User interface	Applicable user	Port used	Description
AUX	Users logging in through the console port	Console port	Each switch can accommodate one AUX user.
VTY	Telnet users and SSH users	Ethernet port	Each switch can accommodate up to five VTY users.

& Note:

As the AUX port and the console port of an H3C series switch are the same one, you will be in the AUX user interface if you log in through this port.

1.2.2 User Interface Number

Two kinds of user interface index exist: absolute user interface index and relative user interface index.

1) The absolute user interface indexes are as follows:

l AUX user interface: 0

l VTY user interfaces: Numbered after AUX user interfaces and increases in the step of 1

2) A relative user interface index can be obtained by appending a number to the identifier of a user interface type. It is generated by user interface type. The relative user interface indexes are as follows:

l AUX user interface: AUX 0

l VTY user interfaces: VTY 0, VTY 1, VTY 2, and so on.

1.2.3 Common User Interface Configuration

To do…	Use the command…	Remarks
Lock the current user interface	lock	Optional Execute this command in user view. A user interface is not locked by default.
Specify to send messages to all user interfaces/a specified user interface	send { all \| number \| type number }	Optional Execute this command in user view.
Disconnect a specified user interface	free user-interface [ type ] number	Optional Execute this command in user view.
Enter system view	system-view	—
Set the banner	header { incoming \| legal \| login \| shell \| motd } text	Optional
Set a system name for the switch	sysname string	Optional
Enter user interface view	user-interface [ type ] first-number [ last-number ]	—
Define a shortcut key for aborting tasks	escape-key { default \| character }	Optional The default shortcut key combination for aborting tasks is < Ctrl+C >.
Set the history command buffer size	history-command max-size value	Optional The default history command buffer size is 10. That is, a history command buffer can store up to 10 commands by default.
Set the timeout time for the user interface	idle-timeout minutes [ seconds ]	Optional The default timeout time of a user interface is 10 minutes. With the timeout time being 10 minutes, the connection to a user interface is terminated if no operation is performed in the user interface within 10 minutes. You can use the idle-timeout 0 command to disable the timeout function.
Set the maximum number of lines the screen can contain	screen-length screen-length	Optional By default, the screen can contain up to 24 lines. You can use the screen-length 0 command to disable the function to display information in pages.
Make terminal services available	shell	Optional By default, terminal services are available in all user interfaces.
Set the display type of a terminal	terminal type { ansi \| vt100 }	Optional By default, the terminal display type is ANSI. The device must use the same type of display as the terminal. If the terminal uses VT 100, the device should also use VT 100.
Display the information about the current user interface/all user interfaces	display users [ all ]	You can execute this command in any view.
Display the physical attributes and configuration of the current/a specified user interface	display user-interface [ type number \| number ] [ summary ]	You can execute this command in any view.
Display the information about the current web users	display web users	You can execute this command in any view.

Chapter 2 Logging In Through the Console Port

& Note:

The default system name of S5500-SI series Ethernet switches is H3C, that is, the command line prompt is H3C. All the following examples take H3C as the command line prompt.

2.1 Introduction

To log in through the console port is the most common way to log in to a switch. It is also the prerequisite to configure other login methods. By default, you can log in to an S5500-SI series Ethernet switch through its console port only.

To log in to an Ethernet switch through its console port, the related configuration of the user terminal must be in accordance with that of the console port.

Table 2-1 lists the default settings of a console port.

Table 2-1 The default settings of a console port

Setting	Default
Baud rate	9,600 bps
Flow control	Off
Check mode	No check bit
Stop bits	1
Data bits	8

After logging in to a switch, you can perform configuration for AUX users. Refer to section 2.3 “Console Port Login Configuration” for more.

2.2 Setting Up the Connection to the Console Port

l Connect the serial port of your PC/terminal to the console port of the switch, as shown in Figure 2-1.

Figure 2-1 Diagram for setting the connection to the console port

l If you use a PC to connect to the console port, launch a terminal emulation utility (such as Terminal in Windows 3.X or HyperTerminal in Windows 9X/Windows 2000/Windows XP) and perform the configuration shown in Figure 2-2 through Figure 2-4 for the connection to be created. Normally, the parameters of a terminal are configured as those listed in Table 2-1.

Figure 2-2 Create a connection

Figure 2-3 Specify the port used to establish the connection

Figure 2-4 Set port parameters terminal window

l Turn on the switch. The user will be prompted to press the Enter key if the switch successfully completes POST (power-on self test). The prompt (such as <H3C>) appears after the user presses the Enter key.

l You can then configure the switch or check the information about the switch by executing commands. You can also acquire help by type the ? character. Refer to the following chapters for information about the commands.

2.3 Console Port Login Configuration

2.3.1 Common Configuration

Table 2-2 lists the common configuration of console port login.

Table 2-2 Common configuration of console port login

Configuration		Description
Console port configuration	Baud rate	Optional The default baud rate is 9,600 bps.
	Check mode	Optional By default, the check mode of the console port is set to “none”, which means no check bit.
	Stop bits	Optional The default stop bits of a console port is 1.
	Data bits	Optional The default data bits of a console port is 8.
AUX user interface configuration	Configure the command level available to the users logging in to the AUX user interface	Optional By default, commands of level 3 are available to the users logging in to the AUX user interface.
Terminal configuration	Define a shortcut key for aborting tasks	Optional The default shortcut key combination for aborting tasks is < Ctrl + C >.
	Define a shortcut key for starting terminal sessions	Optional By default, pressing Enter key starts the terminal session.
	Make terminal services available	Optional By default, terminal services are available in all user interfaces
	Set the maximum number of lines the screen can contain	Optional By default, the screen can contain up to 24 lines.
	Set history command buffer size	Optional By default, the history command buffer can contain up to 10 commands.
	Set the timeout time of a user interface	Optional The default timeout time is 10 minutes.

Caution:

Changing of console port configuration terminates the connection to the console port. To establish the connection again, you need to modify the configuration of the termination emulation utility running on your PC accordingly. Refer to section 2.2 “Setting Up the Connection to the Console Port” for more.

2.3.2 Console Port Login Configurations for Different Authentication Modes

Table 2-3 lists console port login configurations for different authentication modes.

Table 2-3 Console port login configurations for different authentication modes

Authentication mode	Console port login configuration		Description
None	Perform common configuration	Perform common configuration for console port login	Optional Refer to section 2.3.1 “Common Configuration” for more.
Password	Configure the password	Configure the password for local authentication	Required
Password	Perform common configuration	Perform common configuration for console port login	Optional Refer to section 2.3.1 “Common Configuration” for more.
Scheme	Specify to perform local authentication or RADIUS authentication	AAA configuration specifies whether to perform local authentication or RADIUS authentication	Optional Local authentication is performed by default. Refer to the AAA-RADIUS-HWTACACS module for more.
	Configure user name and password	Configure user names and passwords for local/remote users	Required l The user name and password of a local user are configured on the switch. l The user name and password of a remote user are configured on the RADIUS server. Refer to user manual of RADIUS server for more.
	Manage AUX users	Set service type for AUX users	Required
	Perform common configuration	Perform common configuration for console port login	Optional Refer to section 2.3.1 “Common Configuration” for more.

& Note:

Changes of the authentication mode of console port login will not take effect unless you exit and enter again the CLI.

2.4 Console Port Login Configuration with Authentication Mode Being None

2.4.1 Configuration Procedure

To do…		Use the command…	Remarks
Enter system view		system-view	—
Enter AUX user interface view		user-interface aux 0	—
Configure not to authenticate users		authentication-mode none	Required By default, users logging in through the console port are not authenticated.
Configure the console port	Set the baud rate	speed speed-value	Optional The default baud rate of an AUX port (also the console port) is 9,600 bps.
	Set the check mode	parity { even \| mark \| none \| odd \| space }	Optional By default, the check mode of a console port is set to none, that is, no check bit.
	Set the stop bits	stopbits { 1 \| 1.5 \| 2 }	Optional The stop bits of a console port is 1.
	Set the data bits	databits { 5 \| 6 \| 7 \| 8 }	Optional The default data bits of a console port is 8.
Configure the command level available to users logging in to the user interface		user privilege level level	Optional By default, commands of level 3 are available to users logging in to the AUX user interface.
Define a shortcut key for starting terminal sessions		activation-key character	Optional By default, pressing Enter key starts the terminal session.
Define a shortcut key for aborting tasks		escape-key { default \| character }	Optional The default shortcut key combination for aborting tasks is < Ctrl+C >.
Make terminal services available		shell	Optional By default, terminal services are available in all user interfaces.
Set the maximum number of lines the screen can contain		screen-length screen-length	Optional By default, the screen can contain up to 24 lines. You can use the screen-length 0 command to disable the function to display information in pages.
Set the history command buffer size		history-command max-size value	Optional The default history command buffer size is 10. That is, a history command buffer can store up to 10 commands by default.
Set the timeout time for the user interface		idle-timeout minutes [ seconds ]	Optional The default timeout time of a user interface is 10 minutes. With the timeout time being 10 minutes, the connection to a user interface is terminated if no operation is performed in the user interface within 10 minutes. You can use the idle-timeout 0 command to disable the timeout function.

Note that if you configure not to authenticate the users, the command level available to users logging in to a switch depends on both the authentication-mode none command and the user privilege level level command, as listed in the following table.

Table 2-4 Determine the command level (A)

Scenario			Command level
Authentication mode	User type	Command	Command level
None (authentication-mode none)	Users logging in through console ports	The user privilege level level command not executed	Level 3
None (authentication-mode none)	Users logging in through console ports	The user privilege level level command already executed	Determined by the level argument

2.4.2 Configuration Example

I. Network requirements

Assume the switch is configured to allow you to login through Telnet, and your user level is set to the administrator level (level 3). After you telnet to the switch, you need to limit the console user at the following aspects.

l The user is not authenticated when logging in through the console port.

l Commands of level 2 are available to user logging in to the AUX user interface.

l The baud rate of the console port is 19,200 bps.

l The screen can contain up to 30 lines.

l The history command buffer can contain up to 20 commands.

l The timeout time of the AUX user interface is 6 minutes.

II. Network diagram

Figure 2-5 Network diagram for AUX user interface configuration (with the authentication mode being none)

III. Configuration procedure

# Enter system view.

<H3C> system-view

# Enter AUX user interface view.

[H3C] user-interface aux 0

# Specify not to authenticate the user logging in through the console port.

[H3C-ui-aux0] authentication-mode none

# Specify commands of level 2 are available to the user logging in to the AUX user interface.

[H3C-ui-aux0] user privilege level 2

# Set the baud rate of the console port to 19,200 bps.

[H3C-ui-aux0] speed 19200

# Set the maximum number of lines the screen can contain to 30.

[H3C-ui-aux0] screen-length 30

# Set the maximum number of commands the history command buffer can store to 20.

[H3C-ui-aux0] history-command max-size 20

# Set the timeout time of the AUX user interface to 6 minutes.

[H3C-ui-aux0] idle-timeout 6

After the above configuration, to ensure a successful login, the console user needs to change the corresponding configuration of the terminal emulation program running on the PC, to make the configuration consistent with that on the switch. Refer to section 2.2 “Setting Up the Connection to the Console Port” for more.

2.5 Console Port Login Configuration with Authentication Mode Being Password

2.5.1 Configuration Procedure

To do…		Use the command…	Remarks
Enter system view		system-view	—
Enter AUX user interface view		user-interface aux 0	—
Configure to authenticate users using the local password		authentication-mode password	Required By default, users logging in through the console port are not authenticated, while users logging in through the Modem or Telnet need to pass the password authentication.
Set the local password		set authentication password { cipher \| simple } password	Required
Configure the console port	Set the baud rate	speed speed-value	Optional The default baud rate of an AUX port (also the console port) is 9,600 bps.
	Set the check mode	parity { even \| mark \| none \| odd \| space }	Optional By default, the check mode of a console port is set to none, that is, no check bit.
	Set the stop bits	stopbits { 1 \| 1.5 \| 2 }	Optional The default stop bits of a console port is 1.
	Set the data bits	databits { 5 \| 6 \| 7 \| 8 }	Optional The default data bits of a console port is 8.
Configure the command level available to users logging in to the user interface		user privilege level level	Optional By default, commands of level 3 are available to users logging in to the AUX user interface.
Define a shortcut key for starting terminal sessions		activation-key character	Optional By default, pressing Enter key starts the terminal session.
Define a shortcut key for aborting tasks		escape-key { default \| character }	Optional The default shortcut key combination for aborting tasks is < Ctrl+C >.
Make terminal services available to the user interface		shell	Optional By default, terminal services are available in all user interfaces.
Set the maximum number of lines the screen can contain		screen-length screen-length	Optional By default, the screen can contain up to 24 lines. You can use the screen-length 0 command to disable the function to display information in pages.
Set history command buffer size		history-command max-size value	Optional The default history command buffer size is 10. That is, a history command buffer can store up to 10 commands by default.
Set the timeout time for the user interface		idle-timeout minutes [ seconds ]	Optional The default timeout time of a user interface is 10 minutes. With the timeout time being 10 minutes, the connection to a user interface is terminated if no operation is performed in the user interface within 10 minutes. You can use the idle-timeout 0 command to disable the timeout function.

Note that if you configure to authenticate the users in the password mode, the command level available to users logging in to a switch depends on both the authentication-mode password and the user privilege level level command, as listed in the following table.

Table 2-5 Determine the command level (B)

Scenario			Command level
Authentication mode	User type	Command	Command level
Local authentication (authentication-mode password)	Users logging in to the AUX user interface	The user privilege level level command not executed	Level 3
Local authentication (authentication-mode password)	Users logging in to the AUX user interface	The user privilege level level command already executed	Determined by the level argument

2.5.2 Configuration Example

I. Network requirements

l The user is authenticated against the local password when logging in through the console port.

l The local password is set to 123456 (in plain text).

l The commands of level 2 are available to users logging in to the AUX user interface.

l The baud rate of the console port is 19,200 bps.

l The screen can contain up to 30 lines.

l The history command buffer can store up to 20 commands.

l The timeout time of the AUX user interface is 6 minutes.

II. Network diagram

Figure 2-6 Network diagram for AUX user interface configuration (with the authentication mode being password)

III. Configuration procedure

# Enter system view.

<H3C> system-view

# Enter AUX user interface view.

[H3C] user-interface aux 0

# Specify to authenticate the user logging in through the console port using the local password.

[H3C-ui-aux0] authentication-mode password

# Set the local password to 123456 (in plain text).

[H3C-ui-aux0] set authentication password simple 123456

# Specify commands of level 2 are available to the user logging in to the AUX user interface.

[H3C-ui-aux0] user privilege level 2

# Set the baud rate of the console port to 19,200 bps.

[H3C-ui-aux0] speed 19200

# Set the maximum number of lines the screen can contain to 30.

[H3C-ui-aux0] screen-length 30

# Set the maximum number of commands the history command buffer can store to 20.

[H3C-ui-aux0] history-command max-size 20

# Set the timeout time of the AUX user interface to 6 minutes.

[H3C-ui-aux0] idle-timeout 6

2.6 Console Port Login Configuration with Authentication Mode Being Scheme

2.6.1 Configuration Procedure

To do…			Use the command…	Remarks
Enter system view			system-view	—
Configure the authentication mode	Enter the default ISP domain view		domain Domain name	Optional By default, the local AAA scheme is applied. If you specify to apply the local AAA scheme, you need to perform the configuration concerning local user as well. If you specify to apply an existing scheme by providing the radius-scheme-name argument, you need to perform the following configuration as well: l Perform AAA-RADIUS configuration on the switch. (Refer to the AAA-RADIUS-HWTACACS module for more.) l Configure the user name and password accordingly on the AAA server. (Refer to the user manual of AAA server.)
	Specify the AAA scheme to be applied to the domain		authentication default { hwtacacs- scheme hwtacacs-scheme-name [ local ] \| local \| none \| radius-scheme radius-scheme-name [ local ] }
	Quit to system view		quit
Create a local user (Enter local user view.)			local-user user-name	Required No local user exists by default.
Set the authentication password for the local user			password { simple \| cipher } password	Required
Specify the service type for AUX users			service-type terminal [ level level ]	Required
Quit to system view			quit	—
Enter AUX user interface view			user-interface aux 0	—
Configure to authenticate users locally or remotely			authentication-mode scheme [ command- authorization ]	Required The specified AAA scheme determines whether to authenticate users locally or remotely. Users are authenticated locally by default.
Configure the console port		Set the baud rate	speed speed-value	Optional The default baud rate of the AUX port (also the console port) is 9,600 bps.
		Set the check mode	parity { even \| mark \| none \| odd \| space }	Optional By default, the check mode of the console port is set to none, that is, no check bit.
		Set the stop bits	stopbits { 1 \| 1.5 \| 2 }	Optional The default stop bits of the console port is 1.
		Set the data bits	databits { 5 \| 6 \| 7 \| 8 }	Optional The default data bits of the console port is 8.
Configure the command level available to users logging in to the user interface			user privilege level level	Optional By default, commands of level 3 are available to users logging in to the AUX user interface.
Define a shortcut key for starting terminal sessions			activation-key character	Optional By default, pressing Enter key starts the terminal session.
Define a shortcut key for aborting tasks			escape-key { default \| character }	Optional The default shortcut key combination for aborting tasks is < Ctrl+C >.
Make terminal services available to the user interface			shell	Optional By default, terminal services are available in all user interfaces.
Set the maximum number of lines the screen can contain			screen-length screen-length	Optional By default, the screen can contain up to 24 lines. You can use the screen-length 0 command to disable the function to display information in pages.
Set history command buffer size			history-command max-size value	Optional The default history command buffer size is 10. That is, a history command buffer can store up to 10 commands by default.
Set the timeout time for the user interface			idle-timeout minutes [ seconds ]	Optional The default timeout time of a user interface is 10 minutes. With the timeout time being 10 minutes, the connection to a user interface is terminated if no operation is performed in the user interface within 10 minutes. You can use the idle-timeout 0 command to disable the timeout function.

Note that the level the commands of which are available to users logging in to a switch depends on the authentication-mode scheme [ command-authorization ] command, the user privilege level level command, and the service-type terminal [ level level ] command, as listed in Table 2-6.

Table 2-6 Determine the command level

Scenario			Command level
Authentication mode	User type	Command	Command level
authentication-mode scheme [ command- authorization ]	Users logging in to the console port and pass AAA-RADIUS or local authentication	The user privilege level level command is not executed, and the service-type terminal [ level level ] command does not specify the available command level.	Level 0 The default command level available for local users is level 0.
		The user privilege level level command is not executed, and the service-type terminal [ level level ] command specifies the available command level.	Determined by the service-type terminal [ level level ] command
		The user privilege level level command is executed, and the service-type terminal [ level level ] command does not specify the available command level.	Level 0
		The user privilege level level command is executed, and the service-type terminal [ level level ] command specifies the available command level.	Determined by the service-type terminal [ level level ] command

2.6.2 Configuration Example

I. Network requirements

l Configure the name of the local user to be guest.

l Set the authentication password of the local user to 123456 (in plain text).

l Set the service type of the local user to Terminal.

l Configure to authenticate the user logging in through the console port in the scheme mode.

l The commands of level 2 are available to the user logging in to the AUX user interface.

l The baud rate of the console port is 19,200 bps.

l The screen can contain up to 30 lines.

l The history command buffer can store up to 20 commands.

l The timeout time of the AUX user interface is 6 minutes.

II. Network diagram

Figure 2-7 Network diagram for AUX user interface configuration (with the authentication mode being scheme)

III. Configuration procedure

# Enter system view.

<H3C> system-view

# Create a local user named guest and enter local user view.

[H3C] local-user guest

# Set the authentication password to 123456 (in plain text).

[H3C-luser-guest] password simple 123456

# Set the service type to Terminal, Specify commands of level 2 are available to the user logging in to the AUX user interface.

[H3C-luser-guest] service-type terminal level 2

[H3C-luser-guest] quit

# Enter AUX user interface view.

[H3C] user-interface aux 0

# Configure to authenticate the user logging in through the console port in the scheme mode.

[H3C-ui-aux0] authentication-mode scheme

# Set the baud rate of the console port to 19,200 bps.

[H3C-ui-aux0] speed 19200

# Set the maximum number of lines the screen can contain to 30.

[H3C-ui-aux0] screen-length 30

# Set the maximum number of commands the history command buffer can store to 20.

[H3C-ui-aux0] history-command max-size 20

# Set the timeout time of the AUX user interface to 6 minutes.

[H3C-ui-aux0] idle-timeout 6

Chapter 3 Logging In Through Telnet

3.1 Introduction

You can telnet to a remote switch to manage and maintain the switch. To achieve this, you need to configure both the switch and the Telnet terminal properly.

Table 3-1 Requirements for Telnet to a switch

Item	Requirement
Switch	Start the Telnet Server
	The IP address of the VLAN of the switch is configured and the route between the switch and the Telnet terminal is available. (Refer to the module “IP Addressing and Performance” and “IP Routing” for more.)
	The authentication mode and other settings are configured. Refer to Table 3-2 and Table 3-3.
Telnet terminal	Telnet is running.
Telnet terminal	The IP address of the management VLAN of the switch is available.

& Note:

l After you log in to the switch through Telnet, you can issue commands to the switch by way of pasting session text, which cannot exceed 2000 bytes, and the pasted commands must be in the same view; otherwise, the switch may not execute the commands correctly.

l If the session text exceeds 2000 bytes, you can save it in a configuration file, upload the configuration file to the switch and reboot the switch with this configuration file. For details, refer to the File System Management part of the manual.

l The way to log in to a switch using Telnet based on IPv6 is the same as that based on IPv4.

3.1.1 Common Configuration

Table 3-2 lists the common Telnet configuration.

Table 3-2 Common Telnet configuration

Configuration		Description
VTY user interface configuration	Configure the command level available to users logging in to the VTY user interface	Optional By default, commands of level 0 are available to users logging in to a VTY user interface.
	Configure the protocols the user interface supports	Optional By default, Telnet and SSH protocol are supported.
	Set the command that is automatically executed when a user logs into the user interface	Optional By default, no command is automatically executed when a user logs into a user interface.
VTY terminal configuration	Define a shortcut key for aborting tasks	Optional The default shortcut key combination for aborting tasks is < Ctrl+C >.
	Make terminal services available	Optional By default, terminal services are available in all user interfaces
	Set the maximum number of lines the screen can contain	Optional By default, the screen can contain up to 24 lines.
	Set history command buffer size	Optional By default, the history command buffer can contain up to 10 commands.
	Set the timeout time of a user interface	Optional The default timeout time is 10 minutes.

Caution:

l The auto-execute command command may cause you unable to perform common configuration in the user interface, so use it with caution.

l Before executing the auto-execute command command and save your configuration, make sure you can log in to the switch in other modes and cancel the configuration.

3.1.2 Telnet Configurations for Different Authentication Modes

Table 3-3 lists Telnet configurations for different authentication modes.

Table 3-3 Telnet configurations for different authentication modes

Authentication mode	Telnet configuration		Description
None	Perform common configuration	Perform common Telnet configuration	Optional Refer to Table 3-2.
Password	Configure the password	Configure the password for local authentication	Required
Password	Perform common configuration	Perform common Telnet configuration	Optional Refer to Table 3-2.
Scheme	Specify to perform local authentication or RADIUS authentication	AAA configuration specifies whether to perform local authentication or RADIUS authentication	Optional Local authentication is performed by default. Refer to the AAA-RADIUS-HWTACACS module for more.
	Configure user name and password	Configure user names and passwords for local/remote users	Required l The user name and password of a local user are configured on the switch. l The user name and password of a remote user are configured on the RADIUS server. Refer to user manual of RADIUS server for more.
	Manage VTY users	Set service type for VTY users	Required
	Perform common configuration	Perform common Telnet configuration	Optional Refer to Table 3-2.

3.2 Telnet Configuration with Authentication Mode Being None

3.2.1 Configuration Procedure

To do…	Use the command…	Remarks
Enter system view	system-view	—
Enable the Telnet server function	telnet server enable	Required
Enter one or more VTY user interface views	user-interface vty first-number [ last-number ]	—
Configure not to authenticate users logging in to VTY user interfaces	authentication-mode none	Required By default, VTY users are authenticated after logging in.
Configure the command level available to users logging in to VTY user interface	user privilege level level	Optional By default, commands of level 0 are available to users logging in to VTY user interfaces.
Configure the protocols to be supported by the VTY user interface	protocol inbound { all \| ssh \| telnet }	Optional By default, both Telnet protocol and SSH protocol are supported.
Set the command that is automatically executed when a user logs into the user interface	auto-execute command text	Optional By default, no command is automatically executed when a user logs into a user interface.
Define a shortcut key for aborting tasks	escape-key { default \| character }	Optional The default shortcut key combination for aborting tasks is < Ctrl+C >.
Make terminal services available	shell	Optional By default, terminal services are available in all user interfaces.
Set the maximum number of lines the screen can contain	screen-length screen-length	Optional By default, the screen can contain up to 24 lines. You can use the screen-length 0 command to disable the function to display information in pages.
Set the history command buffer size	history-command max-size value	Optional The default history command buffer size is 10. That is, a history command buffer can store up to 10 commands by default.
Set the timeout time of the VTY user interface	idle-timeout minutes [ seconds ]	Optional The default timeout time of a user interface is 10 minutes. With the timeout time being 10 minutes, the connection to a user interface is terminated if no operation is performed in the user interface within 10 minutes. You can use the idle-timeout 0 command to disable the timeout function.

Table 3-4 Determine the command level when users logging in to switches are not authenticated

Scenario			Command level
Authentication mode	User type	Command	Command level
None (authentication-mode none)	VTY users	The user privilege level level command not executed	Level 0
None (authentication-mode none)	VTY users	The user privilege level level command already executed	Determined by the level argument

3.2.2 Configuration Example

I. Network requirements

Assume that you are a level 3 AUX user and want to perform the following configuration for Telnet users logging in to VTY 0:

l Do not authenticate users logging in to VTY 0.

l Commands of level 2 are available to users logging in to VTY 0.

l Telnet protocol is supported.

l The screen can contain up to 30 lines.

l The history command buffer can contain up to 20 commands.

l The timeout time of VTY 0 is 6 minutes.

II. Network diagram

Figure 3-1 Network diagram for Telnet configuration (with the authentication mode being none)

III. Configuration procedure

# Enter system view, and enable the Telnet service.

<H3C> system-view

[H3C] telnet server enable

# Enter VTY 0 user interface view.

[H3C] user-interface vty 0

# Configure not to authenticate Telnet users logging in to VTY 0.

[H3C-ui-vty0] authentication-mode none

# Specify commands of level 2 are available to users logging in to VTY 0.

[H3C-ui-vty0] user privilege level 2

# Configure Telnet protocol is supported.

[H3C-ui-vty0] protocol inbound telnet

# Set the maximum number of lines the screen can contain to 30.

[H3C-ui-vty0] screen-length 30

# Set the maximum number of commands the history command buffer can store to 20.

[H3C-ui-vty0] history-command max-size 20

# Set the timeout time to 6 minutes.

[H3C-ui-vty0] idle-timeout 6

3.3 Telnet Configuration with Authentication Mode Being Password

3.3.1 Configuration Procedure

To do…	Use the command…	Remarks
Enter system view	system-view	—
Enable the Telnet server function	telnet server enable	Required
Enter one or more VTY user interface views	user-interface vty first-number [ last-number ]	—
Configure to authenticate users logging in to VTY user interfaces using the local password	authentication-mode password	Required
Set the local password	set authentication password { cipher \| simple } password	Required
Configure the command level available to users logging in to the user interface	user privilege level level	Optional By default, commands of level 0 are available to users logging in to VTY user interface.
Configure the protocol to be supported by the user interface	protocol inbound { all \| ssh \| telnet }	Optional By default, both Telnet protocol and SSH protocol are supported.
Set the command that is automatically executed when a user logs into the user interface	auto-execute command text	Optional By default, no command is automatically executed when a user logs into a user interface.
Define a shortcut key for aborting tasks	escape-key { default \| character }	Optional The default shortcut key combination for aborting tasks is < Ctrl+C >.
Make terminal services available	shell	Optional By default, terminal services are available in all user interfaces.
Set the maximum number of lines the screen can contain	screen-length screen-length	Optional By default, the screen can contain up to 24 lines. You can use the screen-length 0 command to disable the function to display information in pages.
Set the history command buffer size	history-command max-size value	Optional The default history command buffer size is 10. That is, a history command buffer can store up to 10 commands by default.
Set the timeout time of the user interface	idle-timeout minutes [ seconds ]	Optional The default timeout time of a user interface is 10 minutes. With the timeout time being 10 minutes, the connection to a user interface is terminated if no operation is performed in the user interface within 10 minutes. You can use the idle-timeout 0 command to disable the timeout function.

Note that if you configure to authenticate the users in the password mode, the command level available to users logging in to a switch depends on both the authentication-mode password command and the user privilege level level command, as listed in Table 3-5.

Table 3-5 Determine the command level when users logging in to switches are authenticated in the password mode

Scenario			Command level
Authentication mode	User type	Command	Command level
Password (authentication-mode password)	VTY users	The user privilege level level command not executed	Level 0
Password (authentication-mode password)	VTY users	The user privilege level level command already executed	Determined by the level argument

3.3.2 Configuration Example

I. Network requirements

Assume that you are a level 3 AUX user and want to perform the following configuration for Telnet users logging in to VTY 0:

l Authenticate users logging in to VTY 0 using the local password.

l Set the local password to 123456 (in plain text).

l Commands of level 2 are available to users logging in to VTY 0.

l Telnet protocol is supported.

l The screen can contain up to 30 lines.

l The history command buffer can contain up to 20 commands.

l The timeout time of VTY 0 is 6 minutes.

II. Network diagram

Figure 3-2 Network diagram for Telnet configuration (with the authentication mode being password)

III. Configuration procedure

# Enter system view, and enable the Telnet service.

<H3C> system-view

[H3C] telnet server enable

# Enter VTY 0 user interface view.

[H3C] user-interface vty 0

# Configure to authenticate users logging in to VTY 0 using the local password.

[H3C-ui-vty0] authentication-mode password

# Set the local password to 123456 (in plain text).

[H3C-ui-vty0] set authentication password simple 123456

# Specify commands of level 2 are available to users logging in to VTY 0.

[H3C-ui-vty0] user privilege level 2

# Configure Telnet protocol is supported.

[H3C-ui-vty0] protocol inbound telnet

# Set the maximum number of lines the screen can contain to 30.

[H3C-ui-vty0] screen-length 30

# Set the maximum number of commands the history command buffer can store to 20.

[H3C-ui-vty0] history-command max-size 20

# Set the timeout time to 6 minutes.

[H3C-ui-vty0] idle-timeout 6

3.4 Telnet Configuration with Authentication Mode Being Scheme

3.4.1 Configuration Procedure

To do…		Use the command…	Remarks
Enter system view		system-view	—
Enable the Telnet server function		telnet server enable	Required
Configure the authentication scheme	Enter the default ISP domain view	domain Domain name	Optional By default, the local AAA scheme is applied. If you specify to apply the local AAA scheme, you need to perform the configuration concerning local user as well. If you specify to apply an existing scheme by providing the radius-scheme-name argument, you need to perform the following configuration as well: l Perform AAA-RADIUS configuration on the switch. (Refer to the AAA-RADIUS-HWTACACS module for more.) l Configure the user name and password accordingly on the AAA server. (Refer to the user manual of AAA server.)
	Configure the AAA scheme to be applied to the domain	authentication default { hwtacacs-scheme hwtacacs-scheme- name [ local ] \| local \| none \| radius-scheme radius-scheme-name [ local ] }
	Quit to system view	quit
Create a local user and enter local user view		local-user user-name	No local user exists by default.
Set the authentication password for the local user		password { simple \| cipher } password	Required
Specify the service type for VTY users		service-type telnet [ level level ]	Required
Quit to system view		quit	—
Enter one or more VTY user interface views		user-interface vty first-number [ last-number ]	—
Configure to authenticate users locally or remotely		authentication-mode scheme	Required The specified AAA scheme determines whether to authenticate users locally or remotely. Users are authenticated locally by default.
Configure the command level available to users logging in to the user interface		user privilege level level	Optional By default, commands of level 0 are available to users logging in to the VTY user interfaces.
Configure the supported protocol		protocol inbound { all \| ssh \| telnet }	Optional Both Telnet protocol and SSH protocol are supported by default.
Set the command that is automatically executed when a user logs into the user interface		auto-execute command text	Optional By default, no command is automatically executed when a user logs into a user interface.
Define a shortcut key for aborting tasks		escape-key { default \| character }	Optional The default shortcut key combination for aborting tasks is Ctrl+C.
Make terminal services available		shell	Optional Terminal services are available in all use interfaces by default.
Set the maximum number of lines the screen can contain		screen-length screen-length	Optional By default, the screen can contain up to 24 lines. You can use the screen-length 0 command to disable the function to display information in pages.
Set history command buffer size		history-command max-size value	Optional The default history command buffer size is 10. That is, a history command buffer can store up to 10 commands by default.
Set the timeout time for the user interface		idle-timeout minutes [ seconds ]	Optional The default timeout time of a user interface is 10 minutes. With the timeout time being 10 minutes, the connection to a user interface is terminated if no operation is performed in the user interface within 10 minutes. You can use the idle-timeout 0 command to disable the timeout function.

Note that if you configure to authenticate the users in the scheme mode, the command level available to users logging in to a switch depends on the authentication-mode scheme [ command-authorization ] command, the user privilege level level command, and the service-type { ftp [ ftp-directory directory ] | lan-access | { ssh | telnet | terminal }* [ level level ] } command, as listed in Table 3-6.

Table 3-6 Determine the command level when users logging in to switches are authenticated in the scheme mode

Scenario			Command level
Authentication mode	User type	Command	Command level
Scheme (authentication-mode scheme [ command-authorization ])	VTY users that are AAA-RADIUS authenticated or locally authenticated	The user privilege level level command is not executed, and the service-type command does not specify the available command level.	Level 0
		The user privilege level level command is not executed, and the service-type command specifies the available command level.	Determined by the service-type command
		The user privilege level level command is executed, and the service-type command does not specify the available command level.	Level 0
		The user privilege level level command is executed, and the service-type command specifies the available command level.	Determined by the service-type command
	VTY users that are authenticated in the RSA mode of SSH	The user privilege level level command is not executed, and the service-type command does not specify the available command level.	Level 0
		The user privilege level level command is not executed, and the service-type command specifies the available command level.	Level 0
		The user privilege level level command is executed, and the service-type command does not specify the available command level.	Determined by the user privilege level level command
		The user privilege level level command is executed, and the service-type command specifies the available command level.	Determined by the user privilege level level command
	VTY users that are authenticated in the password mode of SSH	The user privilege level level command is not executed, and the service-type command does not specify the available command level.	Level 0
		The user privilege level level command is not executed, and the service-type command specifies the available command level.	Determined by the service-type command
		The user privilege level level command is executed, and the service-type command does not specify the available command level.	Level 0
		The user privilege level level command is executed, and the service-type command specifies the available command level.	Determined by the service-type command

& Note:

Refer to the corresponding modules in this manual for information about AAA-RADIUS-HWTACACS and SSH.

3.4.2 Configuration Example

I. Network requirements

Assume that you are a level 3 AUX user and want to perform the following configuration for Telnet users logging in to VTY 0:

l Configure the name of the local user to be “guest”.

l Set the authentication password of the local user to 123456 (in plain text).

l Set the service type of VTY users to Telnet.

l Configure to authenticate users logging in to VTY 0 in scheme mode.

l The commands of level 2 are available to users logging in to VTY 0.

l Telnet protocol is supported in VTY 0.

l The screen can contain up to 30 lines.

l The history command buffer can store up to 20 commands.

l The timeout time of VTY 0 is 6 minutes.

II. Network diagram

Figure 3-3 Network diagram for Telnet configuration (with the authentication mode being scheme)

III. Configuration procedure

# Enter system view, and enable the Telnet service.

<H3C> system-view

[H3C] telnet server enable

# Create a local user named “guest” and enter local user view.

[H3C] local-user guest

# Set the authentication password of the local user to 123456 (in plain text).

[H3C-luser-guest] password simple 123456

# Set the service type to Telnet, Specify commands of level 2 are available to users logging in to VTY 0.

[H3C-luser-guest] service-type telnet level 2

# Enter VTY 0 user interface view.

[H3C] user-interface vty 0

# Configure to authenticate users logging in to VTY 0 in the scheme mode.

[H3C-ui-vty0] authentication-mode scheme

# Configure Telnet protocol is supported.

[H3C-ui-vty0] protocol inbound telnet

# Set the maximum number of lines the screen can contain to 30.

[H3C-ui-vty0] screen-length 30

# Set the maximum number of commands the history command buffer can store to 20.

[H3C-ui-vty0] history-command max-size 20

# Set the timeout time to 6 minutes.

[H3C-ui-vty0] idle-timeout 6

3.5 Telnet Connection Establishment

3.5.1 Telnetting to a Switch from a Terminal

You can telnet to a switch and then configure the switch if the interface of the management VLAN of the switch is assigned with an IP address. (By default, VLAN 1 is the management VLAN.)

Following are procedures to establish a Telnet connection to a switch:

Step 1: Log in to the switch through the console port, enable the Telnet server function and assign an IP address to the management VLAN interface of the switch.

l Connect to the console port. Refer to section 2.2 “Setting Up the Connection to the Console Port”.

l Execute the following commands in the terminal window to enable the Telnet server function and assign an IP address to the management VLAN interface of the switch.

# Enable the Telnet server function and configure the IP address of the management VLAN interface as 202.38.160.92, and .the subnet mask as 255.255.255.0.

<H3C> system-view

[H3C] telnet server enable

[H3C] interface vlan-interface 1

[H3C-Vlan-interface1] ip address 202.38.160.92 255.255.255.0

Step 2: Before Telnet users can log in to the switch, corresponding configurations should have been performed on the switch according to different authentication modes for them. Refer to section 3.2 "Telnet Configuration with Authentication Mode Being None”, section 3.3 “Telnet Configuration with Authentication Mode Being Password”, and section 3.4 “Telnet Configuration with Authentication Mode Being Scheme” for more. By default, Telnet users need to pass the password authentication to login.

Step 3: Connect your PC to the Switch, as shown in Figure 3-4. Make sure the Ethernet port to which your PC is connected belongs to the management VLAN of the switch and the route between your PC and the switch is available.

Figure 3-4 Network diagram for Telnet connection establishment

Step 4: Launch Telnet on your PC, with the IP address of the management VLAN interface of the switch as the parameter, as shown in the following figure.

Figure 3-5 Launch Telnet

Step 5: Enter the password when the Telnet window displays “Login authentication” and prompts for login password. The CLI prompt (such as <H3C>) appears if the password is correct. If all VTY user interfaces of the switch are in use, you will fail to establish the connection and receive the message that says “All user interfaces are used, please try later!”. A H3C series Ethernet switch can accommodate up to five Telnet connections at same time.

Step 6: After successfully Telnetting to a switch, you can configure the switch or display the information about the switch by executing corresponding commands. You can also type ? at any time for help. Refer to the following chapters for the information about the commands.

& Note:

l A Telnet connection will be terminated if you delete or modify the IP address of the VLAN interface in the Telnet session.

l By default, commands of level 0 are available to Telnet users authenticated by password. Refer to the System Maintenance and Debugging module for information about command hierarchy.

3.5.2 Telnetting to Another Switch from the Current Switch

You can Telnet to another switch from the current switch. In this case, the current switch operates as the client, and the other operates as the server. If the interconnected Ethernet ports of the two switches are in the same LAN segment, make sure the IP addresses of the two management VLAN interfaces to which the two Ethernet ports belong to are of the same network segment, or the route between the two VLAN interfaces is available.

As shown in Figure 3-6, after Telnetting to a switch (labeled as Telnet client), you can Telnet to another switch (labeled as Telnet server) by executing the telnet command and then to configure the later.

Figure 3-6 Network diagram for Telnetting to another switch from the current switch

Step 1: Configure the user name and password for Telnet on the switch operating as the Telnet server. Refer to section 3.2 "Telnet Configuration with Authentication Mode Being None”, section 3.3 “Telnet Configuration with Authentication Mode Being Password”, and section 3.4 “Telnet Configuration with Authentication Mode Being Scheme” for more. By default, Telnet users need to pass the password authentication to login.

Step 2: Telnet to the switch operating as the Telnet client.

Step 3: Execute the following command on the switch operating as the Telnet client:

<H3C> telnet xxxx

Where xxxx is the IP address or the host name of the switch operating as the Telnet server. You can use the ip host to assign a host name to a switch.

Step 4: Enter the password. If the password is correct, the CLI prompt (such as <H3C>) appears. If all VTY user interfaces of the switch are in use, you will fail to establish the connection and receive the message that says “All user interfaces are used, please try later!”.

Step 5: After successfully Telnetting to the switch, you can configure the switch or display the information about the switch by executing corresponding commands. You can also type ? at any time for help. Refer to the following chapters for the information about the commands.

Chapter 4 Logging in Using Modem

4.1 Introduction

The administrator can log in to the console port of a remote switch using a modem through PSTN (public switched telephone network) if the remote switch is connected to the PSTN through a modem to configure and maintain the switch remotely. When a network operates improperly or is inaccessible, you can log in to the switches in the network in this way to configure these switches, to query logs and warning messages, and to locate problems.

To log in to a switch in this way, you need to configure the terminal and the switch properly, as listed in the following table.

Table 4-1 Requirements for logging in to a switch using a modem

Item	Requirement
Administrator side	The PC can communicate with the modem connected to it.
	The modem is properly connected to PSTN.
	The telephone number of the switch side is available.
Switch side	The modem is connected to the console port of the switch properly.
	The modem is properly configured.
	The modem is properly connected to PSTN and a telephone set.
	The authentication mode and other related settings are configured on the switch. Refer to Table 2-3.

4.2 Configuration on the Administrator Side

The PC can communicate with the modem connected to it. The modem is properly connected to PSTN. And the telephone number of the switch side is available.

4.3 Configuration on the Switch Side

4.3.1 Modem Configuration

Perform the following configuration on the modem directly connected to the switch:

AT&F ----------------------- Restore the factory settings

ATS0=1 ----------------------- Configure to answer automatically after the first ring

AT&D ----------------------- Ignore DTR signal

AT&K0 ----------------------- Disable flow control

AT&R1 ----------------------- Ignore RTS signal

AT&S0 ----------------------- Set DSR to high level by force

ATEQ1&W ----------------------- Disable the modem from returning command response and the result, save the changes

You can verify your configuration by executing the AT&V command.

& Note:

The above configuration is unnecessary to the modem on the administrator side.

The configuration commands and the output of different modems may differ. Refer to the user manual of the modem when performing the above configuration.

4.3.2 Switch Configuration

& Note:

After logging in to a switch through its console port by using a modem, you will enter the AUX user interface. The corresponding configuration on the switch is the same as those when logging in to the switch locally through its console port except that:

l When you log in through the console port using a modem, the baud rate of the console port is usually set to a value lower than the transmission speed of the modem. Otherwise, packets may get lost.

l Other settings of the console port, such as the check mode, the stop bits, and the data bits, remain the default.

The configuration on the switch depends on the authentication mode the user is in. Refer to Table 2-3 for the information about authentication mode configuration.

4.4 Modem Connection Establishment

Step 1: Configure the user name and password on the switch. Refer to section 2.4 "Console Port Login Configuration with Authentication Mode Being None”, section 2.5 “Console Port Login Configuration with Authentication Mode Being Password”, and section 2.6 "Console Port Login Configuration with Authentication Mode Being Scheme” for more.

Step 2: Perform the following configuration on the modem directly connected to the switch.

AT&F ----------------------- Restore the factory settings

ATS0=1 ----------------------- Configure to answer automatically after the first ring

AT&D ----------------------- Ignore DTR signal

AT&K0 ----------------------- Disable flow control

AT&R1 ----------------------- Ignore RTS signal

AT&S0 ----------------------- Set DSR to high level by force

ATEQ1&W ----------------------- Disable the modem from returning command response and the result, save the changes

You can verify your configuration by executing the AT&V command.

& Note:

l The configuration commands and the output of different modems may differ. Refer to the user manual of the modem when performing the above configuration.

l It is recommended that the baud rate of the AUX port (also the console port) be set to a value lower than the transmission speed of the modem. Otherwise, packets may get lost.

Step 3: Connect your PC, the modems, and the switch, as shown in the following figure.

Figure 4-1 Establish the connection by using modems

Step 4: Launch a terminal emulation utility on the PC and set the telephone number to call the modem directly connected to the switch, as shown in Figure 4-2 and Figure 4-3. Note that you need to set the telephone number to that of the modem directly connected to the switch.

Figure 4-2 Set the telephone number

Figure 4-3 Call the modem

Step 5: Provide the password when prompted. If the password is correct, the prompt (such as <H3C>) appears. You can then configure or manage the switch. You can also enter the character ? at anytime for help. Refer to the following chapters for information about the configuration commands.

& Note:

If you perform no AUX user-related configuration on the switch, the commands of level 3 are available to modem users. Refer to the System Maintenance and Debugging module for information about command level.

Chapter 5 Logging in Through Web-based Network Management System

5.1 Introduction

An S5500-SI series switch has a Web server built in. You can log in to an S5500-SI series switch through a Web browser and manage and maintain the switch intuitively by interacting with the built-in Web server.

To log in to an S5500-SI series switch through the built-in Web-based network management system, you need to perform the related configuration on both the switch and the PC operating as the network management terminal.

Table 5-1 Requirements for logging in to a switch through the Web-based network management system

Item	Requirement
Switch	Start the Web server
	The IP address of the management VLAN of the switch is configured. The route between the switch and the network management terminal is available. (Refer to the module “IP Addressing and Performance” and “IP Routing” for more.)
	The user name and password for logging in to the Web-based network management system are configured.
PC operating as the network management terminal	IE is available.
PC operating as the network management terminal	The IP address of the management VLAN interface of the switch is available.

5.2 HTTP Connection Establishment

Step 1: Log in to the switch through the console port and assign an IP address to the management VLAN interface of the switch. By default, VLAN 1 is the management VLAN.

l Connect to the console port. Refer to section 2.2 Setting Up the Connection to the Console Port.

l Execute the following commands in the terminal window to assign an IP address to the management VLAN interface of the switch.

# Configure the IP address of the management VLAN interface to be 10.153.17.82 with the mask 255.255.255.0.

<H3C> system-view

[H3C] interface vlan-interface 1

[H3C-Vlan-interface1] ip address 10.153.17.82 255.255.255.0

Step 2: Configure the user name and the password for the Web-based network management system.

# Configure the user name to be admin.

[H3C] local-user admin

# Set the user level to level 3.

[H3C-luser-admin] service-type telnet level 3

# Set the password to admin.

[H3C-luser-admin] password simple admin

Step 3: Establish an HTTP connection between your PC and the switch, as shown in the following figure.

Figure 5-1 Establish an HTTP connection between your PC and the switch

Step 4: Log in to the switch through IE. Launch IE on the Web-based network management terminal (your PC) and enter the IP address of the management VLAN interface of the switch (here it is http://10.153.17.82). (Make sure the route between the Web-based network management terminal and the switch is available.)

Step 5: When the login interface (shown in Figure 5-2) appears, enter the user name and the password configured in step 2 and click <Login> to bring up the main page of the Web-based network management system.

Figure 5-2 The login page of the Web-based network management system

5.3 Web Server Shutdown/Startup

You can shut down or start up the Web server.

To do…	Use the command…	Remarks
Enter system view	system-view	—
Shut down the Web server	undo ip http enable	Required Execute this command in system view. The Web server is started by default.
Start the Web server	ip http enable	Required Execute this command in system view.

5.4 Displaying Web Users

After the above configurations, execute the display command in any view to display the information about Web users, and thus to verify the configuration effect.

Table 5-2 Display information about Web users

To do…	Use the command…
Display information about Web users	display web users

Chapter 6 Logging in Through NMS

6.1 Introduction

You can also log in to a switch through an NMS (network management station), and then configure and manage the switch through the agent module on the switch.

l The agent here refers to the software running on network devices (switches) and as the server.

l SNMP (simple network management protocol) is applied between the NMS and the agent.

To log in to a switch through an NMS, you need to perform related configuration on both the NMS and the switch.

Table 6-1 Requirements for logging in to a switch through an NMS

Item	Requirement
Switch	The IP address of the management VLAN of the switch is configured. The route between the NMS and the switch is available. (Refer to the module “IP Addressing and Performance” and “IP Routing” for more.)
Switch	The basic SNMP functions are configured. (Refer to the SNMP-RMON module for more.)
NMS	The NMS is properly configured. (Refer to the user manual of your NMS for more.)

6.2 Connection Establishment Using NMS

Figure 6-1 Network diagram for logging in through an NMS

Chapter 7 Configuring Source IP Address for Telnet Service Packets

Go to these sections for information you are interested in:

l Overview

l Configuring Source IP Address for Telnet Service Packets

l Displaying the source IP address/Interface Specified for Telnet Packets

7.1 Overview

You can configure source IP address or source interface for Telnet client. This provides a way to manage services and enhances security.

The source IP address specified for Telnet service packets is the IP address of an Loopback interface or VLAN interface. After you specify the IP address of a virtual Loopback interface or an unused VLAN interface as the source IP address of Telnet service packets, the IP address is used as the source IP address no matter which interface of the switch is used to transmit packets between the Telnet client and the Telnet server. This conceals the IP address of the actual interface used. As a result, external attacks are guarded and the security is improved. On the other hand, you can configure the Telnet server to accept only Telnet service packets with specific source IP addresses to make sure specific users can log in to the switch.

7.2 Configuring Source IP Address for Telnet Service Packets

This feature can be configured in either user view or system view. The configuration performed in user view takes effect for only the current session, while the configuration performed in system view takes effect for all the following sessions.

I. Configuration in user view

Table 7-1 Configure a source IP address for service packets in user view

To do…	Use the command…	Remarks
Specify the source IP address or source interface for the switch for it to log in to another device as a Telnet client	telnet remote-system [ port-number ] [ source { ip ip-address \| interface interface-type interface-number } ]	Optional Not specified by default

To do…

Use the command…

Remarks

Specify the source IP address or source interface for the switch for it to log in to another device as a Telnet client

telnet remote-system [ port-number ] [ source { ip ip-address | interface interface-type interface-number } ]

Optional

Not specified by default

II. Configuration in system view

Table 7-2 Configure a source IP address for service packets in system view

To do…	Use the command…	Remarks
Enter system view	system-view	—
Specify the source IP address or source interface for the switch for it to log in to another device as a Telnet client	telnet client source { ip ip-address \| interface interface-type interface-number }	Optional Not specified by default

To do…

Use the command…

Remarks

Enter system view

system-view

—

Specify the source IP address or source interface for the switch for it to log in to another device as a Telnet client

telnet client source { ip ip-address | interface interface-type interface-number }

Optional

Not specified by default

& Note:

To perform the configurations listed in Table 7-1 and Table 7-2, make sure that:

l The IP address specified is that of the local device.

l The interface specified exists.

l If a source IP address (or source interface) is specified, you need to make sure that the route between the IP addresses (or interface) of both sides is reachable.

7.3 Displaying the source IP address/Interface Specified for Telnet Packets

Follow these steps to display the source IP address/interface specified for Telnet packets:

To do…	Use the command…
Display the source IP address/interface specified for Telnet packets	display telnet client configuration

Chapter 8 Controlling Login Users

8.1 Introduction

A switch provides ways to control different types of login users, as listed in Table 8-1.

Table 8-1 Ways to control different types of login users

Login mode	Control method	Implementation	Related section
Telnet	By source IP addresses	Through basic ACLs	Section 8.2.2 “Controlling Telnet Users by Source IP Addresses”.
	By source and destination IP addresses	Through advanced ACLs	Section 8.2.3 “Controlling Telnet Users by Source and Destination IP Addresses”.
	By source MAC addresses	Through Layer 2 ACLs	Section 8.2.4 “Controlling Telnet Users by Source MAC Addresses”
SNMP	By source IP addresses	Through basic ACLs	Section 8.3.2 “Controlling Network Management Users by Source IP Addresses”
WEB	By source IP addresses	Through basic ACLs	Section 8.4.2 “Controlling Web Users by Source IP Addresses”
WEB	Disconnect Web users by force	By executing commands in CLI	Section 8.4.3 “Disconnecting a Web User by Force”.

8.2 Controlling Telnet Users

8.2.1 Prerequisites

The controlling policy against Telnet users is determined, including the source and destination IP addresses to be controlled and the controlling actions (permitting or denying).

8.2.2 Controlling Telnet Users by Source IP Addresses

Controlling Telnet users by source IP addresses is achieved by applying basic ACLs, which are numbered from 2000 to 2999.

To do…	Use the command…	Remarks
Enter system view	system-view	—
Create a basic ACL or enter basic ACL view	acl [ ipv6 ] number acl-number [ match-order { config \| auto } ]	As for the acl number command, the config keyword is specified by default.
Define rules for the ACL	rule [ rule-id ] { permit \| deny } [ source { sour-addr sour-wildcard \| any } \| time-range time-name \| fragment \| logging ]*	Required
Quit to system view	quit	—
Enter user interface view	user-interface [ type ] first-number [ last-number ]	—
Apply the ACL to control Telnet users by source IP addresses	acl [ ipv6 ] acl-number { inbound \| outbound }	Required The inbound keyword specifies to filter the users trying to Telnet to the current switch. The outbound keyword specifies to filter users trying to Telnet to other switches from the current switch.

8.2.3 Controlling Telnet Users by Source and Destination IP Addresses

Controlling Telnet users by source and destination IP addresses is achieved by applying advanced ACLs, which are numbered from 3000 to 3999. Refer to the ACL module for information about defining an ACL.

To do…	Use the command…	Remarks
Enter system view	system-view	—
Create an advanced ACL or enter advanced ACL view	acl [ ipv6 ] number acl-number [ match-order { config \| auto } ]	As for the acl number command, the config keyword is specified by default.
Define rules for the ACL	rule [ rule-id ] { permit \| deny } rule-string	Required You can define rules as needed to filter by specific source and destination IP addresses.
Quit to system view	quit	—
Enter user interface view	user-interface [ type ] first-number [ last-number ]	—
Apply the ACL to control Telnet users by specified source and destination IP addresses	acl [ ipv6 ] acl-number { inbound \| outbound }	Required The inbound keyword specifies to filter the users trying to Telnet to the current switch. The outbound keyword specifies to filter users trying to Telnet to other switches from the current switch.

8.2.4 Controlling Telnet Users by Source MAC Addresses

Controlling Telnet users by source MAC addresses is achieved by applying Layer 2 ACLs, which are numbered from 4000 to 4999. Refer to the ACL module for information about defining an ACL.

To do…	Use the command…	Remarks
Enter system view	system-view	—
Create a basic ACL or enter basic ACL view	acl number acl-number [ match-order { config \| auto } ]	As for the acl number command, the config keyword is specified by default.
Define rules for the ACL	rule [ rule-id ] { permit \| deny } rule-string	Required You can define rules as needed to filter by specific source MAC addresses.
Quit to system view	quit	—
Enter user interface view	user-interface [ type ] first-number [ last-number ]	—
Apply the ACL to control Telnet users by source MAC addresses	acl acl-number inbound	Required The inbound keyword specifies to filter the users trying to Telnet to the current switch.

8.2.5 Configuration Example

I. Network requirements

Only the Telnet users sourced from the IP address of 10.110.100.52 and 10.110.100.46 are permitted to log in to the switch.

II. Network diagram

Figure 8-1 Network diagram for controlling Telnet users using ACLs

III. Configuration procedure

# Define a basic ACL.

<H3C> system-view

[H3C] acl number 2000 match-order config

[H3C-acl-basic-2000] rule 1 permit source 10.110.100.52 0

[H3C-acl-basic-2000] rule 2 permit source 10.110.100.46 0

[H3C-acl-basic-2000] rule 3 deny source any

[H3C-acl-basic-2000] quit

# Apply the ACL.

[H3C] user-interface vty 0 4

[H3C-ui-vty0-4] acl 2000 inbound

8.3 Controlling Network Management Users by Source IP Addresses

You can manage a S5500-SI series Ethernet switch through network management software. Network management users can access switches through SNMP.

You need to perform the following two operations to control network management users by source IP addresses.

l Defining an ACL

l Applying the ACL to control users accessing the switch through SNMP

8.3.1 Prerequisites

The controlling policy against network management users is determined, including the source IP addresses to be controlled and the controlling actions (permitting or denying).

8.3.2 Controlling Network Management Users by Source IP Addresses

Controlling network management users by source IP addresses is achieved by applying basic ACLs, which are numbered from 2000 to 2999. Refer to the ACL module for information about defining an ACL.

To do…	Use the command…	Remarks
Enter system view	system-view	—
Create a basic ACL or enter basic ACL view	acl number acl-number [ match-order { config \| auto } ]	As for the acl number command, the config keyword is specified by default.
Define rules for the ACL	rule [ rule-id ] { permit \| deny } [ source { sour-addr sour-wildcard \| any } \| time-range time-name \| fragment \| logging ]*	Required
Quit to system view	quit	—
Apply the ACL while configuring the SNMP community name	snmp-agent community { read \| write } community-name [ mib-view view-name \| acl acl-number ]*	Required
Apply the ACL while configuring the SNMP group name	snmp-agent group { v1 \| v2c } group-name [ read-view read-view ] [ write-view write-view ] [ notify-view notify-view ] [ acl acl-number ] snmp-agent group v3 group-name [ authentication \| privacy ] [ read-view read-view ] [ write-view write-view ] [ notify-view notify-view ] [ acl acl-number ]	Required
Apply the ACL while configuring the SNMP user name	snmp-agent usm-user { v1 \| v2c } user-name group-name [ acl acl-number ] snmp-agent usm-user v3 user-name group-name [ authentication-mode { md5 \| sha } auth-password [ privacy-mode { des56 \| aes128 } priv-password ] ] [ acl acl-number ]	Required

& Note:

You can specify different ACLs while configuring the SNMP community name, the SNMP group name and the SNMP user name.

As SNMP community name is a feature of SNMPv1 and SNMPv2c, the specified ACLs in the command that configures SNMP community names (the snmp-agent community command) take effect in the network management systems that adopt SNMPv1 or SNMPv2c.

Similarly, as SNMP group name and SNMP user name are features of SNMPv2c and the higher SNMP versions, the specified ACLs in the commands that configure SNMP group names (the snmp-agent group command and the snmp-agent group v3 command) and SNMP user names (the snmp-agent usm-user command and the snmp-agent usm-user v3 command) take effect in the network management systems that adopt SNMPv2c or higher SNMP versions. If you configure both the SNMP group name and the SNMP user name and specify ACLs in the two operations, the switch will filter network management users by both SNMP group name and SNMP user name.

8.3.3 Configuration Example

I. Network requirements

Only SNMP users sourced from the IP addresses of 10.110.100.52 and 10.110.100.46 are permitted to access the switch.

II. Network diagram

Figure 8-2 Network diagram for controlling SNMP users using ACLs

III. Configuration procedure

# Define a basic ACL.

<H3C> system-view

[H3C] acl number 2000 match-order config

[H3C-acl-basic-2000] rule 1 permit source 10.110.100.52 0

[H3C-acl-basic-2000] rule 2 permit source 10.110.100.46 0

[H3C-acl-basic-2000] rule 3 deny source any

[H3C-acl-basic-2000] quit

# Apply the ACL to only permit SNMP users sourced from the IP addresses of 10.110.100.52 and 10.110.100.46 to access the switch.

[H3C] snmp-agent community read h3c acl 2000

[H3C] snmp-agent group v2c h3cgroup acl 2000

[H3C] snmp-agent usm-user v2c h3cuser h3cgroup acl 2000

8.4 Controlling Web Users by Source IP Address

You can manage a S5500-SI series Ethernet switch remotely through Web. Web users can access a switch through HTTP connections.

You need to perform the following two operations to control Web users by source IP addresses.

l Defining an ACL

l Applying the ACL to control Web users

8.4.1 Prerequisites

The controlling policy against Web users is determined, including the source IP addresses to be controlled and the controlling actions (permitting or denying).

8.4.2 Controlling Web Users by Source IP Addresses

Controlling Web users by source IP addresses is achieved by applying basic ACLs, which are numbered from 2000 to 2999.

To do…	Use the command…	Remarks
Enter system view	system-view	—
Create a basic ACL or enter basic ACL view	acl number acl-number [ match-order { config \| auto } ]	As for the acl number command, the config keyword is specified by default.
Define rules for the ACL	rule [ rule-id ] { permit \| deny } [ source { sour-addr sour-wildcard \| any } \| time-range time-name \| fragment \| logging ]*	Required
Quit to system view	quit	—
Apply the ACL to control Web users	ip http acl acl-number	Optional

8.4.3 Disconnecting a Web User by Force

The administrator can disconnect a Web user by force using the related command.

To do…	Use the command…	Remarks
Disconnect a Web user by force	free web-users { all \| user-id user-id \| user-name user-name }	Required Execute this command in user view.

To do…

Use the command…

Remarks

Disconnect a Web user by force

free web-users { all | user-id user-id | user-name user-name }

Required

Execute this command in user view.

8.4.4 Configuration Example

I. Network requirements

Only the users sourced from the IP address of 10.110.100.52 are permitted to access the switch.

II. Network diagram

Figure 8-3 Network diagram for controlling Web users using ACLs

III. Configuration procedure

# Define a basic ACL.

<H3C> system-view

[H3C] acl number 2030 match-order config

[H3C-acl-basic-2030] rule 1 permit source 10.110.100.52 0

[H3C-acl-basic-2030] rule 2 deny source any

# Apply the ACL to only permit the Web users sourced from the IP address of 10.110.100.52 to access the switch.

[H3C] ip http acl 2030

H3C S5500-SI Series Ethernet Switches Operation Manual(V1.01)

Chapter 2 Logging In Through the Console Port

I. Network requirements

II. Network diagram

III. Configuration procedure

I. Network requirements

II. Network diagram

III. Configuration procedure

I. Network requirements

II. Network diagram

III. Configuration procedure

Chapter 3 Logging In Through Telnet

I. Network requirements

II. Network diagram

III. Configuration procedure

I. Network requirements

II. Network diagram

III. Configuration procedure

I. Network requirements

II. Network diagram

III. Configuration procedure

Chapter 4 Logging in Using Modem

4.1 Introduction

I. Configuration on switch when the authentication mode is none

II. Configuration on switch when the authentication mode is password

III. Configuration on switch when the authentication mode is scheme

5.3 Web Server Shutdown/Startup

I. Configuration in user view

7.3 Displaying the source IP address/Interface Specified for Telnet Packets

I. Network requirements

II. Network diagram

III. Configuration procedure

I. Network requirements

II. Network diagram

III. Configuration procedure

8.4 Controlling Web Users by Source IP Address

I. Network requirements

II. Network diagram

III. Configuration procedure

Cloud & AI

InterConnect

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Resources

Partner Business Management

Company Information

News & Events

Contact Us