Logging in to the CLI:

Logging in through the console port for the first time

By default, login through the console port is enabled, no username or password is required, and the user privilege level is 3.

Logging in through Telnet

By default, Telnet service is enabled.

·         The IP address is 192.168.0.50.

·         The login username is admin.

·         The login password is h3capadmin.

·         The user privilege level is 3.

Logging in through SSH

By default, SSH service is disabled. To use SSH service, complete the following configuration tasks:

·         Enable the SSH server function and configure SSH attributes.

·         Assign an IP address to a Layer 3 interface and make sure the interface and the SSH client can reach each other. By default, the device has the IP address 192.168.0.50/24.

·         Configure scheme authentication for VTY login users (scheme authentication by default).

·         Configure the user privilege level of VTY login users (0 by default).

Logging in to the Web interface

By default, Web login is enabled.

·         The IP address is 192.168.0.50.

·         The login username is admin.

·         The login password is h3capadmin.

·         The user privilege level is 3.

Logging in through SNMP

By default, SNMP login is disabled. To use SNMP service, complete the following configuration tasks:

·         Assign an IP address to a Layer 3 interface, and make sure the interface and the NMS can reach each other. By default, the device has the IP address 192.168.0.50.

·         Configure SNMP basic parameters.

Console user interface

Console port (EIA/TIA-232 DCE)

Virtual type terminal (VTY) user interface

Telnet or SSH

WA4320-ACN

Common console port

WA4320H-ACN

Mini USB port

WA4320i-ACN

Common console port

WA4320-ACN-PI

Not provided

WA4620i-ACN/WA4620E-ACN

Common console port

Bits per second

9600 bps

Flow control

None

Parity

None

Stop bits

1

Data bits

8

None

Set the authentication mode to none for the console user interface.

"Configuring none authentication for console login"

Password

Enable password authentication on the console user interface.

Set a password.

"Configuring password authentication for console login"

Scheme

Enable scheme authentication on the console user interface.

Configure local or remote authentication settings.

To configure local authentication:

1.       Configure a local user and specify the password.

2.       Configure the device to use local authentication.

To configure remote authentication:

1.       Configure the RADIUS or HWTACACS scheme on the device.

2.       Configure the username and password on the AAA server.

3.       Configure the device to use the scheme for user authentication.

"Configuring scheme authentication for console login"

1.       Enter system view.

system-view

N/A

2.       Enter console user interface view.

user-interface console first-number [ last-number ]

N/A

3.       Enable none authentication mode.

authentication-mode none

By default, you can log in to the device through the console port without authentication and have user privilege level 3.

4.       Configure common settings for console login.

See "Configuring common console user interface settings (optional)."

Optional.

1.       Enter system view.

system-view

N/A

2.       Enter console user interface view.

user-interface console first-number [ last-number ]

N/A

3.       Enable password authentication.

authentication-mode password

By default, you can log in to the device through the console port without authentication and have user privilege level 3 after login.

4.       Set a password.

set authentication password { cipher | simple } password

By default, no password is set.

5.       Configure common settings for console login.

See "Configuring common console user interface settings (optional)."

Optional.

1.       Enter system view.

system-view

N/A

2.       Enter console user interface view.

user-interface console first-number [ last-number ]

N/A

3.       Enable scheme authentication.

authentication-mode scheme

Whether local, RADIUS, or HWTACACS authentication is adopted depends on the configured AAA scheme.

By default, console login users are not authenticated.

4.       Enable command authorization.

command authorization

Optional.

By default, command authorization is disabled. The commands available for a user only depend on the user privilege level.

5.       Enable command accounting.

command accounting

Optional.

By default, command accounting is disabled, and the accounting server does not record the commands executed by users.

6.       Exit to system view.

quit

N/A

7.       Apply an AAA authentication scheme to the intended domain.

a.    Enter ISP domain view:
domain domain-name

b.    Apply an AAA scheme to the domain:
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme radius-scheme-name [ local ] }

c.     Exit to system view:
quit

Optional.

By default, local authentication is used.

For local authentication, configure local user accounts.

For RADIUS or HWTACACS authentication, configure the RADIUS or HWTACACS scheme on the device and configure authentication settings (including the username and password) on the server.

For more information about AAA configuration, see Security Configuration Guide.

8.       Create a local user and enter local user view.

local-user user-name

N/A

9.       Set an authentication password for the local user.

password { cipher | simple } password

N/A

10.    Specifies a command level of the local user.

authorization-attribute level level

Optional.

11.    Specify terminal service for the local user.

service-type terminal

N/A

12.    Configure common settings for console login.

See "Configuring common console user interface settings (optional)."

Optional.

1.       Enter system view.

system-view

N/A

2.       Enter console user interface view.

user-interface console first-number [ last-number ]

N/A

3.       Set the baud rate.

speed speed-value

By default, the baud rate is 9600 bps.

4.       Define the shortcut key for starting a terminal session.

activation-key character

By default, you press Enter to start the terminal session.

5.       Define a shortcut key for terminating tasks.

escape-key { default | character }

By default, pressing Ctrl+C terminates a task.

6.       Specify the terminal display type.

terminal type { ansi | vt100 }

By default, the terminal display type is ANSI.

The device supports two types of terminal display: ANSI and VT100. H3C recommends setting the display type of both the device and the terminal to VT100. If the device and the client use different display types (for example, HyperTerminal or Telnet terminal) or both are set to ANSI, when the total number of characters of the currently edited command line exceeds 80, an anomaly such as cursor corruption or abnormal display of the terminal display might occur on the client.

7.       Configure the user privilege level for login users.

user privilege level level

By default, the default command level is 3 for the console user interface.

8.       Set the maximum number of lines to be displayed on a screen.

screen-length screen-length

By default, a screen displays 24 lines at most.

A value of 0 disables pausing between screens of output.

9.       Set the size of command history buffer.

history-command max-size value

By default, the buffer saves 10 history commands at most.

10.    Set the idle-timeout timer.

idle-timeout minutes [ seconds ]

The default idle-timeout is 10 minutes. The system automatically terminates the user's connection if there is no information interaction between the device and the user within the idle-timeout time.

Setting idle-timeout to 0 disables the idle-timeout function.

Telnet server

Enable Telnet server.

Configure the IP address of a Layer 3 interface, and make sure the Telnet server and client can reach each other.

Configure the authentication mode and other settings.

Telnet client

Run the Telnet client program.

Obtain the IP address of the Layer 3 interface on the server.

None

Set the authentication mode to none for the VTY user interface.

"Configuring none authentication for Telnet login"

Password

Enable password authentication on the VTY user interface.

Set a password.

"Configuring password authentication for Telnet login"

Scheme

Enable scheme authentication on the VTY user interface.

Configure local or remote authentication settings.

To configure local authentication:

1.       Configure a local user and specify the password.

2.       Configure the device to use local authentication.

To configure remote authentication:

1.       Configure the RADIUS or HWTACACS scheme on the device.

2.       Configure the username and password on the AAA server.

3.       Configure the device to use the scheme for user authentication.

"Configuring scheme authentication for Telnet login"

1.       Enter system view.

system-view

N/A

2.       Enable Telnet server.

telnet server enable

By default, the Telnet server function is enabled.

3.       Enter one or multiple VTY user interface views.

user-interface vty first-number [ last-number ]

N/A

4.       Enable none authentication mode.

authentication-mode none

By default, password authentication is enabled for VTY user interfaces.

5.       Configure the command level for login users on the current user interfaces.

user privilege level level

By default, the default command level is 0 for VTY user interfaces.

6.       Configure common settings for the VTY user interfaces.

See "Configuring common VTY user interface settings (optional)."

Optional.

1.       Enter system view.

system-view

N/A

2.       Enable Telnet server.

telnet server enable

By default, the Telnet server function is enabled.

3.       Enter one or multiple VTY user interface views.

user-interface vty first-number [ last-number ]

N/A

4.       Enable password authentication.

authentication-mode password

By default, password authentication is enabled for VTY user interfaces.

5.       Set a password.

set authentication password { cipher | simple } password

By default, no password is set.

6.       Configure the user privilege level for login users.

user privilege level level

The default level is 0.

7.       Configure common settings for VTY user interfaces.

See "Configuring common VTY user interface settings (optional)."

Optional.

1.       Enter system view.

system-view

N/A

2.       Enable Telnet server.

telnet server enable

By default, the Telnet server function is enabled.

3.       Enter one or multiple VTY user interface views.

user-interface vty first-number [ last-number ]

N/A

4.       Enable scheme authentication.

authentication-mode scheme

By default, password authentication is enabled for VTY user interfaces.

Whether local, RADIUS, or HWTACACS authentication is adopted depends on the configured AAA scheme.

By default, local authentication is adopted.

5.       Enable command authorization.

command authorization

Optional.

By default, command authorization is disabled. The commands available for a user only depend on the user privilege level.

6.       Enable command accounting.

command accounting

Optional.

By default, command accounting is disabled. The accounting server does not record the commands executed by users.

7.       Exit to system view.

quit

N/A

8.       Apply an AAA authentication scheme to the intended domain.

a.    Enter ISP domain view:
domain domain-name

b.    Apply an AAA scheme to the domain:
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme radius-scheme-name [ local ] }

c.     Exit to system view:
quit

Optional.

By default, local authentication is used.

For local authentication, configure local user accounts.

For RADIUS or HWTACACS authentication, configure the RADIUS or HWTACACS scheme on the device and configure authentication settings (including the username and password) on the server.

For more information about AAA configuration, see Security Configuration Guide.

9.       Create a local user and enter local user view.

local-user user-name

N/A

10.    Set a password.

password { cipher | simple } password

N/A

11.    Specify the command level of the local user.

authorization-attribute level level

Optional.

12.    Specify Telnet service for the local user.

service-type telnet

N/A

13.    Exit to system view.

quit

N/A

14.    Configure common settings for VTY user interfaces.

See "Configuring common VTY user interface settings (optional)."

Optional.

1.       Enter system view.

system-view

N/A

2.       Enter one or multiple VTY user interface views.

user-interface vty first-number [ last-number ]

N/A

3.       Enable the terminal service.

shell

Optional.

By default, terminal service is enabled.

4.       Enable the user interfaces to support Telnet, SSH, or both of them.

protocol inbound { all | ssh | telnet }

Optional.

By default, both Telnet and SSH are supported.

The configuration takes effect the next time you log in.

5.       Define a shortcut key for terminating tasks.

escape-key { default | character }

Optional.

By default, pressing Ctrl+C terminates a task.

6.       Configure the type of terminal display.

terminal type { ansi | vt100 }

Optional.

By default, the terminal display type is ANSI.

7.       Set the maximum number of lines to be displayed on a screen.

screen-length screen-length

Optional.

By default, up to 24 lines is displayed on a screen.

A value of 0 disables the function.

8.       Set the size of command history buffer.

history-command max-size value

Optional.

By default, the buffer saves 10 history commands.

9.       Set the idle-timeout timer.

idle-timeout minutes [ seconds ]

Optional.

The default idle-timeout is 10 minutes for all user interfaces.

The system automatically terminates the user's connection if there is no information interaction between the device and the user within the timeout time.

Setting idle-timeout to 0 disables the timer.

10.    Specify a command to be automatically executed when a user logs in to the user interfaces.

auto-execute command command

Optional.

By default, no automatically executed command is specified.

The command auto-execute function is typically used for redirecting a Telnet user to a specific host. After executing the specified command and performing the incurred task, the system automatically disconnect the Telnet session.

1.       Enter system view.

system-view

N/A

2.       Specify the source IPv4 address or source interface for outgoing Telnet packets.

telnet client source { interface interface-type interface-number | ip ip-address }

Optional.

By default, no source IPv4 address or source interface is specified. The device automatically selects a source IPv4 address.

3.       Exit to user view.

quit

N/A

4.       Use the device to log in to a Telnet server.

·         Log in to an IPv4 Telnet server:
telnet remote-host [ service-port ] [ source { interface interface-type interface-number | ip ip-address } ]

·         Log in to an IPv6 Telnet server:
telnet ipv6 remote-host [ -i interface-type interface-number ] [ port-number ]

Use either command.

SSH server

Assign an IP address to a Layer 3 interface, and make sure the interface and the client can reach each other.

Configure the authentication mode and other settings.

SSH client

If a host operates as an SSH client, run the SSH client program on the host.

Obtain the IP address of the Layer 3 interface on the server.

1.       Enter system view.

system-view

N/A

2.       Create local key pairs.

public-key local create { ecdsa | rsa }

By default, no local key pairs are created.

3.       Enable SSH server.

ssh server enable

By default, SSH server is disabled.

4.       Enter one or multiple VTY user interface views.

user-interface vty first-number [ last-number ]

N/A

5.       Enable scheme authentication.

authentication-mode scheme

By default, password authentication is enabled on VTY user interfaces.

6.       Enable the user interfaces to support Telnet, SSH, or both of them.

protocol inbound { all | ssh }

Optional.

By default, both Telnet and SSH are supported.

7.       Enable command authorization.

command authorization

Optional.

By default, command authorization is disabled. The commands available for a user only depend on the user privilege level.

8.       Enable command accounting.

command accounting

Optional.

By default, command accounting is disabled. The accounting server does not record the commands executed by users.

9.       Exit to system view.

quit

N/A

10.    Apply an AAA authentication scheme to the intended domain.

a.    Enter the ISP domain view:
domain domain-name

b.    Apply the specified AAA scheme to the domain:
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme radius-scheme-name [ local ] }

c.     Exit to system view:
quit

Optional.

For local authentication, configure local user accounts.

For RADIUS or HWTACACS authentication, configure the RADIUS or HWTACACS scheme on the device and configure authentication settings (including the username and password) on the server.

For more information about AAA configuration, see Security Configuration Guide.

11.    Create a local user and enter local user view.

local-user user-name

N/A

12.    Set a password for the local user.

password { cipher | simple } password

N/A

13.    Specify the command level of the user.

authorization-attribute level level

Optional.

14.    Specify SSH service for the user.

service-type ssh

N/A

15.    Exit to system view.

quit

N/A

16.    Create an SSH user, and specify the authentication mode for the SSH user.

ssh user username service-type stelnet authentication-type { password | { any | password-publickey | publickey } assign publickey keyname }

N/A

17.    Configure common settings for VTY user interfaces.

See "Configuring common VTY user interface settings (optional)."

Optional.

Log in to an IPv4 SSH server.

ssh2 server

The server argument represents the IPv4 address or host name of the server.

Log in to an IPv6 SSH server.

ssh2 ipv6 server

The server argument represents the IPv6 address or host name of the server.

Display information about the user interfaces that are being used.

display users [ | { begin | exclude | include } regular-expression ]

Available in any view.

Display information about all user interfaces the device supports.

display users all [ | { begin | exclude | include } regular-expression ]

Available in any view.

Display user interface information.

display user-interface [ num1 | { console | vty } num2 ] [ summary ] [ | { begin | exclude | include } regular-expression ]

Available in any view.

Display the configuration of the device when it serves as a Telnet client.

display telnet client configuration [ | { begin | exclude | include } regular-expression ]

Available in any view.

Release a user interface.

free user-interface { num1 | { console | vty } num2 }

Available in user view.

Multiple users can log in to the device to simultaneously configure the device. When necessary, you can execute this command to release some connections.

You cannot use this command to release the connection you are using.

Lock the current user interface.

lock

Available in user view.

By default, the system does not automatically lock a user interface.

Send messages to user interfaces.

send { all | num1 | { console | vty } num2 }

Available in user view.

Device

Assign an IP address to a Layer 3 interface.

Configure routes to make sure the interface and the PC can reach each other.

Perform either or both of the following tasks:

·         Configuring HTTP login

·         Configuring HTTPS login

PC

Install a Web browser.

Obtain the IP address of the device's Layer 3 interface.

1.       Specify a fixed verification code for Web login.

web captcha verification-code

Optional.

By default, no fixed verification code is configured for Web login, and a Web user must enter the verification code provided on the login page at login.

This command is available in user view.

2.       Enter system view.

system-view

N/A

3.       Enable the HTTP service.

ip http enable

By default, the HTTP service is enabled.

4.       Configure the HTTP service port number.

ip http port port-number

Optional.

The default HTTP service port number is 80.

If you execute the command multiple times, the last one takes effect.

5.       Associate the HTTP service with an ACL.

ip http acl acl-number

Optional.

By default, the HTTP service is not associated with any ACL.

Associating the HTTP service with an ACL enables the device to allow only clients permitted by the ACL to log in.

6.       Set the Web connection timeout time.

web idle-timeout minutes

Optional.

7.       Set the size of the buffer for Web login logging.

web logbuffer size pieces

Optional.

8.       Create a local user and enter local user view.

local-user user-name

N/A

9.       Configure a password for the local user.

password { cipher | simple } password

N/A

10.    Specify the command level of the local user.

authorization-attribute level level

N/A

11.    Authorize the user to use the Web service.

service-type web

N/A

12.    Exit to system view.

quit

N/A

13.    Create a VLAN interface and enter its view.

interface vlan-interface vlan-interface-id

If the VLAN interface already exists, the command enters its view.

You could replace this VLAN interface with any other Layer 3 interface as appropriate.

14.    Assign an IP address and subnet mask to the interface.

ip address ip-address { mask | mask-length }

N/A

1.       Specify a fixed verification code for Web login.

web captcha verification-code

Optional.

By default, no fixed verification code is configured for Web login, and a Web user must enter the verification code provided on the login page at login.

This command is available in user view.

2.       Enter system view.

system-view

N/A

3.       Associate the HTTPS service with an SSL server policy.

ip https ssl-server-policy policy-name

Optional.

By default, the HTTPS service is not associated with any SSL server policy, and the device uses a self-signed certificate for authentication.

Disabling the HTTPS service de-associates the SSL service policy from the HTTPS service. To re-enable the HTTPS service, you must reconfigure this command again.

If the HTTPS service has been enabled, any changes to the SSL server policy associated with it do not take effect.

4.       Enable the HTTPS service.

ip https enable

By default, HTTPS is disabled.

Enabling the HTTPS service triggers an SSL handshake negotiation process:

·         If a local certificate exists on the device, the SSL negotiation succeeds and the HTTPS service starts up.

·         If no local certificate exists, a certificate application process is triggered by the SSL handshake negotiation. Because the application process takes a long time, the SSL negotiation often fails and the HTTPS service cannot be started. In that case, execute this command multiple times to start the HTTPS service.

5.       Associate the HTTPS service with a certificate attribute-based access control policy.

ip https certificate access-control-policy policy-name

Optional.

By default, the HTTPS service is not associated with any certificate-based attribute access control policy.

The device uses the associated policy to control client access rights.

You must configure the client-verify enable command and at least one permit rule in the associated SSL server policy. Otherwise, no clients can log in through HTTPS.

For more information about certificate attribute-based access control policies, see the chapter on PKI in Security Configuration Guide.

6.       Specify the HTTPS service port number.

ip https port port-number

Optional.

The default HTTPS service port number is 443.

7.       Associate the HTTPS service with an ACL.

ip https acl acl-number

By default, the HTTPS service is not associated with any ACL.

The device allows only clients permitted by the associated ACL to log in.

8.       Set the HTTPS user authentication mode.

web https-authorization mode { auto | manual }

Optional.

The default HTTPS user authentication mode is manual.

In manual mode, a user must enter the correct username and password to log in through HTTPS.

In auto mode, the device first authenticates users by their certificates:

·          If the certificate is correct and not expired, the CN field in the certificate is used as the username to perform AAA authentication. If the authentication succeeds, the Web interface of the device appears on the user's terminal.

·         If the certificate is correct and not expired, but the AAA authentication fails, the device shows the Web login page and the user must enter the correct username and password to log in.

·         If the certificate is incorrect or expired, the HTTPS connection is terminated.

9.       Set the Web user connection timeout time.

web idle-timeout minutes

Optional.

10.    Set the size of the buffer for Web login logging.

web logbuffer size pieces

Optional.

11.    Create a local user and enter local user view.

local-user user-name

N/A

12.    Configure a password for the local user.

password { cipher | simple } password

N/A

13.    Specify the command level of the local user.

authorization-attribute level level

N/A

14.    Authorize the local user to use the Web service.

service-type web

N/A

15.    Exit to system view.

quit

N/A

16.    Create a VLAN interface and enter its view.

interface vlan-interface vlan-interface-id

If the VLAN interface already exists, the command enters its view.

You could replace this VLAN interface with any other Layer 3 interface as appropriate.

17.    Assign an IP address and subnet mask to the interface.

ip address ip-address { mask | mask-length }

N/A

Display information about Web users.

display web users [ | { begin | exclude | include } regular-expression ]

Available in any view.

Display HTTP state information.

display ip http [ | { begin | exclude | include } regular-expression ]

Available in any view.

Display HTTPS state information.

display ip https [ | { begin | exclude | include } regular-expression ]

Available in any view.

1.       Enter system view.

system-view

N/A

2.       Enable the SNMP agent.

snmp-agent

Optional.

By default, the SNMP agent is disabled.

You can enable SNMP agent with this command or any command that begins with snmp-agent.

3.       Configure an SNMP group and specify its access right.

snmp-agent group v3 group-name [ authentication | privacy ] [ read-view read-view ] [ write-view write-view ] [ notify-view notify-view ] [ acl acl-number ] *

By default, no SNMP group is configured.

4.       Add a user to the SNMP group.

snmp-agent usm-user v3 user-name group-name [ [ cipher ] authentication-mode { md5 | sha } auth-password [ privacy-mode { 3des | aes128 | des56 } priv-password ] ] [ acl acl-number ] *

N/A

1.       Enter system view.

system-view

N/A

2.       Enable the SNMP agent.

snmp-agent

Optional.

By default, the SNMP agent is disabled.

You can enable SNMP agent with this command or any command that begins with snmp-agent.

3.       Create or update MIB view information.

snmp-agent mib-view { excluded | included  } view-name oid-tree [ mask mask-value ]

Optional.

By default, the MIB view name is ViewDefault and OID is 1.

4.       Configure the SNMP access right.

·         (Approach 1) Specify the SNMP NMS access right directly by configuring an SNMP community:
snmp-agent community { read | write } community-name [ mib-view view-name ] [ acl acl-number ] *

·         (Approach 2) Configure an SNMP group and add a user to the SNMP group:

a.    snmp-agent group { v1 | v2c } group-name [ read-view read-view ] [ write-view write-view ] [ notify-view notify-view ] [ acl acl-number ] *

b.    snmp-agent usm-user { v1 | v2c } user-name group-name [ acl acl-number ] *

Use either approach.

The username in approach 2 is equivalent to the community name used in approach 1, and must be the same as the community name configured on the NMS.

1.       Enter system view.

system-view

N/A

2.       Create a basic ACL and enter its view, or enter the view of an existing basic ACL.

acl [ ipv6 ] number acl-number [ name name ] [ match-order { config | auto } ]

By default, no basic ACL exists.

3.       Configure an ACL rule.

·         For IPv4 networks:
rule [ rule-id ] { deny | permit } [ counting | fragment | logging | source { sour-addr sour-wildcard | any } | time-range time-range-name ] *

·         For IPv6 networks:
rule [ rule-id ] { deny | permit } [ counting | fragment | logging | routing [ type routing-type ] | source { ipv6-address prefix-length | ipv6-address/prefix-length | any } | time-range time-range-name ]

By default, a basic ACL does not contain any rule.

4.       Exit the basic ACL view.

quit

N/A

5.       Enter user interface view.

user-interface [ type ] first-number [ last-number ]

N/A

6.       Use the ACL to control user logins by source IP address.

acl [ ipv6 ] acl-number { inbound | outbound }

·         inbound: Filters incoming packets.

·         outbound: Filters outgoing packets.

1.       Enter system view.

system-view

N/A

2.       Create an advanced ACL and enter its view, or enter the view of an existing advanced ACL.

acl [ ipv6 ] number acl-number [ name name ] [ match-order { config | auto } ]

By default, no advanced ACL exists.

3.       Configure an ACL rule.

rule [ rule-id ] { permit | deny } rule-string

N/A

4.       Exit advanced ACL view.

quit

N/A

5.       Enter user interface view.

user-interface [ type ] first-number [ last-number ]

N/A

6.       Apply the ACL to the user interfaces.

acl [ ipv6 ] acl-number { inbound | outbound }

·         inbound: Filters incoming Telnet packets.

·         outbound: Filters outgoing Telnet packets.

1.       Enter system view.

system-view

N/A

2.       Create an Ethernet frame header ACL and enter its view.

acl number acl-number [ name name ] [ match-order { config | auto } ]

By default, no Ethernet frame header ACL exists.

3.       Configure an ACL rule.

rule [ rule-id ] { permit | deny } rule-string

N/A

4.       Exit Ethernet frame header ACL view.

quit

N/A

5.       Enter user interface view.

user-interface [ type ] first-number [ last-number ]

N/A

6.       Use the ACL to control user logins by source MAC address.

acl acl-number inbound

inbound: Filters incoming packets.

1.       Enter system view.

system-view

N/A

2.       Create a basic ACL and enter its view, or enter the view of an existing basic ACL.

acl [ ipv6 ] number acl-number [ name name ] [ match-order { config | auto } ]

By default, no basic ACL exists.

3.       Configure an ACL rule.

rule [ rule-id ] { deny | permit } [ counting | fragment | logging | source { sour-addr sour-wildcard | any } | time-range time-range-name ]

N/A

4.       Exit the basic ACL view.

quit

N/A

5.       Apply the ACL to an SNMP community, group, or user.

·         SNMPv1/v2c community:
snmp-agent community { read | write } community-name [ mib-view view-name ] [ acl acl-number ]

·         SNMPv1/v2c group:
snmp-agent group { v1 | v2c } group-name [ read-view read-view ] [ write-view write-view ] [ notify-view notify-view ] [ acl acl-number ]

·         SNMPv3 group:
snmp-agent group v3 group-name [ authentication | privacy ] [ read-view read-view ] [ write-view write-view ] [ notify-view notify-view ] [ acl acl-number ]

·         SNMPv1/v2c user:
snmp-agent usm-user { v1 | v2c } user-name group-name [ acl acl-number ]

·         SNMPv3 user:
snmp-agent usm-user v3 user-name group-name [ [ cipher ] authentication-mode { md5 | sha } auth-password [ privacy-mode { 3des | aes128 | des56 } priv-password ] ] [ acl acl-number ]