Logging in to the CLI:

Logging in through OAP

By default, login through OAP is enabled, no username or password is required, and the user privilege level is 3.

Logging in through Telnet

By default, Telnet service is enabled. The default Telnet settings are as follows:

·      Username admin.

·      Password admin.

·      IP address 192.168.0.101.

·      User privilege level 3.

Logging in through SSH

By default, SSH service is disabled. To use SSH service, complete the following configuration tasks:

·      Enable the SSH function and configure SSH attributes.

·      Assign an IP address to a VLAN interface (the default IP address for VLAN-interface 1 is 192.168.0.101) and make sure the interface and the SSH client can reach each other.

·      Enable scheme authentication for VTY login users (scheme authentication is enabled by default).

·      Specify a user privilege level for VTY login users (0 by default).

Logging in to the Web interface

By default, Web login is enabled. The default Web login settings are as follows:

·      Username admin.

·      Password admin.

·      IP address 192.168.0.101.

·      User privilege level 3.

Logging in through SNMP

By default, SNMP login is disabled. To use SNMP service, complete the following configuration tasks:

·      Assign an IP address to a VLAN interface (the default IP address for VLAN-interface 1 is 192.168.0.101), and make sure the interface and the NMS can reach each other.

·      Configure SNMP basic parameters.

AUX user interface

OAP

Virtual type terminal (VTY) user interface

Telnet or SSH

Log in to the switching engine from the access controller engine.

oap connect slot 0

Available in user view of the access controller engine.

1.       Enter system view.

system-view

N/A

2.       Configure a management IP address.

oap management-ip ip-address slot slot-number

The defaults are as follows:

·      192.168.0.100/24 for the access controller engine.

·      192.168.0.101/24 for the switching engine.

Reset the OAP system

oap reboot slot 0

Available in the user view of the access controller engine.

Telnet server

Assign an IP address to a Layer 3 interface, and make sure the Telnet server and client can reach each other.

Configure the authentication mode and other settings.

Telnet client

Run the Telnet client program.

Obtain the IP address of the Layer 3 interface on the server.

Configure other settings.

None

Set the authentication mode to none for the VTY user interface.

"Configuring none authentication for Telnet login"

Password

Enable password authentication on the VTY user interface.

Set a password.

"Configuring password authentication for Telnet login"

AAA

Enable scheme authentication on the VTY user interface.

Configure local or remote authentication settings.

To configure local authentication:

1.       Configure a local user and specify the password.

2.       Configure the device to use local authentication.

To configure remote authentication:

1.       Configure the RADIUS or HWTACACS scheme on the device.

2.       Configure the username and password on the AAA server.

3.       Configure the device to use the scheme for user authentication.

"Configuring scheme authentication for Telnet login"

1.       Enter system view.

system-view

N/A

2.       Enable Telnet server.

telnet server enable

By default, the Telnet server is enabled.

3.       Enter one or multiple VTY user interface views.

user-interface vty first-number [ last-number ]

N/A

4.       Enable the none authentication mode.

authentication-mode none

By default, authentication mode for VTY user interfaces is password.

5.       Configure the command level for login users on the current user interfaces.

user privilege level level

By default, the default command level is 0 for VTY user interfaces.

6.       Configure common settings for the VTY user interfaces.

See "Configuring common settings for VTY user interfaces (optional)."

Optional.

1.       Enter system view.

system-view

N/A

2.       Enable Telnet.

telnet server enable

By default, the Telnet service is enabled.

3.       Enter one or multiple VTY user interface views.

user-interface vty first-number [ last-number ]

N/A

4.       Enable password authentication.

authentication-mode password

By default, password authentication is enabled for VTY user interfaces.

5.       Set a password.

set authentication password [ hash ] { cipher | simple } password

By default, no password is set.

6.       Configure the user privilege level for login users.

user privilege level level

The default level is 0.

7.       Configure common settings for VTY user interfaces.

See "Configuring common settings for VTY user interfaces (optional)."

Optional.

1.       Enter system view.

system-view

N/A

2.       Enable Telnet.

telnet server enable

By default, the Telnet service is enabled.

3.       Enter one or multiple VTY user interface views.

user-interface vty first-number [ last-number ]

N/A

4.       Enable scheme authentication.

authentication-mode scheme

By default, local authentication is adopted.

If local authentication is used and password control is enabled, a user must change the password after being logged in for the first time. If NTP synchronization is also configured, H3C recommends waiting for 10 minutes before changing the password to make sure the NTP synchronization is finished before the password is created.

5.       Enable command authorization.

command authorization

Optional.

By default, command authorization is disabled. The commands available for a user only depend on the user privilege level.

If command authorization is enabled, a command is available only if the user has the commensurate user privilege level and is authorized to use the command by the AAA scheme.

6.       Enable command accounting.

command accounting

Optional.

By default, command accounting is disabled. The accounting server does not record the commands executed by users.

Command accounting allows the HWTACACS server to record all executed commands that are supported by the device, regardless of the command execution result. This function helps control and monitor user behaviors on the device. If command accounting is enabled and command authorization is not enabled, every executed command is recorded on the HWTACACS server. If both command accounting and command authorization are enabled, only the authorized and executed commands are recorded on the HWTACACS server.

7.       Exit to system view.

quit

N/A

8.       Apply an AAA authentication scheme to the intended domain.

a.    Enter ISP domain view:
domain domain-name

b.    Apply an AAA scheme to the domain:
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme radius-scheme-name [ local ] }

c.     Exit to system view:
quit

Optional.

By default, local authentication is used.

For local authentication, configure local user accounts.

For RADIUS or HWTACACS authentication, configure the RADIUS or HWTACACS scheme on the device and configure authentication settings (including the username and password) on the server.

For more information about AAA configuration, see Security Configuration Guide.

9.       Create a local user and enter local user view.

local-user user-name

By default, no local user exists.

10.    Set a password.

password { cipher | simple } password

By default, no password is set.

11.    Specify the command level of the local user.

authorization-attribute level level

Optional.

By default, the command level is 0.

12.    Specify Telnet service for the local user.

service-type telnet

By default, no service type is specified.

13.    Exit to system view.

quit

N/A

14.    Configure common settings for VTY user interfaces.

See "Configuring common settings for VTY user interfaces (optional)."

Optional.

1.       Enter system view.

system-view

N/A

2.       Enter one or multiple VTY user interface views.

user-interface vty first-number [ last-number ]

N/A

3.       Enable the terminal service.

shell

Optional.

By default, terminal service is enabled.

4.       Enable the user interfaces to support Telnet, SSH, or both of them.

protocol inbound { all | ssh | telnet }

Optional.

By default, both Telnet and SSH are supported.

The configuration takes effect the next time you log in.

5.       Define a shortcut key for terminating tasks.

escape-key { default | character }

Optional.

By default, pressing Ctrl+C terminates a task.

6.       Configure the type of terminal display.

terminal type { ansi | vt100 }

Optional.

By default, the terminal display type is ANSI.

7.       Set the maximum number of lines to be displayed on a screen.

screen-length screen-length

Optional.

By default, a screen displays 24 lines.

A value of 0 disables the function.

8.       Set the size of command history buffer.

history-command max-size value

Optional.

By default, the buffer saves 10 history commands.

9.       Set the idle-timeout timer.

idle-timeout minutes [ seconds ]

Optional.

The default idle-timeout is 10 minutes for all user interfaces.

The system automatically terminates the user's connection if there is no information interaction between the device and the user within the timeout time.

Setting idle-timeout to 0 disables the timer.

10.    Specify a command to be automatically executed when a user logs in to the user interfaces.

auto-execute command command

Optional.

By default, no automatically executed command is specified.

The command auto-execute function is typically used for redirecting a Telnet user to a specific host. After executing the specified command and performing the incurred task, the system automatically disconnect the Telnet session.

1.       Enter system view.

system-view

N/A

2.       Set the DSCP value for outgoing Telnet packets when the device acts as the Telnet server.

telnet server dscp dscp-value

The default DSCP value is 48.

1.       Enter system view.

system-view

N/A

2.       Specify a source IPv4 address or source interface for outgoing Telnet packets.

telnet client source { interface interface-type interface-number | ip ip-address }

Optional.

By default, no source IPv4 address or source interface is specified. The IP address of the outbound interface is used as the source IPv4 address.

3.       Exit to user view.

quit

N/A

4.       Use the device to log in to a Telnet server.

telnet remote-host [ service-port ] [ source { interface interface-type interface-number | ip ip-address } ]

N/A

1.       Enter system view.

system-view

N/A

2.       Set the DSCP value for outgoing Telnet packets when the device acts as the Telnet client.

telnet client dscp dscp-value

The default DSCP value is 16.

SSH server

Assign an IP address to a Layer 3 interface, and make sure the interface and the client can reach each other.

Configure the authentication mode and other settings.

SSH client

If the host operates as an SSH client, run the SSH client program on the host.

Obtain the IP address of the Layer 3 interface on the server.

1.       Enter system view.

system-view

N/A

2.       Create local key pairs.

public-key local create { dsa | rsa }

By default, no local key pairs are created.

3.       Enable SSH server.

ssh server enable

By default, SSH server is disabled.

4.       Enter one or more VTY user interface views.

user-interface vty first-number [ last-number ]

N/A

5.       Enable scheme authentication.

authentication-mode scheme

By default, password authentication is enabled on VTY user interfaces.

6.       Enable the user interfaces to support Telnet, SSH, or both of them.

protocol inbound { all | ssh | telnet }

Optional.

By default, both Telnet and SSH are supported.

7.       Enable command authorization.

command authorization

Optional.

By default, command authorization is disabled. The commands available for a user only depend on the user privilege level.

If command authorization is enabled, a command is available only if the user has the commensurate user privilege level and is authorized to use the command by the AAA scheme.

8.       Enable command accounting.

command accounting

Optional.

By default, command accounting is disabled. The accounting server does not record the commands executed by users.

Command accounting allows the HWTACACS server to record all executed commands that are supported by the device, regardless of the command execution result. This function helps control and monitor user behaviors on the device. If command accounting is enabled and command authorization is not enabled, every executed command is recorded on the HWTACACS server. If both command accounting and command authorization are enabled, only the authorized and executed commands are recorded on the HWTACACS server.

9.       Exit to system view.

quit

N/A

10.    Apply an AAA authentication scheme to the intended domain.

a.    Enter the ISP domain view:
domain domain-name

b.    Apply the specified AAA scheme to the domain:
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme radius-scheme-name [ local ] }

c.     Exit to system view:
quit

Optional.

For local authentication, configure local user accounts.

For RADIUS or HWTACACS authentication, configure the RADIUS or HWTACACS scheme on the device and configure authentication settings (including the username and password) on the server.

For more information about AAA configuration, see Security Configuration Guide.

11.    Create a local user and enter local user view.

local-user user-name

By default, no local user exists.

12.    Set a password for the local user.

password { cipher | simple } password

By default, no password is set.

13.    Specify the command level of the user.

authorization-attribute level level

Optional.

By default, the command level is 0.

14.    Specify SSH service for the user.

service-type ssh

By default, no service type is specified.

15.    Exit to system view.

quit

N/A

16.    Create an SSH user, and specify the authentication mode for the SSH user.

ssh user username service-type stelnet authentication-type { password | { any | password-publickey | publickey } assign publickey keyname }

N/A

17.    Configure common settings for VTY user interfaces.

See "Configuring common settings for VTY user interfaces (optional)."

Optional.

Log in to an IPv4 SSH server.

ssh2 server

The server argument represents the IPv4 address or host name of the server.

Display information about the user interfaces that are being used.

display users [ | { begin | exclude | include } regular-expression ]

Available in any view.

Display information about all user interfaces the device supports.

display users all [ | { begin | exclude | include } regular-expression ]

Available in any view.

Display user interface information.

display user-interface [ num1 | { aux | vty } num2 ] [ summary ] [ | { begin | exclude | include } regular-expression ]

Available in any view.

Display the configuration of the device when it serves as a Telnet client.

display telnet client configuration [ | { begin | exclude | include } regular-expression ]

Available in any view.

Release a user interface.

free user-interface { num1 | { aux | vty } num2 }

Available in user view.

Multiple users can log in to the system to simultaneously configure the device. You can execute the command to release the connections established on the specified user interfaces.

You cannot use this command to release the connection you are using.

Lock the current user interface.

lock

Available in user view.

By default, the system does not automatically lock a user interface.

Send messages to the specified user interfaces.

send { all | num1 | { aux | vty } num2 }

Available in user view.

Device

Configure an IP address for a Layer 3 interface.

Configuring routes to make sure the interface and the PC can reach each other.

Perform either or both of the following tasks:

·      Configuring HTTP login

·      Configuring HTTPS login

PC

Install a Web browser.

Obtain the IP address of the device's Layer 3 interface.

1.       Specify a fixed verification code for Web login.

web captcha verification-code

Optional.

By default, a Web user must enter the verification code indicated on the login page to log in.

This command is available in user view.

2.       Enter system view.

system-view

N/A

3.       Enable the HTTP service.

ip http enable

By default, HTTP service is enabled.

4.       Configure the HTTP service port number.

ip http port port-number

Optional.

The default HTTP service port is 80.

If you execute the command multiple times, the last one takes effect.

5.       Associate the HTTP service with an ACL.

ip http acl acl-number

Optional.

By default, the HTTP service is not associated with any ACL.

Associating the HTTP service with an ACL enables the device to allow only clients permitted by the ACL to access the device.

6.       Set the Web connection timeout time.

web idle-timeout minutes

Optional.

By default, the Web connection timeout time is 10 minutes.

7.       Set the size of the buffer for Web login logging.

web logbuffer size pieces

Optional.

By default, the buffer can store up to 512 logs.

8.       Create a local user and enter local user view.

local-user user-name

By default, no local user is configured.

9.       Configure a password for the local user.

password { cipher | simple } password

By default, no password is configured for the local user.

10.    Specify the command level of the local user.

authorization-attribute level level

No command level is configured for the local user.

11.    Specify the Telnet service type for the local user.

service-type web

By default, no service type is configured for the local user.

12.    Set the DSCP value for IP to use for HTTP packets.

ip http dscp dscp-value

Optional.

The default DSCP value is 16.

13.    Exit to system view.

quit

N/A

14.    Create a VLAN interface and enter its view.

interface vlan-interface vlan-interface-id

If the VLAN interface already exists, the command enters its view.

15.    Assign an IP address and subnet mask to the interface.

ip address ip-address { mask | mask-length }

By default, no IP address is assigned to the interface.

1.       Specify a fixed verification code for Web login.

web captcha verification-code

Optional.

By default, a Web user must enter the verification code indicated on the login page to log in.

This command is available in user view.

2.       Enter system view.

system-view

N/A

3.       Associate the HTTPS service with an SSL server policy.

ip https ssl-server-policy policy-name

Optional.

By default, the HTTPS service is not associated with any SSL server policy, and the device uses a self-signed certificate for authentication.

If you disable the HTTPS service, the system automatically de-associates the HTTPS service from the SSL service policy. Before re-enabling the HTTPS service, associate the HTTPS service with an SSL server policy first.

If the HTTPS service has been enabled, any changes to the SSL server policy associated with the HTTP service that is enabled do not take effect.

4.       Enable the HTTPS service.

ip https enable

By default, HTTPS is disabled.

Enabling the HTTPS service triggers an SSL handshake negotiation process. During the process, if the local certificate of the device exists, the SSL negotiation succeeds, and the HTTPS service can be started properly. If no local certificate exists, a certificate application process will be triggered by the SSL negotiation. Because the application process takes much time, the SSL negotiation often fails and the HTTPS service cannot be started normally. In that case, execute the ip https enable command multiple times to start the HTTPS service.

5.       Associate the HTTPS service with a certificate attribute-based access control policy.

ip https certificate access-control-policy policy-name

Optional.

By default, the HTTPS service is not associated with any certificate-based attribute access control policy.

Associating the HTTPS service with a certificate-based attribute access control policy enables the device to control the access rights of clients.

You must configure the client-verify enable command in the associated SSL server policy. If not, no clients can log in to the device.

The associated SSL server policy must contain at least one permit rule. Otherwise, no clients can log in to the device.

For more information about certificate attribute-based access control policies, see Security Configuration Guide.

6.       Specify the HTTPS service port number.

ip https port port-number

Optional.

The default HTTPS service port is 443.

7.       Associate the HTTPS service with an ACL.

ip https acl acl-number

By default, the HTTPS service is not associated with any ACL.

Associating the HTTPS service with an ACL enables the device to allow only clients permitted by the ACL to access the device.

8.       Specify the authentication mode for users trying to log in to the device through HTTPS.

web https-authorization mode { auto | manual }

Optional.

By default, a user must enter the correct username and password to log in through HTTPS.

When the auto mode is enabled:

·      If the user's PKI certificate is correct and not expired, the CN field in the certificate is used as the username to perform AAA authentication. If the authentication succeeds, the user automatically enters the Web interface of the device.

·      If the user's PKI certificate is correct and not expired, but the AAA authentication fails, the device shows the Web login page. The user can log in to the device after entering correct username and password.

9.       Set the Web user connection timeout time.

web idle-timeout minutes

Optional.

By default, the Web connection timeout time is 10 minutes.

10.    Set the size of the buffer for Web login logging.

web logbuffer size pieces

Optional.

By default, the buffer can store up to 512 logs.

11.    Create a local user and enter local user view.

local-user user-name

By default, no local user is configured.

12.    Configure a password for the local user.

password { cipher | simple } password

By default, no password is configured for the local user.

13.    Specify the command level of the local user.

authorization-attribute level level

By default, no command level is configured for the local user.

14.    Specify the Web service type for the local user.

service-type web

By default, no service type is configured for the local user.

15.    Exit to system view.

quit

N/A

16.    Create a VLAN interface and enter its view.

interface vlan-interface vlan-interface-id

If the VLAN interface already exists, the command enters its view.

You could replace this VLAN interface with any other Layer 3 interface as appropriate.

17.    Assign an IP address and subnet mask to the interface.

ip address ip-address { mask | mask-length }

By default, no IP address is assigned to the interface.

Display information about Web users.

display web users [ | { begin | exclude | include } regular-expression ]

Available in any view.

Display HTTP state information.

display ip http [ | { begin | exclude | include } regular-expression ]

Available in any view.

Display HTTPS state information.

display ip https [ | { begin | exclude | include } regular-expression ]

Available in any view.

1.       Enter system view.

system-view

N/A

2.       Enable the SNMP agent.

snmp-agent

Optional.

By default, the SNMP agent is disabled.

You can enable SNMP agent with this command or any command that begins with snmp-agent.

3.       Configure an SNMP group and specify its access right.

snmp-agent group v3 group-name [ authentication | privacy ] [ read-view read-view ] [ write-view write-view ] [ notify-view notify-view ] [ acl acl-number ]

By default, no SNMP group is configured.

4.       Add a user to the SNMP group.

snmp-agent usm-user v3 user-name group-name [ [ cipher ] authentication-mode { md5 | sha } auth-password [ privacy-mode { 3des | aes128 | des56 } priv-password ] ] [ acl acl-number ]

N/A

1.       Enter system view.

system-view

N/A

2.       Enable the SNMP agent.

snmp-agent

Optional.

By default, the SNMP agent is disabled.

You can enable SNMP agent with this command or any command that begins with snmp-agent.

3.       Create or update MIB view information.

snmp-agent mib-view { excluded | included  } view-name oid-tree [ mask mask-value ]

Optional.

By default, the MIB view name is ViewDefault and OID is 1.

4.       Configure SNMP NMS access right.

·      (Approach 1) Specify the SNMP NMS access right directly by configuring an SNMP community:
snmp-agent community { read | write } community-name [ mib-view view-name ] [ acl acl-number ]

·      (Approach 2) Configure an SNMP group and add a user to the SNMP group:

a.    snmp-agent group { v1 | v2c } group-name [ read-view read-view ] [ write-view write-view ] [ notify-view notify-view ] [ acl acl-number ]

b.    snmp-agent usm-user { v1 | v2c } user-name group-name [ acl acl-number ]

Use either approach.

The direct configuration approach is for SNMPv1 or SNMPv2c. The community name configured on the NMS should be consistent with the username configured on the agent.

The indirect configuration approach is for SNMPv3.

1.       Enter system view.

system-view

N/A

2.       Create a basic ACL and enter its view, or enter the view of an existing basic ACL.

acl number acl-number [ name name ] [ match-order { config | auto } ]

By default, no basic ACL exists.

3.       Configure an ACL rule.

rule [ rule-id ] { deny | permit } [ counting | fragment | logging | source { sour-addr sour-wildcard | any } | time-range time-range-name ] *

By default, a basic ACL does not contain any rule.

4.       Exit the basic ACL view.

quit

N/A

5.       Enter user interface view.

user-interface [ type ] first-number [ last-number ]

N/A

6.       Use the ACL to control user logins by source IP address.

acl acl-number { inbound | outbound }

·      inbound: Filters incoming packets.

·      outbound: Filters outgoing packets.

1.       Enter system view.

system-view

N/A

2.       Create an advanced ACL and enter its view, or enter the view of an existing advanced ACL.

acl number acl-number [ name name ] [ match-order { config | auto } ]

By default, no advanced ACL exists.

3.       Configure an ACL rule.

rule [ rule-id ] { permit | deny } rule-string

N/A

4.       Exit advanced ACL view.

quit

N/A

5.       Enter user interface view.

user-interface [ type ] first-number [ last-number ]

N/A

6.       Use the ACL to control user logins by source and destination IP addresses.

acl acl-number { inbound | outbound }

·      inbound: Filters incoming packets.

·      outbound: Filters outgoing packets.

1.       Enter system view.

system-view

N/A

2.       Create an Ethernet frame header ACL and enter its view.

acl number acl-number [ name name ] [ match-order { config | auto } ]

By default, no Ethernet frame header ACL exists.

3.       Configure an ACL rule.

rule [ rule-id ] { permit | deny } rule-string

N/A

4.       Exit Ethernet frame header ACL view.

quit

N/A

5.       Enter user interface view.

user-interface [ type ] first-number [ last-number ]

N/A

6.       Use the ACL to control user logins by source MAC address.

acl acl-number inbound

inbound: Filters incoming packets.

1.       Enter system view.

system-view

N/A

2.       Create a basic ACL and enter its view, or enter the view of an existing basic ACL.

acl number acl-number [ name name ] [ match-order { config | auto } ]

By default, no basic ACL exists.

3.       Create an ACL rule.

rule [ rule-id ] { deny | permit } [ counting | fragment | logging | source { sour-addr sour-wildcard | any } | time-range time-range-name ] *

N/A

4.       Exit the basic ACL view.

quit

N/A

5.       Apply the ACL to an SNMP community, group or user.

·      SNMPv1/v2c community:
snmp-agent community { read | write } community-name [ mib-view view-name ] [ acl acl-number ]

·      SNMPv1/v2c group:
snmp-agent group { v1 | v2c } group-name [ read-view read-view ] [ write-view write-view ] [ notify-view notify-view ] [ acl acl-number ]

·      SNMPv3 group:
snmp-agent group v3 group-name [ authentication | privacy ] [ read-view read-view ] [ write-view write-view ] [ notify-view notify-view ] [ acl acl-number ]

·      SNMPv1/v2c user:
snmp-agent usm-user { v1 | v2c } user-name group-name [ acl acl-number ]

·      SNMPv3 user:
snmp-agent usm-user v3 user-name group-name [ [ cipher ] authentication-mode { md5 | sha } auth-password [ privacy-mode { 3des | aes128 | des56 } priv-password ] ] [ acl acl-number ]

For more information about SNMP, see Network Management and Monitoring Configuration Guide.

1.       Enter system view.

system-view

N/A

2.       Create a basic ACL and enter its view, or enter the view of an existing basic ACL.

acl number acl-number [ name name ] [ match-order { config | auto } ]

By default, no basic ACL exists.

3.       Create rules for this ACL.

rule [ rule-id ] { deny | permit } [ counting | fragment | logging | source { sour-addr sour-wildcard | any } | time-range time-range-name ] *

N/A

4.       Exit the basic ACL view.

quit

N/A

5.       Associate the HTTP service with the ACL.

ip http acl acl-number

Configure either or both of the commands.

HTTP login and HTTPS login are separate login methods. To use HTTPS login, you do not need to configure HTTP login.

6.       Associate the HTTPS service with the ACL.

ip https acl acl-number

Log off online Web users.

free web-users { all | user-id user-id | user-name user-name }

Available in user interface view.