Logging in to the CLI:

·     Logging in through the console/AUX port locally

By default, login through the console port is enabled, no username or password is required, and the user role network-admin is assigned. After login, configure password or scheme authentication mode to improve device security.

By default, login through the AUX port is enabled and requires a password, but no password is configured.

To use the AUX port for login, perform the following tasks:

·     Log in through any other method and configure a password for password authentication. You can also change the authentication mode and configure parameters for the new authentication mode.

·     Assign a user role (network-operator by default).

·     Logging in through Telnet

By default, Telnet login is disabled.

To enable Telnet login, perform the following tasks:

·     Enable the Telnet server feature.

·     Assign an IP address to a Layer 3 interface and make sure the interface and the Telnet client can reach each other.

·     Configure an authentication mode for VTY login users. By default, password authentication is used but no password is configured.

·     Assign a user role to VTY login users (network-operator by default).

·     Logging in through SSH

By default, SSH login is disabled.

To enable SSH login, perform the following tasks:

·     Enable the SSH server feature and configure SSH attributes.

·     Assign an IP address to a Layer 3 interface and make sure the interface and the SSH client can reach each other.

·     Configure scheme authentication for VTY login users (password authentication by default).

·     Assign a user role to VTY login users (network-operator by default).

Accessing the device through SNMP

By default, SNMP access is disabled.

To enable SNMP access, perform the following tasks:

·     Assign an IP address to a Layer 3 interface, and make sure the interface and the NMS can reach each other.

·     Configure SNMP basic parameters.

Console line

Console port.

AUX line

AUX port.

Virtual type terminal (VTY) line

Telnet or SSH.

None

Set the authentication mode to none.

Password

1.     Set the authentication mode to password.

2.     Set a password.

Scheme

1.     Set the authentication mode to scheme.

2.     Configure login authentication methods in ISP domain view. For more information, see Security Configuration Guide.

(Required.) Configuring login authentication:

·     Disabling authentication for console/AUX login

·     Configuring password authentication for console/AUX login

·     Configuring scheme authentication for console/AUX login

Configure one authentication mode as required.

In FIPS mode, only the scheme authentication mode is supported.

(Optional.) Configuring common console/AUX line settings

N/A

1.     Enter system view.

system-view

N/A

2.     Enter console/AUX line view or class view.

·     Enter console/AUX line view:
line { aux | console } first-number [ last-number ]

·     Enter console/AUX line class view:
line class { aux | console }

A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.

3.     Disable authentication.

authentication-mode none

By default, authentication is disabled for the console line and password authentication is enabled for the AUX line.

4.     Assign a user role.

user-role role-name

The default is as follows:

·     network-admin for a console line user of the default MDC.

·     network-operator for an AUX line user of the default MDC.

Non-default MDCs do not support console or AUX login.

1.     Enter system view.

system-view

N/A

2.     Enter console/AUX line view or class view.

·     Enter console/AUX line view:
line { aux | console } first-number [ last-number ]

·     Enter console/AUX line class view:
line class { aux | console }

A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.

3.     Enable password authentication.

authentication-mode password

By default, authentication is disabled for the console line and password authentication is enabled for the AUX line.

4.     Set a password.

set authentication password { hash | simple } password

By default, no password is set.

5.     Assign a user role.

user-role role-name

The default is as follows:

·     network-admin for a console line user of the default MDC.

·     network-operator for an AUX line user of the default MDC.

Non-default MDCs do not support console or AUX login.

1.     Enter system view.

system-view

N/A

2.     Enter console/AUX line view or class view.

·     Enter console/AUX line view:
line { aux | console } first-number [ last-number ]

·     Enter console/AUX line class view:
line class { aux | console }

A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.

3.     Enable scheme authentication.

authentication-mode scheme

By default, authentication is disabled for the console line and password authentication is enabled for the AUX line.

1.     Enter system view.

system-view

N/A

2.     Enter console/AUX line view or class view.

·     Enter console/AUX line view:
line { aux | console } first-number [ last-number ]

·     Enter console/AUX line class view:
line class { aux | console }

A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.

3.     Set the baud rate.

speed speed-value

By default, the baud rate is 9600 bps.

This command is not available in console/AUX line class view.

4.     Specify the parity check mode.

parity { even | mark | none | odd | space }

By default, the parity check mode is none, and no parity check is performed.

This command is not available in console/AUX line class view.

5.     Specify the number of stop bits.

stopbits { 1 | 1.5 | 2 }

The default is 1.

Stop bits indicate the end of a character. The more the stop bits, the slower the transmission.

This command is not available in console/AUX line class view.

6.     Specify the number of data bits for each character.

databits { 5 | 6 | 7 | 8 }

The default is 8.

Configure this command depending on the character coding type. For example, set the number of data bits to 7 for standard ASCII characters. Set the number of data bits to 8 for extended ASCII characters.

This command is not available in console/AUX line class view.

7.     Define a shortcut key for starting a terminal session.

activation-key character

By default, pressing Enter starts the terminal session.

8.     Define a shortcut key for terminating tasks.

escape-key { character | default }

By default, pressing Ctrl+C terminates a task.

9.     Configure the flow control mode.

flow-control { hardware | none | software }

This command is not available in console/AUX line class view.

10.     Specify the terminal display type.

terminal type { ansi | vt100 }

By default, the terminal display type is ANSI.

The device supports two terminal display types: ANSI and VT100. H3C recommends that you set the display type to VT100 on both the device and the configuration terminal. If either side uses the ANSI type, a display problem such as cursor positioning error might occur when a command line has more than 80 characters.

11.     Set the maximum number of lines to be displayed on a screen.

screen-length screen-length

By default, a screen displays up to 24 lines.

To disable pausing between screens of output, set the value to 0.

12.     Set the size of the command history buffer.

history-command max-size value

By default, the buffer saves up to 10 history commands.

13.     Set the session idle timeout.

idle-timeout minutes [ seconds ]

The default is 10 minutes.

If there is no interaction between the device and the user within the idle timeout, the system automatically terminates the user connection on the user line.

If you set the idle timeout to 0, the session will not be aged out.

14.     Specify the command to be automatically executed for login users on the lines.

auto-execute command command

By default, no command is specified for a user line to be automatically executed.

The device will automatically execute the specified command when a user logs in through the user line, and close the user connection after the command is executed.

This command is not available in console line view or console line class view.

15.     Disable the terminal service.

undo shell

Be default, the terminal service is enabled on all user lines.

This command is not available in console line view or console line class view.

(Required.) Configuring login authentication:

·     Disabling authentication for Telnet login

·     Configuring password authentication for Telnet login

·     Configuring scheme authentication for Telnet login

Configure one authentication mode as required.

(Optional.) Setting the maximum number of concurrent Telnet users

N/A

(Optional.) Setting the DSCP value for outgoing Telnet packets

N/A

(Optional.) Configuring common VTY line settings

N/A

16.     Enter system view.

system-view

N/A

17.     Enable Telnet server.

telnet server enable

By default, the Telnet server feature is disabled.

18.     Enter VTY line view or class view.

·     Enter VTY line view:
line vty first-number [ last-number ]

·     Enter VTY line class view:
line class vty

A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.

19.     Disable authentication.

authentication-mode none

By default, password authentication is enabled for VTY lines.

In VTY line view, this command is associated with the protocol inbound command. If you specify a non-default value for only one of the two commands in VTY line view, the other command uses the default setting, regardless of the setting in VTY line class view.

20.     (Optional.) Assign a user role.

user-role role-name

By default, a VTY line user of the default MDC is assigned the user role network-operator. A VTY line user of a non-default MDC is assigned the user role mdc-operator.

1.     Enter system view.

system-view

N/A

2.     Enable Telnet server.

telnet server enable

By default, the Telnet server feature is disabled.

3.     Enter VTY line view or class view.

·     Enter VTY line view:
line vty first-number [ last-number ]

·     Enter VTY line class view:
line class vty

A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.

4.     Enable password authentication.

authentication-mode password

By default, password authentication is enabled for VTY lines.

In VTY line view, this command is associated with the protocol inbound command. If you specify a non-default value for only one of the two commands in VTY line view, the other command uses the default setting, regardless of the setting in VTY line class view.

5.     Set a password.

set authentication password { hash | simple } password

By default, no password is set.

6.     (Optional.) Assign a user role.

user-role role-name

By default, a VTY line user of the default MDC is assigned the user role network-operator. A VTY line user of a non-default MDC is assigned the user role mdc-operator.

1.     Enter system view.

system-view

N/A

2.     Enable Telnet server.

telnet server enable

By default, the Telnet server feature is disabled.

3.     Enter VTY line view or class view.

·     Enter VTY line view:
line vty first-number [ last-number ]

·     Enter VTY line class view:
line class vty

A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.

4.     Enable scheme authentication.

authentication-mode scheme

By default, password authentication is enabled for VTY lines.

In VTY line view, this command is associated with the protocol inbound command. If you specify a non-default value for only one of the two commands in VTY line view, the other command uses the default setting, regardless of the setting in VTY line class view.

1.     Enter system view.

system-view

N/A

2.     Set the maximum number of concurrent Telnet users.

aaa session-limit telnet max-sessions

By default, the maximum number of concurrent Telnet users is 16.

Changing this setting does not affect users who are currently online. If the current number of online Telnet users is equal to or greater than the new setting, no additional Telnet users can log in until online users log out.

For more information about this command, see Security Command Reference.

1.     Enter system view.

system-view

N/A

2.     Set the DSCP value for outgoing Telnet packets.

·     For a Telnet server running IPv4:
telnet server dscp dscp-value

·     For a Telnet server running IPv6:
telnet server ipv6 dscp dscp-value

By default, the DSCP value is 48.

1.     Enter system view.

system-view

N/A

2.     Enter VTY line view or class view.

·     Enter VTY line view:
line vty first-number [ last-number ]

·     Enter VTY line class view:
line class vty

A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.

3.     Enable the terminal service.

shell

By default, the terminal service is enabled.

4.     Specify the protocols for the user lines to support.

protocol inbound { all | pad | ssh | telnet }

By default, Telnet and SSH are supported.

A protocol change does not take effect for current online users. It takes effect only for new login users.

In VTY line view, this command is associated with the authentication-mode command. If you specify a non-default value for only one of the two commands in VTY line view, the other command uses the default setting, regardless of the setting in VTY line class view.

5.     Define a shortcut key for terminating tasks.

escape-key { character | default }

By default, pressing Ctrl+C terminates a task.

6.     Specify the terminal display type.

terminal type { ansi | vt100 }

By default, the terminal display type is ANSI.

7.     Set the maximum number of lines to be displayed on a screen.

screen-length screen-length

By default, up to 24 lines is displayed on a screen.

To disable pausing between screens of output, set the value to 0.

8.     Set the size of command history buffer.

history-command max-size value

By default, the buffer saves 10 history commands.

9.     Set the session idle timeout.

idle-timeout minutes [ seconds ]

By default, the session idle timeout is 10 minutes for all user lines.

If there is no interaction between the device and the user within the idle timeout, the system automatically terminates the user connection on the user line.

If you set the idle timeout to 0, the session will not be aged out.

10.     Specify the command to be automatically executed for login users on the user lines.

auto-execute command command

By default, no automatically executed command is specified.

 IMPORTANT:

Before you configure this command and save the configuration, make sure you can access the CLI through a different user line.

1.     Enter system view.

system-view

N/A

2.     (Optional.) Specify the source IPv4 address or source interface for outgoing Telnet packets.

telnet client source { interface interface-type interface-number | ip ip-address }

By default, no source IPv4 address or source interface is specified, and the primary IPv4 address of the outbound interface is used as the source address for outgoing Telnet packets.

3.     Exit to user view.

quit

N/A

4.     Use the device to log in to a Telnet server.

·     Log in to an IPv4 Telnet server:
telnet remote-host [ service-port ] [ vpn-instance vpn-instance-name ] [ source { interface interface-type interface-number | ip ip-address } ] [ dscp dscp-value ]

·     Log in to an IPv6 Telnet server:
telnet ipv6 remote-host [ -i interface-type interface-number ] [ port-number ] [ vpn-instance vpn-instance-name ] [ dscp dscp-value ]

N/A

1.     Enter system view.

system-view

N/A

2.     Create local key pairs.

public-key local create { dsa | rsa }

By default, no local key pairs are created.

3.     Enable SSH server.

ssh server enable

By default, SSH server is disabled.

4.     (Optional.) Create an SSH user and specify the authentication mode.

·     In non-FIPS mode:
ssh user username service-type stelnet authentication-type { password | { any | password-publickey | publickey } assign publickey keyname }

·     In FIPS mode:
ssh user username service-type stelnet authentication-type { password | password-publickey assign publickey keyname }

By default, no SSH user is configured on the device.

5.     Enter VTY line view or class view.

·     Enter VTY line view:
line vty first-number [ last-number ]

·     Enter VTY line class view:
line class vty

A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.

6.     Enable scheme authentication.

authentication-mode scheme

In non-FIPS mode, password authentication is enabled for VTY lines by default.

In FIPS mode, scheme authentication is enabled for VTY lines by default.

In VTY line view, this command is associated with the protocol inbound command. If you specify a non-default value for only one of the two commands in VTY line view, the other command uses the default setting, regardless of the setting in VTY line class view.

7.     (Optional.) Specify the protocols for  the user lines to support.

·      In non-FIPS mode:
protocol inbound { all | pad | ssh | telnet }

·     In FIPS mode:
protocol inbound ssh

In non-FIPS mode, Telnet and SSH are supported by default.

In FIPS mode, SSH is supported by default.

A protocol change does not take effect for current online users. It takes effect only for new login users.

In VTY line view, this command is associated with the authentication-mode command. If you specify a non-default value for only one of the two commands in VTY line view, the other command uses the default setting, regardless of the setting in VTY line class view.

8.     (Optional.) Set the maximum number of concurrent SSH users.

aaa session-limit ssh max-sessions

By default, the maximum number of concurrent SSH users is 16.

Changing this setting does not affect users who are currently online. If the current number of online SSH users is equal to or greater than the new setting, no additional SSH users can log in until online users log out.

For more information about this command, see Security Command Reference.

9.     Exit to system view.

quit

N/A

10.     (Optional.) Configure common settings for VTY lines.

See "Configuring common VTY line settings."

N/A

Log in to an IPv4 SSH server.

ssh2 server

Log in to an IPv6 SSH server.

ssh2 ipv6 server

Display online CLI user information.

display users [ all ]

N/A

Display user line information.

display line [ num1 | { aux | console | vty } num2 ] [ summary ]

N/A

Display the source address or interface for outgoing Telnet packets when the device acts as a Telnet client.

display telnet client

N/A

Release a user line.

free line { num1 | { aux | console | vty } num2 }

Multiple users can log in to the device to simultaneously configure the device. When necessary, you can execute this command to release some connections.

You cannot use this command to release the connection you are using.

Lock the current user line.

lock

By default, the system does not lock any user lines.

This command is not supported in FIPS mode.

Send messages to user lines.

send { all | num1 | { aux | console | vty } num2 }

N/A

1.     Enter system view.

system-view

N/A

2.     Enable the SNMP agent.

snmp-agent

By default, the SNMP agent is disabled.

3.     (Optional.) Create or update MIB view information.

snmp-agent mib-view { excluded | included } view-name oid-tree [ mask mask-value ]

By default, the device has four views, all of which are named ViewDefault.

·     View 1 includes MIB subtree iso.

·     View 2 does not include subtree snmpUsmMIB.

·     View 3 does not include subtree snmpVacmMIB.

·     View 4 does not include subtree snmpModules.18.

4.     Create an SNMPv3 group.

snmp-agent group v3 group-name [ authentication | privacy ] [ read-view view-name ] [ write-view view-name ] [ notify-view view-name ] [ acl acl-number | acl ipv6 ipv6-acl-number ] *

By default, no SNMPv3 group exists.

5.     Create an SNMPv3 user.

snmp-agent usm-user v3 user-name group-name [ remote { ip-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ] ] [ { cipher | simple } authentication-mode { md5 | sha } auth-password [ privacy-mode { aes128 | des56 } priv-password ] ] [ acl acl-number | acl ipv6 ipv6-acl-number ] *

To send informs to an SNMPv3 NMS, you must use the remote ip-address option to specify the IP address of the NMS.

1.     Enter system view.

system-view

N/A

2.     Enable the SNMP agent.

snmp-agent

By default, the SNMP agent is disabled.

3.     (Optional.) Create or update MIB view information.

snmp-agent mib-view { excluded | included } view-name oid-tree [ mask mask-value ]

By default, the device has four views, all of which are named ViewDefault.

·     View 1 includes MIB subtree iso.

·     View 2 does not include subtree snmpUsmMIB.

·     View 3 does not include subtree snmpVacmMIB.

·     View 4 does not include subtree snmpModules.18.

4.     Configure the SNMP access right.

·     (Method 1.) Specify the SNMP NMS access right directly by configuring an SNMP community:
snmp-agent community { read | write } community-name [ mib-view view-name ] [ acl acl-number | acl ipv6 ipv6-acl-number ] *

·     (Method 2.) Configure an SNMP group and add a user to the SNMP group:

a.     snmp-agent group { v1 | v2c } group-name [ read-view view-name ] [ write-view view-name ] [ notify-view view-name ] [ acl acl-number | acl ipv6 ipv6-acl-number ] *

b.     snmp-agent usm-user { v1 | v2c } user-name group-name [ acl acl-number | acl ipv6 ipv6-acl-number ] *

The username in method 2 is equivalent to the community name used in method 1, and must be the same as the community name configured on the NMS.

By default, no SNMP group or SNMP community exists.

1.     Enter system view.

system-view

N/A

2.     Apply an ACL to filter Telnet logins.

·     telnet server acl acl-number

·     telnet server ipv6 acl [ ipv6 ] acl-number

By default, no ACL is used to filter Telnet logins.

1.     Enter system view.

system-view

N/A

2.     Apply an ACL to filter SSH logins.

·     ssh server acl acl-number

·     ssh server ipv6 acl [ ipv6 ] acl-number

By default, no ACL is used to filter SSH logins.

For more information about these two commands, see Security Command Reference.

1.     Enter system view.

system-view

N/A

2.     Apply the ACL to an SNMP community, group, or user.

·     SNMP community:
snmp-agent community { read | write } community-name [ mib-view view-name ] [ acl acl-number | acl ipv6 ipv6-acl-number ] *

·     SNMPv1/v2c group:
snmp-agent group { v1 | v2c } group-name [ read-view view-name ] [ write-view view-name ] [ notify-view view-name ] [ acl acl-number | acl ipv6 ipv6-acl-number ] *

·     SNMPv3 group:
snmp-agent group v3 group-name [ authentication | privacy ] [ read-view view-name ] [ write-view view-name ] [ notify-view view-name ] [ acl acl-number | acl ipv6 ipv6-acl-number ] *

·     SNMPv1/v2c user:
snmp-agent usm-user { v1 | v2c } user-name group-name [ acl acl-number | acl ipv6 ipv6-acl-number ] *

·     SNMPv3 user:
snmp-agent usm-user v3 user-name group-name [ remote { ip-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ] ] [ { cipher | simple } authentication-mode { md5 | sha } auth-password [ privacy-mode { aes128 | des56 } priv-password ] ] [ acl acl-number | acl ipv6 ipv6-acl-number ] *

For more information about SNMP, see Network Management and Monitoring Configuration Guide.

1.     Enter system view.

system-view

N/A

2.     Enter user line view or user line class view.

·     Enter user line view:
line { first-number1 [ last-number1 ] | { aux | console | vty } first-number2 [ last-number2 ] }

·     Enter user line class view:
line class { aux | console | vty }

A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.

3.     Enable scheme authentication.

authentication-mode scheme

By default, authentication is disabled for the console line and password authentication is enabled for the AUX line and VTY lines.

In VTY line view, this command is associated with the protocol inbound command. If you specify a non-default value for only one of the two commands in VTY line view, the other command uses the default setting, regardless of the setting in VTY line class view.

4.     Enable command authorization.

command authorization

By default, command authorization is disabled, and the commands available for a user only depend on the user role.

If the command authorization command is configured in user line class view, command authorization is enabled on all user lines in the class. You cannot configure the undo command authorization command in the view of a user line in the class.