H3C S6850&S9850&S9820-64H Config Examples-Release 655x-6W100

HomeSupportResource CenterH3C S6850&S9850&S9820-64H Config Examples-Release 655x-6W100
Table of Contents
Related Documents
76-Puppet Configuration Examples
Title Size Download
76-Puppet Configuration Examples 68.50 KB


H3C S6850 & S9850 & S9820-64H

Puppet Configuration Examples













































Copyright © 2020 New H3C Technologies Co., Ltd. All rights reserved.

No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of New H3C Technologies Co., Ltd.

Except for the trademarks of New H3C Technologies Co., Ltd., any trademarks that may be mentioned in this document are the property of their respective owners.

The information in this document is subject to change without notice.


This document provides Puppet configuration examples.

Puppet is an open-source configuration management tool. It provides the Puppet language. You can use the Puppet language to create configuration manifests and save them to a server. You can then use the server for centralized configuration enforcement and management.


The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of Puppet.

Example: Configuring Puppet

Network configuration

As shown in Figure 1, Puppet agents Device A and Device B are connected to the Puppet master. Use Puppet to create VLAN 100 on each Puppet agent.

Figure 1 Network diagram


Applicable hardware and software versions

The following matrix shows the hardware and software versions to which this configuration example is applicable:



Software version

S6850 switch series

S9850 switch series

Release 6555P01

S9820-64H switch

Release 6555P01



Configuring the Puppet master

1.      Assign an IP address to the Puppet master. (Details not shown.)

2.      Install Puppet on the Puppet master.

$ sudo apt-get install puppetmaster

3.      Verify that Puppet configuration file puppet.conf is created in directory /etc/puppet.

If the file does not exist, execute the following command to create the file:

$ sudo puppet master –genconfig > puppet.conf

4.      Add files provided by H3C:

# Copy the type and provider library files to directory /etc/puppet/modules/custom/lib/puppet. If conflicts exist, overwrite the existing files. (Details not shown.)

# Create directory manifests/nodes in directory /etc/puppet/.

$ sudo mkdir –p /etc/puppet/manifests/nodes

# Copy H3C file puppet.master.com.pp to directory /etc/puppet/manifests/nodes/. (Details not shown.)

5.      Configure file site.pp:

# Go to directory /etc/puppet/manifests/ and create file site.pp in the directory.

$ cd ..

$ sudo touch site.pp

# Edit file site.pp.

node ''{


    ensure => undo_shutdown,

    username => 'test',

    password => 'test',

    ipaddr => '',


    include custom


node ''{


    ensure => undo_shutdown,

    username => 'test',

    password => 'test',

    ipaddr => '',


    include custom


6.      Configure file init.pp:

# Create directory modules/custom/manifests in directory /etc/puppet/ to store configuration manifests.

$ sudo mkdir -p /etc/puppet/modules/custom/manifests

# Create configuration manifest init.pp in directory /etc/puppet/modules/custom/manifests.

$ sudo touch init.pp

# Edit file init.pp.

class custom{


    ensure => undo_shutdown,

    id => 100,

    require => Netdev_device['device'],



Configuring Puppet agent Device A

1.      Assign an IP address to Device A. (Details not shown.)

<DeviceA> system-view

[DeviceA] interface vlan-interface 2

[DeviceA-Vlan-interface2] ip address

[DeviceA-Vlan-interface2] quit

2.      Configure the device as the NETCONF over SSH server:

# Generate RSA key pairs. Leave the key pair to use the default key pair name.

[DeviceA] public-key local create rsa

# Enable NETCONF over SSH.

[DeviceA] netconf ssh server enable

# Enable scheme authentication for NETCONF over SSH users.

[DeviceA] line vty 0 63

[DeviceA-line-vty0-63] authentication-mode scheme

[DeviceA-line-vty0-63] user-role network-admin

[DeviceA-line-vty0-63] quit

# Create device management user test. Set the password to test, and assign the SSH service and network-admin user role to the user.

[DeviceA] local-user test class manage

[DeviceA-luser-manage-test] password simple test

[DeviceA-luser-manage-test] service-type ssh

[DeviceA-luser-manage-test] authorization-attribute user-role network-admin

[DeviceA-luser-manage-test] quit

3.      Configure the device as an NTP client to synchronize its system time to the system time on the Puppet master:

# Enable the NTP service

[DeviceA] ntp-service enable

# Configure the device to use NTP to obtain the UTC time.

[DeviceA] clock protocol ntp

# Configure the device to operate in NTP broadcast client mode and use VLAN-interface 2 to receive NTP broadcast packets.

[DeviceA] interface vlan-interface 2

[DeviceA-Vlan-interface2] ntp-service broadcast-client

[DeviceA-Vlan-interface2] quit

4.      Start Puppet on the device.

[DeviceA] third-part-process start name puppet arg agent --certname= --server=

The device will act as a Puppet client to request a certificate from the Puppet master.

Configuring Puppet agent Device B

The steps are similar to the steps for Device A

Using the Puppet master to issue certificates to the Puppet clients

# Use the puppet cert list command to display devices that require a certificate. (Details not shown.)

# Sign a certificate for Device A.

$ sudo puppet cert sign

After Device A obtains a certificate, it obtains a configuration manifest from the Puppet master and run the manifest.

# Sign a certificate for Device B. (Details not shown.)

Verifying the configuration

# Display device configuration information. VLAN 100 is created. (Details not shown.)

Configuration files

·           Puppet master:

The type and provider library files and the puppet.master.com.pp file are provided by H3C.

·           Device A


 clock protocol ntp


interface Vlan-interface2

 ip address

 ntp-service broadcast-client


 ntp-service enable


line vty 0 63

 authentication-mode scheme

 user-role network-admin

 user-role network-operator

 idle-timeout 0 0


local-user test class manage

 password hash $h$6$x0kIJnaHZkFFa3Ga$H4yMQnG96xjHiTID+6UPyJrTLXru6RJaGqrCKpxmo2O


 service-type ssh

 authorization-attribute user-role network-admin

 authorization-attribute user-role network-operator


 netconf ssh server enable


Related documentation

·           H3C S6850 & S9850 Switch Series Network Management and Monitoring Configuration Guide-Release 655x

·           H3C S6850 & S9850 Switch Series Network Management and Monitoring Command Reference-Release 655x

·           H3C S9820-64H Switch Network Management and Monitoring Configuration Guide-Release 655x

·           H3C S9820-64H Switch Network Management and Monitoring Command Reference-Release 655x