inbound: Restricts Telnet or SSH connections established in the inbound direction through the VTY user interface. If the received packets for establishing a Telnet or SSH connection are permitted by an ACL rule, the connection is allowed to be established. When the device functions as a Telnet server or SSH server, this keyword is used to control access of Telnet clients or SSH clients.

outbound: Restricts Telnet connections established in the outbound direction through the VTY user interface. If the packets sent for establishing a Telnet connection are permitted by an ACL rule, the connection is allowed to be established. When the device functions as a Telnet client, this keyword is used to define Telnet servers accessible to the client.

Description

Use acl to reference ACLs to control access to the VTY user interface.

Use undo acl to cancel the ACL application. For more information about ACL, see ACL and QoS Command Reference.

By default, access to the VTY user interface is not restricted.

If no ACL is referenced in VTY user interface view, the VTY user interface has no access control over establishing a Telnet or SSH connection.

If an ACL is referenced in VTY user interface view, the connection is permitted to be established only when packets for establishing a Telnet or SSH connection match a permit statement in the ACL.

The system regards the basic/advanced ACL with the inbound keyword, the basic/advanced ACL with the outbound keyword, WLAN ACL, and Ethernet frame header ACL as four different types of ACLs, which can coexist in one VTY user interface. The match order is WLAN ACL, basic/advanced ACL, Ethernet frame header ACL. At most one ACL of each type can be referenced in the same VTY user interface, and the last configured one takes effect.

Examples

# Allow only the user with the IP address of 192.168.1.26 to access the device through Telnet or SSH.

<Sysname> system-view

[Sysname] acl number 2001

[Sysname-acl-basic-2001] rule permit source 192.168.1.26 0

[Sysname-acl-basic-2001] quit

[Sysname] user-interface vty 0

[Sysname-ui-vty0] acl 2001 inbound

After your configuration, user A (with the IP address 192.168.1.26) can Telnet to the device while user B (with the IP address 192.168.1.60) cannot Telnet to the device. Upon a connection failure, a message appears, saying "%connection closed by remote host!"

# Allow the device to only Telnet to the Telnet server with IP address 192.168.1.41.

<Sysname> system-view

[Sysname] acl number 3001

[Sysname-acl-adv-3001] rule permit tcp destination 192.168.1.41 0

[Sysname-acl-adv-3001] quit

[Sysname] user-interface vty 0 4

[Sysname-ui-vty0-4] acl 3001 outbound

[Sysname-ui-vty0-4] return

After your configuration, if you Telnet to 192.168.1.46, your operation fails.

<Sysname> telnet 192.168.1.46

%Can't access the host from this terminal!

But you can Telnet to 192.168.1.41.

<Sysname> telnet 192.168.1.41

Trying 192.168.1.41 ...

Press CTRL+K to abort

Connected to 192.168.1.41 ...

# Allow only the WLAN client with the SSID of Admin to access the device through VTY 0.

<Sysname> system-view

[Sysname] acl number 100

[Sysname-acl-wlan-100] rule permit ssid Admin

[Sysname-acl-wlan-100] quit

[Sysname] user-interface vty 0

[Sysname-ui-vty0] acl 100 inbound

activation-key

Syntax

activation-key character

undo activation-key

View

User interface view

Default level

3: Manage level

Parameters

character: Shortcut key for starting a terminal session, a single character (or its corresponding ASCII code value in the range of 0 to 127) or a string of 1 to 3 characters. However, only the first character functions as the shortcut key. For example, if you input an ASCII code value of 97, the system uses its corresponding character a as the shortcut key. If you input string b@c, the system uses the first character b as the shortcut key.

Description

Use activation-key to define a shortcut key for starting a terminal session.

Use undo activation-key to restore the default.

By default, pressing the Enter key starts a terminal session. However, if a new shortcut key is defined with the activation-key command, the Enter key no longer functions. To display the shortcut key you have defined, use the display current-configuration command.

NOTE:

The activation-key command is not supported by the VTY user interface.

Examples

# Configure character s as the shortcut key for starting a terminal session on the console port.

<Sysname> system-view

[Sysname] user-interface console 0

[Sysname-ui-console0] activation-key s

To verify the configuration:

1. Exit the terminal session on the console port.

[Sysname-ui-console0] return

<Sysname> quit

2. Log in to the console port again.

The following message appears.

******************************************************************************

* Without the owner's prior written consent, *

* no decompiling or reverse-engineering shall be allowed. *

******************************************************************************

User interface con0 is available.

Please press ENTER.

3. At this moment, pressing Enter does not start a session. To start the terminal session, enter s instead.

%Mar 2 18:40:27:981 2005 Sysname SHELL/5/LOGIN: Console login from con0

auto-execute command

Syntax

auto-execute command command

undo auto-execute command

View

User interface view

Default level

3: Manage level

Parameters

command: Specifies a command to be automatically executed.

Description

Use auto-execute command to specify a command to be automatically executed when a user logs in to the current user interface.

Use undo auto-execute command to remove the configuration.

By default, command auto-execution is disabled.

The auto-execute command command is not supported by the console port, or the AUX port when the device has only one AUX port and no console port.

The system automatically executes the specified command when a user logs in to the user interface, and tears down the user connection after the command is executed. If the command triggers another task, the system does not tear down the user connection until the task is completed.

Typically, you use can use the auto-execute command telnet command in user interface view to enable a user to automatically Telnet to the specified host when the user logs in to the device. After the user terminates the connection with the host, the user's connection with the device is automatically terminated.

CAUTION:

The auto-execute command command may disable you from configuring the system through the user interface to which the command is applied. Before configuring the command and saving the configuration (by using the save command), make sure that you can access the device through VTY, console, or AUX interfaces to remove the configuration when a problem occurs.

Examples

# Configure the device to automatically Telnet to 192.168.1.41 after a user logs in to interface VTY 0.

<Sysname> system-view

[Sysname] user-interface vty 0

[Sysname -ui-vty0] auto-execute command telnet 192.168.1.41

% This action will lead to configuration failure through ui-vty0. Are you sure?

[Y/N]:y

[Sysname-ui-vty0]

To verify the configuration, Telnet to 192.168.1.40:

C:\> telnet 192.168.1.40

******************************************************************************

* Without the owner's prior written consent, *

* no decompiling or reverse-engineering shall be allowed. *

******************************************************************************

Trying 192.168.1.41 ...

Press CTRL+K to abort

Connected to 192.168.1.41 ...

******************************************************************************

* Without the owner's prior written consent, *

* no decompiling or reverse-engineering shall be allowed. *

******************************************************************************

<Sysname.41>

This operation is the same as directly logging in to the device at 192.168.1.41. If the Telnet connection to 192.168.1.41 is broken down, the Telnet connection to 192.168.1.40 breaks down at the same time.

authentication-mode

Syntax

authentication-mode { none | password | scheme }

undo authentication-mode

View

User interface view

Default level

3: Manage level

Parameters

none: Performs no authentication.

password: Performs local password authentication.

scheme: Performs AAA authentication. For more information about AAA, see Security Configuration Guide.

Description

Use authentication-mode to set the authentication mode for the user interface.

Use undo authentication-mode to restore the default.

By default, the authentication mode for VTY and AUX user interfaces is password, and for the console user interfaces is none.

Related commands: set authentication password.

Examples

# Specify that no authentication is needed for VTY 0. (This mode is insecure.)

<Sysname> system-view

[Sysname] user-interface vty 0

[Sysname-ui-vty0] authentication-mode none

# Use password authentication when users log in to the device through VTY 0, and set the authentication password to 321.

<Sysname> system-view

[Sysname] user-interface vty 0

[Sysname-ui-vty0] authentication-mode password

[Sysname-ui-vty0] set authentication password cipher 321

# Authenticate users by username and password for VTY 0. Set the username to 123 and the password to 321.

<Sysname> system-view

[Sysname] user-interface vty 0

[Sysname-ui-vty0] authentication-mode scheme

[Sysname-ui-vty0] quit

[Sysname] local-user 123

[Sysname-luser-123] password cipher 321

[Sysname-luser-123] service-type telnet

[Sysname-luser-123] authorization-attribute level 3

command accounting

Syntax

command accounting

undo command accounting

View

User interface view

Default level

3: Manage level

Parameters

None

Description

Use command accounting to enable command accounting.

Use undo command accounting to restore the default.

By default, command accounting is disabled. The accounting server does not record the commands that users have executed.

When command accounting is enabled and command authorization is not, every executed command is recorded on the HWTACACS server.

When both command accounting and command authorization are enabled, only the authorized and executed commands are recorded on the HWTACACS server.

Examples

# Enable command accounting on VTY 0. Then the HWTACACS server records the commands executed by users that have logged in through VTY 0.

<Sysname> system-view

[Sysname] user-interface vty 0

[Sysname-ui-vty0] command accounting

command authorization

Syntax

command authorization

undo command authorization

View

User interface view

Default level

3: Manage level

Parameters

None

Description

Use command authorization to enable command authorization.

Use undo command authorization to restore the default.

By default, command authorization is disabled. Logged-in users can execute commands without authorization.

With command authorization enabled, users can perform only commands authorized by the server.

Examples

# Enable command accounting for VTY 0 so that users logging in from VTY 0 can perform only the commands authorized by the HWTACACS server.

<Sysname> system-view

[Sysname] user-interface vty 0

[Sysname-ui-vty0] command authorization

databits

Syntax

databits { 5 | 6 | 7 | 8 }

undo databits

View

User interface view

Default level

2: System level

Parameters

5: Sets 5 data bits for each character.

6: Sets 6 data bits for each character.

7: Sets 7 data bits for each character.

8: Sets 8 data bits for each character.

Description

Use databits to set data bits for each character.

Use undo databits to restore the default.

By default, 8 data bits are set for each character.

NOTE:

· The command is only applicable to asynchronous serial interfaces (including AUX and console ports).

· The data bits setting must be the same for the user interfaces of the connecting ports on the device and the terminal device for communication.

Examples

# Specify 5 data bits for each character.

<Sysname> system-view

[Sysname] user-interface aux 0

[Sysname-ui-aux0] databits 5

display ip http

Syntax

display ip http [ | { begin | exclude | include } regular-expression ]

View

Any view

Default level

1: Monitor level

Parameters

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Description

Use display ip http to display HTTP information.

Examples

# Display information about HTTP..

<Sysname> display ip http

HTTP port: 80

WLAN ACL: 100

Basic ACL: 2222

Current connection: 0

Operation status: Running

Table 1 Command output

Field	Description
HTTP port	Port number used by the HTTP service.
WLAN ACL	WLAN ACL associated with the HTTP service.
Basic ACL	Basic ACL number associated with the HTTP service.
Current connection	Number of current connections.
Operation status	Operation status, which takes the following values: · Running—The HTTP service is enabled. · Stopped—The HTTP service is disabled.

display ip https

Syntax

display ip https [ | { begin | exclude | include } regular-expression ]

View

Any view

Default level

1: Monitor level

Parameters

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Description

Use display ip https to display information about HTTPS.

Examples

# Display information about HTTPS.

<Sysname> display ip https

HTTPS port: 443

SSL server policy: test

Certificate access-control-policy:

WLAN ACL: 100

Basic ACL: 2222

Current connection: 0

Operation status: Running

Table 2 Command output

Field	Description
HTTPS port	Port number used by the HTTPS service.
SSL server policy	The SSL server policy associated with the HTTPS service.
Certificate access-control-policy	The certificate attribute access control policy associated with the HTTPS service.
WLAN ACL	WLAN ACL number associated with the HTTPS service.
Basic ACL	The basic ACL number associated with the HTTPS service.
Current connection	Number of current connections.
Operation status	Operation status, which takes the following values: · Running—The HTTPS service is enabled. · Stopped—The HTTPS service is disabled.

display telnet client configuration

Syntax

display telnet client configuration [ | { begin | exclude | include } regular-expression ]

View

Any view

Default level

1: Monitor level

Parameters

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Description

Use display telnet client configuration to display the configuration of the device when it serves as a Telnet client.

Examples

# Display the configuration of the device when it serves as a Telnet client.

<Sysname> display telnet client configuration

The source IP address is 1.1.1.1.

The output shows that when the device serves as a client, the source IPv4 address for sending Telnet packets is 1.1.1.1.

display user-interface

Syntax

display user-interface [ num1 | { aux | console | vty } num2 ] [ summary ] [ | { begin | exclude | include } regular-expression ]

View

Any view

Default level

1: Monitor level

Parameters

num1: Absolute number of a user interface. The value range varies with devices, and typically starts from 0. For more information, see About the WX Series Access Controllers Command References.

num2: Relative number of a user interface. It is 0 for the AUX or console port, and in the range of 0 to 4 for a VTY user interface.

summary: Displays summary about user interfaces.

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Description

Use display user-interface to display information about the specified or all user interfaces.

If the summary keyword is not included, the command displays the type of the user interface, the absolute or relative number, the transmission rate, the user privilege level, the authentication mode, and the access port.

If the summary keyword is included, the command displays all user interface numbers and types.

Examples

# Display information about user interface 0.

<Sysname> display user-interface 0

Idx Type Tx/Rx Modem Privi Auth Int

+ 0 CON 0 9600 - 3 N -

+ : Current user-interface is active.

F : Current user-interface is active and work in async mode.

Idx : Absolute index of user-interface.

Type : Type and relative index of user-interface.

Privi: The privilege of user-interface.

Auth : The authentication mode of user-interface.

Int : The physical location of UIs.

A : Authentication use AAA.

L : Authentication use local database.

N : Current UI need not authentication.

P : Authentication use current UI's password.

Table 3 Command output

Field	Description
+	The current user interface is active.
F	The current user interface is active and operating in asynchronous mode.
Idx	Absolute number of the user interface.
Type	Type and relative number of the user interface.
Tx/Rx	Transmission/Receive rate of the user interface
Privi	Indicates the command level of a user under that user interface.
Auth	Authentication mode for the users, which can be A, P, L, and N.
Int	The physical port that corresponds to the user interface. For user interfaces of console ports, AUX ports, and VTY interfaces, an hyphen (-) is displayed.
A	AAA authentication.
L	Local authentication, not supported.
N	No authentication.
P	Password authentication.

# Display summary about all user interfaces.

<Sysname> display user-interface summary

User interface type : [CON]

0:X

User interface type : [AUX]

1:X

User interface type : [VTY]

2:XUXU U

3 character mode users. (U)

4 UI never used. (X)

3 total UI in use

Table 4 Command output

Field	Description
User interface type	Type of user interface (CON/AUX/VTY).
0:X	0 represents the absolute number of the user interface. X means this user interface is not used; U means this user interface is in use. For example, 2:XUXU U shows that the absolute number of the first user interface is 2, and the user interface is not in use.
character mode users. (U)	Number of users, or, the total number of character U.
UI never used. (X)	Number of user interfaces not used, or, the total number of character X.
total UI in use	Total number of user interfaces in use.

display users

Syntax

display users [ all ] [ | { begin | exclude | include } regular-expression ]

View

Any view

Default level

1: Monitor level

Parameters

all: Displays information about all user interfaces that the device supports.

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Description

Use display users to display information about the user interfaces that are being used.

Use display users all to display information about all user interfaces supported by the device.

Examples

# Display information about the user interfaces that are being used.

<Sysname> display users

The user application information of the user interface(s):

Idx UI Delay Type Userlevel

+ 178 VTY 0 00:00:00 TEL 3

179 VTY 1 00:02:34 TEL 3

Following are more details.

VTY 0 :

Location: 192.168.1.54

VTY 1 :

Location: 192.168.1.58

+ : Current operation user.

F : Current operation user work in async mode.

The output shows that two users have logged in to the device. The one with IP address 192.168.1.54 uses VTY 0, and the other with IP address 192.168.1.58 uses VTY 1.

Table 5 Command output

Field	Description
Idx	Absolute number of the user interface.
UI	Relative number of the user interface. For example, with VTY, the first column represents user interface type, and the second column represents the relative number of the user interface.
Delay	Time elapsed since the user's last input, in the format hh:mm:ss.
Type	User type, such as Telnet or SSH.
Userlevel	User level: 0 for visit, 1 for monitor, 2 for system, and 3 for manage.
+	Current user.
Location	IP address of the user.
F	The current user is operating in asynchronous mode.

escape-key

Syntax

escape-key { default | character }

undo escape-key

View

User interface view

Default level

3: Manage level

Parameters

character: Specifies the escape key for terminating a task, a single character (or its corresponding ASCII code value in the range of 0 to 127) or a string of 1 to 3 characters. Only the first character of a string functions as the escape key. For example, if you enter an ASCII code value of 113, the system uses its corresponding character q as the escape key. If you enter the string q@c, the system uses the first character q as the escape key.

default: Restores the default escape key sequence of Ctrl+C.

Description

Use escape-key to define a escape key for terminating a task.

Use undo escape-key to disable the escape key for terminating tasks.

By default, the key sequence Ctrl+C is used to terminate tasks.

After you define a new escape key by using the escape-key command, the new escape key is used to terminate a task. To display the escape key you have defined, use the display current-configuration command.

If you set the character argument in a user interface of a device, when you use the user interface to log in to the device and then Telnet to another device, the character argument can be used as a control character to terminate a task rather than used as a common character. For example, if you specify character e in VTY 0 user interface of Device A, when you log in to Device A by using VTY 0 from a PC (HyperTerminal), you can input e as a common character on the PC, and you can also use e to terminate the task running on Device A. If you Telnet to Device B from Device A, you can only use e to terminate the task running on Device B, rather than use e as a common character. A good practice is to use a key sequence.

Examples

# Define key a as the escape key for terminating a task.

<Sysname> system-view

[Sysname] user-interface console 0

[Sysname-ui-console0] escape-key a

To verify the configuration:

# Ping the IP address of 192.168.1.49 and use the -c keyword to specify the number of ICMP echo packets to be sent as 20.

<Sysname> ping -c 20 192.168.1.49

PING 192.168.1.49: 56 data bytes, press a to break

Reply from 192.168.1.49: bytes=56 Sequence=1 ttl=255 time=3 ms

Reply from 192.168.1.49: bytes=56 Sequence=2 ttl=255 time=3 ms

# Enter a. The task terminates immediately and the system returns to system view.

--- 192.168.1.49 ping statistics ---

2 packet(s) transmitted

2 packet(s) received

0.00% packet loss

round-trip min/avg/max = 3/3/3 ms

free user-interface

Syntax

free user-interface { num1 | { aux | console | vty } num2 }

View

User view

Default level

3: Manage level

Parameters

num1: Absolute number of a user interface. The value range varies with devices, and typically starts from 0. For more information, see About the WX Series Access Controllers Command References.

num2: Relative number of a user interface. It is 0 for an AUX or console port, and in the range of 0 to 4 for a VTY user interface.

Description

Use free user-interface to release the connections established on the specified user interface.

This command cannot release the connection that you are using.

Examples

# Display the connection established on user interface VTY 1.

<Sysname> display users

The user application information of the user interface(s):

Idx UI Delay Type Userlevel

+ 82 VTY 0 00:00:00 TEL 3

83 VTY 1 00:00:03 TEL 3

Following are more details.

VTY 0 :

Location: 192.168.1.26

VTY 1 :

Location: 192.168.1.20

+ : Current operation user.

F : Current operation user work in async mode.

// You can display information about the users that are using the device.

<Sysname> free user-interface vty 1

Are you sure to free user-interface vty1? [Y/N]:y

// To make configurations without interruption from the user using VTY 1, you can release the connection established on VTY 1.

history-command max-size

Syntax

history-command max-size size-value

undo history-command max-size

View

User interface view

Default level

2: System level

Parameters

size-value: Specifies the maximum number of history commands that the buffer can store. The value is in the range of 0 to 256.

Description

Use history-command max-size to set the size of the history command buffer of the current user interface.

Use undo history-command max-size to restore the default.

By default, the buffer saves 10 history commands.

The history command buffer saves executed history commands per user interface and buffers for different user interfaces do not affect each other. To display the commands that are stored in the history buffer, use the display history-command command. To view the recently executed commands, press the upper arrow or lower arrow key. For more information about the display history-command command, see Fundamentals Command Reference.

After you terminate the current session, the system automatically removes the commands saved in the corresponding history buffer.

Examples

# Set the buffer to store 20 history commands at most.

<Sysname> system-view

[Sysname] user-interface console 0

[Sysname-ui-console0] history-command max-size 20

idle-timeout

Syntax

idle-timeout minutes [ seconds ]

undo idle-timeout

View

User interface view

Default level

2: System level

Parameters

minutes: Specifies the timeout time in minutes, which is in the range of 0 to 35791, and defaults to 10 minutes.

seconds: Specifies timeout time in seconds, which is in the range of 0 to 59, and defaults to 0 seconds.

Description

Use idle-timeout to set the idle-timeout timer.

Use undo idle-timeout to restore the default.

The default idle-timeout is 10 minutes.

NOTE:

· The system automatically terminates the user's connections if there is no information interaction between the device and the users within the idle timeout time.

· Setting idle-timeout to zero disables the timer. In this case, connections are maintained unless you terminate them.

Examples

# Set the idle-timeout timer to 1 minute and 30 seconds.

<Sysname> system-view

[Sysname] user-interface console 0

[Sysname-ui-console0] idle-timeout 1 30

ip http acl

Syntax

ip http acl acl-number

undo ip http acl acl-number

View

System view

Default level

2: System level

Parameters

acl-number: ACL number. A WLAN ACL is in the range of 100 to 199, and a basic IPv4 ACL is in the range of 2000 to 2999.

Description

Use ip http acl to associate the HTTP service with an ACL.

Use undo ip http acl to remove the association.

By default, the HTTP service is not associated with any ACL.

After the HTTP service is associated with an ACL, only the clients permitted by the ACL can access the device through HTTP.

The HTTP service can be associated with a WLAN ACL and a basic ACL, and the two types of ACLs will not overwrite each other. However, ACLs of the same type will overwrite each other. If you execute the ip http acl command multiple times to associate the HTTP service with the same type of ACLs, the HTTP service is only associated with the last specified ACL.

When the HTTP service is associated with a WLAN ACL, the HTTP service uses this ACL to filter wireless clients only, and does not filter wired clients with this ACL.

Related commands: display ip http (Fundamentals Command Reference) and acl number (ACL and QoS Command Reference).

Examples

# Associate the HTTP service with ACL 100 to allow only the wireless client with the SSID user-ssid-name to access the device through HTTP.

<Sysname> system-view

[Sysname] acl number 100

[Sysname-acl-wlan-100] rule permit ssid user-ssid-name

[Sysname-acl-wlan-100] quit

[Sysname] ip http acl 100

# Associate the HTTP service with ACL 2001 to only allow the clients within the 10.10.0.0/16 network to access the device through HTTP.

<Sysname> system-view

[Sysname] acl number 2001

[Sysname-acl-basic-2001] rule permit source 10.10.0.0 0.0.255.255

[Sysname-acl-basic-2001] quit

[Sysname] ip http acl 2001

ip http enable

Syntax

ip http enable

undo ip http enable

View

System view

Default level

2: System level

Parameters

None

Description

Use ip http enable to enable the HTTP service.

Use undo ip http enable to disable the HTTP service.

The device can act as the HTTP server that can be accessed only after the HTTP service is enabled.

Related commands: display ip http.

Examples

# Enable the HTTP service.

<Sysname> system-view

[Sysname] ip http enable

# Disable the HTTP service.

<Sysname> system-view

[Sysname] undo ip http enable

ip http port

Syntax

ip http port port-number

undo ip http port

View

System view

Default level

3: Manage level

Parameters

port-number: Port number of the HTTP service, which is in the range of 1 to 65535.

Description

Use ip http port to configure the port number of the HTTP service.

Use undo ip http port to restore the default.

By default, the port number of the HTTP service is 80.

Verify that the port number is not used by another service, because this command does not check for conflicts with configured port numbers.

Related commands: display ip http.

Examples

# Configure the port number of the HTTP service as 8080.

<Sysname> system-view

[Sysname] ip http port 8080

ip https acl

Syntax

ip https acl acl-number

undo ip https acl acl-number

View

System view

Default level

3: Manage level

Parameters

acl-number: ACL number. A WLAN ACL is in the range of 100 to 199, and a basic IPv4 ACL is in the range of 2000 to 2999.

Description

Use ip https acl to associate the HTTPS service with an ACL.

Use undo ip https acl to remove the association.

By default, the HTTPS service is not associated with any ACL.

After the HTTPS service is associated with an ACL, only the clients permitted by the ACL can access the device.

The HTTPS service can be associated with a WLAN ACL and basic ACL, and the two types of ACLs will not overwrite each other. However, ACLs of the same type will overwrite each other. If you execute the ip https acl command multiple times to associate the HTTPS service with the same type of ACLs, the HTTPS service is only associated with the last specified ACL.

When the HTTPS service is associated with a WLAN ACL, the HTTPS service uses this ACL to filter wireless clients only, and does not filter wired clients with this ACL.

Related commands: display ip https (Fundamentals Command Reference) and acl number (ACL and QoS Command Reference).

Examples

# Associate the HTTPS service with ACL 100 to only allow the wireless client with the SSID user-ssid-name to access the device through HTTP.

<Sysname> system-view

[Sysname] acl number 100

[Sysname-acl-wlan-100] rule permit ssid user-ssid-name

[Sysname-acl-wlan-100] quit

[Sysname] ip https acl 100

# Associate the HTTPS service with ACL 2001 to only allow the clients within the 10.10.0.0/16 network segment to access the HTTPS server through HTTP.

<Sysname> system-view

[Sysname] acl number 2001

[Sysname-acl-basic-2001] rule permit source 10.10.0.0 0.0.255.255

[Sysname-acl-basic-2001] quit

[Sysname] ip https acl 2001

ip https certificate access-control-policy

Syntax

ip https certificate access-control-policy policy-name

undo ip https certificate access-control-policy

View

System view

Default level

3: Manage level

Parameters

policy-name: Name of the certificate attribute access control policy, a string of 1 to 16 characters.

Description

Use ip https certificate access-control-policy to associate the HTTPS service with a certificate attribute access control policy.

Use undo ip https certificate access-control-policy to remove the association.

By default, the HTTPS service is not associated with any certificate attribute access control policy.

Association of the HTTPS service with a certificate attribute access control policy can control the access rights of clients.

Related commands: display ip https (Fundamentals Command Reference) and pki certificate access-control-policy (Security Command Reference).

Examples

# Associate the HTTPS server to certificate attribute access control policy myacl.

<Sysname> system-view

[Sysname] ip https certificate access-control-policy myacl

ip https enable

Syntax

ip https enable

undo ip https enable

View

System view

Default level

3: Manage level

Parameters

None

Description

Use ip https enable to enable the HTTPS service.

Use undo ip https enable to disable the HTTPS service.

By default, the HTTPS service is disabled.

The device can act as the HTTP server that can be accessed only after the HTTP service is enabled.

Enabling the HTTPS service triggers an SSL handshake negotiation process:

· If the local certificate of the device exists, the SSL negotiation succeeds, and the HTTPS service can be started.

· If no local certificate exists, the SSL negotiation triggers a certificate application process that often fails because it times out. If that happens, execute the ip https enable command multiple times to start the HTTPS service.

Related commands: display ip https.

Examples

# Enable the HTTPS service.

<Sysname> system-view

[Sysname] ip https enable

ip https port

Syntax

ip https port port-number

undo ip https port

View

System view

Default level

3: Manage level

Parameters

port-number: Port number of the HTTPS service, which is in the range of 1 to 65535.

Description

Use ip https port to configure the port number of the HTTPS service.

Use undo ip https port to restore the default.

By default, the port number of the HTTPS service is 443.

Verify that the port number is not used by another service, because this command does not check for conflicts with configured port numbers.

Related commands: display ip https.

Examples

# Configure the port number of the HTTPS service as 6000.

<Sysname> system-view

[Sysname] ip https port 6000

ip https ssl-server-policy

Syntax

ip https ssl-server-policy policy-name

undo ip https ssl-server-policy

View

System view

Default level

3: Manage level

Parameters

policy-name: Name of an SSL server policy, a string of 1 to 16 characters.

Description

Use ip https ssl-server-policy to associate the HTTPS service with an SSL server policy.

Use undo ip https ssl-server-policy to remove the association.

By default, the HTTPS service is not associated with any SSL server policy.

The HTTPS service can be enabled only after this command is configured successfully.

With the HTTPS service enabled, you cannot modify the associated SSL server policy or remove the association between the HTTPS service and the SSL server policy after the HTTPS service is enabled.

Related commands: display ip https; ssl server-policy (Security Command Reference).

Examples

# Associate the HTTPS service with SSL server policy myssl.

<Sysname> system-view

[Sysname] ip https ssl-server-policy myssl

lock

Syntax

lock

View

User view

Default level

3: Manage level

Parameters

None

Description

Use lock to lock the user interface. This method prevents unauthorized users from using the user interface.

When entering the lock command, you are asked to input a password (up to 16 characters) and then confirm it by inputting the password again. After locking the user interface, you must press Enter and input the correct password next time you enter this user interface.

By default, this function is disabled.

Examples

# Lock the current user interface.

<Sysname> lock

Please input password<1 to 16> to lock current user terminal interface:

Password:

Again:

locked !

Password:

parity

Syntax

parity { even | mark | none | odd | space }

undo parity

View

User interface view

Default level

2: System level

Parameters

even: Performs an even parity check.

mark: Performs a mark parity check.

none: Performs no parity check.

odd: Performs an odd parity check.

space: Performs a space parity check.

Description

Use parity to set a parity check method.

Use undo parity to restore the default.

By default, no parity check is performed.

NOTE:

· The command is only applicable to asynchronous serial interfaces (including AUX and console ports).

· The parity check setting must be the same for the user interfaces of the connecting ports on the device and the target terminal device for communication.

Examples

# Configure the AUX port to perform odd parity check.

<Sysname> system-view

[Sysname] user-interface aux 0

[Sysname-ui-aux0] parity odd

protocol inbound

Syntax

protocol inbound { all | ssh | telnet }

undo protocol inbound

View

VTY interface view

Default level

3: Manage level

Parameters

all: Supports all the protocols: Telnet and SSH.

ssh: Supports SSH only.

telnet: Supports Telnet only.

Description

Use protocol inbound to enable the current user interface to support either Telnet or SSH, or both of them. The configuration takes effect next time you log in.

Use undo protocol inbound to restore the default.

By default, all the three protocols are supported.

NOTE:

· Before configuring a user interface to support SSH, set the authentication mode to scheme for the user interface; otherwise, the protocol inbound ssh command fails. For more information, see authentication-mode.

· By default, the authentication mode of the Telnet protocol is password.

Examples

# Enable the VTYs 0 through 4 to support SSH only.

<Sysname> system-view

[Sysname] user-interface vty 0 4

[Sysname-ui-vty0-4] authentication-mode scheme

[Sysname-ui-vty0-4] protocol inbound ssh

screen-length

Syntax

screen-length screen-length

undo screen-length

View

User interface view

Default level

2: System level

Parameters

screen-length: Number of lines on the next screen, which is in the range of 0 to 512. The value of 0 disables pausing between screens of output.

Description

Use screen-length to set the number of lines on the next screen.

Use undo screen-length to restore the default.

By default, the next screen displays 24 lines.

When screen output pauses, press the Space key to display the next screen. Not all terminals support this command setting. For example, assume that you set screen-length to 40, but the terminal can display 24 lines in one screen at most. When you press Space, the device sends 40 lines to the terminal, but the next screen displays only lines 18 through 40. To view the first 17 lines, you must press the page up or page down key.

To disable multiple-screen output of the current user interface, use the screen-length disable command. For more information about the screen-length disable command, see "CLI commands."

Examples

# Set the next screen of the user interface of console port 0 to display 30 lines.

<Sysname> system-view

[Sysname] user-interface console 0

[Sysname-ui-console0] screen-length 30

send

Syntax

send { all | num1 | { aux | console | vty } num2 }

View

User view

Default level

1: Monitor level

Parameters

all: Sends messages to all user interfaces.

num1: Absolute number of a user interface. The value range varies with devices, and typically starts from 0. For more information, see About the WX Series Access Controllers Command References.

num2: Relative number of a user interface. It is 0 for an AUX or console port, and in the range of 0 to 4 for a VTY user interface.

Description

Use send to send messages to the specified user interfaces.

To end message input, press Ctrl+Z. To cancel message input and return to user view, press Ctrl+C.

Examples

# Send message hello abc to the user interface of console port 0.

<Sysname> send console 0

Enter message, end with CTRL+Z or Enter; abort with CTRL+C:

hello abc^Z

Send message? [Y/N]:y

***

***Message from con0 to con0

***

hello abc

# Assume you are using VTY 0. Before you restart the device, to inform users that are accessing the device through other user interfaces, perform the following steps:

1. Display information about all users:

<Sysname> display users

The user application information of the user interface(s):

Idx UI Delay Type Userlevel

+ 82 VTY 0 00:00:00 TEL 3

83 VTY 1 00:00:03 TEL 3

Following are more details.

VTY 0 :

Location: 192.168.1.26

VTY 1 :

Location: 192.168.1.20

+ : Current operation user.

F : Current operation user work in async mode.

// The output shows that a user is using VTY 0.

<Sysname> send vty 1

Enter message, end with CTRL+Z or Enter; abort with CTRL+C:

Note please, I will reboot the system in 3 minutes!^Z

Send message? [Y/N]:y

// A message is sent to VTY 1, telling that the system will reboot in 3 minutes.

2. If a user is trying to log in through VTY 1, the following message appears: (VTY 1 receives the message from VTY 0 when the interface ethernet command is entered.)

[Sysname] interface eth

***

***Message from vty0 to vty1

***

Note please, I will reboot the system in 3 minutes!

set authentication password

Syntax

set authentication password { cipher | simple } password

undo set authentication password

View

User interface view

Default level

3: Manage level

Parameters

cipher: Cipher text password.

simple: Plain text password.

password: A case-sensitive string. If the password format is simple, the password argument must be in plain text, and the configuration file saves the password in plain text. If the format is cipher, password can be either in cipher text or in plain text, and the configuration file always saves the password in cipher text. A plain text password can be a string of no more than 16 characters, 1234567 for example. A cipher text password or the encrypted version of the plain text password comprises 24 characters, such as _(TT8F]Y\5SQ=^Q`MAF4<1!!.

Description

Use set authentication password to set an authentication password.

Use undo set authentication password to remove the local authentication password.

By default, no local authentication password is set.

No matter whether the password format is plain text or cipher text, you must type the password in plain text during authentication.

A plain text password easily gets cracked. Therefore, a cipher text password is recommended.

Related commands: authentication-mode.

Examples

# Set the local authentication password for the user interface of console port 0 to hello.

<Sysname> system-view

[Sysname] user-interface console 0

[Sysname-ui-console0] authentication-mode password

[Sysname-ui-console0] set authentication password cipher hello

Next time you enter the system, the password is required.

shell

Syntax

shell

undo shell

View

User interface view

Default level

3: Manage level

Parameters

None

Description

Use shell to enable terminal services on the current user interface.

Use undo shell to disable terminal services on the current user interface.

The console user interface does not support the undo shell command.

The AUX user interface does not support the undo shell command when the device has only one AUX port and no console port.

You cannot disable the terminal services on the user interface through which you are logged in.

By default, terminal services are enabled on all user interfaces.

Examples

# Disable terminal services on VTYs 0 through 4, which means you cannot log in to the device through VTYs 0 through 4.

<Sysname> system-view

[Sysname] user-interface vty 0 4

[Sysname-ui-vty0-4] undo shell

% Disable ui-vty0-4 , are you sure? [Y/N]:y

[Sysname-ui-vty0-4]

The following message appears when a terminal tries to Telnet to the device:

The connection was closed by the remote host!

speed (user interface view)

Syntax

speed speed-value

undo speed

View

User interface view

Default level

2: System level

Parameters

speed-value: Transmission rate in bps. Transmission rates available with asynchronous serial interfaces include: 300 bps, 600 bps, 1200 bps, 2400 bps, 4800 bps, 9600 bps, 19200 bps, 38400 bps, 57600 bps, and 115200 bps.

The transmission rate varies with devices and configuration environment.

Description

Use speed to set the transmission rate on the user interface.

Use undo speed to restore the default transmission rate.

By default, the transmission rate is 9600 bps.

NOTE:

· The command is only applicable to asynchronous serial interfaces (including AUX and console ports).

· The transmission rate setting must be identical for the user interfaces of the connecting ports on the device and the target terminal device for communication.

Examples

# Set the transmission rate on the user interface AUX 0 to 19200 bps.

<Sysname> system-view

[Sysname] user-interface aux 0

[Sysname-ui-aux0] speed 19200

stopbits

Syntax

stopbits { 1 | 1.5 | 2 }

undo stopbits

View

User interface view

Default level

2: System level

Parameters

1: One stop bit.

1.5: One and a half stop bits.

2: Two stop bits.

Description

Use stopbits to set the number of stop bits transmitted per byte.

Use undo stopbits to restore the default.

By default, the stop bit is one.

NOTE:

· The command is only applicable to asynchronous serial interfaces (including AUX and console ports).

· The stop bits setting must be the identical for the user interfaces of the connecting ports on the device and the target device for communication.

Examples

# Set the stop bits on the user interface AUX 0 to 1.5.

<Sysname> system-view

[Sysname] user-interface aux 0

[Sysname-ui-aux0] stopbits 1.5

telnet

Syntax

telnet remote-host [ service-port ] [ source { interface interface-type interface-number | ip ip-address } ]

View

User view

Default level

0: Visit level

Parameters

remote-host: IPv4 address or host name of a remote host, a case-insensitive string of 1 to 20 characters.

service-port: TCP port number of the Telnet service on the remote host. It is in the range of 0 to 65535 and defaults to 23.

source: Specifies the source interface or source IPv4 address of Telnet packets.

interface interface-type interface-number: Specifies the source interface. The source IPv4 address of the Telnet packets sent is the IPv4 address of the specified interface. interface-type interface-number represents the interface type and number.

ip ip-address: Specifies the source IPv4 address of Telnet packets.

Description

Use telnet to Telnet to a remote host.

To terminate the current Telnet connection, press Ctrl+K or use the quit command.

The source IPv4 address or source interface specified by this command is applicable to the current Telnet connection only.

Examples

# Telnet to the remote host 1.1.1.2, specifying the source IP address of Telnet packets as 1.1.1.1.

<Sysname> telnet 1.1.1.2 source ip 1.1.1.1

telnet client source

Syntax

telnet client source { interface interface-type interface-number | ip ip-address }

undo telnet client source

View

System view

Default level

2: System level

Parameters

ip ip-address: Specifies the source IPv4 address of Telnet packets.

Description

Use telnet client source to specify the source IPv4 address or source interface for sending Telnet packets when the device serves as a Telnet client.

Use undo telnet client source to remove the source IPv4 address or source interface for sending Telnet packets.

By default, no source IPv4 address or source interface for sending Telnet packets is specified. The source IPv4 address is selected by routing.

The source IPv4 address or source interface specified by this command is applicable all Telnet connections.

If you use both this command and the telnet command to specify the source IPv4 address or source interface, the source IPv4 address or interface specified by the telnet command takes effect.

Related commands: display telnet client configuration.

Examples

# Specify the source IPv4 address for sending Telnet packets when the device serves as a Telnet client as 1.1.1.1.

<Sysname> system-view

[Sysname] telnet client source ip 1.1.1.1

telnet ipv6

Syntax

telnet ipv6 remote-host [ -i interface-type interface-number ] [ port-number ]

View

User view

Default level

0: Visit level

Parameters

remote-host: IP address or host name of a remote host, a case-insensitive string of 1 to 46 characters.

-i interface-type interface-number: Specifies the outbound interface for sending Telnet packets, where interface-type interface-number represents the interface type and number. If the destination address is a link-local address, provide the –i interface-type interface-number argument.

port-number: TCP port number for the remote host to provide the Telnet service. It is in the range of 0 to 65535 and defaults to 23.

Description

Use telnet ipv6 to Telnet to a remote host in an IPv6 network. To terminate the current Telnet connection, press Ctrl+K or use the quit command.

Examples

# Telnet to the remote host with the IPv6 address 5000::1.

<Sysname> telnet ipv6 5000::1

telnet server enable

Syntax

telnet server enable

undo telnet server enable

View

System view

Default level

3: Manage level

Parameters

None

Description

Use telnet server enable to enable the Telnet server.

Use undo telnet server enable to disable the Telnet server.

The Telnet server is disabled by default.

Examples

# Enable the Telnet server.

<Sysname> system-view

[Sysname] telnet server enable

terminal type

Syntax

terminal type { ansi | vt100 }

undo terminal type

View

User interface view

Default level

2: System level

Parameters

ansi: Specifies the terminal display type as ANSI.

vt100: Specifies the terminal display type as VT100.

Description

Use terminal type to configure the type of terminal display of the current user interface.

Use undo terminal type to restore the default.

By default, the terminal display type is ANSI.

The device supports two types of terminal display: ANSI and VT100. H3C recommends that you set the display type of both the device and the client to VT100. If the device and the client use different display types (for example, HyperTerminal or Telnet terminal) or both are set to ANSI, when the total number of characters of the currently edited command line exceeds 80, an anomaly such as cursor corruption or abnormal display of the terminal display may occur on the client.

Examples

# Set the terminal display type to VT100.

<Sysname> system-view

[Sysname] user-interface vty 0

[Sysname-ui-vty0] terminal type vt100

user privilege level

Syntax

user privilege level level

undo user privilege level

View

User interface view

Default level

3: Manage level

Parameters

level: Specifies a user privilege level, in the range of 0 to 3.

NOTE:

User privilege levels include visit, monitor, system, and manage, represented by the number 0, 1, 2 and 3 respectively. The administrator can change the user privilege level when necessary.

Description

Use user privilege level to configure the user privilege level. Users logging into the user interface are assigned a user privilege level.

Use undo user privilege level to restore the default.

By default, the default command level is 3 for the console user interface and 0 for other user interfaces.

Examples

# Set the command level for users logging in through VTY 0 to 0.

<Sysname> system-view

[Sysname] user-interface vty 0

[Sysname-ui-vty0] user privilege level 0

After you Telnet to the device through VTY 0, the terminal only displays commands of level 0 in the help information:

<Sysname> ?

User view commands:

display Display current system information

ping Ping function

quit Exit from current command view

rsh Establish one RSH connection

ssh2 Establish a secure shell client connection

super Set the current user priority level

telnet Establish one TELNET connection

tracert Trace route function

user-interface

Syntax

user-interface { first-num1 [ last-num1 ] | { aux | console | vty } first-num2 [ last-num2 ] }

View

System view

Default level

2: System level

Parameters

first-num1: Absolute number of the first user interface. The value range varies with devices, and typically starts from 0. For more information, see About the WX Series Access Controllers Command References.

last-num1: Absolute number of the last user interface. The value range varies with devices, and typically starts from 0, but cannot be smaller than the first-num1.

first-num2: Relative number of the first user interface. It is 0 for the AUX or console port and in the range of 0 to 4 for VTY user interfaces.

last-num2: Relative number of the last user interface. It cannot be smaller than first-num 2. For VTY user interfaces, it is in the range of (first-num2 + 1) to 4.

Description

Use user-interface to enter a single or multiple user interface views.

In a single user interface view, the configuration takes effect in the user view only.

In multiple user interface views, the configuration takes effect in these user views.

Examples

# Enter the console user interface view.

<Sysname> system-view

[Sysname] user-interface console 0

[Sysname-ui-console0]

# Enter the user interface views of VTYs 0 to 4.

<Sysname> system-view

[Sysname] user-interface vty 0 4

[Sysname-ui-vty0-4]

01-Fundamentals Command Reference

ip http enable

ip https enable

screen-length

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Policy & Program

Global Learning

Partner Sales Resources

Service Business

News & Events

Contact Us