Table of Contents

Chapter 1 AAA and RADIUS/HWTACACS Configuration Commands. 1-1

1.1 AAA Configuration Commands. 1-1

1.1.1 access-limit 1-1

1.1.2 accounting. 1-1

1.1.3 accounting optional 1-2

1.1.4 authentication. 1-3

1.1.5 authorization. 1-4

1.1.6 display connection. 1-5

1.1.7 display domain. 1-6

1.1.8 display local-user 1-8

1.1.9 domain. 1-9

1.1.10 ip pool 1-11

1.1.11 level 1-12

1.1.12 local-user 1-13

1.1.13 local-user password-display-mode. 1-13

1.1.14 password. 1-14

1.1.15 scheme. 1-15

1.1.16 service-type. 1-16

1.1.17 service-type ftp. 1-17

1.1.18 service-type ppp. 1-18

1.1.19 state. 1-18

1.2 RADIUS Configuration Commands. 1-19

1.2.1 accounting. 1-19

1.2.2 accounting-on. 1-20

1.2.3 authentication. 1-22

1.2.4 data-flow-format 1-23

1.2.5 debugging local-server 1-24

1.2.6 debugging radius. 1-24

1.2.7 display local-server statistics. 1-25

1.2.8 display radius nas-ip. 1-26

1.2.9 display radius scheme. 1-26

1.2.10 display radius statistics. 1-28

1.2.11 display stop-accounting-buffer 1-32

1.2.12 key. 1-33

1.2.13 local-server 1-34

1.2.14 nas-ip. 1-35

1.2.15 primary accounting. 1-36

1.2.16 primary authentication. 1-37

1.2.17 radius nas-ip. 1-38

1.2.18 radius scheme. 1-39

1.2.19 radius trap. 1-40

1.2.20 reset radius statistics. 1-41

1.2.21 reset stop-accounting-buffer 1-41

1.2.22 retry. 1-42

1.2.23 retry realtime-accounting. 1-43

1.2.24 retry stop-accounting. 1-44

1.2.25 secondary accounting. 1-45

1.2.26 secondary authentication. 1-46

1.2.27 server-type. 1-46

1.2.28 state. 1-47

1.2.29 stop-accounting-buffer enable. 1-48

1.2.30 timer quiet 1-49

1.2.31 timer realtime-accounting. 1-49

1.2.32 timer response-timeout 1-50

1.2.33 user-name-format 1-51

1.2.34 vpn-instance. 1-52

1.3 HWTACACS Configuration Commands. 1-53

1.3.1 accounting. 1-54

1.3.2 authentication. 1-55

1.3.3 authorization. 1-56

1.3.4 data-flow-format 1-57

1.3.5 debugging hwtacacs. 1-58

1.3.6 display hwtacacs nas-ip. 1-59

1.3.7 display hwtacacs scheme. 1-59

1.3.8 display stop-accounting-buffer 1-62

1.3.9 hwtacacs change-password self 1-63

1.3.10 hwtacacs nas-ip. 1-63

1.3.11 hwtacacs scheme. 1-64

1.3.12 key. 1-65

1.3.13 nas-ip. 1-66

1.3.14 primary accounting. 1-67

1.3.15 primary authentication. 1-68

1.3.16 primary authorization. 1-69

1.3.17 reset hwtacacs statistics. 1-70

1.3.18 reset stop-accounting-buffer 1-70

1.3.19 retry stop-accounting. 1-71

1.3.20 secondary accounting. 1-72

1.3.21 secondary authentication. 1-73

1.3.22 secondary authorization. 1-73

1.3.23 timer quiet 1-74

1.3.24 timer realtime-accounting. 1-75

1.3.25 timer response-timeout 1-76

1.3.26 user-name-format 1-77

1.3.27 vpn-instance. 1-78

Chapter 2 Portal Configuration Commands. 2-1

2.1 Portal Configuration Commands. 2-1

2.1.1 debugging portal 2-1

2.1.2 display portal 2-4

2.1.3 portal 2-8

2.1.4 portal auth-network. 2-9

2.1.5 portal fast-authentication. 2-9

2.1.6 portal free-ip. 2-10

2.1.7 portal free-user 2-11

2.1.8 portal method. 2-12

2.1.9 portal server 2-13

2.1.10 reset portal 2-14

2.2 EAD Configuration Commands. 2-15

2.2.1 security-policy-server 2-15

Chapter 3 Access Control List Configuration Commands. 3-1

3.1 ACL Configuration Commands. 3-1

3.1.1 acl 3-1

3.1.2 acl-reflect timeout 3-2

3.1.3 display acl 3-2

3.1.4 nesting. 3-3

3.1.5 reset acl counter 3-3

3.1.6 rule. 3-4

3.2 Time-range Configuration Commands. 3-9

3.2.1 display time-range. 3-9

3.2.2 time-range. 3-10

Chapter 4 Firewall Configuration Commands. 4-1

4.1 Packet Filtering Firewall Configuration Commands. 4-1

4.1.1 debugging firewall 4-1

4.1.2 display firewall-statistics. 4-2

4.1.3 firewall default 4-2

4.1.4 firewall enable. 4-3

4.1.5 firewall fragments-inspect 4-3

4.1.6 firewall fragments-inspect { high | low } 4-4

4.1.7 firewall packet-filter 4-5

4.1.8 reset firewall-statistics. 4-7

4.2 ASPF Configuration Commands. 4-7

4.2.1 aging-time. 4-7

4.2.2 aspf-policy. 4-8

4.2.3 debugging aspf 4-8

4.2.4 detect 4-9

4.2.5 display aspf all 4-11

4.2.6 display aspf interface. 4-12

4.2.7 display aspf policy. 4-13

4.2.8 display aspf session. 4-14

4.2.9 display port-mapping. 4-15

4.2.10 firewall aspf 4-16

4.2.11 log enable. 4-16

4.2.12 port-mapping. 4-17

Chapter 5 WEB Filtering Configuration Commands. 5-1

5.1 WEB Filtering Configuration Commands. 5-1

5.1.1 debugging web java-blocking. 5-1

5.1.2 debugging web url-filter host 5-1

5.1.3 debugging web url-filter parameter 5-2

5.1.4 display web java-blocking. 5-3

5.1.5 display web url-filter host 5-3

5.1.6 display web url-filter parameter 5-4

5.1.7 reset web java-blocking counter 5-5

5.1.8 reset web log-buf 5-5

5.1.9 reset web url-filter host counter 5-6

5.1.10 reset web url-filter parameter counter 5-6

5.1.11 web java-blocking acl-number 5-7

5.1.12 web java-blocking enable. 5-7

5.1.13 web java-blocking extension add. 5-8

5.1.14 web java-blocking extension add-default 5-8

5.1.15 web java-blocking extension delete. 5-9

5.1.16 web java-blocking extension delete-all 5-10

5.1.17 web java-blocking extension load-file. 5-10

5.1.18 web java-blocking extension save-file. 5-11

5.1.19 web log enable. 5-12

5.1.20 web log timer 5-12

5.1.21 web url-filter host acl-number 5-13

5.1.22 web url-filter host add. 5-13

5.1.23 web url-filter host default 5-15

5.1.24 web url-filter host delete. 5-15

5.1.25 web url-filter host delete-all 5-16

5.1.26 web url-filter host enable. 5-16

5.1.27 web url-filter host ip-address. 5-17

5.1.28 web url-filter host load-file. 5-18

5.1.29 web url-filter host save-file. 5-18

5.1.30 web url-filter parameter add. 5-19

5.1.31 web url-filter parameter add-default 5-19

5.1.32 web url-filter parameter delete. 5-20

5.1.33 web url-filter parameter delete-all 5-20

5.1.34 web url-filter parameter enable. 5-21

5.1.35 web url-filter parameter load-file. 5-22

5.1.36 web url-filter parameter save-file. 5-22

Chapter 6 IPSec Configuration Commands. 6-1

6.1 IPSec Configuration Commands. 6-1

6.1.1 ah authentication-algorithm.. 6-1

6.1.2 debugging ipsec. 6-2

6.1.3 display ipsec fragment buffer-chain. 6-2

6.1.4 display ipsec fragment statistics. 6-3

6.1.5 display ipsec policy. 6-4

6.1.6 display ipsec policy-template. 6-7

6.1.7 display ipsec proposal 6-8

6.1.8 display ipsec sa. 6-9

6.1.9 display ipsec statistics. 6-13

6.1.10 encapsulation-mode. 6-14

6.1.11 esp authentication-algorithm.. 6-16

6.1.12 esp encryption-algorithm.. 6-17

6.1.13 ipsec fragment-chain. 6-18

6.1.14 ipsec fragment-chain timeout 6-18

6.1.15 ipsec policy (in system view) 6-19

6.1.16 ipsec policy local-address. 6-20

6.1.17 ipsec policy(in interface view) 6-21

6.1.18 ipsec policy-template. 6-22

6.1.19 ipsec proposal 6-24

6.1.20 ipsec protect-forward-ike-packet 6-24

6.1.21 ipsec sa global-duration. 6-25

6.1.22 ipsec sa synchronization. 6-26

6.1.23 pfs. 6-27

6.1.24 proposal 6-28

6.1.25 reset ipsec fragment buffer-chain. 6-29

6.1.26 reset ipsec fragment statistics. 6-29

6.1.27 reset ipsec sa. 6-29

6.1.28 reset ipsec statistics. 6-31

6.1.29 sa authentication-hex. 6-31

6.1.30 sa duration. 6-33

6.1.31 sa encryption-hex. 6-34

6.1.32 sa spi 6-36

6.1.33 sa string-key. 6-37

6.1.34 security acl 6-39

6.1.35 transform.. 6-40

6.1.36 tunnel local 6-41

6.1.37 tunnel remote. 6-42

6.2 Encryption Card Configuration Commands. 6-43

6.2.1 debugging encrypt-card. 6-43

6.2.2 debugging encrypt-card host 6-44

6.2.3 display encrypt-card fast-switch. 6-45

6.2.4 display encrypt-card sa. 6-46

6.2.5 display encrypt-card statistics. 6-47

6.2.6 display encrypt-card syslog. 6-48

6.2.7 display interface encrypt 6-49

6.2.8 encrypt-card backuped. 6-50

6.2.9 encrypt-card fast-switch. 6-51

6.2.10 interface encrypt 6-51

6.2.11 ipsec card-proposal 6-52

6.2.12 reset counters interface encrypt 6-53

6.2.13 reset encrypt-card sa. 6-54

6.2.14 reset encrypt-card statistics. 6-54

6.2.15 reset encrypt-card syslog. 6-55

6.2.16 snmp-agent trap enable encrypt-card. 6-56

6.2.17 use encrypt-card. 6-56

6.3 IPSec DPD Configuration Commands. 6-57

6.3.1 debugging ike dpd. 6-57

6.3.2 display ike dpd. 6-58

6.3.3 dpd. 6-59

6.3.4 ike dpd. 6-60

6.3.5 interval-time. 6-60

6.3.6 time-out 6-61

Chapter 7 IKE Configuration Commands. 7-1

7.1 IKE Configuration Commands. 7-1

7.1.1 authentication-algorithm.. 7-1

7.1.2 authentication-method. 7-1

7.1.3 debugging ike. 7-2

7.1.4 dh. 7-3

7.1.5 display ike peer 7-4

7.1.6 display ike proposal 7-5

7.1.7 display ike sa. 7-6

7.1.8 encryption-algorithm.. 7-8

7.1.9 exchange-mode. 7-9

7.1.10 id-type. 7-10

7.1.11 ike local-name. 7-11

7.1.12 ike next-payload check disabled. 7-11

7.1.13 ike peer (in System View) 7-12

7.1.14 ike proposal 7-12

7.1.15 ike sa keepalive-timer interval 7-14

7.1.16 ike sa keepalive-timer timeout 7-14

7.1.17 ike sa nat-keepalive-timer interval 7-15

7.1.18 ike-peer (In IPSec policy view or IPSec policy template view) 7-16

7.1.19 local 7-17

7.1.20 local-address. 7-17

7.1.21 nat traversal 7-18

7.1.22 peer 7-19

7.1.23 pre-shared-key. 7-19

7.1.24 remote-address. 7-20

7.1.25 remote-name. 7-21

7.1.26 reset ike sa. 7-21

7.1.27 sa duration. 7-22

Chapter 8 PKI Configuration Commands. 8-1

8.1 PKI Domain Configuration Commands. 8-1

8.1.1 ca identifier 8-1

8.1.2 certificate request entity. 8-1

8.1.3 certificate request from.. 8-2

8.1.4 certificate request mode. 8-3

8.1.5 certificate request polling. 8-4

8.1.6 certificate request url 8-4

8.1.7 crl check disable. 8-5

8.1.8 crl update-period. 8-6

8.1.9 crl url 8-6

8.1.10 ldap-server 8-7

8.1.11 pki domain. 8-7

8.1.12 root-certificate fingerprint 8-8

8.1.13 source-interface. 8-9

8.1.14 source-ip. 8-9

8.2 PKI Entity Configuration Commands. 8-10

8.2.1 common-name. 8-10

8.2.2 country. 8-11

8.2.3 fqdn. 8-11

8.2.4 ip. 8-12

8.2.5 locality. 8-12

8.2.6 organization. 8-13

8.2.7 organizational-unit 8-13

8.2.8 pki entity. 8-14

8.2.9 state. 8-15

8.3 PKI Certificate Operation Commands. 8-15

8.3.1 pki delete-certificate. 8-15

8.3.2 pki import-certificate. 8-16

8.3.3 pki request-certificate. 8-17

8.3.4 pki retrieval-certificate. 8-17

8.3.5 pki retrieval-crl 8-18

8.3.6 pki validate-certificate. 8-19

8.4 PKI Displaying and Debugging Commands. 8-19

8.4.1 debugging pki 8-19

8.4.2 display pki certificate. 8-23

8.4.3 display pki crl 8-25

 

Chapter 1  AAA and RADIUS/HWTACACS Configuration Commands

1.1  AAA Configuration Commands

1.1.1  access-limit

Syntax

access-limit { disable | enable max-user-number }

undo access-limit

View

ISP domain view

Parameter

disable: No limit to the supplicant number in the current ISP domain.

enable max-user-number: Specifies the maximum supplicant number in the current ISP domain, ranging from 1 to 1048.

Description

Use the access-limit command to configure a limit to the amount of supplicants in the current ISP domain.

Use the undo access-limit command to restore the limit to the default setting.

By default, there is no limit to the amount of supplicants in the current ISP domain.

This command limits the amount of supplicants contained in the current ISP domain. The supplicants may compete for the network resources. So setting a suitable limit to the amount will guarantee the reliable performance to the existing supplicants.

Example

# Set a limit of 500 supplicants for the ISP domain h3c163.net.

[H3C-isp-h3c163.net] access-limit enable 500

1.1.2  accounting

Syntax

accounting { hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name | none }

undo accounting

View

ISP domain view

Parameter

hwtacacs-scheme radius-scheme-name: Specifies the HWTACACS scheme for accounting.

radius-scheme hwtacacs-scheme-name: Specifies the RADIUS scheme for accounting.

none: Specifies not to perform accounting.

Description

Use the accounting command to configure an accounting scheme for the current ISP domain.

Use the undo accounting command to remove the accounting scheme used by the ISP domain.

By default, no separate accounting scheme is available.

Note that the RADIUS or HWTACACS accounting scheme you configure by using the accounting command must exist already.

If you configure the accounting command in ISP domain view, the system uses the scheme specified in the command for accounting. Otherwise, the system uses the scheme specified by using the scheme command.

Related command: scheme, radius scheme, hwtacacs scheme.

Example

# Specify ISP domain h3c163.net to use RADIUS scheme radius for accounting.

[H3C-isp-h3c163.net] accounting radius-scheme  radius

# Specify ISP domain h3c to use HWTACACS scheme hwtac for accounting.

[H3C-isp-h3c] accounting hwtacacs-scheme hwtac

1.1.3  accounting optional

Syntax

accounting optional

undo accounting optional

View

ISP domain view, RADIUS view

Parameter

None

Description

Use the accounting optional command to enable optional accounting.

Use the undo accounting optional command to disable it.

By default, optional accounting is disabled.

After the accounting optional command is configured, a user that will be disconnected otherwise can use the network resources even when there is no available accounting server or the communication with the current accounting server fails. This command is normally used for the authentication without accounting.

Example

# Enable optional accounting for users in the domain h3c163.net.

[H3C] domain h3c163.net

[H3C-isp-h3c163.net] accounting optional

1.1.4  authentication

Syntax

authentication { hwtacacs-scheme hwtacacs-scheme-name [ local ] | radius-scheme radius-scheme-name [ local ] | local | none }

undo authentication

View

ISP domain view

Parameter

hwtacacs-scheme hwtacacs-scheme-name: Specifies the HWTACACS scheme for authentication.

radius-scheme radius-scheme-name: Specifies the RADIUS scheme for authentication.

local: Specifies to use the local authentication scheme.

none: Specifies not to perform authentication.

Description

Use the authentication command to configure an authentication scheme for the current ISP domain.

Use the undo authentication command to restore the default authentication scheme of the domain.

By default, no separate authentication scheme is available.

Note that the RADIUS or HWTACACS authentication scheme you configure by using the authentication command must exist already.

If you configure the authentication radius-scheme radius-scheme-name local or authentication hwtacacs-scheme hwtacacs-scheme-name local command, the local authentication scheme is the alternate scheme for use when the RADIUS server or TACACS server is not responding properly. That is, the local authentication scheme is used only when the RADIUS server or TACACS server is not available.

If you want the system to use the local scheme as the first scheme, the local authentication scheme is the only scheme for authentication, and you cannot configure any RADIUS or HWTACACS scheme at the same time. That is, you can only specify the local keyword in the authentication command. The same is true for the none keyword.

If you configure the authentication command in ISP domain view, the system uses the scheme specified in the command for authentication. Otherwise, the system uses the scheme specified by using the scheme command.

Related command: scheme, radius scheme, hwtacacs scheme.

Example

# Specify ISP domain h3c163.net to use RADIUS scheme radius for authentication.

[H3C-isp-h3c163.net] authentication radius-scheme  radius

# Specify ISP domain h3c to use RADIUS scheme rd for authentication and use the local authentication scheme as the alternate one.

[H3C-isp-h3c] authentication radius-scheme rd local

# Specify ISP domain h3c to use HWTACACS scheme hwtac for authentication and use the local authentication scheme as the alternate one.

[H3C-isp-h3c] authentication hwtacacs-scheme hwtac local

1.1.5  authorization

Syntax

authorization { hwtacacs-scheme hwtacacs-scheme-name | none }

undo authorization

View

ISP domain view

Parameter

hwtacacs-scheme hwtacacs-scheme-name: Specifies the HWTACACS scheme for authorization.

none: Specifies not to perform authorization, that is, the system provides services without authorization.

Description

Use the authorization command to configure an authorization scheme for the current ISP domain.

Use the undo authorization command to restore the default authorization scheme of the domain.

By default, no separate authorization scheme is available.

Note that the HWTACACS authorization scheme specified in this command must have existed.

If you configure the authorization command in ISP domain view, the system uses the scheme specified in the command for authorization. Otherwise, the system uses the scheme specified by using the scheme command.

Related command: scheme, radius scheme, hwtacacs scheme.

Example

# Specify ISP domain h3c to use HWTACACS scheme hwtac for authorization.

[H3C-isp-h3c] authorization hwtacacs-scheme hwtac

1.1.6  display connection

Syntax

display connection [ domain isp-name | hwtacacs-scheme hwtacacs-scheme-name | ip ip-address | mac mac-address | radius-scheme radius-scheme-name | ucibindex ucib-index | user-name user-name ]

View

Any view

Parameter

domain isp-name: Displays all the user connections belonging to the ISP domain specified by isp-name, a character string not exceeding 24 characters. The specified ISP domain must be an existing one.

hwtacacs-scheme hwtacacs-scheme-name: HWTACACS scheme name.

ip ip-address: Displays all the user connections related to the specified IP address.

mac mac-address: Displays a user connection by specifying its hexadecimal MAC address in the format of x-x-x.

radius-scheme radius-scheme-name: Displays all the user connections connected to the RADIUS server specified by radius-scheme-name, a character string not exceeding 32 characters.

ucibindex ucib-index: Displays information on a user connection by specifyin