The first time you access the device, you can log in to the CLI through the console port. After login, you can change console login parameters or configure other access methods, including Telnet, SSH, modem, and SNMP.

Telnet login is not supported in FIPS mode.

Table 1 Login methods at a glance

Login method	Default settings and minimum configuration requirements
Logging in to the CLI:
· Logging in through the console port locally		By default, login through the console port is enabled, no username or password is required, and the user role network-admin is assigned. After login, configure password or scheme authentication mode to improve device security.
· Logging in through Telnet		By default, Telnet login is disabled. To enable Telnet login, perform the following tasks: · Enable the Telnet server feature. · Assign an IP address to a Layer 3 interface and make sure the interface and the Telnet client can reach each other. · Configure an authentication mode for VTY login users. By default, password authentication is used but no password is configured. · Assign a user role to VTY login users. By default, a VTY login user is assigned the network-operator user role.
· Logging in through SSH		By default, SSH login is disabled. To enable SSH login, perform the following tasks: · Enable the SSH server feature and configure SSH attributes. · Assign an IP address to a Layer 3 interface and make sure the interface and the SSH client can reach each other. · Configure scheme authentication for VTY login users. By default, password authentication is used. · Assign a user role to VTY login users. By default, a VTY login user is assigned the network-operator user role.
· Logging in through a pair of modems		By default, modem dial-in is enabled, and you can dial in to the switch. The default user role is network-admin.
Accessing the device through SNMP		By default, SNMP access is disabled. To enable SNMP access, perform the following tasks: · Assign an IP address to a Layer 3 interface, and make sure the interface and the NMS can reach each other. · Configure SNMP basic parameters.

Logging in through the console port for the first device access

The first time you access the device, you can only log in to the CLI through the console port.

To log in through the console port, prepare a console terminal (for example, a PC). Make sure the console terminal has a terminal emulation program, such as HyperTerminal on Windows XP. On Windows Server 2003, you must manually add the HyperTerminal program. On Windows Server 2008, Windows 7, Windows Vista, or other operating systems, you must obtain and install a third-party terminal emulation program. For information about how to use other terminal emulation programs, see the programs' user guides or online help.

To log in through the console port:

1. Connect the DB-9 female connector of the console cable to the serial port of the PC.

2. Identify the console port of the device carefully and connect the RJ-45 connector of the console cable to the console port of the device.

IMPORTANT:

The serial ports on PCs do not support hot swapping. To connect a PC to an operating switch, first connect the PC end. To disconnect a PC from an operating switch, first disconnect the switch end.

Figure 1 Connecting a terminal to the console port

3. If the PC is off, turn on the PC.

4. On the PC, launch the terminal emulation program and create a connection that uses the serial port connected to the device. Set the port properties so the port properties match the following console port default settings:

¡ Bits per second—9600 bps.

¡ Flow control—None.

¡ Parity—None.

¡ Stop bits—1.

¡ Data bits—8.

5. Power on the device and press Enter as prompted.

The default user view prompt <H3C> appears. You can enter commands to configure or manage the device. To get help, enter ?.

Press Ctrl-B to enter Boot Menu 0

Auto-booting

Decompress Image

OK!

Starting at 0x80100000

Cryptographic algorithms tests passed.

User interface aux0 is available.

Press ENTER to get started.

<H3C>%Sep 24 09:48:54:109 2014 H3C SHELL/4/LOGIN: Console login from aux0

<H3C>

Logging in to the CLI

By default, you can log in to the CLI through the console port. After you log in, you can configure other login methods, including Telnet, SSH, and modem dial-in.

To prevent illegal access to the CLI and control user behavior, perform the following tasks as required:

· Configure login authentication.

· Assign user roles.

· Configure command authorization and command accounting.

· Use ACLs to filter unauthorized logins.

This chapter describes how to configure and use CLI login methods, including login authentication, user roles, and common user line settings. For more information about command authorization, command accounting, and unauthorized access filtering, see "Controlling user access."

CLI overview

User lines

The device uses user lines (also called user interfaces) to manage CLI sessions and monitor user behavior. You can configure access control settings, including login authentication and user role, on user lines. After users are logged in, their actions must be compliant with the settings on the user lines assigned to them.

Users are assigned different user lines, depending on their login methods, as shown in Table 2.

Table 2 CLI login method and user line matrix

User line	Login method
AUX line	Console port.
Virtual type terminal (VTY) line	Telnet or SSH.

User line assignment

The device automatically assigns user lines to CLI login users, depending on their login methods. Each user line can be assigned to only one user at a time. If no user line is available, a CLI login attempt will be rejected.

For a CLI login, the device always picks the lowest numbered user line from the idle user lines available for the login type. For example, four VTY lines (0 to 3) are configured, of which VTY 0 and VTY 3 are idle. When a user Telnets to the device, the device assigns VTY 0 to the user, and uses the settings on VTY 0 to authenticate and manage the user.

User line identification

Every user line has an absolute number and a relative number for identification.

An absolute number uniquely identifies a user line among all user lines. The user lines are numbered starting from 0 and incrementing by 1 and in the sequence of AUX, and VTY lines. You can use the display line command without any parameters to view supported user lines and their absolute numbers.

A relative number uniquely identifies a user line among all user lines that are the same type. The number format is user line type + number. All the types of user lines are numbered starting from 0 and incrementing by 1. For example, the first VTY line is VTY 0.

Login authentication modes

You can configure login authentication to prevent illegal access to the device CLI.

In non-FIPS mode, the device supports the following login authentication modes:

· None—Disables authentication. This mode allows access without authentication and is insecure.

· Password—Requires password authentication.

· Scheme—Uses the AAA module to provide local or remote login authentication. You must provide a username and password at login.

In FIPS mode, the device supports only the scheme authentication mode.

Different login authentication modes require different user line configurations, as shown in Table 3.

Table 3 Configuration required for different login authentication modes

Authentication mode	Configuration tasks
None	Set the authentication mode to none.
Password	1. Set the authentication mode to password. 2. Set a password.
Scheme	1. Set the authentication mode to scheme. 2. Configure login authentication methods in ISP domain view. For more information, see Security Configuration Guide.
Scheme

User roles

A user is assigned user roles at login. The user roles specify the commands that the user can execute. For more information about user roles, see "Configuring RBAC."

The device assigns user roles based on the login authentication mode, user type, and login method.

· In none or password authentication mode, the device assigns the user roles specified for the user line.

· In scheme authentication mode, the device uses the following rules to assign user roles:

¡ For an SSH login user who uses publickey or password-publickey authentication, the device assigns the user roles specified for the local device management user with the same name.

¡ For other users, the device assigns user roles according to the user role configuration of the AAA module. If the AAA server does not assign any user roles and the default user role feature is disabled, a remote AAA authentication user cannot log in.

FIPS compliance

The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for features, commands, and parameters might differ in FIPS mode and non-FIPS mode. For more information about FIPS mode, see Security Configuration Guide.

Telnet login is not supported in FIPS mode.

Logging in through the console port locally

You can connect a terminal to the console port of the device to log in and manage the device, as shown in Figure 2. For the login procedure, see "Logging in through the console port for the first device access."

Figure 2 Logging in through the console port

By default, console login is enabled and does not require authentication. To improve device security, configure password or scheme authentication and assign user roles immediately after you log in to the device for the first time.

To configure console login, perform the following tasks:

Task	Remarks
(Required.) Configuring login authentication: · Disabling authentication for console login · Configuring password authentication for console login · Configuring scheme authentication for console login	Configure one authentication mode as required. In FIPS mode, only the scheme authentication mode is supported.
(Optional.) Configuring common AUX line settings	N/A

Task

Remarks

(Required.) Configuring login authentication:

· Disabling authentication for console login

· Configuring password authentication for console login

· Configuring scheme authentication for console login

Configure one authentication mode as required.

In FIPS mode, only the scheme authentication mode is supported.

(Optional.) Configuring common AUX line settings

N/A

Console login configuration changes do not take effect for current online users. They take effect only for new login users.

Before using multiple devices to form an IRF fabric, enter AUX line class view on each device and perform the following tasks:

· Disable authentication.

· Assign the user role network-admin.

Disabling authentication for console login

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter AUX line view or class view.	· Enter AUX line view: line aux first-number [ last-number ] · Enter AUX line class view: line class aux	A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class. A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view. A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.
3. Disable authentication.	authentication-mode none	By default, authentication is disabled for the AUX line.
4. Assign a user role.	user-role role-name	By default, an AUX line user is assigned the user role network-admin.

The next time you log in through the console port, you do not need to provide a username or password.

Configuring password authentication for console login

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter AUX line view or class view.	· Enter AUX line view: line aux first-number [ last-number ] · Enter AUX line class view: line class aux	A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class. A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view. A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.
3. Enable password authentication.	authentication-mode password	By default, authentication is disabled for the AUX line.
4. Set a password.	set authentication password { hash \| simple } password	By default, no password is set.
5. Assign a user role.	user-role role-name	By default, an AUX line user is assigned the user role network-admin.

The next time you log in through the console port, you must provide the configured login password.

Configuring scheme authentication for console login

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter AUX line view or class view.	· Enter AUX line view: line aux first-number [ last-number ] · Enter AUX line class view: line class aux	A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class. A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view. A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.
3. Enable scheme authentication.	authentication-mode scheme	By default, authentication is disabled for the AUX line.

To use scheme authentication, you must also perform the following tasks:

· Configure login authentication methods in ISP domain view.

· To use remote authentication, configure the scheme to be used.

· To use local authentication, configure a local user and the relevant attributes.

For more information, see Security Configuration Guide.

The next time you log in through the console port, you must provide the configured login username and password.

Configuring common AUX line settings

Some common settings configured for an AUX line take effect immediately and can interrupt the current session. Use a login method different from console login to log in to the device before you change AUX line settings.

To log in through the console port after you configure AUX line settings, change the terminal settings on the configuration terminal to match the line settings.

To configure common settings for an AUX line:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter AUX line view or class view.	· Enter AUX line view: line aux first-number [ last-number ] · Enter AUX line class view: line class aux	A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class. A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view. A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.
3. Set the baud rate.	speed speed-value	By default, the baud rate is 9600 bps. This command is not available in AUX line class view.
4. Specify the parity check mode.	parity { even \| mark \| none \| odd \| space }	By default, the parity check mode is none, and no parity check is performed. This command is not available in AUX line class view.
5. Specify the number of stop bits.	stopbits { 1 \| 1.5 \| 2 }	The default is 1. Stop bits indicate the end of a character. The more the stop bits, the slower the transmission. This command is not available in AUX line class view.
6. Specify the number of data bits for each character.	databits { 5 \| 6 \| 7 \| 8 }	The default is 8. Configure this command depending the character coding type. For example, set the number of data bits to 7 for standard ASCII characters. Set the number of data bits to 8 for extended ASCII characters. This command is not available in AUX line class view.
7. Define a shortcut key for starting a terminal session.	activation-key character	By default, pressing Enter starts the terminal session.
8. Define a shortcut key for terminating tasks.	escape-key { character \| default }	By default, pressing Ctrl+C terminates a task.
9. Configure the flow control mode.	flow-control { hardware \| none \| software }	This command is not available in AUX line class view. By default, the flow control mode is none.
10. Specify the terminal display type.	terminal type { ansi \| vt100 }	By default, the terminal display type is ANSI. The device supports ANSI and VT100 terminal display types. As a best practice, set the display type to VT100 on both the device and the configuration terminal. If either side uses the ANSI type, a display problem such as cursor positioning error might occur when a command line has more than 80 characters.
11. Set the maximum number of lines to be displayed on a screen.	screen-length screen-length	By default, a screen displays up to 24 lines. A value of 0 disables pausing between screens of output.
12. Set the size of the command history buffer.	history-command max-size value	By default, the buffer saves up to 10 history commands.
13. Set the CLI connection idle-timeout timer.	idle-timeout minutes [ seconds ]	By default, the CLI connection idle-timeout timer is 10 minutes. If no interaction occurs between the device and the user within the idle-timeout interval, the system automatically terminates the user connection on the user line. If you set the timeout timer to 0, the connection will not be aged out.

Logging in through Telnet

You can Telnet to the device to remotely manage the device, or use the device as a Telnet client to Telnet to other devices to manage them.

By default, Telnet login is disabled on the device. To log in to the device through Telnet, you must perform the following tasks:

· Log in to the device through any other method.

· Enable the Telnet server.

· Configure Telnet login authentication on the device.

NOTE:

Telnet login is not supported in FIPS mode. For more information about FIPS mode, see Security Configuration Guide.

Configuring Telnet login on the device

Task	Remarks
(Required.) Configuring login authentication: · Disabling authentication for Telnet login · Configuring password authentication for Telnet login · Configuring scheme authentication for Telnet login	Configure one authentication mode as required.
(Optional.) Setting the maximum number of concurrent Telnet users	N/A
(Optional.) Setting the DSCP value for outgoing Telnet packets	N/A
(Optional.) Configuring common VTY line settings	N/A

Telnet login configuration changes do not take effect for current online users. They take effect only for new login users.

Disabling authentication for Telnet login

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable Telnet server.	telnet server enable	By default, the Telnet server feature is disabled.
3. Enter VTY line view or class view.	· Enter VTY line view: line vty first-number [ last-number ] · Enter VTY line class view: line class vty	A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class. A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view. A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.
4. Disable authentication.	authentication-mode none	By default, password authentication is enabled for VTY lines. In VTY line view, this command is associated with the protocol inbound command. If you specify a non-default value for only one of the two commands in VTY line view, the other command uses the default setting, regardless of the setting in VTY line class view.
5. (Optional.) Assign a user role.	user-role role-name	By default, a VTY line user is assigned the user role network-operator.

The next time you Telnet to the device, you do not need to provide a username or password, as shown in the following example:

******************************************************************************

* Without the owner's prior written consent, *

* no decompiling or reverse-engineering shall be allowed. *

******************************************************************************

If the maximum number of login users has been reached, your login attempt fails and the device displays the "All user lines are used, please try later!" message.

Configuring password authentication for Telnet login

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable Telnet server.	telnet server enable	By default, the Telnet server feature is disabled.
3. Enter VTY line view or class view.	· Enter VTY line view: line vty first-number [ last-number ] · Enter VTY line class view: line class vty	A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class. A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view. A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.
4. Enable password authentication.	authentication-mode password	By default, password authentication is enabled for VTY lines. In VTY line view, this command is associated with the protocol inbound command. If you specify a non-default value for only one of the two commands in VTY line view, the other command uses the default setting, regardless of the setting in VTY line class view.
5. Set a password.	set authentication password { hash \| simple } password	By default, no password is set.
6. (Optional.) Assign a user role.	user-role role-name	By default, a VTY line user is assigned the user role network-operator.

The next time you Telnet to the device, you must provide the configured login password, as shown in the following example:

******************************************************************************

* Without the owner's prior written consent, *

* no decompiling or reverse-engineering shall be allowed. *

******************************************************************************

Password:

If the maximum number of login users has been reached, your login attempt fails and the device displays the "All user lines are used, please try later!" message.

Configuring scheme authentication for Telnet login

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable Telnet server.	telnet server enable	By default, the Telnet server feature is disabled.
3. Enter VTY line view or class view.	· Enter VTY line view: line vty first-number [ last-number ] · Enter VTY line class view: line class vty	A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class. A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view. A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.
4. Enable scheme authentication.	authentication-mode scheme	By default, password authentication is enabled for VTY lines. In VTY line view, this command is associated with the protocol inbound command. If you specify a non-default value for only one of the two commands in VTY line view, the other command uses the default setting, regardless of the setting in VTY line class view.

To use scheme authentication, you must also perform the following tasks:

· Configure login authentication methods in ISP domain view.

· To use remote authentication, configure the scheme to be used.

· To use local authentication, configure a local user and the relevant attributes.

For more information, see Security Configuration Guide.

The next time you Telnet to the CLI, you must provide the configured login username and password, as shown in the following example:

******************************************************************************

* Without the owner's prior written consent, *

* no decompiling or reverse-engineering shall be allowed. *

******************************************************************************

Password:

If the maximum number of login users has been reached, your login attempt fails and the device displays the "All user lines are used, please try later!" message.

Setting the maximum number of concurrent Telnet users

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set the maximum number of concurrent Telnet users.	aaa session-limit telnet max-sessions	By default, the maximum number of concurrent Telnet users is 32. Changing this setting does not affect online users. If the current number of online Telnet users is equal to or greater than the new setting, no additional Telnet users can log in until online users log out. For more information about this command, see Security Command Reference.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Set the maximum number of concurrent Telnet users.

aaa session-limit telnet max-sessions

By default, the maximum number of concurrent Telnet users is 32.

Changing this setting does not affect online users. If the current number of online Telnet users is equal to or greater than the new setting, no additional Telnet users can log in until online users log out.

For more information about this command, see Security Command Reference.

Setting the DSCP value for outgoing Telnet packets

The DSCP value is carried in the ToS/Traffic class field of an IP or IPv6 packet, and it indicates the transmission priority of the packet.

To set the DSCP value for outgoing Telnet packets:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set the DSCP value for outgoing Telnet packets.	· For a Telnet server running IPv4: telnet server dscp dscp-value · For a Telnet server running IPv6: telnet server ipv6 dscp dscp-value	By default, the DSCP value is 48.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Set the DSCP value for outgoing Telnet packets.

· For a Telnet server running IPv4:
telnet server dscp dscp-value

· For a Telnet server running IPv6:
telnet server ipv6 dscp dscp-value

By default, the DSCP value is 48.

Configuring common VTY line settings

For a VTY line, you can specify a command that is to be automatically executed when a user logs in. After executing the specified command, the system automatically disconnects the Telnet session. Before you configure this feature and save the configuration, make sure you can access the CLI through a different user line.

Typically, you configure the auto-execute command telnet X.X.X.X command on the device so the device redirects a Telnet user to the host at X.X.X.X. In this case, the connection to the current device is closed when the user terminates the Telnet connection to X.X.X.X.

To configure common settings for VTY lines:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter VTY line view or class view.	· Enter VTY line view: line vty first-number [ last-number ] · Enter VTY line class view: line class vty	A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class. A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view. A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.
3. Enable the terminal service.	shell	By default, terminal service is enabled.
4. Specify the protocols for the user lines to support.	protocol inbound { all \| ssh \| telnet }	By default, both Telnet and SSH are supported. A protocol change does not take effect for current online users. It takes effect only for new login users. In VTY line view, this command is associated with the authentication-mode command. If you specify a non-default value for only one of the two commands in VTY line view, the other command uses the default setting, regardless of the setting in VTY line class view.
5. Define a shortcut key for terminating tasks.	escape-key { character \| default }	By default, pressing Ctrl+C terminates a task.
6. Specify the terminal display type.	terminal type { ansi \| vt100 }	By default, the terminal display type is ANSI.
7. Set the maximum number of lines to be displayed on a screen.	screen-length screen-length	By default, up to 24 lines is displayed on a screen. A value of 0 disables the feature.
8. Set the size of command history buffer.	history-command max-size value	By default, the buffer saves 10 history commands.
9. Set the CLI connection idle-timeout timer.	idle-timeout minutes [ seconds ]	By default, the CLI connection idle-timeout timer is 10 minutes. If no interaction occurs between the device and the user within the idle-timeout interval, the system automatically terminates the user connection on the user line. If you set the timeout timer to 0, the connection will not be aged out.
10. Specify a command to be automatically executed when users log in to the user lines.	auto-execute command command	By default, no automatically executed command is specified.

Using the device to log in to a Telnet server

You can use the device as a Telnet client to log in to a Telnet server. If the server is located in a different subnet than the device, make sure the two devices have routes to reach each other.

Figure 3 Telnetting from the device to a Telnet server

To use the device to log in to a Telnet server:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. (Optional.) Specify the source IPv4 address or source interface for outgoing Telnet packets.	telnet client source { interface interface-type interface-number \| ip ip-address }	By default, no source IPv4 address or source interface is specified, and the primary IPv4 address of the outbound interface is used as the source address for outgoing Telnet packets.
3. Exit to user view.	quit	N/A
4. Use the device to log in to a Telnet server.	· Log in to an IPv4 Telnet server: telnet remote-host [ service-port ] [ vpn-instance vpn-instance-name ] [ source { interface interface-type interface-number \| ip ip-address } ] [ dscp dscp-value ] · Log in to an IPv6 Telnet server: telnet ipv6 remote-host [ -i interface-type interface-number ] [ port-number ] [ vpn-instance vpn-instance-name ] [ dscp dscp-value ]	N/A

Logging in through SSH

SSH offers a secure method to remote login. By providing encryption and strong authentication, it protects devices against attacks such as IP spoofing and plain text password interception. For more information, see Security Configuration Guide.

You can use an SSH client to log in to the device for remote management, or use the device as an SSH client to log in to an SSH server.

By default, SSH login is disabled on the device. To log in to the device through SSH, you must log in to the device through any other method and configure SSH login on the device first.

Configuring the device as an SSH server

This section provides the configuration procedure for when the SSH client authentication method is password. For more information about SSH and publickey authentication configuration, see Security Configuration Guide.

To configure SSH login on the device:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create local key pairs.	public-key local create { dsa \| rsa \| ecdsa } [ name key-name ]	By default, no local key pairs are created.
3. Enable SSH server.	ssh server enable	By default, SSH server is disabled.
4. (Optional.) Create an SSH user and specify the authentication mode.	· In non-FIPS mode: ssh user username service-type stelnet authentication-type { password \| { any \| password-publickey \| publickey } [ assign { pki-domain domain-name \| publickey keyname } ] } · In FIPS mode: ssh user username service-type stelnet authentication-type { password \| password-publickey [ assign { pki-domain domain-name \| publickey keyname } ] }	By default, no SSH user is configured on the device.
5. Enter VTY line view or class view.	· Enter VTY line view: line vty first-number [ last-number ] · Enter VTY line class view: line class vty	A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class. A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view. A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.
6. Enable scheme authentication.	authentication-mode scheme	In non-FIPS mode, password authentication is enabled for VTY lines by default. In FIPS mode, scheme authentication is enabled for VTY lines by default. In VTY line view, this command is associated with the protocol inbound command. If you specify a non-default value for only one of the two commands in VTY line view, the other command uses the default setting, regardless of the setting in VTY line class view.
7. (Optional.) Specify the protocols for the user lines to support.	· In non-FIPS mode: protocol inbound { all \| ssh \| telnet } · In FIPS mode: protocol inbound ssh	In non-FIPS mode, Telnet and SSH are supported by default. In FIPS mode, SSH is supported by default. A protocol change does not take effect for current online users. It takes effect only for new login users. In VTY line view, this command is associated with the authentication-mode command. If you specify a non-default value for only one of the two commands in VTY line view, the other command uses the default setting, regardless of the setting in VTY line class view.
8. (Optional.) Set the maximum number of concurrent SSH users.	aaa session-limit ssh max-sessions	By default, the maximum number of concurrent SSH users is 32. Changing this setting does not affect online users. If the current number of online SSH users is equal to or greater than the new setting, no additional SSH users can log in until online users log out. For more information about this command, see Security Command Reference.
9. Exit to system view.	quit	N/A
10. (Optional.) Configure common settings for VTY lines.	See "Configuring common VTY line settings."	N/A

Using the device to log in to an SSH server

You can use the device as an SSH client to log in to an SSH server. If the server is located in a different subnet than the device, make sure the two devices have routes to reach each other.

Figure 4 Logging in to an SSH client from the device

Perform the following tasks in user view:

Task	Command
Log in to an IPv4 SSH server.	ssh2 server
Log in to an IPv6 SSH server.	ssh2 ipv6 server

To work with the SSH server, you might need to configure the SSH client. For information about configuring the SSH client, see Security Configuration Guide.

Logging in through a pair of modems

You can use a pair of modems to remotely connect to the console port of the device over PSTN when the IP network connection is broken.

By default, modem dial-in is enabled, and you can dial in to the switch. The default user role is network-admin. To change modem dial-in parameters, see "Logging in through the console port locally."

To use a pair of modems to remotely log in to the device:

1. Connect one modem to the serial port of the PC and another modem to the console port of the device.

2. Connect each modem to the PSTN through a telephone cable.

Figure 5 Connecting the PC to the device through modems

3. Obtain the telephone number of the device-side modem.

4. Configure the following settings on the device-side modem:

¡ AT&F—Restores the factory default.

¡ ATS0=1—Configures auto-answer on first ring.

¡ AT&D—Ignores DTR signals.

¡ AT&K0—Disables local flow control.

¡ AT&R1—Ignores RTS signals.

¡ AT&S0—Forces DSR to remain on.

¡ ATEQ1&W—Disables the modem from returning command responses and execution results, and saves configuration.

To verify your configuration, enter AT&V to display the configuration results.

NOTE:

The configuration commands and output vary by modem. For more information, see the modem user guide.

5. To ensure successful communication and to avoid data loss, verify that the modems are using a transmission rate higher than the console port's baud rate.

6. Launch the terminal emulation program on the PC and create a connection using the telephone number of the device-side modem.

Figure 6 through Figure 9 show the configuration procedure in Windows XP HyperTerminal. On Windows Server 2003, add the HyperTerminal program first, and then log in to and manage the device as described in this document. On Windows Server 2008, Windows 7, Windows Vista, or another operating system, obtain a third-party terminal control program first. Then, follow the user guide or online help of that program to log in to the device.

Figure 6 Creating a connection

Figure 7 Configuring the dialing parameters

7. Dial the telephone number to establish a connection to the device.

Figure 8 Dialing the number

8. After you hear the dial tone, press Enter as prompted.

If the authentication mode is none, the prompt <H3C> appears. If the authentication mode is password or scheme, you must enter the correct authentication information as prompted.

Figure 9 Login page

IMPORTANT:

Do not directly close the HyperTerminal. Doing so can cause some modems to stay in use, and your subsequent dial-in attempts will always fail.

To disconnect the PC from the device, execute the appropriate ATH command in the HyperTerminal. If the command cannot be entered, enter AT+ + +. When the word OK appears, execute the ATH command. The connection is terminated if OK is displayed. You can also terminate the connection by clicking in the HyperTerminal window.

Displaying and maintaining CLI login

Execute display commands in any view and the other commands in user view.

Task	Command	Remarks
Display online CLI user information.	display users [ all ]	N/A
Display user line information.	display line [ num1 \| { aux \| vty } num2 ] [ summary ]	N/A
Display the source address or interface for outgoing Telnet packets when the device acts as a Telnet client.	display telnet client	N/A
Release a user line.	free line { num1 \| { aux \| vty } num2 }	Multiple users can log in to the device to simultaneously configure the device. When necessary, you can execute this command to release some connections. You cannot use this command to release the connection you are using.
Lock the current user line.	lock	By default, the system does not lock any user lines. This command is not supported in FIPS mode.
Send messages to user lines.	send { all \| num1 \| { aux \| vty } num2 }	Use this command in user view.

Accessing the device through SNMP

You can run SNMP on an NMS to access the device MIB and perform Get and Set operations to manage and monitor the device.

Figure 10 SNMP access diagram

The device supports SNMPv1, SNMPv2c, and SNMPv3, and can cooperate with various network management software products, including IMC. However, the device and the NMS must use the same SNMP version. For more information about SNMP, see Network Management and Monitoring Configuration Guide.

By default, SNMP access is disabled. To access the device through SNMP, you must log in to the device through any other method and configure SNMP access.

Controlling user access

Use ACLs to prevent unauthorized access and configure command authorization and accounting to monitor and control user behavior. For more information about ACLs, see ACL and QoS Configuration Guide.

FIPS compliance

Telnet is not supported in FIPS mode.

Controlling Telnet/SSH logins

Use basic ACLs (2000 to 2999) to filter Telnet and SSH logins by source IP address. Use advanced ACLs (3000 to 3999) to filter Telnet and SSH logins by source and/or destination IP address. Use Ethernet frame header ACLs (4000 to 4999) to filter Telnet and SSH logins by source MAC address.

If an applied ACL does not exist or does not have any rules, no user login restriction is applied. If the ACL exists and has rules, only users permitted by the ACL can access the device through Telnet or SSH.

Configuration procedures

To control Telnet logins:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Apply an ACL to filter Telnet logins.	· telnet server acl acl-number · telnet server ipv6 acl [ ipv6 ] acl-number	By default, no ACL is used to filter Telnet logins.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Apply an ACL to filter Telnet logins.

· telnet server acl acl-number

· telnet server ipv6 acl [ ipv6 ] acl-number

By default, no ACL is used to filter Telnet logins.

To control SSH logins:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Apply an ACL to filter SSH logins.	· ssh server acl { advanced-acl-number \| basic-acl-number \| mac-acl-number } · ssh server ipv6 acl { ipv6 { advanced-acl-number \| basic-acl-number } \| mac-acl-number }	By default, no ACL is used to filter SSH logins. For more information about these two commands, see Security Command Reference.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Apply an ACL to filter SSH logins.

· ssh server acl { advanced-acl-number | basic-acl-number | mac-acl-number }

· ssh server ipv6 acl { ipv6 { advanced-acl-number | basic-acl-number } | mac-acl-number }

By default, no ACL is used to filter SSH logins.

For more information about these two commands, see Security Command Reference.

Configuration example

Network requirements

As shown in Figure 11, the device is a Telnet server.

Configure the device to permit only Telnet packets sourced from Host A and Host B.

Figure 11 Network diagram

Configuration procedure

# Configure an ACL to permit packets sourced from Host A and Host B.

<Sysname> system-view

[Sysname] acl number 2000 match-order config

[Sysname-acl-basic-2000] rule 1 permit source 10.110.100.52 0

[Sysname-acl-basic-2000] rule 2 permit source 10.110.100.46 0

[Sysname-acl-basic-2000] quit

# Apply the ACL to filter Telnet logins.

[Sysname] telnet server acl 2000

Controlling SNMP access

Use a basic ACL (2000 to 2999) to control SNMP access by source IP address. To access the requested MIB view, an NMS must use a source IP address permitted by the ACL.

Configuration procedure

To control SNMPv1 or SNMPv2c access, configure ACLs and perform the following tasks:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Configure the SNMP access right.	· (Method 1.) Create an SNMP community and specify ACLs for the community: ¡ In VACM mode: snmp-agent community { read \| write } [ simple \| cipher ] community-name [ mib-view view-name ] [ acl acl-number \| acl ipv6 ipv6-acl-number ] * ¡ In RBAC mode: snmp-agent community [ simple \| cipher ] community-name user-role role-name [ acl acl-number \| acl ipv6 ipv6-acl-number ] * · (Method 2.) Create an SNMPv1/v2c group and add a user to the group, specifying ACLs for the group and user: a. snmp-agent group { v1 \| v2c } group-name [ read-view view-name ] [ write-view view-name ] [ notify-view view-name ] [ acl acl-number \| acl ipv6 ipv6-acl-number ] * b. snmp-agent usm-user { v1 \| v2c } user-name group-name [ acl acl-number \| acl ipv6 ipv6-acl-number ] *	For more information about SNMP, see Network Management and Monitoring Configuration Guide.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Configure the SNMP access right.

· (Method 1.) Create an SNMP community and specify ACLs for the community:

¡ In VACM mode:
snmp-agent community { read | write } [ simple | cipher ] community-name [ mib-view view-name ] [ acl acl-number | acl ipv6 ipv6-acl-number ] *

¡ In RBAC mode:
snmp-agent community [ simple | cipher ] community-name user-role role-name [ acl acl-number | acl ipv6 ipv6-acl-number ] *

· (Method 2.) Create an SNMPv1/v2c group and add a user to the group, specifying ACLs for the group and user:

a. snmp-agent group { v1 | v2c } group-name [ read-view view-name ] [ write-view view-name ] [ notify-view view-name ] [ acl acl-number | acl ipv6 ipv6-acl-number ] *

b. snmp-agent usm-user { v1 | v2c } user-name group-name [ acl acl-number | acl ipv6 ipv6-acl-number ] *

For more information about SNMP, see Network Management and Monitoring Configuration Guide.

To control SNMPv3 access, configure ACLs and perform the following tasks:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create an SNMPv3 group, specifying ACLs for the group.	snmp-agent group v3 group-name [ authentication \| privacy ] [ read-view view-name ] [ write-view view-name ] [ notify-view view-name ] [ acl acl-number \| acl ipv6 ipv6-acl-number ] *	N/A
3. Create an SNMPv3 user, specifying ACLs for the user.	· In VACM mode: snmp-agent usm-user v3 user-name group-name [ remote { ip-address \| ipv6 ipv6-address } [ vpn-instance vpn-instance-name ] ] [ { cipher \| simple } authentication-mode { md5 \| sha } auth-password [ privacy-mode { aes128 \| 3des \| des56 } priv-password ] ] [ acl acl-number \| acl ipv6 ipv6-acl-number ] * · In RBAC mode: snmp-agent usm-user v3 user-name user-role role-name [ remote { ip-address \| ipv6 ipv6-address } [ vpn-instance vpn-instance-name ] ] [ { cipher \| simple } authentication-mode { md5 \| sha } auth-password [ privacy-mode { aes128 \| 3des \| des56 } priv-password ] ] [ acl acl-number \| acl ipv6 ipv6-acl-number ] *	For more information about SNMP, see Network Management and Monitoring Configuration Guide.

Configuration example

Network requirements

As shown in Figure 12, the device is running SNMP.

Configure the device to allow Host A and Host B to access the device through SNMP.

Figure 12 Network diagram

Configuration procedure

# Create an ACL to permit packets sourced from Host A and Host B.

<Sysname> system-view

[Sysname] acl number 2000 match-order config

[Sysname-acl-basic-2000] rule 1 permit source 10.110.100.52 0

[Sysname-acl-basic-2000] rule 2 permit source 10.110.100.46 0

[Sysname-acl-basic-2000] quit

# Associate the ACL with the SNMP community and the SNMP group.

[Sysname] snmp-agent community read aaa acl 2000

[Sysname] snmp-agent group v2c groupa acl 2000

[Sysname] snmp-agent usm-user v2c usera groupa acl 2000

Configuring command authorization

By default, commands are available for a user depending only on that user's user roles. When the authentication mode is scheme, you can configure the command authorization feature to further control access to commands.

After you enable command authorization, a user can use only commands that are permitted by both the AAA scheme and user role.

This section provides the procedure for configuring command authorization. To make the command authorization feature take effect, you must configure a command authorization method in ISP domain view. For more information, see Security Configuration Guide.

Configuration procedure

To configure command authorization:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter user line view or user line class view.	· Enter user line view: line { first-number1 [ last-number1 ] \| { aux \| vty } first-number2 [ last-number2 ] } · Enter user line class view: line class { aux \| vty }	A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class. A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view. A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.
3. Enable scheme authentication.	authentication-mode scheme	By default, authentication is disabled for AUX lines, and password authentication is enabled for VTY lines. In VTY line view, this command is associated with the protocol inbound command. If you specify a non-default value for only one of the two commands in VTY line view, the other command uses the default setting, regardless of the setting in VTY line class view.
4. Enable command authorization.	command authorization	By default, command authorization is disabled, and the commands available for a user vary only by user role. If the command authorization command is configured in user line class view, command authorization is enabled on all user lines in the class. You cannot configure the undo command authorization command in the view of a user line in the class.

Configuration example

Network requirements

As shown in Figure 13, Host A needs to log in to the device to manage the device.

Configure the device to perform the following tasks:

· Allows Host A to Telnet in after authentication.

· Uses the HWTACACS server to control the commands that the user can execute.

· If the HWTACACS server is not available, uses local authorization.

Figure 13 Network diagram

Configuration procedure

# Assign IP addresses to relevant interfaces. Make sure the device and the HWTACACS server can reach each other. Make sure the device and Host A can reach each other. (Details not shown.)

# Enable the Telnet server.

<Device> system-view

[Device] telnet server enable

# Enable scheme authentication for user lines VTY 0 through VTY 63.

[Device] line vty 0 63

[Device-line-vty0-63] authentication-mode scheme

# Enable command authorization for the user lines.

[Device-line-vty0-63] command authorization

[Device-line-vty0-63] quit

# Create HWTACACS scheme tac.

[Device] hwtacacs scheme tac

# Configure the scheme to use the HWTACACS server at 192.168.2.20:49 for authentication and authorization.

[Device-hwtacacs-tac] primary authentication 192.168.2.20 49

[Device-hwtacacs-tac] primary authorization 192.168.2.20 49

# Set the shared keys to expert.

[Device-hwtacacs-tac] key authentication expert

[Device-hwtacacs-tac] key authorization expert

# Remove domain names from usernames sent to the HWTACACS server.

[Device-hwtacacs-tac] user-name-format without-domain

[Device-hwtacacs-tac] quit

# Configure the system-predefined domain system. Use the HWTACACS scheme tac for login user authentication and command authorization. Use local authentication and local authorization as the backup method.

[Device] domain system

[Device-isp-system] authentication login hwtacacs-scheme tac local

[Device-isp-system] authorization command hwtacacs-scheme tac local

[Device-isp-system] quit

# Create local user monitor. Set the password to 123, the service type to Telnet, and the default user role to level-1.

[Device] local-user monitor

[Device-luser-manage-admin] password cipher 123

[Device-luser-manage-admin] service-type telnet

[Device-luser-manage-admin] authorization-attribute user-role level-1

Configuring command accounting

Command accounting allows the HWTACACS server to record all executed commands that are supported by the device, regardless of the command execution result. This feature helps control and monitor user behavior on the device.

When command accounting is disabled, the accounting server does not record the commands executed by users. If command accounting is enabled but command authorization is not, every executed command is recorded on the HWTACACS server. If both command accounting and command authorization are enabled, only authorized commands that are executed are recorded on the HWTACACS server.

This section provides only the procedure for configuring command accounting. To make the command accounting feature take effect, you must configure a command accounting method in ISP domain view. For more information, see Security Configuration Guide.

Configuration procedure

To configure command accounting:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter user line view or user line class view.	· Enter user line view: line { first-number1 [ last-number1 ] \| { aux \| vty } first-number2 [ last-number2 ] } · Enter user line class view: line class { aux \| vty }	A setting in user line view is applied only to the user line. A setting in user line class view is applied to all user lines of the class. A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view. A setting in user line view takes effect immediately and affects the online user. A setting in user line class view does not affect online users and takes effect only for new login users.
3. Enable scheme authentication.	authentication-mode scheme	By default, authentication is disabled for AUX lines, and password authentication is enabled for VTY lines. In VTY line view, this command is associated with the protocol inbound command. If you specify a non-default value for only one of the two commands in VTY line view, the other command uses the default setting, regardless of the setting in VTY line class view.
4. Enable command accounting.	command accounting	By default, command accounting is disabled, and the accounting server does not record the commands executed by users. If the command accounting command is configured in user line class view, command accounting is enabled on all user lines in the class. You cannot configure the undo command accounting command in the view of a user line in the class.

Configuration example

Network requirements

As shown in Figure 14, users need to log in to the device to manage the device.

Configure the device to send commands executed by users to the HWTACACS server to monitor and control user operations on the device.

Figure 14 Network diagram

Configuration procedure

# Enable the Telnet server.

<Device> system-view

[Device] telnet server enable

# Enable command accounting for user line AUX 0.

[Device] line aux 0

[Device-line-aux0] command accounting

[Device-line-aux0] quit

# Enable command accounting for user lines VTY 0 through VTY 63.

[Device] line vty 0 63

[Device-line-vty0-63] command accounting

[Device-line-vty0-63] quit

# Create HWTACACS scheme tac.

[Device] hwtacacs scheme tac

# Configure the scheme to use the HWTACACS server at 192.168.2.20:49 for accounting.

[Device-hwtacacs-tac] primary accounting 192.168.2.20 49

# Set the shared key to expert.

[Device-hwtacacs-tac] key accounting expert

# Remove domain names from usernames sent to the HWTACACS server.

[Device-hwtacacs-tac] user-name-format without-domain

[Device-hwtacacs-tac] quit

# Configure the system-predefined domain system to use the HWTACACS scheme for command accounting.

[Device] domain system

[Device-isp-system] accounting command hwtacacs-scheme tac

[Device-isp-system] quit

01-Fundamentals Configuration Guide

Disabling authentication for console login

Configuring common AUX line settings

Logging in through Telnet

Configuring Telnet login on the device

Configuring password authentication for Telnet login

Configuring scheme authentication for Telnet login

Setting the maximum number of concurrent Telnet users

Configuring common VTY line settings

Using the device to log in to a Telnet server

Configuring the device as an SSH server

Using the device to log in to an SSH server

Displaying and maintaining CLI login

Controlling Telnet/SSH logins

Configuration example

Network requirements

Configuration procedure

Network requirements

Configuration procedure

Network requirements

Configuration procedure

Network requirements

Configuration procedure

Cloud & AI

InterConnect

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Resources

Partner Business Management

Company Information

News & Events

Contact Us