies the number of user offline records to be displayed. The value range for the count argument is 1 to 32768.

Usage guidelines

You can specify multiple query criteria to filter user offline records. This command displays the most recent user offline records that match the specified criteria in reverse chronological order.

If user offline records exist in the system, you can use this command to display the records regardless of whether user offline recording is enabled or not.

If you do not specify any parameters, this command displays detailed information about user offline records for all users.

Examples

# Display detailed information about offline records for all users.

<Sysname> display aaa offline-record

Total count: 1

Username: jay

Domain: dm1

MAC address: -

Access type: Telnet

Access interface: GigabitEthernet1/0/1

SVLAN/CVLAN: -/-

IP address: 19.19.0.2

IPv6 address: -

Online request time: 2020/01/02 15:20:33

Offline time: 2020/02/28 15:20:56

Offline reason: User request

# Display brief information about offline records for login users

<Sysname> display aaa offline-record access-type login brief

Username: jay

MAC address: -

IP address: 20.20.20.1

IPv6 address: -

Offline reason: User request.

Username: test

MAC address: -

IP address: 20.20.20.3

IPv6 address: -

Offline reason: User request.

Table 5 Command output

Field	Description
Total count	Total number of matching user offline records.
Username	Name of the user. This field does not display anything if the system failed to obtain the username.
Domain	Name of the ISP domain to which the user belongs. This field does not display anything if the system failed to obtain the ISP domain.
MAC address	MAC address of the user. This filed displays a hyphen (-) if the system failed to obtain the MAC address.
Access type	Access type of the user: · PPPoPhy—PPP over physical link. · PPPoE. · PPPoL2TP—PPP over L2TP. · PPPoFR—PPP over Frame Relay. · VPPP—L2TP auto dial-up. · MAC authentication. · 802.1X. · Telnet. · FTP. · SSH. · Portal. · IPoE. · IPoE interface leased. · IPoE subnet leased. · IPoE L2VPN leased. · NETCONF over SOAP. · NETCONF over RESTful. · Web—Web login. · Terminal—Terminal login such as console login.
Access interface	Interface through which the user accesses the network. This field displays a hyphen (-) if the system failed to obtain the access interface.
SVLAN/CVLAN	SVLAN and CVLAN to which the user belongs. This field displays a hyphen (-) for the SVLAN or CVLAN in the following situations: · The user does not belong to an SVLAN. · The system failed to obtain the SVLAN or CVLAN of the user.
IP address	IPv4 address of the user. This field displays a hyphen (-) if the system failed to obtain the IPv4 address.
IPv6 address	IPv6 address of the user. This field displays a hyphen (-) if the system failed to obtain the IPv6 address.
Online request time	Time when the user requested to come online.
Offline time	Time when the user went offline.
Offline reason	Reason that the user went offline. For more information about the reasons, see Table 2.

‌

Related commands

reset aaa offline-record

display aaa online-fail-record

Use display aaa online-fail-record to display user online failure records.

Syntax

display aaa online-fail-record { access-type { ipoe | lan-access | login | portal | ppp } | domain domain-name | interface interface-type interface-number | { ip ipv4-address | ipv6 ipv6-address } | mac-address mac-address | s-vlan svlan-id [ c-vlan cvlan-id ] | slot slot-number | username user-name [ fuzzy-match ] } * [ brief | count count ]

display aaa online-fail-record time begin-time end-time [ date begin-date end-date ] [ brief ]

display aaa online-fail-record

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

access-type: Specifies users by the access type.

ipoe: Specifies IPoE users.

lan-access: Specifies LAN users, such as 802.1X users and MAC authentication users.

portal: Specifies portal users.

ppp: Specifies PPP users.

domain domain-name: Specifies an ISP domain by its name, a case-insensitive string of 1 to 255 characters.

interface interface-type interface-number: Specifies an interface by its interface type and interface number.

ip ipv4-address: Specifies a user by its IPv4 address.

ipv6 ipv6-address: Specifies a user by its IPv6 address.

mac-address mac-address: Specifies a user by its MAC address in the format of H-H-H.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays user online failure records for all cards.

s-vlan svlan-id: Specifies an SVLAN by its VLAN ID in the range of 1 to 4094.

c-vlan cvlan-id: Specifies a CVLAN by its VLAN ID in the range of 1 to 4094.

username user-name: Specifies users using the specified username, a case-sensitive string of 1 to 253 characters.

time: Specifies user online failure records generated in a time range.

begin-time: Specifies the start time in the format of hh:mm:ss. The value range for the hh argument is 0 to 23. The value range for the mm and ss arguments is 0 to 59.

end-time: Specifies the end time in the format of hh:mm:ss. The value range for the hh argument is 0 to 23. The value range for the mm and ss arguments is 0 to 59.

date: Specifies a date range. If you do not specify a date range, this command displays user abnormal offline records on the current day.

brief: Displays brief information about user online failure records. If you do not specify this keyword, the command displays detailed information about user online failure records.

count count: Specifies the number of user online failure records to be displayed. The value range for the count argument is 1 to 32768.

Usage guidelines

You can specify multiple query criteria to filter user online failure records. This command displays the most recent user online failure records that match the specified criteria in reverse chronological order.

If user online failure records exist in the system, you can use this command to display the records regardless of whether user online failure recording is enabled or not.

If you do not specify any parameters, this command displays detailed information about user online failure records for all users.

Examples

# Display detailed information about the most recent two online failure records for login users that use the username aaa.

<Sysname> display aaa online-fail-record username aaa access-type login count 2

Username: aaa

Domain: test

MAC address: -

Access type: Telnet

Access interface: GigabitEthernet1/0/1

SVLAN/CVLAN: 100/-

IP address: 19.19.0.1

IPv6 address: -

Online request time: 2020/01/02 15:20:37

Online failure reason: Authentication failed.

Server reply message: no user exists.

Username: aaa

Domain: test

MAC address: -

Access type: Telnet

Access interface: GigabitEthernet1/0/1

SVLAN/CVLAN: -/-

IP address: 19.19.0.2

IPv6 address: -

Online request time: 2020/01/02 15:20:33

Online failure reason: Authentication failed.

Server reply message: no user exists.

# Display brief information about user online failure records generated from 2020-02-01 13:20:50 to 2020-02-02 17:20:30.

<Sysname> display aaa online-fail-record time 13:20:50 10:20:30 date 2020/2/1 2020/2/2 brief

Username: aaa

MAC address: -

IP address: 19.19.0.2

IPv6 address: -

Online failure reason: Authentication failed.

Server reply message: no user exists.

# Display detailed information about user online failure records generated from 2020-02-01 13:20:50 to 2020-02-02 17:20:30.

<Sysname> display aaa online-fail-record time 13:20:50 17:20:30 date 2020/2/1 2020/2/2

Username: aaa

Domain: test

MAC address: -

Access type: Telnet

Access interface: GigabitEthernet1/0/1

SVLAN/CVLAN: -/-

IP address: 19.19.0.1

IPv6 address: -

Online request time: 2020/02/02 16:20:33

Online failure reason: Authentication failed

Server reply message: no user exists.

Username: aaa

Domain: test

MAC address: -

Access type: Telnet

Access interface: GigabitEthernet1/0/1

SVLAN/CVLAN: -/-

IP address: 19.19.0.2

IPv6 address: -

Online request time: 2020/02/01 15:20:51

Online failure reason: Authentication failed.

Server reply message: no user exists.

Table 6 Command output

Field	Description
Total count	Total number of matching user online failure records.
Username	Name of the user. This field does not display anything if the system failed to obtain the username.
Domain	Name of the ISP domain to which the user belongs. This field does not display anything if the system failed to obtain the ISP domain.
MAC address	MAC address of the user. This filed displays a hyphen (-) if the system failed to obtain the user's MAC address.
Access type	Access type of the user: · PPPoPhy—PPP over physical link. · PPPoE. · PPPoL2TP—PPP over L2TP. · PPPoFR—PPP over Frame Relay. · VPPP—L2TP auto dial-up. · MAC authentication. · 802.1X. · Web authentication. · Telnet. · FTP. · SSH. · Portal. · IPoE. · IPoE interface leased. · IPoE subnet leased. · IPoE L2VPN leased. · NETCONF over SOAP. · NETCONF over RESTful. · Web—Web login. · Terminal—Terminal login such as console login.
Access interface	Interface through which the user accesses the network. This field displays a hyphen (-) if the system failed to obtain the access interface.
SVLAN/CVLAN	SVLAN and CVLAN to which the user belongs. This field displays a hyphen (-) for the SVLAN or CVLAN in the following situations: · The user does not belong to an SVLAN. · The system failed to obtain the SVLAN or CVLAN of the user.
IP address	IPv4 address of the user. This field displays a hyphen (-) if the system failed to obtain the IPv4 address.
IPv6 address	IPv6 address of the user. This field displays a hyphen (-) if the system failed to obtain the IPv6 address.
Online request time	Time when the user requested to come online.
Online failure reason	Reason that the user failed to come online. For more information about the reasons, see Table 2.
Server reply message	Message sent from the server. This field is not displayed if the server does not send a message.

‌

Related commands

reset aaa online-fail-record

display domain

Use display domain to display ISP domain configuration.

Syntax

display domain [ isp-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

isp-name: Specifies an ISP domain by its name, a case-insensitive string of 1 to 255 characters. If you do not specify an ISP domain, this command displays the configuration of all ISP domains.

Examples

# Display the configuration of all ISP domains.

<Sysname> display domain

Total 2 domains

Domain: system

Current state: Active

State configuration: Active

Default authentication scheme: Local

Default authorization scheme: Local

Default accounting scheme: Local

Accounting start failure action: Online

Accounting update failure action: Online

Accounting quota out policy: Offline

Send accounting update:Yes

Service type: HSI

Session time: Exclude idle time

DHCPv6-follow-IPv6CP timeout: Not configured

Dual-stack accounting method: Merge

NAS-ID: N/A

Web server URL : Not configured

Web server URL parameters : Not configured

Web server IPv4 address : Not configured

Web server IPv6 address : Not configured

Authorization attributes:

Idle cut: Disabled

IGMP access limit: 4

MLD access limit: 4

Authen-fail action: Offline

Authen-radius-unavailable: Not configured

Authen-radius-recover: Not configured

Temporary redirect: Disabled

Domain: dm

Current state: Active

State configuration: Blocked during specific time ranges

Time ranges:

Online-user logoff: Disabled

Super authentication scheme: RADIUS=rad

PPP accounting scheme: RADIUS=r1, (RADIUS=r2), HWTACACS=tc, Local

Command authorization scheme: HWTACACS=hw

LAN access authentication scheme: RADIUS=r4

Portal authentication scheme: LDAP=ldp

IPoE authentication scheme: RADIUS=rad, Local, None

5G authentication scheme: RADIUS=rad, None

Default authentication scheme: RADIUS=rad, Local, None

Default authorization scheme: Local

Default accounting scheme: None

Accounting start failure action: Online

Accounting update failure action: Online

Accounting quota out policy: Offline

Service type: HSI

Session time: Include idle time

Dual-stack accounting method: Merge

NAS-ID: test

Web server URL : Not configured

Web server URL parameters : Not configured

Web server IPv4 address : Not configured

Web server IPv6 address : Not configured

Authorization attributes:

Idle cut : Enabled

Idle timeout: 2 minutes

Flow: 10240 bytes

Traffic direction: Both

IP pool: appy

User profile: test

Session group profile: abc

Inbound CAR: CIR 64000 bps PIR 640000 bps

Outbound CAR: CIR 64000 bps PIR 640000 bps

ACL number: 3000

User group: ugg

IPv6 prefix: 1::1/34

IPv6 pool: ipv6pool

Primary DNS server: 6.6.6.6

Secondary DNS server: 3.6.2.3

URL: http://test

VPN instance: vpn1

IGMP access limit: 4

MLD access limit: 4

Authen-fail action: Online in domain dm1 without authentication

Authen-radius-unavailable: Online domain dm2

Authen-radius-recover: Offline

Temporary redirect: Disabled

Default domain name: system

Table 7 Command output

Field	Description
Domain	ISP domain name.
Current state	Current state of the ISP domain: · Blocked. · Active.
State configuration	State settings of the ISP domain: · Active—The ISP domain is set to the active state. · Blocked during specific time ranges—The ISP domain is set to the blocked state during the listed time ranges. · Blocked—The ISP domain is set to the blocked state.
Time ranges	Time ranges during which the ISP domain is in blocked state.
Online-user logoff	Status for the feature of logging off online users when the state of the ISP domain changes to blocked: · Enabled. · Disabled.
Default authentication scheme	Default authentication methods.
Default authorization scheme	Default authorization methods.
Default accounting scheme	Default accounting methods.
ADVPN authentication scheme	Authentication methods for ADVPN users.
ADVPN authorization scheme	Authorization methods for ADVPN users.
ADVPN accounting scheme	Accounting methods for ADVPN users.
Login authentication scheme	Authentication methods for login users.
Login authorization scheme	Authorization methods for login users.
Login accounting scheme	Accounting methods for login users.
Super authentication scheme	Authentication methods for obtaining another user role without reconnecting to the device.
PPP authentication scheme	Authentication methods for PPP users.
PPP authorization scheme	Authorization methods for PPP users.
PPP accounting scheme	Accounting methods for PPP users.
Command authorization scheme	Command line authorization methods.
Command accounting scheme	Command line accounting method.
LAN access authentication scheme	Authentication methods for LAN users.
LAN access authorization scheme	Authorization methods for LAN users.
LAN access accounting scheme	Accounting methods for LAN users.
Portal authentication scheme	Authentication methods for portal users.
Portal authorization scheme	Authorization methods for portal users.
Portal accounting scheme	Accounting methods for portal users.
IKE authentication scheme	IKE extended authentication methods.
IKE authorization scheme	Authorization methods for IKE extended authentication.
IPoE authentication scheme	Authentication methods for IPoE users.
IPoE authorization scheme	Authorization methods for IPoE users.
IPoE accounting scheme	Accounting methods for IPoE users.
ONU authentication scheme	Authentication methods for ONU users.
5G authentication scheme	Authentication methods for 5G users.
5G authorization scheme	Authorization methods for 5G users.
5G accounting scheme	Accounting methods for 5G users.
RADIUS	RADIUS scheme.
HWTACACS	HWTACACS scheme.
LDAP	LDAP scheme.
Local	Local scheme.
None	No authentication, no authorization, or no accounting.
Accounting start failure action	Access control for users that encounter accounting-start failures: · Online—Allows the users to stay online. · Offline—Logs off the users.
Accounting update failure max-times	Maximum number of consecutive accounting-update failures allowed by the device for each user in the domain.
Accounting update failure action	Access control for users that have failed all their accounting-update attempts: · Online—Allows the users to stay online. · Offline—Logs off the users.
Accounting quota out policy	Access control for users that have used up their accounting quotas: · Online—Allows the users to stay online. · Offline—Logs off the users. · Redirect—Redirects the users to the specified URL.
Redirect URL	URL to which users are redirected when the users have used up their data quotas.
Stop accounting	Whether to send stop-accounting packets for users that have used up their data quotas.
User profile	Name of the user profile assigned to users that have used up their data quotas.
Send accounting update	Whether to send accounting-update packets to refresh users' data quotas: · Yes. · No.
Service type	Service type of the ISP domain, including HSI, STB, and VoIP.
Session time	Online duration sent to the server for users that went offline due to connection failure or malfunction: · Include idle time—The online duration includes the idle timeout period. · Exclude idle time—The online duration does not include the idle timeout period.
User address type	Type of IP addresses for users in the ISP domain. This field is not available if no user address type is specified in the ISP domain.
User basic service IP type	Types of IP addresses that PPPoE and L2TP users rely on to use the basic services: · IPv4. · IPv6. · IPv6-PD.
DHCPv6-follow-IPv6CP timeout	IPv6 address wait timer (in seconds) that starts after IPv6CP negotiation for PPPoE and L2TP users. This field displays Not Configured if no IPv6 address wait timer is set for PPPoE or L2TP users.
Dual-stack accounting method	Accounting method for dual-stack users: · Merge—Merges IPv4 data with IPv6 data for accounting. · Separate—Separates IPv4 data from IPv6 data for accounting.
NAS-ID	NAS-ID of the device. This field displays N/A if no NAS-ID is set in the ISP domain.
Web server URL	URL of the Web server.
Web server URL parameters	Parameters added to the URL of the Web server.
Web server IPv4 address	IPv4 address of the Web server.
Web server IPv6 address	IPv6 address of the Web server.
Authorization attributes	Authorization attributes for users in the ISP domain.
Idle cut	Idle cut feature status: · Enabled—The feature is enabled. The device logs off users that do not meet the minimum traffic requirements in an idle timeout period. · Disabled—The feature is disabled. It is the default idle cut state.
Idle timeout	Idle timeout period, in minutes.
Flow	Minimum traffic that a login user must generate in an idle timeout period, in bytes.
Traffic direction	Traffic direction for the idle cut feature: · Both. · Inbound. · Outbound.
IP pool	Name of the authorization IPv4 pool.
User profile	Name of the authorization user profile.
Session group profile	Name of the authorization session group profile.
Inbound CAR	Authorization inbound CAR: · CIR—Committed information rate in bps. · PIR—Peak information rate in bps. If no inbound CAR is authorized, this field displays N/A.
Outbound CAR	Authorization outbound CAR: · CIR—Committed information rate in bps. · PIR—Peak information rate in bps. If no outbound CAR is authorized, this field displays N/A.
ACL number	Authorization ACL for users.
User group	Authorization user group for users.
IPv6 prefix	Authorization IPv6 address prefix for users.
IPv6 pool	Name of the authorization IPv6 pool for users.
Primary DNS server	IPv4 address of the authorization primary DNS server for users.
Secondary DNS server	IPv4 address of the authorization secondary DNS server for users.
Primary DNSV6 server	IPv6 address of the authorization primary DNS server for users.
Secondary DNSV6 server	IPv6 address of the authorization secondary DNS server for users.
URL	Authorization redirect URL for users.
VPN instance	Name of the authorization VPN instance for users.
IGMP access limit	Maximum number of IGMP groups that an IPv4 user is authorized to join concurrently.
MLD access limit	Maximum number of MLD groups that an IPv6 user is authorized to join concurrently.
Inbound user priority	Authorization user priority for users' upstream packets.
Outbound user priority	Authorization user priority for users' downstream packets.
User session timeout	Authorization session timeout time for users, in seconds.
VSI name	Authorization VSI name.
VLAN ID	Authorization VLAN ID.
Microsegment ID	Authorization microsegment ID.
Author profile	Authorization profile name.
Authen-fail action	Authentication failure policy for users that fail authentication in the ISP domain: · Offline—Logs out the users. · Online in domain isp-name without authentication—Allows the users to stay online and assigns the users to the auth-fail domain (represented by the isp-domain argument) without reauthentication. The system will only do reauthorization and accounting for them.
Authen-radius-unavailable	Critical domain to accommodate users when all RADIUS authentication servers are unavailable.
Authen-radius-recover	Action to take on users in the critical domain when a RADIUS authentication server becomes available. · Offline—Logs off the users. · Online in domain isp-name—Allows the users to stay online in the recovery domain. · Reauthen—Reauthenticate the users in the original authentication ISP domain.
Temporary redirect	Status of temporary redirection. · Enabled—Temporary redirection is enabled. The HTTP/HTTPS redirection packets sent to users carry status code 302. · Disabled—Temporary redirection is enabled. The HTTP/HTTPS redirection packets sent to users carry status code 200.
Default domain name	Default ISP domain name.

‌

display max-user history

Use display max-user history to display history peak statistics of users.

Syntax

display max-user history [ slot slot-number ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays history peak statistics of users for all cards.

Usage guidelines

The history peak statistics of users include the following information:

· Peak values of concurrent authenticated users, concurrent online users, concurrent user sessions that have been issued to the driver, and concurrent users in accounting.

· The time when each peak value is reached.

This command might fail to display history peak statistics for an access module if the access module is busy. You can re-execute this command later.

This command displays history peak statistics only for PPPoE and IPoE users. The system does not count IPoE Web users at the preauthentication stage into history peak statistics.

The system counts a user that is authenticated on a logical interface (such as an aggregate interface) as follows:

· For the peak value of concurrent driver sessions, the user is counted for each slot that has a member interface of the logical interface.

· For the other peak values, the user is counted only for the slot that has the physical interface through which the user accesses the network.

Examples

# Display history peak statistics of users on slot 1.

<Sysname> display max-user history slot 1

Slot 1:

Max concurrent authenticated PPPoE users: 100 Time: 2020-03-04 12:03:53

Max concurrent online PPPoE users: 100 Time: 2020-03-04 12:03:53

Max concurrent PPPoE driver sessions: 100 Time: 2020-03-04 12:03:53

Max concurrent PPPoE users in accounting: 100 Time: 2020-03-04 12:03:53

Max concurrent authenticated IPoE users: 100 Time: 2020-03-04 12:03:53

Max concurrent online IPoE users: 100 Time: 2020-03-04 12:03:53

Max concurrent IPoE driver sessions: 100 Time: 2020-03-04 12:03:53

Max concurrent IPoE users in accounting: 100 Time: 2020-03-04 12:03:53

Max concurrent authenticated IP6oE users: 110 Time: 2020-03-04 12:03:53

Max concurrent online IP6oE users: 110 Time: 2020-03-04 12:03:53

Max concurrent IP6oE driver sessions: 110 Time: 2020-03-04 12:03:55

Max concurrent IP6oE users in accounting: 110 Time: 2020-03-04 12:03:55

Table 8 Command output

Field	Description
Max concurrent authenticated xxx users	Peak value of concurrent xxx users that have initiated authentication since the system started up, where xxx represents the type of users. This field is not displayed if the maximum number is 0.
Max concurrent online xxx users	Peak value of concurrent online xxx users since the system started up, where xxx represents the type of users. This field is not displayed if the maximum number is 0.
Max concurrent xxx driver sessions	Peak value of concurrent xxx sessions that have been issued to the driver since the system started up, where xxx represents the type of users. This field is not displayed if the maximum number is 0.
Max concurrent xxx users in accounting	Peak value of concurrent xxx users that are in accounting since the system started up, where xxx represents the type of users. This field is not displayed if the maximum number is 0.
Time	Time when the peak value is reached.

‌

display mubm record

Use display mubm record to display user MAC and UUID binding entries.

Syntax

display mubm record [ mac mac-address ] [ interface interface-type interface-number | slot slot-number ] [ access-type { dot1x | mac-auth | wlan } ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

mac mac-address: Specifies a user MAC address in the format of H-H-H. If you do not specify a user MAC address, this command displays MAC and UUID binding entries for all user MAC addresses.

interface interface-type interface-number: Specifies the user's access interface by its type and number. If you do not specify an interface, this command displays MAC and UUID binding entries on all interfaces.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays MAC and UUID binding entries on the active MPU.

access-type: Specifies the user access type. If you do not specify a user access type, this command displays MAC and UUID binding entries for all user access types.

dot1x: Specifies 802.1X authentication access.

mac-auth: Specifies MAC authentication access.

wlan: Specifies wireless 802.1X and MAC authentication access.

Usage guidelines

If you do not specify any parameters, this command displays all user MAC and UUID binding entries.

To help administrators identify whether a universally unique identifier (UUID) has been assigned to a user and maintain the MAC and UUID binding entries for users, use this command.

In some scenarios, administrators configure and manage MAC address and UUID binding entries for users on the authentication server, depending on the user access control policies. The binding entries will be assigned to the users after they pass authentication. The device automatically generates the MAC and UUID binding entry of a user when the user comes online and automatically deletes the binding entry when the user goes offline.

When a user's client requests the DHCP server to assign or release an IP address, the DHCP snooping module first searches for the UUID bound to the client MAC address. Then, the device replaces the value of Option 61 (client ID) in the client's DHCP packets with the UUID and forwards the DHCP packets to the DHCP server. The DHCP server will assign or reclaim an IP address based on the UUID in the received DHCP packets. UUID-based IP address assignment flexibly meets the IP address requirements of different scenarios.

Examples

# Display UUID information bound to user MAC address 0C-DA-41-1D-1E-EF.

<Sysname> display mubm record mac 0C-DA-41-1D-1E-EF

Mac Address Access Type Interface UUID

0CDA-411D-1EEF Dot1x GE1/0/1 ff ff ff ff

0CDA-411D-1EEF MAC-auth GE1/0/2 41 41 41 41 42 42 42

0CDA-411D-1EEF WLAN N/A 41 41 41 41 42 42 43

Table 9 Command output

Field	Description
Mac Address	User MAC address.
Access Type	User access type: · Dot1x—802.1X authentication. · MAC-auth—MAC authentication. · WLAN—Wireless authentication.
Interface	Interface through which the user accesses the device. If the user accesses the device through a wireless network, this field displays N/A.
UUID	UUID bound to the user MAC address. The UUID value and format subject to the actual situation.

‌

domain

Use domain to create an ISP domain and enter its view, or enter the view of an existing ISP domain.

Use undo domain to delete an ISP domain.

Syntax

Format 1:

domain name isp-name

undo domain name isp-name

Format 2:

domain isp-name

undo domain isp-name

Default

A system-defined ISP domain exists. The domain name is system.

Views

System view

Predefined user roles

network-admin

Parameters

Format 1:

name isp-name: Specifies the ISP domain name, a case-insensitive string of 1 to 255 characters. The name cannot contain a forward slash (/), backslash (\), vertical bar (|), quotation marks ("), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).

Format 2:

isp-name: Specifies the ISP domain name, a case-insensitive string of 1 to 255 characters. The name cannot contain a forward slash (/), backslash (\), vertical bar (|), quotation marks ("), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@). The name cannot be d, de, def, defa, defau, defaul, default, i, if, if-, if-u, if-un, if-unk, if-unkn, if-unkno, if-unknow, or if-unknown.

Usage guidelines

All ISP domains are in active state when they are created.

You can modify settings for the system-defined ISP domain system, but you cannot delete this domain.

An ISP domain cannot be deleted when it is the default ISP domain. Before you use the undo domain command, change the domain to a non-default ISP domain by using the undo domain default enable command.

Use short domain names to ensure that user names containing a domain name do not exceed the maximum name length required by different types of users.

Examples

# Create an ISP domain named test and enter ISP domain view.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test]

Related commands

display domain

domain default enable

domain if-unknown

state (ISP domain view)

domain default enable

Use domain default enable to specify the default ISP domain. Users without any domain name included in the usernames are considered in the default domain.

Use undo domain default enable to restore the default.

Syntax

domain default enable isp-name

undo domain default enable

Default

The default ISP domain is the system-defined ISP domain system.

Views

System view

Predefined user roles

network-admin

Parameters

isp-name: Specifies the ISP domain name, a case-insensitive string of 1 to 255 characters. The ISP domain must already exist.

Usage guidelines

The system has only one default ISP domain.

Examples

# Create an ISP domain named test, and configure the domain as the default ISP domain.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] quit

[Sysname] domain default enable test

Related commands

display domain

domain

domain if-unknown

Use domain if-unknown to specify an ISP domain to accommodate users that are assigned to nonexistent domains.

Use undo domain if-unknown to restore the default.

Syntax

domain if-unknown isp-name

undo domain if-unknown

Default

No ISP domain is specified to accommodate users that are assigned to nonexistent domains.

Views

System view

Predefined user roles

network-admin

Parameters

Usage guidelines

The device chooses an authentication domain for each user in the following order:

1. The authentication domain specified for the access module.

2. The ISP domain in the username.

3. The default ISP domain of the device.

If the chosen domain does not exist on the device, the device searches for the ISP domain that accommodates users assigned to nonexistent domains. If no such ISP domain is configured, user authentication fails.

NOTE:

Support for the authentication domain configuration depends on the access module.

‌

Examples

# Specify ISP domain test to accommodate users that are assigned to nonexistent domains.

<Sysname> system-view

[Sysname] domain if-unknown test

Related commands

display domain

local-server log change-password-prompt

Use local-server log change-password-prompt to enable password change prompt logging.

Use undo local-server log change-password-prompt to disable password change prompt logging.

Syntax

local-server log change-password-prompt

undo local-server log change-password-prompt

Default

Password change prompt logging is enabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

Use this feature to enhance the protection of passwords for Telnet, SSH, HTTP, HTTPS, NETCONF over SSH, and NETCONF over SOAP users and improve the system security.

This feature enables the device to generate logs to prompt users to change their weak passwords at an interval of 24 hours and at the users' login.

A password is a weak password if it does not meet the following requirements:

· Password composition restriction configured by using the password-control composition command.

· Minimum password length restriction set by using the password-control length command.

· Password complexity checking policy configured by using the password-control complexit command.

For a NETCONF over SSH or NETCONF over SOAP user, the device also generates a password change prompt log if any of the following conditions exists:

· The current password of the user is the default password or has expired.

· The user logs in to the device for the first time or uses a new password to log in after global password control is enabled.

The device will no longer generate password change prompt logs for a user when one of the following conditions exists:

· The password change prompt logging feature is disabled.

· The user has changed the password and the new password meets the password control requirements.

· The enabling status of a related password control feature has changed so the current password of the user meets the password control requirements.

· The password composition policy or the minimum password length has changed.

You can use the display password-control command to display password control configuration. For more information about password control commands, see "Password control commands."

Examples

# Enable password change prompt logging.

<Sysname> system-view

[Sysname] local-server log change-password-prompt

Related commands

display password-control

password-control composition

password-control length

nas-id

Use nas-id to set the NAS-ID in an ISP domain.

Use undo nas-id to delete the NAS-ID from an ISP domain.

Syntax

nas-id nas-identifier

undo nas-id

Default

No NAS-ID is set in an ISP domain.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

nas-identifier: Specifies a NAS-ID, a case-sensitive string of 1 to 253 characters.

Usage guidelines

During RADIUS authentication, the device uses a NAS-ID to set the NAS-Identifier attribute of RADIUS packets so that the RADIUS server can identify the access location of users.

1. NAS-ID in a VSRP instance.

2. NAS-ID bound with VLANs in a NAS-ID profile.

3. NAS-ID on an interface.

4. NAS-ID in an ISP domain.

If no NAS-ID is selected, the device uses the device name as the NAS-ID.

The NAS-ID on an interface is applicable only to portal, PPP, and IPoE users that access the network through the interface.

Examples

# Set the NAS-ID to test for ISP domain test.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] nas-id test

Related commands

aaa nas-id

aaa nas-id profile

nas id (High Availability Command Reference)

nas-id bind

Use nas-id bind to configure a NAS-ID and VLAN binding.

Use undo nas-id bind to remove a NAS-ID and VLAN binding.

Syntax

nas-id nas-identifier bind { { c-vid vlan-id | s-vid vlan-id } * | vlan vlan-id }

undo nas-id nas-identifier bind { { c-vid vlan-id | s-vid vlan-id } * | vlan vlan-id }

Default

No NAS-ID and VLAN bindings exist.

Views

NAS-ID profile view

Predefined user roles

network-admin

Parameters

nas-identifier: Specifies a NAS-ID, a case-sensitive string of 1 to 253 characters.

c-vid vlan-id : Specifies an inner VLAN ID in the range of 1 to 4094.

s-vid vlan-id: Specifies an outer VLAN ID in the range of 1 to 4094.

vlan vlan-id: Specifies a VLAN ID in the range of 1 to 4094.

Usage guidelines

You can configure multiple NAS-ID and VLAN bindings in a NAS-ID profile.

A NAS-ID can be bound with more than one VLAN or one combination of inner VLAN and outer VLAN. A VLAN or a combination of inner VLAN and outer VLAN can be bound with only one NAS-ID. If you configure multiple bindings for the same VLAN, the most recent configuration takes effect.

The device selects a NAS-ID and VLAN binding for double-tagged packets in the following order:

1. NAS-ID with both matching outer VLAN ID and inner VLAN ID.

2. NAS-ID with a matching outer VLAN ID.

3. NAS-ID with a matching inner VLAN ID.

Examples

# Bind NAS-ID 222 with VLAN 2 in NAS-ID profile aaa.

<Sysname> system-view

[Sysname] aaa nas-id profile aaa

[Sysname-nas-id-prof-aaa] nas-id 222 bind vlan 2

Related commands

aaa nas-id profile

redirect move-temporarily enable

Use redirect move-temporarily enable to enable the temporary redirect feature.

Use undo redirect move-temporarily enable to disable the temporary redirect feature.

Syntax

redirect move-temporarily enable

undo redirect move-temporarily enable

Default

The temporary redirect feature is disabled.

Views

ISP domain view

Predefined user roles

network-admin

Usage guidelines

Typically, the device carries the redirect URL coded in JavaScript in HTTP or HTTPS responses sent to users, and the status code in the responses is 200. The users obtain the redirect URL by parsing the JavaScript codes. If the endpoint of a user (application, for example) does not support JavaScript, the user will fail to be redirected.

To resolve this issue, enable the temporary redirect feature. This feature enables the device to send HTTP or HTTPS responses with status code 302 to users so that the users can obtain the redirect URL.

This feature takes effect only on wired 802.1X and MAC authentication users authorized with a redirection URL.

If you change the temporary redirect setting, the change takes effect only on users that come online afterwards or users that are reauthorized.

Examples

# In ISP domain test, enable the temporary redirect feature.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] redirect move-temporarily enable

Related commands

display domain

reset aaa abnormal-offline-record

Use reset aaa abnormal-offline-record to clear all user abnormal offline records.

Syntax

reset aaa abnormal-offline-record

Views

User view

Predefined user roles

network-admin

Usage guidelines

The device saves user abnormal offline records in memory and does not automatically clear the records unless the device reboots. To prevent the records from overusing the memory, use this command to clear all user abnormal offline records.

Use this command with caution. Cleared records cannot be recovered.

Examples

# Clear all user abnormal offline records.

<Sysname> reset aaa abnormal-offline-record

Related commands

display aaa abnormal-offline-record

reset aaa normal-offline-record

Use reset aaa normal-offline-record to clear all user normal offline records.

Syntax

reset aaa normal-offline-record

Views

User view

Predefined user roles

network-admin

Usage guidelines

The device saves user normal offline records in memory and does not automatically clear the records unless the device reboots. To prevent the records from overusing the memory, use this command to clear all user normal offline records.

Use this command with caution. Cleared records cannot be recovered.

Examples

# Clear all user normal offline records.

<Sysname> reset aaa normal-offline-record

Related commands

display aaa normal-offline-record

reset aaa offline-record

Use reset aaa offline-record to clear all user offline records.

Syntax

reset aaa offline-record

Views

User view

Predefined user roles

network-admin

Usage guidelines

The device saves user offline records in memory and does not automatically clear the records unless the device reboots. To prevent the records from overusing the memory, use this command to clear all user offline records.

Use this command with caution. Cleared records cannot be recovered.

Examples

# Clear all user offline records.

<Sysname> reset aaa offline-record

Related commands

display aaa offline-record

reset aaa online-fail-record

Use reset aaa online-fail-record to clear all user online failure records.

Syntax

reset aaa online-fail-record

Views

User view

Predefined user roles

network-admin

Usage guidelines

The device saves user online failure records in memory and does not automatically clear the records unless the device reboots. To prevent the records from overusing the memory, use this command to clear all user online failure records.

Use this command with caution. Cleared records cannot be recovered.

Examples

# Clear all user online failure records.

<Sysname> reset aaa online-fail-record

Related commands

display aaa online-fail-record

service-type (ISP domain view)

Use service-type to specify the service type for users in an ISP domain.

Use undo service-type to restore the default.

Syntax

service-type { hsi | stb | voip }

undo service-type

Default

The service type is hsi for users in an ISP domain.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hsi: Specifies the High Speed Internet (HSI) service. This service is applicable to users that access the network through PPP, 802.1X, or IPoE.

stb: Specifies the Set Top Box (STB) service. This service is applicable to users that access the network through STB.

voip: Specifies the Voice over IP (VoIP) service. This service is applicable to users that access the network through IP phones.

Usage guidelines

When the HSI service is specified, the multicast feature of the access module is disabled to save system resources.

When the STB service is specified, the multicast feature of the access module is enabled to improve the performance of the multicast module.

When the VoIP service is specified, the QoS module increases the priority of voice traffic to reduce the transmission delay for IP phone users.

For PPP (excluding PPPoE), IPoE leased line, and 802.1X users, the system uses the HSI service forcibly even if the STB or VoIP service is specified.

You can configure only one service type for an ISP domain.

Examples

# Specify the STB service for users in ISP domain test.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] service-type stb

session-time include-idle-time

Use session-time include-idle-time to configure the device to include the idle timeout period in the user online duration sent to the server.

Use undo session-time include-idle-time to restore the default.

Syntax

session-time include-idle-time

undo session-time include-idle-time

Default

The device does not include the idle timeout period in the user online duration sent to the server.

Views

ISP domain view

Predefined user roles

network-admin

Usage guidelines

Whether to configure the device to include the idle timeout period in the user online duration sent to the server, depending on the accounting policy in your network. The idle timeout period is assigned to users by the authorization server after the users pass authentication. For portal users, the device includes the idle timeout period set for the online portal user detection feature in the user online duration. For more information about online detection for portal users, see portal authentication configuration in User Access and Authentication Configuration Guide.

If the user goes offline due to connection failure or malfunction, the user online duration sent to the server is not the same as the actual online duration.

· If the session-time include-idle-time command is used, the user's online duration sent to the server includes the idle timeout period. The online duration that is generated on the server is longer than the actual online duration of the user.

· If the undo session-time include-idle-time command is used, the user's online duration sent to the server excludes the idle timeout period. The online duration that is generated on the server is shorter than the actual online duration of the user.

Examples

# Configure the device to include the idle timeout period in the online duration sent to the server for users in ISP domain test.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] session-time include-idle-time

Related commands

display domain

snmp-agent trap enable local-server

Use snmp-agent trap enable local-server to enable SNMP notifications for password changes of local users.

Use undo snmp-agent trap enable local-server to disable SNMP notifications for password changes of local users.

Syntax

snmp-agent trap enable local-server [ manage-password-change | network-password-change ] *

undo snmp-agent trap enable local-server [ manage-password-change | network-password-change ] *

Default

All SNMP notifications are disabled for password changes of local users.

Views

System view

Predefined user roles

network-admin

Parameters

manage-password-change: Specifies password changes of device management users.

network-password-change: Specifies password changes of network access users.

Usage guidelines

With SNMP notifications enabled for password changes of local users, the system generates alarms when one of the following cases occurs:

· The password of a local user is configured or changed from the CLI.

· The password of a local user is changed through NETCONF or MIB, or from the Web interface.

· The password of a portal or SSL VPN user is changed online on the login page.

For RADIUS SNMP notifications to be sent correctly, you must also configure SNMP on the device. For more information about SNMP configuration, see Network Management and Monitoring Configuration Guide.

If you do not specify any keywords, the command enables SNMP notifications for password changes of both device management users and network access users.

Examples

# Enable SNMP notifications for password changes of local users.

<Sysname> system-view

[Sysname] snmp-agent trap enable local-server manage-password-change

state (ISP domain view)

Use state to set the status of an ISP domain.

Use undo state to restore the default.

Syntax

state { active | block [ time-range ] [ offline ] }

undo state

Default

An ISP domain is in active state.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

active: Places the ISP domain in active state to allow the users in the ISP domain to request network services.

block: Places the ISP domain in blocked state to prevent users in the ISP domain from requesting network services. This keyword takes effect on all types of users except the SSH users that perform publickey authentication.

time-range: Places the ISP domain in blocked state based on time ranges. If you specify the block keyword but do not specify the time-range keyword, the ISP domain is always placed in blocked state.

offline: Logs off online users (including 802.1X, MAC authentication, portal, IPoE, and PPP users) in the ISP domain when the state of the ISP domain changes to blocked. If you specify the block keyword but do not specify the offline keyword, the users in the ISP domain stay online when the state of the ISP domain changes to blocked.

Usage guidelines

To block an ISP domain based on time ranges, specify the time-range keyword in this command, and specify time ranges by using the state block time-range name command.

Examples

# Place ISP domain test in blocked state.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] state block

Related commands

display domain

state block time-range name

Use state block time-range name to specify time ranges during which an ISP domain is placed in blocked state.

Use undo state block time-range name to delete time ranges for placing an ISP domain in blocked state.

Syntax

state block time-range name time-range-name

undo state block time-range { all | name time-range-name }

Default

No time ranges are specified for placing an ISP domain in blocked state.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

time-range-name: Specifies a time range by its name, a case-insensitive string of 1 to 63 characters. The string must begin with a letter and cannot be all.

all: Specifies all time ranges.

Usage guidelines

The specified time ranges take effect only when the device is configured to block an ISP domain based on time ranges. To configure the device to block the ISP domain based on time ranges, use the state block time-range command.

You can repeat this command to specify multiple time ranges.

Examples

# Specify time ranges t1 and t2 for placing ISP domain test in blocked state.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] state block time-range name t1

[Sysname-isp-test] state block time-range name t2

Related commands

state

time-range (ACL and QoS Command Reference)

user-address-type

Use user-address-type to specify the user address type in the ISP domain.

Use undo user-address-type to restore the default.

Syntax

user-address-type { ds-lite | ipv6 | nat64 | private-ds | private-ipv4 | public-ds | public-ipv4 }

undo user-address-type

Default

No user address type is specified for the ISP domain.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

ds-lite: Specifies the DS-Lite address type.

ipv6: Specifies the IPv6 address type.

nat64: Specifies the NAT64 address type.

private-ds: Specifies the private-DS address type.

private-ipv4: Specifies the private IPv4 address type.

public-ds: Specifies the public-DS address type.

public-ipv4: Specifies the public IPv4 address type.

Usage guidelines

Specify the address type for users in an ISP domain according to the actual customer network environment and address assignment policies for the users.

On a CGN network, make sure the correct address type is specified on the device and users obtain private IP addresses of the specified type. Then, the device can cooperate with NAT to implement public IP address assignment, port block assignment, and user tracking after the users pass authentication. For more information about NAT, see NAT Configuration Guide.

Any change to the user address type does not affect online users.

Examples

# Specify the private IPv4 address type for users in ISP domain test.

<Sysname> system-view

[Sysname] domain name test

[Sysname-isp-test] user-address-type private-ipv4

Related commands

display domain

Local user commands

access-limit

Use access-limit to set the maximum number of concurrent logins using the local user name.

Use undo access-limit to restore the default.

Syntax

access-limit max-user-number

undo access-limit

Default

The number of concurrent logins using the local user name is not limited.

Views

Local user view

Predefined user roles

network-admin

Parameters

max-user-number: Specifies the maximum number of concurrent logins, in the range of 1 to 1024.

Usage guidelines

The command does not apply to FTP, SFTP, or SCP users. These users do not support accounting.

As a best practice to ensure accuracy for this command on network access users, execute the accounting start-fail offline command in the view of the users' ISP domain.

Examples

# Set the maximum number of concurrent logins to 5 for users using the local user name abc.

<Sysname> system-view

[Sysname] local-user abc

[Sysname-luser-manage-abc] access-limit 5

Related commands

accounting start-fail offline

display local-user

access-user email authentication

Use access-user email authentication to specify the username and password used to log in to the SMTP server that sends email notifications to network access users.

Use undo access-user email authentication to restore the default.

Syntax

access-user email authentication username user-name password { cipher | simple } string

undo access-user email authentication

Default

No SMTP server username or password is specified.

Views

System view

Predefined user roles

network-admin

Parameters

username user-name: Specifies the username, a case-sensitive string of 1 to 63 characters.

password: Specifies the password.

cipher: Specifies the password in encrypted form.

simple: Specifies the password in plaintext form. For security purposes, the password specified in plaintext form will be stored in encrypted form.

string: Specifies the password string. Its plaintext form is a case-sensitive string of 1 to 63 characters. Its encrypted form is a case-sensitive string of 1 to 117 characters.

Usage guidelines

If the SMTP server requires a username and password for login, you must use this command to specify the username and password on the device.

If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Set the username to abc and the password to 123 for logging in to the SMTP server that sends email notifications to network access users.

<Sysname> system-view

[Sysname] access-user email authentication username abc password simple 123

Related commands

access-user email format

access-user email sender

access-user email smtp-server

access-user email format

Use access-user email format to configure the subject and body for the email notifications to send to network access users.

Use undo access-user email format to restore the default.

Syntax

access-user email format { body body-string | subject sub-string }

undo access-user email format { body | subject }

Default

The email subject is Password reset notification.

The email body is as follows:

A random password has been generated for your account.

Username: xxx

Password: yyy

Validity: YYYY/MM/DD hh:mm:ss to YYYY/MM/DD hh:mm:ss

The xxx string represents the username, the yyy string represents the password, and the YYYY/MM/DD hh:mm:ss to YYYY/MM/DD hh:mm:ss string represents the validity period.

Views

System view

Predefined user roles

network-admin

Parameters

body body-string: Configures the body content. The body-string argument is a case-sensitive string of 1 to 255 characters.

subject sub-string: Configures the email subject. The sub-string argument is a case-sensitive string of 1 to 127 characters.

Usage guidelines

You can configure the device to generate a random password for a network access user on the Web interface. The random password is sent to the user by email. Use this command to configure the email subject and body content.

The email body includes the string configured by using the body-string argument and the following information:

Username: xxx

Password: yyy

Validity: YYYY/MM/DD hh:mm:ss to YYYY/MM/DD hh:mm:ss

The xxx string represents the username, the yyy string represents the password, and the YYYY/MM/DD hh:mm:ss to YYYY/MM/DD hh:mm:ss string represents the validity period.

If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Configure the subject and body for the email notifications to send to network access users.

<Sysname> system-view

[Sysname] access-user email format subject new password setting

[Sysname] access-user email format body The username, password, and validity period of the account are given below.

Related commands

access-user email authentication

access-user email sender

access-user email smtp-server

access-user email sender

Use access-user email sender to configure the email sender address in email notifications sent by the device to network access users.

Use undo access-user email sender to restore the default.

Syntax

access-user email sender email-address

undo access-user email sender

Default

No email sender address is configured for the email notifications sent by the device to network access users.

Views

System view

Predefined user roles

network-admin

Parameters

email-address: Specifies the email sender address, a case-sensitive string of 1 to 255 characters. The string must contain an at sign (@), and it can contain only one at sign (@). In addition, the string cannot contain only the at sign (@).

Usage guidelines

If you do not specify the email sender address, the device cannot send email notifications to any network access users.

The device supports only one email sender address for network access users. If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Specify the email sender address as [email protected] for email notifications of network access users.

<Sysname> system-view

[Sysname] access-user email sender [email protected]

Related commands

access-user email authentication

access-user email format

access-user email smtp-server

Use access-user email smtp-server to specify an SMTP server to send email notifications of network access users.

Use undo access-user email smtp-server to restore the default.

Syntax

access-user email smtp-server url-string

undo access-user email smtp-server

Default

No SMTP server is specified to send email notifications of network access users.

Views

System view

Predefined user roles

network-admin

Parameters

url-string: Specifies the path of the SMTP server, a case-sensitive string of 1 to 255 characters. The path must comply with the standard SMTP protocol and start with smtp://.

Usage guidelines

You can specify only one SMTP server to send email notifications of network access users.

If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Specify the SMTP server at smtp://www.example.com/smtp to send email notifications of network access users.

<Sysname> system-view

[Sysname] access-user email smtp-server smtp://www.example.com/smtp

Related commands

access-user email authentication

access-user email format

access-user email sender

authorization-attribute (local user view/user group view)

Use authorization-attribute to configure authorization attributes for a local user or user group. After the local user or a local user in the user group passes authentication, the device assigns these attributes to the user.

Use undo authorization-attribute to restore the default of an authorization attribute.

Syntax

authorization-attribute { acl acl-number | callback-number callback-number | idle-cut minutes | ip ipv4-address | ip-pool ipv4-pool-name | ipv6 ipv6-address | ipv6-pool ipv6-pool-name | ipv6-prefix ipv6-prefix prefix-length | { primary-dns | secondary-dns } { ip ipv4-address | ipv6 ipv6-address } | session-group-profile session-group-profile-name | session-timeout minutes | subscriber-id subscriber-id | url url-string | user-group user-group-name | user-profile profile-name | user-role role-name | vlan vlan-id | vpn-instance vpn-instance-name | wlan-vlan wlan-vlan-id | wlan-vlan-group wlan-vlan-group-name | work-directory directory-name } *

undo authorization-attribute { acl | callback-number | idle-cut | ip | ip-pool | ipv6 | ipv6-pool | ipv6-prefix | primary-dns | secondary-dns | session-group-profile | session-timeout | subscriber-id | url | user-group | user-profile | user-role role-name | vlan | vpn-instance | wlan-vlan| wlan-vlan-group | work-directory } *

Default

The working directory for FTP, SFTP, and SCP users is the root directory of the NAS. However, the users do not have permission to access the root directory.

The local users created by a network-admin or level-15 user are assigned the network-operator user role.

Views

Local user view

User group view

Predefined user roles

network-admin

Parameters

acl acl-number: Specifies an authorization ACL. The value range for the acl-number argument varies by device model. The device processes the traffic that matches the rules in the authorization ACL based on the permit or deny statement in the rules.

callback-number callback-number: Specifies an authorized PPP callback number. The callback-number argument is a case-sensitive string of 1 to 64 characters. After a local user passes authentication, the device uses this number to call the user.

idle-cut minutes: Specifies an idle timeout period in minutes. The value range for the minutes argument is 1 to 120. An online user is logged out if its idle period exceeds the specified idle timeout period.

ip ipv4-address: Assigns a static IPv4 address to the user after it passes authentication. You can specify this option only in local user view. This option is not supported in user group view.

ip-pool ipv4-pool-name: Specifies an IPv4 pool for the user. The ipv4-pool-name argument is a case-insensitive string of 1 to 63 characters.

ipv6 ipv6-address: Assigns a static IPv6 address to the user after it passes authentication. You can specify this option only in local user view. This option is not supported in user group view.

ipv6-pool ipv6-pool-name: Specifies an IPv6 pool for the user. The ipv6-pool-name argument is a case-insensitive string of 1 to 63 characters.

ipv6-prefix ipv6-prefix prefix-length: Specifies an IPv6 address prefix for the user. The value range for the prefix-length argument is 1 to 128.

primary-dns ip ipv4-address: Specifies the IPv4 address of the primary DNS server for the user.

primary-dns ipv6 ipv6-address: Specifies the IPv6 address of the primary DNS server for the user.

secondary-dns ip ipv4-address: Specifies the IPv4 address of the secondary DNS server for the user.

secondary-dns ipv6 ipv6-address: Specifies the IPv6 address of the secondary DNS server for the user.

session-group-profile session-group-profile-name: Specifies a session group profile for the user. The session-group-profile-name argument is a case-sensitive string of 1 to 31 characters and can contain only letters, digits, underscores (_), minus signs (-), and dots (.). The string can begin with a letter or a digit, but it cannot be all digits. For more information about session group profiles, see user profile configuration in User Access and Authentication Configuration Guide.

session-timeout minutes: Specifies the session timeout timer for the user, in minutes. The value range for the minutes argument is 1 to 1440. The device logs off the user after the timer expires.

subscriber-id subscriber-id: Specifies a subscriber ID for the user, in the range of 1 to 4095. Subscriber IDs are used with session group profiles to implement QoS traffic control on a per-group basis or used with local QoS IDs to implement HQoS. For more information about QoS and HQoS, see ACL and QoS Configuration Guide.

url url-string: Specifies a redirect URL for wireless MAC authentication users and wireless 802.1X users and specifies a PPPoE Active Discovery Message (PADM) URL for PPPoE users. The url-string argument is a case-sensitive string of 1 to 255 characters. For wireless MAC authentication and 802.1X users, you can configure the redirect URL to push advertisements or notifications to the users after they pass authentication or push bill overdue notifications to the users. In addition, the URL must start with http:// or https://. For PPPoE users, you must specify a URL that uses port number 80 or 8080.

user-group user-group-name: Specifies the name of a local user group, a case-insensitive string of 1 to 32 characters. This option is available only in local user view. Do not specify this option in user group view.

user-profile profile-name: Specifies an authorization user profile by its name. The profile-name argument is a case-sensitive string of 1 to 31 characters. Valid characters include letters, digits, underscores (_), minus signs (-), and dots (.). The string can begin with a letter or digit, but it cannot be all digits. The user profile restricts the behavior of authenticated users. For more information, see User Access and Authentication Configuration Guide.

user-role role-name: Specifies an authorized user role. The role-name argument is a case-sensitive string of 1 to 63 characters. A maximum of 64 user roles can be specified for a user. For user role-related commands, see Fundamentals Command Reference for RBAC commands. This option is available only in local user view, and is not available in user group view.

vlan vlan-id: Specifies an authorized VLAN. The value range for the vlan-id argument is 1 to 4094. After passing authentication and being authorized a VLAN, a local user can access only the resources in this VLAN.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the user belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. After passing authentication, the user has permission to access the network resources in the specified VPN.

wlan-vlan wlan-vlan-id: Specifies a VLAN by its ID in the range of 1 to 4094. This option takes effect only on wireless users.

wlan-vlan-group wlan-vlan-group-name: Specifies a VLAN group by its name, a case-sensitive string of 1 to 32 characters. The name must start with a letter. This option takes effect only on wireless users.

work-directory directory-name: Specifies the working directory for FTP, SFTP, or SCP users. The directory-name argument is a case-insensitive string of 1 to 255 characters. The directory must already exist.

Usage guidelines

Configure authorization attributes according to the application environments and purposes. Support for authorization attributes depends on the service types of users.

For PPP users, only the following authorization attributes take effect: callback-number, idle-cut, ip, ipv6, ip-pool, ipv6-pool, ipv6-prefix, primary-dns, secondary-dns, session-group-profile, session-timeout, subscriber-id, user-profile, vpn-instance, user-group, and url.

For IPoE users, only the following authorization attributes take effect: idle-cut, ip-pool, ipv6-pool, ipv6-prefix, session-group-profile, subscriber-id, user-profile, vpn-instance, primary-dns, secondary-dns, and session-timeout. If the IPoE users access the network through leased lines, the vpn-instance authorization attribute does not take effect.

For portal users, only the following authorization attributes take effect: acl, ip-pool, ipv6-pool, user-group, user-profile, and session-timeout. The user-group attribute takes effect only on wireless users.

For LAN users, only the following authorization attributes take effect: acl, idle-cut, session-timeout, url, user-group, user-profile, wlan-vlan, wlan-vlan-group, and vlan. The idle-cut, wlan-vlan, wlan-vlan-group, user-group, and url authorization attributes take effect only on wireless users.

For SSH, Telnet, and terminal users, only the authorization attributes idle-cut and user-role take effect.

For HTTP and HTTPS users, only the authorization attribute user-role takes effect.

For FTP users, only the authorization attributes user-role and work-directory take effect.

For IKE users, only the authorization attributes ip-pool, ip, and ipv6 take effect.

For other types of local users, no authorization attribute takes effect.

Authorization attributes configured for a user group are intended for all local users in the group. You can group local users to improve configuration and management efficiency. An authorization attribute configured in local user view takes precedence over the same attribute configured in user group view.

When you specify an authorization ACL, the following restrictions apply:

· Support for the VPN instance parameter in the ACL rules for LAN users depends on the device model.

· Support for the VPN instance parameter in the ACL rules for portal users depends on the device model.

· For portal users to come online after passing authentication, make sure ACLs assigned to portal users do not have rules specified with a source IP or MAC address.

To make sure FTP, SFTP, and SCP users can access the directory after an active/standby switchover, do not specify chassis or slot information for the working directory.

To make sure the user have only the user roles authorized by using this command, use the undo authorization-attribute user-role command to remove the default user role.

The security-audit user role has access to the commands for managing security log files and security log file system. To display all the accessible commands of the security-audit user role, use the display role name security-audit command. For more information about security log management, see configuring the information center in System Management Configuration Guide. For more information about file system management, see Fundamentals Configuration Guide.

You cannot delete a local user if the local user is the only user that has the security-audit user role.

The security-audit user role is mutually exclusive with other user roles.

· When you assign the security-audit user role to a local user, the system requests confirmation for deleting all the other user roles of the user.

· When you assign other user roles to a local user that has the security-audit user role, the system requests confirmation for deleting the security-audit user role for the local user.

Examples

# Configure the authorized VLAN of network access user abc as VLAN 2.

<Sysname> system-view

[Sysname] local-user abc class network

[Sysname-luser-network-abc] authorization-attribute vlan 2

# Configure the authorized VLAN of user group abc as VLAN 3.

<Sysname> system-view

[Sysname] user-group abc

[Sysname-ugroup-abc] authorization-attribute vlan 3

# Assign the security-audit user role to device management user xyz as the authorized user role.

<Sysname> system-view

[Sysname] local-user xyz class manage

[Sysname-luser-manage-xyz] authorization-attribute user-role security-audit

This operation will delete all other roles of the user. Are you sure? [Y/N]:y

Related commands

display local-user

display user-group

bind-attribute

Use bind-attribute to configure binding attributes for a local user.

Use undo bind-attribute to remove binding attributes of a local user.

Syntax

bind-attribute { call-number call-number [ : subcall-number ] | ip ip-address | location interface interface-type interface-number | mac mac-address | vlan vlan-id } *

undo bind-attribute { call-number | ip | location | mac | vlan } *

Default

No binding attributes are configured for a local user.

Views

Local user view

Predefined user roles

network-admin

Parameters

call-number call-number: Specifies a calling number for PPP user authentication. The call-number argument is a string of 1 to 64 characters. This option applies only to PPP users.

subcall-number: Specifies the subcalling number. The total length of the calling number and the subcalling number cannot be more than 62 characters.

ip ip-address: Specifies the IP address to which the user is bound. This option applies only to 802.1X users.

location interface interface-type interface-number: Specifies the interface to which the user is bound. The interface-type argument represents the interface type, and the interface-number argument represents the interface number. To pass authentication, the user must access the network through the bound interface. This option applies only to LAN, PPP, IPoE, and portal users.

mac mac-address: Specifies the MAC address of the user in the format H-H-H. This option applies only to SSL VPN users that log in through iNode clients, LAN users, PPP users, IPoE users, and portal users.

vlan vlan-id: Specifies the VLAN to which the user belongs. The vlan-id argument is in the range of 1 to 4094. This option applies only to LAN, PPP, IPoE, and portal users.

Usage guidelines

To perform local authentication of a user, the device matches the actual user attributes with the configured binding attributes. If the user has a non-matching attribute or lacks a required attribute, the user will fail authentication.

Binding attribute check takes effect on all access services. Configure the binding attributes for a user based on the access services and make sure the device can obtain all attributes to be checked from the user's packet. For example, you can configure an IP address binding for an 802.1X user, because 802.1X authentication can include the user's IP address in the packet. However, you cannot configure IP address bindings for MAC authentication users, because MAC authentication does not use IP addresses.

The binding interface type must meet the requirements of the local user. Configure the binding interface based on the service type of the user.

· If the user is an 802.1X user, specify the 802.1X-enabled Layer 2 Ethernet interface or Layer 2 aggregate interface.

· If the user is a MAC authentication user, specify the MAC authentication-enabled Layer 2 Ethernet interface or Layer 2 aggregate interface.

· If the user is a Web authentication user, specify the Web authentication-enabled Layer 2 Ethernet interface.

· If the user is a portal user, specify the portal-enabled interface. Specify the Layer 2 Ethernet interface if portal is enabled on a VLAN interface and the portal roaming enable command is not configured.

Examples

# Bind MAC address 11-11-11 with network access user abc.

<Sysname> system-view

[Sysname] local-user abc class network

[Sysname-luser-network-abc] bind-attribute mac 11-11-11

Related commands

display local-user

company

Use company to specify the company of a local guest.

Use undo company to restore the default.

Syntax

company company-name

undo company

Default

No company is specified for a local guest.

Views

Local guest view

Predefined user roles

network-admin

Parameters

company-name: Specifies the company name, a case-sensitive string of 1 to 255 characters.

Examples

# Specify company yyy for local guest abc.

<Sysname> system-view

[Sysname] local-user abc class network guest

[Sysname-luser-network(guest)-abc] company yyy

Related commands

display local-user

description

Use description to configure a description for a network access user.

Use undo description to restore the default.

Syntax

description text

undo description

Default

No description is configured for a network access user.

Views

Network access user view

Predefined user roles

network-admin

Parameters

text: Configures a description, case-sensitive string of 1 to 255 characters.

Usage guidelines

To mark a network access user for special displaying or management purposes, configure description #user_from_server# for the user. The purposes depend on the implementation of the management side.

Examples

# Configure a description for network access user 123.

<Sysname> system-view

[Sysname] local-user 123 class network

[Sysname-luser-network-123] description Manager of MSC company

Related commands

display local-user

display local-guest waiting-approval

Use display local-guest waiting-approval to display pending registration requests for local guests.

Syntax

display local-guest waiting-approval [ user-name user-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

user-name user-name: Specifies a local guest by the username, a string of 1 to 80 characters. If you do not specify a guest, this command displays pending registration requests for all local guests. The username of the specified guest can be a pure username or contain a domain name (in the format of pure-username@domain-name).

· The pure username is a case-sensitive string and must meet the following requirements:

¡ Cannot contain any of the following characters: forward slash (/), backslash (\), vertical bar (|), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).

¡ Cannot be a, al, or all.

· The domain name is a case-insensitive string and cannot contain an at sign (@).

Usage guidelines

On the Web registration page, users submit local guest registration requests for approval. The guest manager can add supplementary information to the guest accounts and approves the requests. The device then creates local guest accounts based on the approved requests.

Examples

# Display all pending registration requests for local guests.

<Sysname> display local-guest waiting-approval

Total 1 guest entries matched.

Guest user Smith:

Full name : Smith Li

Company : YYY

Email : [email protected]

Phone : 139189301033

Description: The employee of YYY company

Table 10 Command output

Field	Description
Total 1 guest entries matched.	Number of local guests that have pending registration requests.
Full name	Full name of the local guest.
Company	Company name of the local guest.
Email	Email address of the local guest.
Phone	Phone number of the local guest.
Description	Description of the local guest.

‌

Related commands

reset local-guest waiting-approval

display local-user

Use display local-user to display the local user configuration and online user statistics.

Syntax

display local-user [ class { manage | network [ guest ] } | idle-cut { disable | enable } | service-type { advpn | ftp | http | https | ike | ipoe | lan-access | onu | pad | portal | ppp | ssh | telnet | terminal } | state { active | block } | user-name user-name class { manage | network [ guest ] } | vlan vlan-id ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

class: Specifies the local user type.

manage: Device management user.

network: Network access user.

guest: Guest user account.

idle-cut { disable | enable }: Specifies local users by the status of the idle cut feature.

service-type: Specifies the local users that use a specific type of service.

advpn: ADVPN tunnel users.

ftp: FTP users.

http: HTTP users.

https: HTTPS users.

ike: IKE users that access the network through IKE extended authentication.

ipoe: IPoE users that access the network through Layer 2 or Layer 3 leased lines or STBs.

lan-access: LAN users that typically access the network through an Ethernet, such as 802.1X users.

onu: ONU users.

pad: X.25 PAD users.

portal: Portal users.

ppp: PPP users.

ssh: SSH users.

telnet: Telnet users.

terminal: Terminal users that log in through console ports or asyn ports.

state { active | block }: Specifies local users in active or blocked state. A local user in active state can access network services, but a local user in blocked state cannot.

user-name user-name: Specifies all local users using the specified username, a string of 1 to 80 characters. The specified username can be a pure username or contain a domain name (in the format of pure-username@domain-name).

· The pure username is a case-sensitive string and must meet the following requirements:

¡ Cannot be a, al, or all.

· The domain name is a case-insensitive string and cannot contain an at sign (@).

vlan vlan-id: Specifies all local users in a VLAN. The vlan-id argument is in the range of 1 to 4094.

Usage guidelines

If you do not specify any parameters, this command displays information about all local users.

Examples

# Display information about all local users.

<Sysname> display local-user

Total 3 local users matched.

Device management user root:

State: Active

Service type: SSH/Telnet/Terminal

Access limit: Enabled

Max access number: 3

Current access number: 1

User group: system

Bind attributes:

Authorization attributes:

Work directory: flash:

User role list: network-admin

Password control configurations:

Password aging: 3 days

Password history was last reset: 0 days ago

Password remaining lifetime: 2 days 12 hours 30 minutes 30 seconds

Network access user jj:

State: Active

Service type: LAN-access

User group: system

Bind attributes:

IP address: 2.2.2.2

Location bound: GigabitEthernet1/0/1

MAC address: 0001-0001-0001

VLAN ID: 2

Authorization attributes:

Idle timeout: 33 minutes

Work directory: flash:

ACL number: 2000

User profile: pp

User role list: network-operator, level-0, level-3

Description: A network access user from company cc

Validity period:

Start date and time: 2020/01/01-00:01:01

Expiration date and time: 2020/01/01-01:01:01

Password control configurations:

Password length: 4 characters

Network access guest user1:

State: Active

Service type: LAN-access/Portal

User group: guest1

Full name: Jack

Company: cc

Email: [email protected]

Phone: 131129237

Sponsor full name: Sam

Sponsor department: security

Sponsor email: [email protected]

Description: A guest from company cc

Validity period:

Start date and time: 2020/02/01-08:00:00

Expiration date and time: 2020/02/03-18:00:00

Table 11 Command output

Field	Description
State	Status of the local user: active or blocked.
Service type	Service types that the local user can use.
Access limit	Whether the concurrent login limit is enabled.
Max access number	Maximum number of concurrent logins using the local user name.
Current access number	Current number of concurrent logins using the local user name.
User group	Group to which the local user belongs.
Bind attributes	Binding attributes of the local user.
IP address	IP address of the local user.
Location bound	Binding port of the local user.
MAC address	MAC address of the local user.
VLAN ID	Binding VLAN of the local user.
WLAN VLAN ID	Authorization VLAN of the local wireless user.
WLAN VLAN group name	Authorization VLAN group of the local wireless user.
Calling number	Calling number of the ISDN user.
Authorization attributes	Authorization attributes of the local user.
Idle timeout	Idle timeout period of the user, in minutes.
Session-timeout	Session timeout timer for the user, in minutes.
Callback number	Authorized PPP callback number of the local user.
Work directory	Directory that the FTP, SFTP, or SCP user can access.
ACL number	Authorization ACL of the local user.
VLAN ID	Authorized VLAN of the local user.
User profile	Authorization user profile of the local user.
User role list	Authorized roles of the local user.
IP pool	IPv4 pool authorized to the local user.
IP address	IPv4 address authorized to the local user.
IPv6 address	IPv6 address authorized to the local user.
IPv6 prefix	IPv6 address prefix authorized to the local user.
IPv6 pool	IPv6 pool authorized to the local user.
Primary DNS server	IPv4 address of the primary DNS server for the local user.
Secondary DNS server	IPv4 address of the secondary DNS server for the local user.
Primary DNSV6 server	IPv6 address of the primary DNS server for the local user.
Secondary DNSV6 server	IPv6 address of the secondary DNS server for the local user.
URL	Authorization PADM URL for the local user.
VPN instance	Authorization VPN instance for the local user.
Subscriber ID	Subscriber ID of the local user.
Session group profile	Session group profile of the local user.
User group	User group of the local user.
Password control configurations	Password control attributes that are configured for the local user.
Password aging	This field displays the password aging time if local user password aging is enabled. If the feature is disabled, this field displays Disabled.
Password length	Minimum number of characters that a password must contain.
Password composition	Password composition policy: · Minimum number of character types that a password must contain. · Minimum number of characters from each type in a password.
Password complexity	Password complexity checking policy: · Reject a password that contains the username or the reverse of the username. · Reject a password that contains any character repeated consecutively three or more times.
Maximum login attempts	Maximum number of consecutive failed login attempts.
Action for exceeding login attempts	Action to take on the user that failed to log in after using up all login attempts.
Password history was last reset	The most recent time that the history password records were cleared.
Password remaining lifetime	Remaining aging time for the password.
Full name	Name of the local guest.
Company	Company name of the local guest.
Email	Email address of the local guest.
Phone	Phone number of the local guest.
Sponsor full name	Name of the guest sponsor.
Sponsor department	Department of the guest sponsor.
Sponsor email	Email address of the guest sponsor.
Description	Description of the network access user.
Validity period	Validity period of the network access user.
Start date and time	Date and time from which the network access user begins to take effect.
Expiration date and time	Date and time at which the network access user expires.

‌

display local-user access-count

Use display local-user access-count to display access statistics for a local user.

Syntax

display local-user user-name user-name class { manage | network } access-count

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

user-name user-name: Specifies all local users using the specified username. The username is a string of 1 to 55 characters. The username cannot contain a forward slash (/), backslash (\), vertical bar (|), colon (:), asterisk (*), question mark (?), left angle bracket (<), or right angle bracket (>). It also cannot be a, al, or all.

class: Specifies the local user type.

manage: Specifies the device management user.

network: Specifies the network access user.

Examples

# Display access statistics for device management user admin.

<Sysname> display local-user user-name admin class manage access-count

Device management user admin:

Configured access limit: 30

Current access count: 15

Access method Slot Access count

Telnet 1 10

SSH 1 5

Table 12 Command output

Field	Description
Configured access limit	Maximum number of concurrent logins using the local user name.
Current access count	Current number of concurrent logins using the local user name.
Access method	Access type of the user: · ADVPN. · Telnet. · SSH. · HTTP. · HTTPS. · Terminal. · IPoE. · LAN access. · Portal. · PPP. · SSL VPN.
Access count	Current number of concurrent logins of the specified access type that use the specified local username.

‌

Related commands

access-limit

display user-group

Use display user-group to display user group configuration.

Syntax

display user-group { all | name group-name [ byod-authorization ] } [ identity-member { all | group | user } ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

all: Specifies all user groups.

name group-name: Specifies a user group by its name, a case-insensitive string of 1 to 32 characters.

byod-authorization: Specifies BYOD authorization information. If you do not specify this keyword, the command does not display BYOD authorization information and only displays whether BYOD authorization attributes are configured.

identity-member: Specifies identity members in the specified user group or all user groups. If you do not specify this option, the command does not display identity member information.

all: Specifies all identity members, including identity users and identity groups.

group: Specifies identity groups.

user: Specifies identity users.

Examples

# Display the configuration of all user groups.

<Sysname> display user-group all

Total 2 user groups matched.

User group: system

Group ID: 1

Authorization attributes:

Work directory: flash:

BYOD authorization attributes: Configured

User-Isolation: Not configured

User group: jj

Group ID: 2

Authorization attributes:

Idle timeout: 2 minutes

Callback number: 2:2

Work directory: flash:/

ACL number: 2000

VLAN ID: 2

User profile: pp

BYOD authorization attributes: Not configured

User-Isolation: Intra-group

Password control configurations:

Password aging: 2 days

# Display information about all identity members for all user groups.

<Sysname> display user-group all identity-member all

Total 2 user groups matched.

User group: system

Identity groups: 0

User group: jj

Identity groups: 2

Group ID Group name

0xffffffff group1

0x567 group2

Identity users: 2

User ID Username

0x234 user1

0xffffffff user2

Table 13 Command output

Field	Description
User group	User group name.
Authorization attributes	Authorization attributes of the user group.
Idle timeout	Idle timeout period, in minutes.
Session-timeout	Session timeout timer, in minutes.
Callback number	Authorized PPP callback number.
Work directory	Directory that FTP, SFTP, or SCP users in the group can access.
ACL number	Authorization ACL.
VLAN ID	Authorized VLAN.
User profile	Authorization user profile.
IP pool	IPv4 pool authorized to the user group.
IPv6 prefix	IPv6 address prefix authorized to the user group.
IPv6 pool	IPv6 pool authorized to the user group.
Primary DNS server	IPv4 address of the primary DNS server authorized to the user group.
Secondary DNS server	IPv4 address of the secondary DNS server authorized to the user group.
Primary DNSV6 server	IPv6 address of the primary DNS server authorized to the user group.
Secondary DNSV6 server	IPv6 address of the secondary DNS server authorized to the user group.
URL	Authorization PADM URL for the user group.
VPN instance	Authorization VPN instance for the user group.

‌

BYOD authorization attributes	BYOD authorization attributes of the user group.
User isolation	User group-based user isolation policy. Options include: · Intra-group—Intra-group isolation. · Inter-group—Inter-group isolation.
Password control configurations	Password control attributes that are configured for the user group.
Password aging	Password expiration time.
Password length	Minimum number of characters that a password must contain.
Password composition	Password composition policy: · Minimum number of character types that a password must contain. · Minimum number of characters from each type in a password.
Password complexity	Password complexity checking policy: · Reject a password that contains the username or the reverse of the username. · Reject a password that contains any character repeated consecutively three or more times.
Maximum login attempts	Maximum number of consecutive failed login attempts.
Action for exceeding login attempts	Action to take on the user that failed to log in after using up all login attempts.
Identity users	Number of identity users.
Identity groups	Number of identity groups.
User ID	Identity user ID.
Group ID	Identity group ID.
Username	Identity user name.
Group name	Identity group name.

‌

email

Use email to configure an email address for a local guest.

Use undo email to restore the default.

Syntax

email email-string

undo email

Default

No email address is configured for a local guest.

Views

Local guest view

Predefined user roles

network-admin

Parameters

email-string: Specifies the email address for the local guest, a case-sensitive string of 1 to 255 characters. For example, [email protected]. The address must comply with RFC 822.

Usage guidelines

The local guest uses the email address to receive notifications from the device.

Examples

# Configure the email address as [email protected] for local guest abc.

<Sysname> system-view

[Sysname] local-user abc class network guest

[Sysname-luser-network(guest)-abc] email [email protected]

Related commands

display local-user

full-name

Use full-name to configure the name of a local guest.

Use undo full-name to restore the default.

Syntax

full-name name-string

undo full-name

Default

No name is configured for a local guest.

Views

Local guest view

Predefined user roles

network-admin

Parameters

name-string: Specifies the local guest name, a case-sensitive string of 1 to 255 characters.

Examples

# Configure the name as abc Snow for local guest abc.

<Sysname> system-view

[Sysname] local-user abc class network guest

[Sysname-luser-network(guest)-abc] full-name abc Snow

Related commands

display local-user

group

Use group to assign a local user to a user group.

Use undo group to restore the default.

Syntax

group group-name

undo group

Default

A local user belongs to user group system.

Views

Local user view

Predefined user roles

network-admin

Parameters

group-name: Specifies the user group name, a case-insensitive string of 1 to 32 characters.

Examples

# Assign device management user 111 to user group abc.

<Sysname> system-view

[Sysname] local-user 111 class manage

[Sysname-luser-manage-111] group abc

Related commands

display local-user

identity-group

Use identity-group to add a network access user to an identity group.

Use undo identity-group to remove a network access user from identity groups.

Syntax

identity-group group-name

undo identity-group [ group-name ]

Default

A network access user does not belong to an identity group.

Views

Network access user view

Predefined user roles

network-admin

Parameters

group-name: Specifies an identity group by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

Add users to an identity group as identity members for centralized management.

A user can belong to multiple identity groups.

After you add a user to an identity group in network access user view, the system automatically synchronizes the configuration to the user group view of the identity group. Then, the user is available in user group view of the identity group.

If you do not specify a group name, the undo identity-group command removes the user from all identity groups.

Examples

# Add network access user user1 to identity group group1.

<Sysname> system-view

[Sysname] local-user user1 class network

[Sysname-luser-network-user1] identity-group group1

Related commands

identity-member

user-group

identity-member

Use identity-member to add an identity member to a user group.

Use undo identity-member to remove identity members from a user group.

Syntax

identity-member { group group-name | user user-name }

undo identity-member { group [ group-name ] | user [ user-name ] }

Default

No identity members exist in a user group.

Views

User group view

Predefined user roles

network-admin

Parameters

group group-name: Specifies an identity group by its name, a case-insensitive string of 1 to 32 characters.

user user-name: Specifies an identity user by its name, a string of 1 to 80 characters. The username can be a pure username or a username containing a domain name.

· A pure username is case sensitive. It cannot contain a forward slash (/), backslash (\), vertical bar (|), colon (:), asterisk (*), question mark (?), left angle bracket (<), or right angle bracket (>). It also cannot be a, al, or all.

· A username containing a domain name is in the pure-username@domain-name format.

¡ The pure username part is case sensitive. It cannot contain a forward slash (/), backslash (\), vertical bar (|), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@). It also cannot be a, al, or all.

¡ The domain name part is case insensitive and cannot contain an at sign (@).

Usage guidelines

Assign users or users groups that have the same user identification requirements to the same group.

When you add identity members, follow these restrictions and guidelines:

· You can add only network access users as identity users.

· After you add an identity user to an identity group in user group view, the system automatically synchronizes the configuration to the local user view of the identity user if the user exists. Then, the identity user group is available in the local user view of the identity user.

· You cannot assign the parent group of a user group to the user group as an identity member.

If you do not specify a user name or group name, the undo identity-member command removes all identity users or groups from the user group.

If an identity user group is used in a security policy, avoid removing member identity user groups from that identity user group. Doing so will change the tree of identity user groups, resulting in incorrect user traffic matching or user traffic matching failure.

Examples

# Add identity user user1 and identity group group2 to user group group1.

<Sysname> system-view

[Sysname] user-group group1

[Sysname-ugroup-group1] identity-member user user1

[Sysname-ugroup-group1] identity-member group group2

Related commands

display user-group

identity-group

local-guest email format

Use local-guest email format to configure the subject and body for the email notifications of local guest information.

Use undo local-guest email format to delete the configured subject or body for the email notifications of local guest information.

Syntax

local-guest email format to { guest | manager | sponsor } { body body-string | subject sub-string }

undo local-guest email format to { guest | manager | sponsor } { body | subject }

Default

No subject or body is configured for the email notifications of local guest information.

Views

System view

Predefined user roles

network-admin

Parameters

to: Specifies the email recipient.

guest: Specifies the local guest.

manager: Specifies the guest manager.

sponsor: Specifies the guest sponsor.

body body-string: Configures the body content. The body-string argument is a case-sensitive string of 1 to 255 characters.

subject sub-string: Configures the email subject. The sub-string argument is a case-sensitive string of 1 to 127 characters.

Usage guidelines

Email notifications need to be sent to notify the local guests, guest sponsors, or guest managers of the guest account information or guest registration requests. Use this command to configure the subject and body for the email notifications to be sent by the device.

You can configure one subject and one body for each email recipient. If you configure the subject or body content multiple times for the same recipient, the most recent configuration takes effect.

You must configure both the subject and body for each recipient.

Examples

# Configure the subject and body for the email notifications to send to the local guest.

<Sysname> system-view

[Sysname] local-guest email format to guest subject Guest account information

[Sysname] local-guest email format to guest body A guest account has been created for you. The username, password, and validity period of the account are given below.

Related commands

local-guest email sender

local-guest email smtp-server

local-guest manager-email

local-guest send-email

local-guest email sender

Use local-guest email sender to configure the email sender address in email notifications of local guests sent by the device.

Use undo local-guest email sender to restore the default.

Syntax

local-guest email sender email-address

undo local-guest email sender

Default

No email sender address is configured for the email notifications of local guests sent by the device.

Views

System view

Predefined user roles

network-admin

Parameters

email-address: Specifies the email sender address, a case-sensitive string of 1 to 255 characters.

Usage guidelines

If you do not specify the email sender address, the device cannot send email notifications.

The device supports only one email sender address. If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Specify the email sender address as [email protected] for email notifications of local guests.

<Sysname> system-view

[Sysname] local-guest email sender [email protected]

Related commands

local-guest email format

local-guest email smtp-server

local-guest manager-email

local-guest send-email

local-guest email smtp-server

Use local-guest email smtp-server to specify an SMTP server to send email notifications of local guests.

Use undo local-guest email smtp-server to restore the default.

Syntax

local-guest email smtp-server url-string

undo local-guest email smtp-server

Default

No SMTP server is specified to send email notifications of local guests.

Views

System view

Predefined user roles

network-admin

Parameters

url-string: Specifies the path of the SMTP server, a case-sensitive string of 1 to 255 characters. The path must comply with the standard SMTP protocol and start with smtp://.

Usage guidelines

If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Specify the SMTP server at smtp://www.test.com/smtp to send local guest email notifications.

<Sysname> system-view

[Sysname] local-guest email smtp-server smtp://www.test.com/smtp

Related commands

local-guest email format

local-guest email sender

local-guest manager-email

local-guest send-email

local-guest generate

Use local-guest generate to create local guests in batch.

Syntax

local-guest generate username-prefix name-prefix [ password-prefix password-prefix ] suffix suffix-number [ group group-name ] count user-count validity-datetime start-date start-time to expiration-date expiration-time

Views

System view

Predefined user roles

network-admin

Parameters

username-prefix name-prefix: Specifies the name prefix. The name-prefix argument is a case-sensitive string of 1 to 70 characters. The prefix cannot contain any of the following characters: forward slash (/), backslash (\), vertical bar (|), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).

password-prefix password-prefix: Specifies a prefix for the plaintext password. The password-prefix argument is a case-sensitive string of 1 to 53 characters. If you do not specify a password prefix, the device randomly generates passwords for the local guests.

suffix suffix-number: Specifies the start suffix number of the username and password. The suffix-number argument is a numeric string of 1 to 10 digits.

group group-name: Specifies a user group by the name. The group-name argument is a case-sensitive string of 1 to 32 characters. If you do not specify a user group, the guests are assigned to the system-defined user group system.

count user-count: Specifies the number of local guests to be created. The value range for the user-count argument is 1 to 256.

validity-datetime: Specifies the validity period of the local guests.

start-date: Specifies the start date of the validity period, in the format of MM/DD/YYYY or YYYY/MM/DD. The value range for the MM argument is 1 to 12. The value range for the DD argument varies with the specified month. The value range for the YYYY argument is 2000 to 2035.

start-time: Specifies the start time of the validity period, in the format of hh:mm:ss. The value range for the hh argument is 0 to 23. The value range for the mm and ss arguments is 0 to 59. The mm and ss arguments are optional. For example, enter 1 to indicate 1:00:00. A value of 0 indicates 00:00:00.

to: Specifies the end date and time of the validity period.

expiration-date: Specifies the expiration date in the format of MM/DD/YYYY or YYYY/MM/DD. The value range for the MM argument is 1 to 12. The value range for the DD argument varies with the specified month. The value range for the YYYY argument is 2000 to 2035.

expiration-time: Specifies the expiration time in the format of hh:mm:ss. The value range for the hh argument is 0 to 23. The value range for the mm and ss arguments is 0 to 59. The mm and ss arguments are optional. For example, enter 1 to indicate 1:00:00. A value of 0 indicates 00:00:00.

Usage guidelines

Account names of batch created local guests start with the same string specified by the name prefix, and end with a different number as the suffix. The system increases the start suffix number by 1 for each new local guest created in the batch.

The device generates plaintext passwords by using the password prefix and suffix number in the same way it batch creates the local guest names.

Consider the system resources when you specify the number of local guests to create. The device might fail to create all accounts for a large batch of local guests because of insufficient resources.

If a local guest to be created has the same name as an existing local guest on the device, the new guest overrides the existing guest.

Examples

# Create 20 local guests in batch with user names abc01 through abc20 for user group visit. The user accounts are effective from 2020/01/01 00:00:00 to 2020/02/02 12:00:00.

<Sysname> system-view

[Sysname] local-guest generate username-prefix abc suffix 01 group visit count 20 validity-datetime 2020/01/01 00:00:00 to 2020/02/02 12:00:00

Related commands

local-user

display local-user

local-guest manager-email

Use local-guest manager-email to configure the email address of the guest manager.

Use undo local-guest manager-email to restore the default.

Syntax

local-guest manager-email email-address

undo local-guest manager-email

Default

No email address is configured for the guest manager.

Views

System view

Predefined user roles

network-admin

Parameters

email-address: Specifies the email address, a case-sensitive string of 1 to 255 characters. For example, [email protected]. The address must comply with RFC 822.

Usage guidelines

Use this command to specify the email address to which the device sends the local guest registration requests for approval.

If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Configure the email address of the guest manager as [email protected].

<Sysname> system-view

[Sysname] local-guest manager-email [email protected]

Related commands

local-guest email format

local-guest email sender

local-guest email smtp-server

local-guest send-email

Use local-guest send-email to send emails to a local guest or guest sponsor.

Syntax

local-guest send-email user-name user-name to { guest | sponsor }

Views

User view

Predefined user roles

network-admin

Parameters

user-name user-name: Specifies a local guest by the username, a string of 1 to 80 characters. The username of the specified guest can be a pure username or contain a domain name (in the format of pure-username@domain-name).

· The pure username is a case-sensitive string and must meet the following requirements:

¡ Cannot be a, al, or all.

· The domain name is a case-insensitive string and cannot contain an at sign (@).

to: Specifies the email recipient.

guest: Specifies the local guest.

sponsor: Specifies the guest sponsor.

Usage guidelines

Device managers can use this command to inform local guests or guest sponsors of the guest password and validity period information.

Examples

# Send an email to notify local guest abc of the guest password and validity period information.

<Sysname> local-guest send-email user-name abc to guest

Related commands

sponsor-email

local-guest timer

Use local-guest timer to set the waiting-approval timeout timer for local guests.

Syntax

local-guest timer waiting-approval time-value

undo local-guest timer waiting-approval

Default

The setting is 24 hours.

Views

System view

Predefined user roles

network-admin

Parameters

time-value: Specifies the waiting-approval timeout timer in the range of 1 to 720, in hours.

Usage guidelines

The waiting-approval timeout timer starts when the registration request of a local guest is sent for approval. If the request is not approved within the timer, the device deletes the registration request.

Examples

# Set the waiting-approval timeout timer to 12 hours.

<Sysname> system-view

[Sysname] local-guest timer waiting-approval 12

local-user

Use local-user to add a local user and enter its view, or enter the view of an existing local user.

Use undo local-user to delete local users.

Syntax

local-user user-name [ class { manage | network [ guest ] } ]

undo local-user { user-name class { manage | network [ guest ] } | all [ class { manage | network [ guest ] } |service-type { advpn | ftp | http | https | ike | ipoe | lan-access | onu | pad | portal | ppp | ssh | sslvpn | telnet | terminal } ] }

Default

No local users exist.

Views

System view

Predefined user roles

network-admin

Parameters

user-name: Specifies the username of the local user, a string of 1 to 80 characters. The specified username can be a pure username or contain a domain name (in the format of pure-username@domain-name).

· The pure username is a case-sensitive string and must meet the following requirements:

¡ Cannot be a substring of all or auto-delete that starts with character a (for example, a, al, all, au, aut, auto, or auto-).

· The domain name is a case-insensitive string and cannot contain an at sign (@).

class: Specifies the local user type. If you do not specify this keyword, the command adds a device management user.

manage: Device management user that can configure and monitor the device after login. Device management users can use FTP, HTTP, HTTPS, Telnet, SSH, terminal, and PAD services.

network: Network access user that accesses network resources through the device. Network access users can use ADVPN, IKE, IPoE, LAN access, portal, PPP, and ONU services.

guest: Guest that can access network resources through the device during a specific validity period. Guests can use LAN access and portal services.

all: Specifies all users.

service-type: Specifies the local users that use a specific type of service.

advpn: ADVPN tunnel users.

ftp: FTP users.

http: HTTP users.

https: HTTPS users.

ike: IKE users that access the network through IKE extended authentication.

ipoe: IPoE users that access the network through Layer 2 or Layer 3 leased lines or STBs.

lan-access: LAN users that typically access the network through an Ethernet, such as 802.1X users.

onu: ONU users.

pad: X.25 PAD users.

portal: Portal users.

ppp: PPP users.

ssh: SSH users.

telnet: Telnet users.

terminal: Terminal users that log in through console ports or asyn ports.

Usage guidelines

In local authentication, a username and user type uniquely identifies a local user. The username is used to match the pure username parsed from the username entered by the user. The user type restricts the service types that can be used by the user.

The device supports multiple local users. The maximum number of device management users varies by device model. The maximum number of network access users varies by device model.

If the local username contains Chinese characters, make sure the endpoint software used at device login adopts the same character set encoding format as the device. If they use different encoding formats, the username cannot be correctly decoded on the device, which might cause local authentication failure. To view the encoding format used by the device, execute the display character-encoding command.

Some device models do not suppor creating a local management user with the same name as the default user.

Examples

# Add a device management user named user1 and enter local user view.

<Sysname> system-view

[Sysname] local-user user1 class manage

[Sysname-luser-manage-user1]

# Add a network access user named user2 and enter local user view.

<Sysname> system-view

[Sysname] local-user user2 class network

[Sysname-luser-network-user2]

# Add a local guest named user3 and enter local guest view.

Sysname> system-view

[Sysname] local-user user3 class network guest

[Sysname-luser-network(guest)-user3]

Related commands

display local-user

display character-encoding (Fundamentals Command Reference)

service-type (local user view)

local-user auto-delete enable

Use local-user auto-delete enable to enable the local user auto-delete feature.

Use undo local-user auto-delete enable to restore the default.

Syntax

local-user auto-delete enable

undo local-user auto-delete enable

Default

The local user auto-delete feature is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

This feature enables the device to examine the validity of local users at fixed time periods of 10 minutes and automatically delete expired local users.

Examples

# Enable the local user auto-delete feature.

<Sysname> system-view

[Sysname] local-user auto-delete enable

Related commands

validity-datetime

local-user-export class network

Use local-user-export class network to export network access user account information to a .csv file.

Syntax

local-user-export class network url url-string [ from { group group-name | user user-name } ]

Views

System view

Predefined user roles

network-admin

Parameters

url url-string: Specifies the URL of the destination file, a case-insensitive string of 1 to 255 characters.

from: Specifies the range of users to be exported. If you do not specify this keyword, the command exports all network access users on the device.

group group-name: Specifies a user group by the name, a case-insensitive string of 1 to 32 characters.

user user-name: Specifies a user by the name, a string of 1 to 80 characters. The specified username can be a pure username or contain a domain name (in the format of pure-username@domain-name).

· The pure username is a case-sensitive string and must meet the following requirements:

¡ Cannot be a, al, or all.

· The domain name is a case-insensitive string and cannot contain an at sign (@).

Usage guidelines

You can import the user account information back to the device or to other devices that support the local-user-import class network command. Before the import, you can edit the .csv file as needed. However, you must follow the restrictions in "local-user-import class network."

The device supports TFTP and FTP file transfer modes. Table 14 describes the valid URL formats of the .csv file.

Table 14 URL formats

Protocol	URL format	Description
TFTP	tftp://server/path/filename	Specify a TFTP server by IP address or hostname. The path parameter represents the relative path of the TFTP working directory. For example, specify the file path as tftp://1.1.1.1/user/user.csv.
FTP	· With FTP user name and password: ftp://username:password@server/path/filename · Without FTP user name and password: ftp://server/path/filename	Specify an FTP server by IP address or hostname. The path parameter represents the relative path of the FTP working directory. The device ignores the domain name in the FTP user name. For example, specify the file path as ftp://1:[email protected]/user/user.csv or ftp://1.1.1.1/user/user.csv.

Protocol

URL format

Description

TFTP

tftp://server/path/filename

Specify a TFTP server by IP address or hostname. The path parameter represents the relative path of the TFTP working directory. For example, specify the file path as tftp://1.1.1.1/user/user.csv.

FTP

· With FTP user name and password:
ftp://username:password@server/path/filename

· Without FTP user name and password:
ftp://server/path/filename

Specify an FTP server by IP address or hostname. The path parameter represents the relative path of the FTP working directory.

The device ignores the domain name in the FTP user name.

For example, specify the file path as ftp://1:[email protected]/user/user.csv or ftp://1.1.1.1/user/user.csv.

‌

Examples

# Export network access user account information to the identityuser.csv file in the ftp://1.1.1.1/user/ path.

<Sysname> system-view

[Sysname] local-user-export class network url ftp://1.1.1.1/user/identityuser.csv

Related commands

display local-user

local-user-import class network

local-user-export class network guest

Use local-user-export class network guest to export local guest account information to a .csv file.

Syntax

local-user-export class network guest url url-string

Views

System view

Predefined user roles

network-admin

Parameters

url url-string: Specifies the URL of the destination file, a case-insensitive string of 1 to 255 characters.

Usage guidelines

You can import the user account information back to the device or to other devices that support the local-user-import class network guest command. Before the import, you can edit the .csv file as needed. However, you must follow the restrictions in "local-user-import class network guest."

The device supports TFTP and FTP file transfer modes. Table 15 describes the valid URL formats of the .csv file.

Table 15 URL formats

Protocol	URL format	Description
TFTP	tftp://server/path/filename	Specify a TFTP server by IP address or hostname. The path parameter represents the relative path of the TFTP working directory. For example, specify the file path as tftp://1.1.1.1/user/user.csv.
FTP	· With FTP user name and password: ftp://username:password@server/path/filename · Without FTP user name and password: ftp://server/path/filename	Specify an FTP server by IP address or hostname. The path parameter represents the relative path of the FTP working directory. The device ignores the domain name in the FTP user name. For example, specify the file path as ftp://1:[email protected]/user/user.csv or ftp://1.1.1.1/user/user.csv.

Protocol

URL format

Description

TFTP

tftp://server/path/filename

Specify a TFTP server by IP address or hostname. The path parameter represents the relative path of the TFTP working directory. For example, specify the file path as tftp://1.1.1.1/user/user.csv.

FTP

· With FTP user name and password:
ftp://username:password@server/path/filename

· Without FTP user name and password:
ftp://server/path/filename

Specify an FTP server by IP address or hostname. The path parameter represents the relative path of the FTP working directory.

The device ignores the domain name in the FTP user name.

For example, specify the file path as ftp://1:[email protected]/user/user.csv or ftp://1.1.1.1/user/user.csv.

‌

Examples

# Export local guest account information to the guest.csv file in the ftp://1.1.1.1/user/ path.

<Sysname> system-view

[Sysname] local-user-export class network guest url ftp://1.1.1.1/user/guest.csv

Related commands

display local-user

local-user-import class network guest

local-user-import class network

Use local-user-import class network to import user information from a .csv file and create network access users based on the imported information.

Syntax

local-user-import class network url url-string [ auto-create-group | override | start-line line-number ] *

Views

System view

Predefined user roles

network-admin

Parameters

url url-string: Specifies the URL of the source file, a case-insensitive string of 1 to 255 characters.

auto-create-group: Enables the device to automatically create user groups for the imported network access users if the groups do not exist on the device. If you do not specify this keyword, the device ignores the nonexistent user groups of the network access users and assigns the users to the predefined user group system.

override: Specifies the device to override the existing account with the same name as a user account to be imported. If you do not specify this keyword, the device retains the existing account information.

start-line line-number: Specifies the number of the line at which the account import begins. The value range for the line-number argument is 1 to 1048576. If you do not specify this option, the command imports information about all user accounts in the file.

Usage guidelines

The .csv file contains multiple parameters for each account and the parameters must be strictly arranged in the following order:

· Username—The username cannot be empty and is a string of 1 to 80 characters. The username can be a pure username or contain a domain name (in the format of pure-username@domain-name).

¡ The pure username is a case-sensitive string and must meet the following requirements:

- Cannot contain any of the following characters: forward slash (/), backslash (\), vertical bar (|), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).

- Cannot be a, al, or all.

¡ The domain name is a case-insensitive string and cannot contain an at sign (@).

IMPORTANT:

Any invalid character results in account import failure and interruption.

‌

· Password form—Plaintext or encrypted form. If the parameter is empty, the password is in encrypted form.

· Password—The encrypted form is a case-sensitive string of 1 to 117 characters. The plaintext form is a case-sensitive string of 1 to 64 characters. If the device fails to parse the password or the password is empty, the device imports the account without a password.

· Authorization user group—User group to which the user belongs after the user passes local authentication. The group name is a case-insensitive string of 1 to 32 characters. If the parameter is empty, the device assigns the user to the default user group system.

· Identity groups—Groups for identity-based access control. A user can belong to multiple identity groups. An identity group name is a case-insensitive string of 1 to 32 characters. Separate identity group names by the string 0x0A. If the parameter is empty, the user does not belong to any identity group.

· Service types—Services to assign to the user. Available services include portal, PPP, IPoE, LAN access, ADVPN, SSL VPN, ONU, and IKE. A service name is case insensitive. Separate service types by the string 0x0A. If the parameter is empty, the user cannot use any service.

· Max concurrent logins—The maximum number of online users with the same user name. The value range is 1 to 1024. If the parameter is empty, the device does not restrict the number of online users with the same user name.

Separate different accounts by a carriage return and separate each parameter value of the same account by a comma (,). For example,

Jack,$c$3$uM6DH5empTfbsx341Qk/ORGozkbxNE0=,author-group1,parent-group1(0x0A)parent-group2,portal(0x0A)lan-access,1024

Mary,$c$3$YpVonswJTN1dVMEev+zu2pgrCIIJ,author-group2,parent-group1(0x0A)parent-group2,ppp(0x0A)ipoe,800

When you edit the .csv file, follow these restrictions and guidelines:

· Start lines with pound signs (#) to contain explanation information for usage guidelines. The device does not import the lines as user account information.

· Separate parameter values by a comma (,). If the value of a parameter contains a comma (,), you must enclose the value into single quotation marks (') to avoid ambiguity. For example, if the authorization user group of a user is named as author,group, you must specify the authorization user group name as 'author,group' in the .csv file.

The device supports TFTP and FTP file transfer modes. Table 17 describes the valid URL formats of the .csv file.

Table 16 URL formats

Protocol	URL format	Description
TFTP	tftp://server/path/filename	Specify a TFTP server by IP address or hostname. The path parameter represents the relative path of the TFTP working directory. For example, specify the file path as tftp://1.1.1.1/user/user.csv.
FTP	· With FTP user name and password: ftp://username:password@server/path/filename · Without FTP user name and password: ftp://server/path/filename	Specify an FTP server by IP address or hostname. The path parameter represents the relative path of the FTP working directory. The device ignores the domain name in the FTP user name. For example, specify the file path as ftp://1:[email protected]/user/user.csv or ftp://1.1.1.1/user/user.csv.

Protocol

URL format

Description

TFTP

tftp://server/path/filename

Specify a TFTP server by IP address or hostname. The path parameter represents the relative path of the TFTP working directory. For example, specify the file path as tftp://1.1.1.1/user/user.csv.

FTP

· With FTP user name and password:
ftp://username:password@server/path/filename

· Without FTP user name and password:
ftp://server/path/filename

Specify an FTP server by IP address or hostname. The path parameter represents the relative path of the FTP working directory.

The device ignores the domain name in the FTP user name.

For example, specify the file path as ftp://1:[email protected]/user/user.csv or ftp://1.1.1.1/user/user.csv.

‌

Examples

# Import user account information from the localuser.csv file in the ftp://1.1.1.1/user/ path, and create network access users based on the imported information. Specify the device to ignore the accounts that have the same name as the existing accounts on the device. Enable the device to automatically create the user group of an imported network access user if the user group does not exist on the device.

<Sysname> system-view

[Sysname] local-user-import class network url ftp://1.1.1.1/user/localuser.csv auto-create-group

Related commands

local-user-export class network

local-user-import class network guest

Use local-user-import class network guest to import local guest account information from a .csv file to create local guests based on the imported information.

Syntax

local-user-import class network guest url url-string validity-datetime start-date start-time to expiration-date expiration-time [ auto-create-group | override | start-line line-number ] *

Views

System view

Predefined user roles

network-admin

Parameters

url url-string: Specifies the source file path. The url-string argument is a case-insensitive string of 1 to 255 characters.

validity-datetime: Specifies the guest validity period of the local guests.

to: Specifies the end date and time of the validity period.

auto-create-group: Enables the device to automatically create user groups for the imported local guests if the groups in the imported information do not exist on the device. If you do not specify this keyword, the device adds all imported local guests to the system-defined user group named system.

override: Enables the device to override the existing account with the same name as an imported guest account. If you do not specify this keyword, the device retains the existing account and does not import the local guest with the same name.

start-line line-number: Specifies the number of the line at which the account import begins. If you do not specify a line number, this command imports all accounts in the .csv file.

Usage guidelines

The .csv file contains multiple parameters for each account and the parameters must be strictly arranged in the following order:

· Username—User name of the guest account. The user name cannot be empty.

· Password—Password of the guest account in plaintext form. If the password is empty, the device generates a random password in encrypted form for the guest.

· User group—User group to which the guest belongs. If the user group is empty, the device assigns the guest to the system-defined user group named system.

· Guest full name—Name of the guest.

· Guest company—Company of the guest.

· Guest email—Email address of the guest.

· Guest phone—Phone number of the guest.

· Guest description—Description of the guest.

· Sponsor full name—Name of the guest sponsor.

· Sponsor department—Department of the guest sponsor.

· Sponsor email—Email address of the guest sponsor.

The value of each parameter in the file must meet the requirements of the local user attributes on the device. Any violation results in account import failure and interruption. The system displays the number of the line where the account import is interrupted.

Separate different account entries by a carriage return and separate each parameter value in an account entry by a comma (,). If the value of a parameter contains a comma (,), you must enclose the value within a pair of quotation marks ("") to avoid ambiguity. For example,

Jack,abc,visit,Jack Chen,ETP,[email protected],1399899,"The manager of ETP, come from TP.",Sam Wang,Ministry of personnel,[email protected]

The device supports TFTP and FTP file transfer modes. Table 17 describes the valid URL formats of the .csv file.

Table 17 URL formats

Protocol	URL format	Description
TFTP	tftp://server/path/filename	Specify a TFTP server by IP address or hostname. The path parameter represents the relative path of the TFTP working directory. For example, specify the file path as tftp://1.1.1.1/user/user.csv.
FTP	· With FTP user name and password: ftp://username:password@server/path/filename · Without FTP user name and password: ftp://server/path/filename	Specify an FTP server by IP address or hostname. The path parameter represents the relative path of the FTP working directory. The device ignores the domain name in the FTP user name. For example, specify the file path as ftp://1:[email protected]/user/user.csv or ftp://1.1.1.1/user/user.csv.

Protocol

URL format

Description

TFTP

tftp://server/path/filename

Specify a TFTP server by IP address or hostname. The path parameter represents the relative path of the TFTP working directory. For example, specify the file path as tftp://1.1.1.1/user/user.csv.

FTP

· With FTP user name and password:
ftp://username:password@server/path/filename

· Without FTP user name and password:
ftp://server/path/filename

Specify an FTP server by IP address or hostname. The path parameter represents the relative path of the FTP working directory.

The device ignores the domain name in the FTP user name.

For example, specify the file path as ftp://1:[email protected]/user/user.csv or ftp://1.1.1.1/user/user.csv.

‌

Examples

# Import guest account information from the ftp://1.1.1.1/user/guest.csv file and specify a validity period for the imported guests.

<Sysname> system-view

[Sysname] local-user-import class network guest url ftp://1.1.1.1/user/guest.csv validity-datetime 2020/02/01 00:00:00 to 2020/02/02 12:00:00

Related commands

display local-user

local-user-export class network guest

password (device management user view)

Use password to configure a password for a device management user.

Use undo password to restore the default.

Syntax

In non-FIPS mode:

password [ { hash | simple } string ]

undo password

In FIPS mode:

password

Default

In non-FIPS mode:

A device management user does not have a password and can pass authentication after entering the correct username and passing attribute checks.

In FIPS mode:

A device management user does not have a password and cannot pass authentication.

Views

Device management user view

Predefined user roles

network-admin

Parameters

hash: Specifies a password encrypted by the hash algorithm.

simple: Specifies a password in plaintext form. For security purposes, the password specified in plaintext form will be stored in hashed form.

string: Specifies the password string. This argument is case sensitive. In non-FIPS mode, the hashed form of the password is a string of 1 to 110 characters. The plaintext form of the password is a string of 1 to 64 characters. In FIPS mode, the password is in plaintext form and is a string of 15 to 64 characters. The string must contain digits, uppercase letters, lowercase letters, and special characters. Available characters include all visible characters except the question mark (?). Visible characters correspond to the ASCII codes in the range of 32 to 126. To contain a quotation mark (") or back slash (\) in the password, you must add an escape character (\) before the quotation mark or back slash. That is, enter \" to represent a quotation mark and enter \\ to represent a back slash. To contain spaces in the password, you must enclose the entire password string into a pair of quotation marks ("").

Usage guidelines

If you do not specify any parameters, you enter the interactive mode to set a plaintext password.

In non-FIPS mode, a device management user for which no password is specified can pass authentication after entering the correct username and passing attribute checks. To enhance security, configure a password for each device management user.

In FIPS mode, a password is required for a device management user to pass authentication. You must set the password in interactive mode.

When global password control is enabled, the device handles passwords of device management users as follows:

· All passwords in the history records are saved in hashed form.

· If a user changes its own password in plaintext form, the system requests the user to enter the current plaintext password. The new password must be different from all passwords in the history records and the current password. In addition, the new password must have a minimum of four characters different from the current password.

· If a user changes the password for another user in plaintext form, the new password must be different from the latter user's all passwords in the history records and current password.

· If a user deletes its own password, the system requests the user to enter the current plaintext password.

· Except the above listed situations, the system does not request a user to enter the current plaintext password or compare the new password with passwords in the history records and the current password.

Examples

# Set the password to 123456TESTplat&! in plaintext form for device management user user1.

<Sysname> system-view

[Sysname] local-user user1 class manage

[Sysname-luser-manage-user1] password simple 123456TESTplat&!

# Configure the password in interactive mode for device management user test.

<Sysname> system-view

[Sysname] local-user test class manage

[Sysname-luser-manage-test] password

Password:

Confirm:

Related commands

display local-user

password (network access user view)

Use password to configure a password for a network access user.

Use undo password to restore the default.

Syntax

password { cipher | simple } string

undo password

Default

A network access user does not have a password and can pass authentication after entering the correct username and passing attribute checks.

Views

Network access user view

Predefined user roles

network-admin

Parameters

cipher: Specifies a password in encrypted form.

simple: Specifies a password in plaintext form. For security purposes, the password specified in plaintext form will be stored in encrypted form.

string: Specifies the password string. Its plaintext form is a case-sensitive string of 1 to 64 characters. Its encrypted form is a case-sensitive string of 1 to 117 characters.

Usage guidelines

As a best practice to enhance security, configure a password for each network access user.

When password control is enabled globally for network access users, the device neither displays the passwords of the users nor retains the passwords in the running configuration. To enable password control globally for network access users, use the password-control enable network-class command.

Examples

# Set the password to 123456TESTuser&! in plaintext form for network access user user1.

<Sysname> system-view

[Sysname] local-user user1 class network

[Sysname-luser-network-user1] password simple 123456TESTuser&!

Related commands

display local-user

password-control enable

password (user view)

Use password to configure a password for a device management user in interactive mode.

Syntax

password

Views

User view

Predefined user roles

network-admin

Usage guidelines

Use this command to configure a password in interactive mode for an existing device management user without entering the user's local user view.

In non-FIPS mode, the password is a plaintext string of 1 to 64 characters.

In FIPS mode, the password is a plaintext string of 15 to 64 characters. The string must contain digits, uppercase letters, lowercase letters, and special characters.

Examples

# Configure a password for user test.

<Sysname> password

Change password for user: test

Old password:

Enter new password:

Confirm:

Related commands

password (device management user view)

phone

Use phone to specify the phone number of a local guest.

Use undo phone to restore the default.

Syntax

phone phone-number

undo phone

Default

No phone number is specified for a local guest.

Views

Local guest view

Predefined user roles

network-admin

Parameters

phone-number: Specifies the phone number, a string of 1 to 32 characters.

Examples

# Specify the phone number as 13813723920 for local guest abc.

<Sysname> system-view

[Sysname] local-user abc class network guest

[Sysname-luser-network(guest)-abc] phone 13813723920

Related commands

display local-user

reset local-guest waiting-approval

Use reset local-guest waiting-approval to clear pending registration requests for local guests.

Syntax

reset local-guest waiting-approval [ user-name user-name ]

Views

User view

Predefined user roles

network-admin

Parameters

user-name user-name: Specifies a local guest by the username, a string of 1 to 80 characters. If you do not specify a local guest, this command clears information about all registration requests for all local guests. The username of the specified local guest can be a pure username or contain a domain name (in the format of pure-username@domain-name).

· The pure username is a case-sensitive string and must meet the following requirements:

¡ Cannot be a, al, or all.

· The domain name is a case-insensitive string and cannot contain an at sign (@).

Examples

# Clear information about all registration requests for local guests.

<Sysname> reset local-guest waiting-approval

Related commands

display local-guest waiting-approval

service-type (local user view)

Use service-type to specify the service types that a local user can use.

Use undo service-type to remove service types configured for a local user.

Syntax

In non-FIPS mode:

service-type { advpn | ftp | ike | ipoe | lan-access | { http | https | onu | pad | ssh | telnet | terminal } * | portal | ppp }

undo service-type { advpn | ftp | ike | ipoe | lan-access | { http | https | onu | pad | ssh | telnet | terminal } * | portal | ppp }

In FIPS mode:

service-type { advpn | ike | ipoe | lan-access | { https | onu | pad | ssh | terminal } * | portal | ppp | sslvpn }

undo service-type { advpn | ike | ipoe | lan-access | { https | onu | pad | ssh | terminal } * | portal | ppp | sslvpn }

Default

A local user is not authorized to use any service.

Views

Local user view

Predefined user roles

network-admin

Parameters

advpn: Authorizes the user to use the ADVPN service.

ftp: Authorizes the user to use the FTP service. The authorized directory can be modified by using the authorization-attribute work-directory command.

http: Authorizes the user to use the HTTP service.

https: Authorizes the user to use the HTTPS service.

ike: Authorizes the user to use the IKE extended authentication service.

ipoe: Authorizes the user to use the IPoE service.

lan-access: Authorizes the user to use the LAN access service. The users are typically Ethernet users, for example, 802.1X users.

onu: Authorizes the user to use the ONU service.

pad: Authorizes the user to use the PAD service.

ssh: Authorizes the user to use the SSH service.

telnet: Authorizes the user to use the Telnet service.

terminal: Authorizes the user to use the terminal service and log in from a console or asyn port.

portal: Authorizes the user to use the portal service.

ppp: Authorizes the user to use the PPP service.

Usage guidelines

You can assign multiple service types to a user.

Examples

# Authorize device management user user1 to use the Telnet and FTP services.

<Sysname> system-view

[Sysname] local-user user1 class manage

[Sysname-luser-manage-user1] service-type telnet

[Sysname-luser-manage-user1] service-type ftp

Related commands

display local-user

sponsor-department

Use sponsor-department to specify the department of the guest sponsor for a local guest.

Use undo sponsor-department to restore the default.

Syntax

sponsor-department department-string

undo sponsor-department

Default

No department is specified for the guest sponsor of a local guest.

Views

Local guest view

Predefined user roles

network-admin

Parameters

department-string: Specifies the department name, a case-sensitive string of 1 to 127 characters.

Examples

# Specify the department as test for the guest sponsor of local guest abc.

<Sysname> system-view

[Sysname] local-user abc class network guest

[Sysname-luser-network(guest)-abc] sponsor-department test

Related commands

display local-user

sponsor-email

Use sponsor-email to specify the email address of the guest sponsor for a local guest.

Use undo sponsor-email to restore the default.

Syntax

sponsor-email email-string

undo sponsor-email

Default

No email address is specified for the guest sponsor.

Views

Local guest view

Predefined user roles

network-admin

Parameters

email-string: Specifies the email address, a case-sensitive string of 1 to 255 characters. The address must comply with RFC 822.

Examples

# Specify the email address as [email protected] for the guest sponsor of local guest abc.

<Sysname> system-view

[Sysname] local-user abc class network guest

[Sysname-luser-network(guest)-abc] sponsor-email [email protected]

Related commands

display local-user

sponsor-full-name

Use sponsor-full-name to specify the guest sponsor name for a local guest.

Use undo sponsor-full-name to restore the default.

Syntax

sponsor-full-name name-string

undo sponsor-full-name

Default

No guest sponsor name is specified for a local guest.

Views

Local guest view

Predefined user roles

network-admin

Parameters

name-string: Specifies the guest sponsor name, a case-sensitive string of 1 to 255 characters.

Examples

# Specify the guest sponsor name as Sam Li for local guest abc.

<Sysname> system-view

[Sysname] local-user abc class network guest

[Sysname-luser-network(guest)-abc] sponsor-full-name Sam Li

Related commands

display local-user

state (local user view)

Use state to set the status of a local user.

Use undo state to restore the default.

Syntax

state { active | block }

undo state

Default

A local user is in active state.

Views

Local user view

Predefined user roles

network-admin

Parameters

active: Places the local user in active state to allow the local user to request network services.

block: Places the local user in blocked state to prevent the local user from requesting network services.

Examples

# Place device management user user1 in blocked state.

<Sysname> system-view

[Sysname] local-user user1 class manage

[Sysname-luser-manage-user1] state block

Related commands

display local-user

user-group

Use user-group to create a user group and enter its view, or enter the view of an existing user group.

Use undo user-group to delete a user group.

Syntax

user-group group-name

undo user-group group-name

Default

A system-defined user group exists. The group name is system.

Views

System view

Predefined user roles

network-admin

Parameters

group-name: Specifies the user group name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

A user group consists of a group of local users and has a set of local user attributes. You can configure local user attributes for a user group to implement centralized management of user attributes for the local users in the group.

A user group that has local users cannot be deleted.

You can modify settings for the system-defined user group named system, but you cannot delete the user group.

Examples

# Create a user group named abc and enter user group view.

<Sysname> system-view

[Sysname] user-group abc

[Sysname-ugroup-abc]

Related commands

display user-group

user-isolation

Use user-isolation to configure the user group-based isolation policy.

Use undo user-isolation to remove the configured user group-based isolation policy.

Syntax

user-isolation { intra-group | inter-group } *

undo user-isolation { intra-group | inter-group } *

Default

No user group-based isolation policy is configured.

Views

User group view

Predefined user roles

network-admin

Parameters

intra-group: Specifies intra-group isolation. With this policy configured, users in this group cannot reach each other at Layer 2 or Layer 3.

inter-group: Specifies inter-group isolation. With this policy configured, users in this group cannot communicate with users in other groups.

Usage guidelines

To isolate wireless services by user group, you can authorize user groups to wireless users and configure user group-based isolation in user group view.

When you configure user group-based isolation, follow these restrictions and guidelines:

· User group-based user isolation takes effect only on unicast packets in a WLAN enabled with centralized forwarding.

· If wireless users are in different service VLANs, you must deploy the gateway on the AC to use the user group-based isolation feature.

· If a user in a user group has obtained the user group-based isolation policy, do not delete or edit the group as a best practice. If you delete or edit such a user group, isolation policy chaos might occur.

Examples

# Configure inter-group isolation for user group test.

<Sysname> system-view

[Sysname] user-group test

[Sysname-ugroup-test] user-isolation inter-group

Related commands

display user-group

validity-datetime

Use validity-datetime to specify the validity period for a network access user.

Use undo validity-datetime to restore the default.

Syntax

In network access user view:

validity-datetime { from start-date start-time to expiration-date expiration-time | from start-date start-time | to expiration-date expiration-time }

undo validity-datetime

In local guest view:

validity-datetime from start-date start-time to expiration-date expiration-time

undo validity-datetime

Default

The validity period for a local user does not expire.

Views

Network access user view

Local guest view

Predefined user roles

network-admin

Parameters

from: Specifies the validity start date and time for the user. If you do not specify this option, the command defines only the expiration date and time of the user.

start-date: Specifies the date on which the user becomes effective. The date is in the format of MM/DD/YYYY or YYYY/MM/DD. The value range for the MM argument is 1 to 12. The value range for the DD argument varies with the specified month. The value range for the YYYY argument is 2000 to 2035.

start-time: Specifies the time on the day when the user becomes effective. The time is in the format of hh:mm:ss. The value range for the hh argument is 0 to 23. The value range for the mm and ss arguments is 0 to 59. The mm and ss arguments are optional. For example, enter 1 to indicate 1:00:00. A value of 0 indicates 00:00:00.

to: Specifies the expiration date and time for the user. If you do not specify this option, the command defines only the validity start date and time of the user.

Usage guidelines

Expired network access user accounts cannot be used for authentication.

When both from and to options are specified, the expiration date and time must be later than the validity start date and time.

When only the from option is specified, the user is valid since the specified date and time. When only the to option is specified, the user is valid until the specified date and time.

When the RADIUS server feature is enabled on the device, the RADIUS user data for authentication is automatically generated from the network access user configuration. The device ignores the validity start date and time of the RADIUS users.

Examples

# Specify the validity period for network access user 123.

<Sysname> system-view

[Sysname] local-user 123 class network

[Sysname-luser-network-123] validity-datetime from 2020/01/01 00:00:00 to 2020/02/02 12:00:00

Related commands

display local-user

RADIUS commands

aaa device-id

Use aaa device-id to configure the device ID.

Use undo aaa device-id to restore the default.

Syntax

aaa device-id device-id

undo aaa device-id

Default

The device ID is 0.

Views

System view

Predefined user roles

network-admin

Parameters

device-id: Specifies a device ID in the range of 1 to 255.

Usage guidelines

RADIUS uses the value of the Acct-Session-ID attribute as the accounting ID for a user. The device generates an Acct-Session-ID value that includes the device ID for each online user. On a VSRP network where multiple devices use the same accounting server, accounting ID conflicts might occur. To avoid duplicate accounting IDs, use this command to assign a unique device ID to each device.

If you modify the device ID, the new device ID does not take effect on users that have been online during the change.

Examples

# Configure the device ID as 1.

<Sysname> system-view

[Sysname] aaa device-id 1

accounting-on enable

Use accounting-on enable to configure the accounting-on feature.

Use undo accounting-on enable to disable the accounting-on feature.

Syntax

accounting-on enable [ interval interval | send send-times ] *

undo accounting-on enable

Default

The accounting-on feature is disabled.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

interval interval: Specifies the time interval for retransmitting an accounting-on packet in seconds. The value range for the interval argument is 1 to 15, and the default setting is 3.

send send-times: Specifies the maximum number of accounting-on packet transmission attempts. The value range for the send-times argument is 1 to 255, and the default setting is 50.

Usage guidelines

After you enable the accounting-on feature in RADIUS scheme view, the device automatically monitors the link reachability status of all RADIUS accounting servers used by the scheme after restarting. Upon the corresponding link becoming reachable, the device sends an accounting-on message to the server and logs out all online users so they can log in again through the device.

Execute the save command to ensure that the accounting-on enable command takes effect at the next device reboot. For information about the save command, see Fundamentals Command Reference.

Parameters set by using the accounting-on enable command take effect immediately.

Examples

# Enable the accounting-on feature for RADIUS scheme radius1, and set the retransmission interval to 5 seconds and the transmission attempts to 15.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] accounting-on enable interval 5 send 15

Related commands

display radius scheme

accounting-on extended

Use accounting-on extended to enable the extended accounting-on feature.

Use undo accounting-on extended to disable the extended accounting-on feature.

Syntax

accounting-on extended

undo accounting-on extended

Default

The extended accounting-on feature is disabled.

Views

RADIUS scheme view

Predefined user roles

network-admin

network-operator

Usage guidelines

The extended accounting-on feature enhances the accounting-on feature by applying to a distributed architecture. For the extended accounting-on feature to take effect, the RADIUS server must run on IMC and the accounting-on feature must be enabled.

The extended accounting-on feature is applicable to IPoE, LAN, and PPP (L2TP LAC-side) users. The user data is saved to the cards through which the users access the device.

When this feature is enabled, the device automatically sends an accounting-on packet to the RADIUS server after a card reboots (device not reboot). The packet contains the card identifier. Upon receiving the accounting-on packet, the RADIUS server logs out all online users that access the device through the card. If no users have come online through the card, the device does not send an accounting-on packet to the RADIUS server after the card reboots.

The device uses the packet retransmission interval and maximum transmission attempts set by using the accounting-on enable command for this feature.

Execute the save command to ensure that the accounting-on extended command takes effect at the next card reboot. For information about the save command, see Fundamentals Command Reference.

Examples

# Enable the extended accounting-on feature for RADIUS scheme radius1.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] accounting-on extended

Related commands

accounting-on enable

display radius scheme

attribute 5 format

Use attribute 5 format to configure the format of the RADIUS NAS-Port attribute.

Use undo attribute 5 format to restore the default.

Syntax

attribute 5 format port

undo attribute 5 format

Default

The NAS-Port attribute contains the following portions:

· 8-bit slot number.

· 4-bit subslot number.

· 8-bit interface index.

· 12-bit VLAN ID.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

port: Specifies the port format.

Usage guidelines

RADIUS servers of different types might have different requirements for the format of the NAS-Port attribute. To ensure correct RADIUS packet exchange, make sure the format of the NAS-Port attribute meets the requirements of the RADIUS servers.

If you specify the port format, the NAS-Port attribute contains the last segment for the interface number of the interface through which a user accesses the device. For example, if a user accesses the device through GigabitEthernet 1/0/2, 2 is used as the value for the RADIUS NAS-Port attribute.

This command does not distinguish user access types and takes effect on RADIUS packets for all users.

Examples

# Configure the format of the RADIUS NAS-Port attribute as the port format in RADIUS scheme radius1.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] attribute 5 format port

Related commands

display radius scheme

attribute 15 check-mode

Use attribute 15 check-mode to configure the Login-Service attribute check method for SSH, FTP, and terminal users.

Use undo attribute 15 check-mode to restore the default.

Syntax

attribute 15 check-mode { loose | strict }

undo attribute 15 check-mode

Default

The strict check method applies for SSH, FTP, and terminal users.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

loose: Matches the standard Login-Service attribute value 0 for SSH, FTP, HTTP, HTTPS, and terminal services.

strict: Matches the extended Login-Service attribute values for the following types of users:

· 50—SSH.

· 51—FTP.

· 52—Terminal.

· 53—HTTP.

· 54—HTTPS.

Usage guidelines

Use the loose check method only when the server does not issue Login-Service attribute values for SSH, FTP, HTTP, HTTPS, and terminal users.

Examples

# Configure the Login-Service attribute check method as loose for users in RADIUS scheme radius1.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] attribute 15 check-mode loose

Related commands

display radius scheme

attribute 17 old-password

Use attribute 17 old-password to enable online user password change by using RADIUS attribute 17.

Use undo attribute 17 old-password to restore the default.

Syntax

attribute 17 old-password

undo attribute 17 old-password

Default

Online user password change is disabled.

Views

RADIUS scheme view

Predefined user roles

network-admin

Usage guidelines

When this feature is enabled, the process of online password change is as follows for a user when the user passes authentication:

1. If the RADIUS authentication server sends an Access-Challenge packet that includes the Reply-Message attribute when a user passes authentication, the device prompts the user to change its password.

2. After receiving the password change request from the user, the device sends a RADIUS authentication request to the RADIUS authentication server.

In the authentication request, the device uses attribute 2 to carry the new user password.

3. When the device receives a response from the RADIUS authentication server, the online user's password is changed successfully.

When this feature is enabled, the process of online password change is as follows for an online user:

1. After receiving the password change request from the user, the device sends a RADIUS authentication request to a reachable RADIUS server. In the authentication request, the device uses attribute 2 and attribute 17 to carry the new user password and old user password, respectively.

The RADIUS server selection process for online password change is the same as the process used to select a RADIUS authentication server. Online password change might fail because the device selects a RADIUS server different from the RADIUS server that authenticated the user.

2. When the device receives a response from the selected RADIUS server, the online user's password is changed successfully.

This feature is applicable only to SSL VPN users.

Do not enable this feature if the RADIUS server does not support online user password change.

Examples

# In RADIUS scheme radius1, enable online user password change by using RADIUS attribute 17.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] attribute 17 old-password

Related commands

display radius scheme

attribute 25 car

Use attribute 25 car to configure the device to interpret the RADIUS class attribute (attribute 25) as CAR parameters.

Use undo attribute 25 car to restore the default.

Syntax

attribute 25 car

undo attribute 25 car

Default

The RADIUS class attribute is not interpreted as CAR parameters.

Views

RADIUS scheme view

Predefined user roles

network-admin

Usage guidelines

Configure the device to interpret the RADIUS class attribute if the RADIUS server uses the attribute to deliver CAR parameters for user-based traffic monitoring and control.

The device can interpret the RADIUS class attribute only in the format of string1string2string3string4 as CAR parameters. Each string contains eight characters and each character must be a digit from 0 to 9.

After the device interprets the RADIUS class attribute sent by a RADIUS server as CAR parameters, it carries the interpreted CAR parameters in the subsequent accounting packets sent to that server instead of carrying the original class attribute.

Examples

# In RADIUS scheme radius1, configure the device to interpret the RADIUS class attribute as CAR parameters.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] attribute 25 car

Related commands

display radius scheme

attribute 30 format

Use attribute 30 format to configure the format of the RADIUS Called-Station-Id attribute.

Use undo attribute 30 format to restore the default.

Syntax

attribute 30 format { apmac-only | apname-only | { apmac-ssid | apname-ssid } delimiter { colon | hyphen } }

undo attribute 30 format

Default

The RADIUS Called-Station-Id attribute is in the format of HH-HH-HH-HH-HH-HH:SSID. The HH-HH-HH-HH-HH-HH argument is the AP's MAC address, the SSID argument is the SSID, and a colon (:) is used as the delimiter.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

apmac-only: Carries only the AP's MAC address in the attribute.

apname-only: Carries only the AP's name in the attribute.

apmac-ssid: Carries the AP's MAC address and SSID in the attribute.

apname-ssid: Carries the AP's name and SSID in the attribute.

delimiter: Specifies a delimiter to separate the AP MAC or name from the SSID in the attribute.

colon: Specifies the colon (:).

hyphen: Specifies the hyphen (-).

Usage guidelines

In a wireless network, configure the format of the RADIUS Called-Station-Id attribute (attribute 30) to meet the requirements of the RADIUS servers.

This command takes effect only on RADIUS packets for portal, 802.1X, and MAC authentication users in a wireless network.

The format of the AP's MAC address in this attribute can be customized by using the attribute 30 mac-format command.

The AP name populated in the Called-Station-Id attribute is the name of the AP from which a user comes online. Before the user goes offline, the AP name remains unchanged.

Examples

# In RADIUS scheme radius1, configure the format of the RADIUS Called-Station-Id attribute as AP name:SSID.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] attribute 30 format apname-ssid delimiter colon

Related commands

attribute 30 mac-format

display radius scheme

attribute 30 mac-format

Use attribute 30 mac-format to configure the format of the MAC address in the RADIUS Called-Station-Id attribute.

Use undo attribute 30 mac-format to restore the default.

Syntax

attribute 30 mac-format section { one | { six | three } separator separator-character } { lowercase | uppercase }

undo attribute 30 mac-format

Default

The MAC address in the RADIUS Called-Station-Id attribute is in the format of HH-HH-HH-HH-HH-HH. The MAC address is separated by hyphens (-) into six sections with letters in upper case.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

section: Specifies the number of sections that a MAC address contains.

one: Specifies the one-section format HHHHHHHHHHHH.

six: Specifies the six-section format HH-HH-HH-HH-HH-HH.

three: Specifies the three-section format HHHH-HHHH-HHHH.

separator separator-character: Specifies a case-sensitive character that separates the sections.

lowercase: Specifies the letters in a MAC address to be in lower case.

uppercase: Specifies the letters in a MAC address to be in upper case.

Usage guidelines

Configure the format of the MAC address in the RADIUS Called-Station-Id attribute to meet the requirements of the RADIUS servers.

Examples

# In RADIUS scheme radius1, specify hhhhhhhhhhhh as the format of the MAC address in the RADIUS Called-Station-Id attribute.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] attribute 30 mac-format section one lowercase

Related commands

display radius scheme

attribute 31 mac-format

Use attribute 31 mac-format to configure the format of the MAC address in the RADIUS Calling-Station-Id attribute.

Use undo attribute 31 mac-format to restore the default.

Syntax

attribute 31 mac-format section { one | six | three } separator separator-character { lowercase | uppercase }

undo attribute 31 mac-format

Default

The MAC address in the RADIUS Calling-Station-Id attribute (attribute 31) is in the format of HH-HH-HH-HH-HH-HH. The MAC address is separated by hyphens (-) into six sections with letters in upper case.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

section: Specifies the number of sections that a MAC address contains.

one: Specifies the one-section format HHHHHHHHHHHH.

six: Specifies the six-section format HH-HH-HH-HH-HH-HH.

three: Specifies the three-section format HHHH-HHHH-HHHH.

separator separator-character: Specifies a case-sensitive character that separates the sections.

lowercase: Specifies the letters in a MAC address to be in lower case.

uppercase: Specifies the letters in a MAC address to be in upper case.

Usage guidelines

Configure the format of the MAC address in the RADIUS Calling-Station-Id attribute to meet the requirements of the RADIUS servers.

Examples

# In RADIUS scheme radius1, specify hh:hh:hh:hh:hh:hh as the format of the MAC address in the RADIUS Calling-Station-Id attribute.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] attribute 31 mac-format section six separator : lowercase

Related commands

display radius scheme

attribute 87 format

Use attribute 87 format to configure the format of the RADIUS NAS-Port-Id attribute (attribute 87).

Use undo attribute 87 format to restore the default.

Syntax

attribute 87 format interface-name

undo attribute 87 format

Default

The default format varies by user access type.

· For portal users, the NAS-Port-Id attribute contains the following portions:

¡ 2-bit slot number.

¡ 2-bit 0s.

¡ 3-bit interface index.

¡ 9-bit VLAN ID.

· For IPoE and PPP users, the NAS-Port-Id attribute is in the format of slot=xx;subslot=xx;port=xx;vlanid=xx;vlanid2=xx.

¡ slot—Slot number.

¡ subslot—Subslot number.

¡ port—Interface index.

¡ vlanid—Outer VLAN ID.

¡ vlanid2—Inner VLAN ID.

· For 802.1X and MAC authentication users, the NAS-Port-Id attribute is in the format of slot=xx;subslot=xx;port=xx;vlanid=xx.

¡ slot—Slot number.

¡ subslot—Subslot number.

¡ port—Interface index.

¡ vlanid—VLAN ID.

· For login users, the NAS-Port-Id attribute is not included in RADIUS packets.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

interface-name: Specifies the interface name format.

Usage guidelines

RADIUS servers of different types might have different requirements for the format of the NAS-Port-Id attribute. To ensure correct RADIUS packet exchange, configure the format of the NAS-Port-Id attribute to meet the requirements of the RADIUS servers.

If you specify the interface name format, the NAS-Port-Id attribute contains the name of the interface through which a user accesses the device. For example, if a user accesses the device through GigabitEthernet 1/0/1, GigabitEthernet 1/0/1 is used as the value for the RADIUS NAS-Port-Id attribute.

This command does not distinguish user access types and takes effect on RADIUS packets for all users.

Examples

# Configure the format of the RADIUS NAS-Port-Id attribute as the interface name format in RADIUS scheme radius1.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] attribute 87 format interface-name

Related commands

display radius scheme

attribute 182 vendor-id 25506 vlan

Use attribute 182 vendor-id 25506 vlan to enable the device to interpret the Microsegment-Id attribute to an authorization VLAN.

Use undo attribute 182 vendor-id 25506 vlan to disable the device from interpreting the Microsegment-Id attribute to an authorization VLAN.

Syntax

attribute 182 vendor-id 25506 vlan

undo attribute 182 vendor-id 25506 vlan

Default

The device is disabled from interpreting the Microsegment-Id attribute to an authorization VLAN.

Views

RADIUS scheme view

Predefined user roles

network-admin

Usage guidelines

Use this command only when the RADIUS server uses authorization microsegment IDs for granular user access control and the access device uses authorization VLANs to implement microsegment-based access control.

This feature enables the device to interpret the RADIUS Microsegment-Id attribute (attribute 182 with vendor ID 25506) assigned by the RADIUS server to an authorization VLAN.

· If the attribute value is an integer, the device interprets this attribute to a VLAN ID.

· If the attribute value is not an integer, the device interprets this attribute to a VLAN name.

If the RADIUS server uses a RADIUS attribute other than the Microsegment-Id attribute to assign microsegment IDs, you must first convert the attribute to the Microsegment-Id attribute. To enable RADIUS attribute translation feature, use the attribute translate command.

Examples

# In RADIUS scheme radius1, enable the device to interpret the Microsegment-Id attribute to an authorization VLAN.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] attribute 182 vendor-id 25506 vlan

Related commands

attribute translate

display radius scheme

attribute convert (RADIUS DAS view)

Use attribute convert to configure a RADIUS attribute conversion rule.

Use undo attribute convert to delete RADIUS attribute conversion rules.

Syntax

attribute convert src-attr-name to dest-attr-name { { coa-ack | coa-request } * | { received | sent } * }

undo attribute convert [ src-attr-name ]

Default

No RADIUS attribute conversion rules exist. The system processes RADIUS attributes according to the principles of the standard RADIUS protocol.

Views

RADIUS DAS view

Predefined user roles

network-admin

Parameters

src-attr-name: Specifies the source RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The attribute must be supported by the system.

dest-attr-name: Specifies the destination RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The attribute must be supported by the system.

coa-ack: Specifies the CoA acknowledgment packets.

coa-request: Specifies the CoA request packets.

received: Specifies the received DAE packets.

sent: Specifies the sent DAE packets.

Usage guidelines

The device replaces the attribute in packets that match a RADIUS attribute conversion rule with the destination RADIUS attribute in the rule.

The conversion rules take effect only when the RADIUS attribute translation feature is enabled.

When you configure RADIUS attribute conversion rules, follow these restrictions and guidelines:

· The source and destination RADIUS attributes in a rule must use the same data type.

· The source and destination RADIUS attributes in a rule cannot use the same name.

· A source RADIUS attribute can be converted only by one criterion, packet type or direction.

· One source RADIUS attribute cannot be converted to multiple destination attributes.

If you do not specify a source RADIUS attribute, the undo attribute convert command deletes all RADIUS attribute conversion rules.

Examples

# In RADIUS DAS view, configure a RADIUS attribute conversion rule to replace the Hw-Server-String attribute in the received DAE packets with the Connect-Info attribute.

<Sysname> system-view

[Sysname] radius dynamic-author server

[Sysname-radius-da-server] attribute convert Hw-Server-String to Connect-Info received

Related commands

attribute translate

attribute convert (RADIUS scheme view)

Use attribute convert to configure a RADIUS attribute conversion rule.

Use undo attribute convert to delete RADIUS attribute conversion rules.

Syntax

attribute convert src-attr-name to dest-attr-name { { access-accept | access-request | accounting } * | { received | sent } * }

undo attribute convert [ src-attr-name ]

Default

No RADIUS attribute conversion rules exist. The system processes RADIUS attributes according to the principles of the standard RADIUS protocol.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

src-attr-name: Specifies the source RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The attribute must be supported by the system.

dest-attr-name: Specifies the destination RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The attribute must be supported by the system.

access-accept: Specifies the RADIUS Access-Accept packets.

access-request: Specifies the RADIUS Access-Request packets.

accounting: Specifies the RADIUS accounting packets.

received: Specifies the received RADIUS packets.

sent: Specifies the sent RADIUS packets.