Login
- Table of Contents
-
- 02-System Management Configuration Guide
- 00-Preface
- 01-Basic device management configuration
- 02-Device hardening configuration
- 03-Hardware resource management configuration
- 04-EAA configuration
- 05-Process monitoring and maintenance configuration
- 06-Information center configuration
- 07-GOLD configuration
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 01-Basic device management configuration | 139.06 KB |
Performing basic device management
Restrictions and guidelines for configuring the system time
System time configuration tasks at a glance
Setting the system time at the CLI
Obtaining the UTC time through NTP or PTP
Setting the daylight saving time
Displaying system time information
Displaying copyright information
Enabling copyright statement display
Displaying detailed copyright information
Verifying and maintaining task scheduling
Isolating switching fabric modules
Suppressing removal interrupt signals from switching fabric modules
Restrictions and guidelines for device reboot
Rebooting the device immediately at the CLI
Performing basic device management
Configuring the device name
About this task
A device name (also called hostname) identifies a device in a network and is used in CLI view prompts. For example, if the device name is Sysname, the user view prompt is <Sysname>.
Procedure
1. Enter system view.
system-view
sysname sysname
By default, the device name is H3C.
Configuring the system time
About the system time
Correct system time is essential to network management and communication. Configure the system time correctly before you run the device on the network.
The device can use the following methods to obtain the system time:
· Uses the locally set system time, and then uses the clock signals generated by its built-in crystal oscillator to maintain the system time.
· Periodically obtains the UTC time from an NTP source, and uses the UTC time, time zone, and daylight saving time to calculate the system time. For more information about NTP, see Network Management and Monitoring Configuration Guide.
The system time calculated by using the UTC time from a time source is more precise.
Restrictions and guidelines for configuring the system time
The system time configured by using the clock datetime command takes effect immediately. The time zone or daylight saving time, whether configured or not, are not taken into account.
If you configure or change the time zone or daylight saving time after the device obtains the system time, the device recalculates the system time. To view the system time, use the display clock command.
You can configure the device to use both methods to obtain the system time. For time consistency, however, configure the device to use only one of the methods to obtain the system time. If you configure the device to use both methods, the device uses the manually set system time or the periodically obtained UTC time, whichever is obtained later.
System time configuration tasks at a glance
To configure the system time, perform the following tasks:
1. Configuring the system time
Choose one of the following tasks:
¡ Setting the system time at the CLI
¡ Obtaining the UTC time through NTP or PTP
2. (Optional.) Setting the time zone
Make sure each network device uses the time zone of the place where the device resides.
3. (Optional.) Setting the daylight saving time
Make sure each network device uses the daylight saving time parameters of the place where the device resides.
4. (Optional.) Displaying system time information
Setting the system time at the CLI
1. Enter system view.
system-view
2. Configure the device to use the local system time.
clock protocol none
By default, the device uses the NTP time source.
If you execute this command multiple times, the most recent configuration takes effect.
3. Return to user view.
quit
4. Set the local system time.
clock datetime time date
By default, the system time is UTC time 00:00:00 01/01/2011. .
|
|
CAUTION: This command changes the system time, which affects the execution of system time-related features (for example, scheduled tasks) and collaborative operations of the device with other devices (for example, log reporting and statistics collection). Before executing this command, make sure you fully understand its impact on your live network. |
Obtaining the UTC time through NTP or PTP
1. Enter system view.
system-view
2. Specify the system time source.
clock protocol { ntp | ptp }
By default, the device uses the NTP time source.
If you execute this command multiple times, the most recent configuration takes effect.
3. Configure time protocol parameters.
For more information about NTP and PTP configuration, see Network Management and Monitoring Configuration Guide.
Setting the time zone
1. Enter system view.
system-view
2. Set the time zone.
clock timezone zone-name { add | minus } zone-offset
By default, the system uses the UTC time zone.
Setting the daylight saving time
1. Enter system view.
system-view
2. Set the daylight saving time.
clock summer-time name start-time start-date end-time end-date add-time
By default, the daylight saving time is not set.
Displaying system time information
To display system time information, execute the following command in any view:
display clock
This command displays the system time, date, time zone, and daylight saving time.
Displaying copyright information
Enabling copyright statement display
About this task
This feature enables the device to display the copyright statement in the following situations:
· When a Telnet or SSH user logs in.
· When a console, AUX, or modem dial-in user quits user view. This is because the device automatically tries to restart the user session.
Figure 1 shows the copyright statement.
If you disable displaying the copyright statement, the device does not display the copyright statement in any situations.
Figure 1 Copyright statement at the login page
Procedure
1. Enter system view.
system-view
2. Enable copyright statement display.
copyright-info enable
By default, copyright statement display is enabled.
Displaying detailed copyright information
To display detailed copyright information, execute the following command in any view:
display copyright
Configuring banners
About this task
Banners are messages that the system displays when a user logs in.
The system supports the following banners:
· Legal banner—Appears after the copyright statement. To continue login, the user must enter Y or press Enter. To quit the process, the user must enter N. Y and N are case insensitive.
· Message of the Day (MOTD) banner—Appears after the legal banner and before the login banner.
· Login banner—Appears only when password or scheme authentication is configured.
· Incoming banner—Appears for a modem dial-in user when the user accesses user view.
· Shell banner—Appears for a non-modem user when the user accesses user view.
The system displays the banners in the following order: legal banner, MOTD banner, login banner, and incoming or shell banner.
Banner input methods
You can configure a banner by using one of the following methods:
· Input the entire command line in a single line.
The banner cannot contain carriage returns. The entire command line, including the command keywords, the banner, and the delimiters, can have a maximum of 511 characters. The delimiters for the banner can be any printable character but must be the same. You cannot press Enter before you input the end delimiter.
For example, you can configure the shell banner "Have a nice day." as follows:
<System> system-view
[System] header shell %Have a nice day.%
· Input the command line in multiple lines.
The banner can contain carriage returns. A carriage return is counted as two characters.
To input a banner configuration command line in multiple lines, use one of the following methods:
¡ Press Enter after the final command keyword, type the banner, and end the final line with the delimiter character %. The banner plus the delimiter can have a maximum of 1999 characters.
For example, you can configure the banner "Have a nice day." as follows:
<System> system-view
[System] header shell
Please input banner content, and quit with the character '%'.
Have a nice day.%
¡ After you type the final command keyword, type any printable character as the start delimiter for the banner and press Enter. Then, type the banner and end the final line with the same delimiter. The banner plus the end delimiter can have a maximum of 1999 characters.
For example, you can configure the banner "Have a nice day." as follows:
<System> system-view
[System] header shell A
Please input banner content, and quit with the character 'A'.
Have a nice day.A
¡ After you type the final command keyword, type the start delimiter and part of the banner. Make sure the final character of the final string is different from the start delimiter. Then, press Enter, type the rest of the banner, and end the final line with the same delimiter. The banner plus the start and end delimiters can have a maximum of 2002 characters.
For example, you can configure the banner "Have a nice day." as follows:
<System> system-view
[System] header shell AHave a nice day.
Please input banner content, and quit with the character 'A'.
A
Procedure
1. Enter system view.
system-view
2. Configure the legal banner.
header legal text
3. Configure the MOTD banner.
header motd text
4. Configure the login banner.
header login text
5. Configure the incoming banner.
header incoming text
6. Configure the shell banner.
header shell text
Scheduling a task
About task scheduling
You can schedule the device to automatically execute a command or a set of commands without administrative interference.
You can configure a periodic schedule or a non-periodic schedule. A non-periodic schedule is not saved to the configuration file and is lost when the device reboots. A periodic schedule is saved to the startup configuration file and is automatically executed periodically.
Restrictions and guidelines
· The default system time is always restored at reboot. To make sure a task schedule can be executed as expected, reconfigure the system time or configure NTP after you reboot the device. For more information about NTP, see Network Management and Monitoring Configuration Guide.
· To assign a command (command A) to a job, you must first assign the job the command or commands for entering the view of command A.
· Make sure all commands in a schedule are compliant to the command syntax. The system does not check the syntax when you assign a command to a job.
· A schedule cannot contain any one of these commands: telnet, ftp, ssh2, and monitor process.
· A schedule does not support user interaction. If a command requires a yes or no answer, the system always assumes that a Y or Yes is entered. If a command requires a character string input, the system assumes that either the default character string (if any) or a null string is entered.
· A schedule is executed in the background, and no output (except for logs, traps, and debug information) is displayed for the schedule.
· You can use the user-role command to assign multiple user roles to a schedule. The use role with the highest permission takes effect for the schedule. A schedule cannot have both the security-audit user role and any other user roles. Any previously assigned user roles are automatically removed when you assign the security-audit user role to the policy. The previously assigned security-audit user role is automatically removed when you assign any other user roles to the policy.
Procedure
1. Enter system view.
system-view
2. Create a job.
scheduler job job-name
3. Assign a command to the job.
command id command
By default, no command is assigned to a job.
You can assign multiple commands to a job. A command with a smaller ID is executed first.
4. Exit to system view.
quit
5. Create a schedule.
scheduler schedule schedule-name
6. Assign a job to the schedule.
job job-name
By default, no job is assigned to a schedule.
You can assign multiple jobs to a schedule. The jobs will be executed concurrently.
7. Assign user roles to the schedule.
user-role role-name
By default, a schedule has the user role of the schedule creator.
8. Specify the execution time for the schedule.
Choose one option as needed:
¡ Execute the schedule at specific points of time.
time at time date
time once at time [ month-date month-day | week-day week-day&<1-7> ]
¡ Execute the schedule after a period of time.
time once delay time
¡ Execute the schedule at the specified time on every specified day in a month or week.
time repeating at time [ month-date [ month-day | last ] | week-day week-day&<1-7> ]
¡ Execute the schedule periodically from the specified time on.
time repeating [ at time [date ] ] interval interval
By default, no execution time is specified for a schedule.
The time commands overwrite each other. The most recently configured command takes effect.
9. (Optional.) Set the schedule log file size limit.
scheduler logfile size value
By default, the schedule log file size limit is 16 KB.
The schedule log file stores log messages for execution results of commands in jobs. After the limit is reached, the system deletes the oldest log messages to store the new log messages. If the remaining space of the log file is not enough for a single log message, the system truncates the message and does not store the extra part.
Verifying and maintaining task scheduling
Displaying task scheduling and execution information
Perform display tasks in any view.
· Display the automatic reboot schedule.
display scheduler reboot
· Display schedule information.
display scheduler schedule [ schedule-name ]
· Display schedule job configuration information.
display scheduler job [ job-name ]
· Display schedule job execution log information.
display scheduler logfile
Clearing schedule job execution log information
To clear schedule job execution log information, execute the following command in user view:
reset scheduler logfile
Example: Scheduling a task
Network configuration
As shown in Figure 2, two interfaces of the device are connected to users.
To save energy, configure the device to perform the following operations:
· Enable the interfaces at 8:00 a.m. every Monday through Friday.
· Disable the interfaces at 18:00 every Monday through Friday.
Procedure
|
|
IMPORTANT: By default, interfaces on the device are in ADM or Administratively Down state. To have an interface operate, you must use the undo shutdown command to enable that interface. |
# Enter system view.
<Sysname> system-view
# Configure a job for disabling interface HundredGigE 1/0/1.
[Sysname] scheduler job shutdown-HundredGigE1/0/1
[Sysname-job-shutdown-HundredGigE1/0/1] command 1 system-view
[Sysname-job-shutdown-HundredGigE1/0/1] command 2 interface hundredgige 1/0/1
[Sysname-job-shutdown-HundredGigE1/0/1] command 3 shutdown
[Sysname-job-shutdown-HundredGigE1/0/1] quit
# Configure a job for enabling interface HundredGigE 1/0/1.
[Sysname] scheduler job start-HundredGigE1/0/1
[Sysname-job-start-HundredGigE1/0/1] command 1 system-view
[Sysname-job-start-HundredGigE1/0/1] command 2 interface hundredgige 1/0/1
[Sysname-job-start-HundredGigE1/0/1] command 3 undo shutdown
[Sysname-job-start-HundredGigE1/0/1] quit
# Configure a job for disabling interface HundredGigE 1/0/2.
[Sysname] scheduler job shutdown-HundredGigE1/0/2
[Sysname-job-shutdown-HundredGigE1/0/2] command 1 system-view
[Sysname-job-shutdown-HundredGigE1/0/2] command 2 interface hundredgige 1/0/2
[Sysname-job-shutdown-HundredGigE1/0/2] command 3 shutdown
[Sysname-job-shutdown-HundredGigE1/0/2] quit
# Configure a job for enabling interface HundredGigE 1/0/2.
[Sysname] scheduler job start-HundredGigE1/0/2
[Sysname-job-start-HundredGigE1/0/2] command 1 system-view
[Sysname-job-start-HundredGigE1/0/2] command 2 interface hundredgige 1/0/2
[Sysname-job-start-HundredGigE1/0/2] command 3 undo shutdown
[Sysname-job-start-HundredGigE1/0/2] quit
# Configure a periodic schedule for enabling the interfaces at 8:00 a.m. every Monday through Friday.
[Sysname] scheduler schedule START-pc1/pc2
[Sysname-schedule-START-pc1/pc2] job start-HundredGigE1/0/1
[Sysname-schedule-START-pc1/pc2] job start-HundredGigE1/0/2
[Sysname-schedule-START-pc1/pc2] time repeating at 8:00 week-day mon tue wed thu fri
[Sysname-schedule-START-pc1/pc2] quit
# Configure a periodic schedule for disabling the interfaces at 18:00 every Monday through Friday.
[Sysname] scheduler schedule STOP-pc1/pc2
[Sysname-schedule-STOP-pc1/pc2] job shutdown-HundredGigE1/0/1
[Sysname-schedule-STOP-pc1/pc2] job shutdown-HundredGigE1/0/2
[Sysname-schedule-STOP-pc1/pc2] time repeating at 18:00 week-day mon tue wed thu fri
[Sysname-schedule-STOP-pc1/pc2] quit
Verifying the configuration
# Display the configuration information of all jobs.
[Sysname] display scheduler job
Job name: shutdown-HundredGigE1/0/1
system-view
interface hundredgige 1/0/1
shutdown
Job name: shutdown-HundredGigE1/0/2
system-view
interface hundredgige 1/0/2
shutdown
Job name: start-HundredGigE1/0/1
system-view
interface hundredgige 1/0/1
undo shutdown
Job name: start-HundredGigE1/0/2
system-view
interface hundredgige 1/0/2
undo shutdown
# Display the schedule information.
[Sysname] display scheduler schedule
Schedule name : START-pc1/pc2
Schedule type : Run on every Mon Tue Wed Thu Fri at 08:00:00
Start time : Wed Sep 28 08:00:00 2011
Last execution time : Wed Sep 28 08:00:00 2011
Last completion time : Wed Sep 28 08:00:03 2011
Execution counts : 1
-----------------------------------------------------------------------
Job name Last execution status
start-HundredGigE1/0/1 Successful
start-HundredGigE1/0/2 Successful
Schedule name : STOP-pc1/pc2
Schedule type : Run on every Mon Tue Wed Thu Fri at 18:00:00
Start time : Wed Sep 28 18:00:00 2011
Last execution time : Wed Sep 28 18:00:00 2011
Last completion time : Wed Sep 28 18:00:01 2011
Execution counts : 1
-----------------------------------------------------------------------
Job name Last execution status
shutdown-HundredGigE1/0/1 Successful
shutdown-HundredGigE1/0/2 Successful
# Display schedule log information.
[Sysname] display scheduler logfile
Job name : start-HundredGigE1/0/1
Schedule name : START-pc1/pc2
Execution time : Wed Sep 28 08:00:00 2011
Completion time : Wed Sep 28 08:00:02 2011
--------------------------------- Job output -----------------------------------
<Sysname>system-view
System View: return to User View with Ctrl+Z.
[Sysname]interface hundredgige 1/0/1
[Sysname-HundredGigE1/0/1]undo shutdown
Job name : start-HundredGigE1/0/2
Schedule name : START-pc1/pc2
Execution time : Wed Sep 28 08:00:00 2011
Completion time : Wed Sep 28 08:00:02 2011
--------------------------------- Job output -----------------------------------
<Sysname>system-view
System View: return to User View with Ctrl+Z.
[Sysname]interface hundredgige 1/0/2
[Sysname-HundredGigE1/0/2]undo shutdown
Job name : shutdown-HundredGigE1/0/1
Schedule name : STOP-pc1/pc2
Execution time : Wed Sep 28 18:00:00 2011
Completion time : Wed Sep 28 18:00:01 2011
--------------------------------- Job output -----------------------------------
<Sysname>system-view
System View: return to User View with Ctrl+Z.
[Sysname]interface hundredgige 1/0/1
[Sysname-HundredGigE1/0/1]shutdown
Job name : shutdown-HundredGigE1/0/2
Schedule name : STOP-pc1/pc2
Execution time : Wed Sep 28 18:00:00 2011
Completion time : Wed Sep 28 18:00:01 2011
--------------------------------- Job output -----------------------------------
<Sysname>system-view
System View: return to User View with Ctrl+Z.
[Sysname]interface hundredgige 1/0/2
[Sysname-HundredGigE1/0/2]shutdown
Isolating switching fabric modules
About this task
Isolating a switching fabric module isolates the module from the data plane. An isolated switching fabric module continues to communicate with the MPU, and can forward traffic immediately after the isolation is canceled. The isolation does not affect protocol packet parsing and protocol calculation on the control plane.
Restrictions and guidelines
|
|
CAUTION: · Do not isolate the only switching fabric module of the device. · Do not reboot the device when a switching fabric module is isolated. |
Isolate a switching fabric module only if required. If the device has multiple switching fabric modules, isolating a switching fabric module or channel decreases the forwarding bandwidth and downgrades the forwarding performance.
You can isolate switching fabric modules to identify whether switching fabric modules can forward traffic correctly.
Before replacing a switching fabric module, you can isolate the module to prevent packet loss.
To use an isolated switching fabric module or channel, use the undo switch-fabric isolate command to cancel the isolation.
As a best practice, isolate a switching fabric module before you remove or install it on an operating device for service stability.
Procedure
1. Enter system view.
system-view
2. Isolate a switching fabric module or channel.
switch-fabric isolate slot slot-number [ channel channel-number ]
By default, a switching fabric module is not isolated and can forward traffic.
Isolating a service module
About service module isolation
When a service module fails, you can use this feature to isolate it to prevent it from affecting traffic forwarding. An isolated service module does not receive traffic.
Restrictions and guidelines
A service module reboot cancels the isolation of the service module.
To display service module operating status, execute the display device command. An isolated service module is in Offline state.
Procedure
1. Enter system view.
system-view
2. Isolate a service module.
switch-linecard isolate slot slot-number
Suppressing removal interrupt signals from switching fabric modules
About this task
Typically, removing a switching fabric module triggers one removal interrupt signal. Upon receiving the signal, the system switches traffic on the switching fabric module to other switching fabric modules to ensure service continuity. Upon hardware failure or signal interference, however, removal interrupt signals might be frequently triggered. To prevent the interrupt signals from affecting system operation, use this feature to suppress the interrupt signals.
Restrictions and guidelines
Suppressing removal interrupt signals from switching fabric modules might result in packet loss and service outage.
Procedure
1. Enter system view.
system-view
2. Suppress removal interrupt signals from switching fabric modules.
switch-fabric removal-signal-suppression
By default, removal interrupt signals from switching fabric modules are not suppressed.
Rebooting the device
About device reboot
The following device reboot methods are available:
· Schedule a reboot at the CLI, so the device automatically reboots at the specified time or after the specified period of time.
· Immediately reboot the device at the CLI.
This method allows you to reboot the device remotely.
· Power off and then power on the device. This method might cause data loss, and is the least-preferred method.
Restrictions and guidelines for device reboot
For data security, the device does not reboot while it is performing file operations.
Rebooting the device immediately at the CLI
Prerequisites
Perform the following steps in any view:
1. Verify that the next-startup configuration file is correctly specified.
display startup
For more information about the display startup command, see Fundamentals Command Reference.
2. Verify that the startup image files are correctly specified.
display boot-loader
If one main startup image file is damaged or does not exist, you must specify another main startup image file before rebooting the device.
For more information about the display boot-loader command, see Fundamentals Command Reference.
3. Save the running configuration to the next-startup configuration file.
save
To avoid configuration loss, save the running configuration before a reboot.
For more information about the save command, see Fundamentals Command Reference.
Procedure
To reboot the device immediately at the CLI, execute one of the following commands in user view:
reboot [ slot slot-number [ subslot subslot-number ] ] [ force ]
|
|
CAUTION: · A device reboot might result in service interruption. Before executing this command, make sure you fully understand its impact on your live network. · Use the force keyword to reboot the device only when the system is faulty or fails to start up normally. A forced device reboots might cause file system damage. Before using the force keyword to reboot the device, make sure you understand its impact. |
Scheduling a device reboot
Restrictions and guidelines
The automatic reboot configuration is canceled if an active/standby switchover occurs.
The device supports only one device reboot schedule. If you execute the scheduler reboot command multiple times, the most recent configuration takes effect.
Procedure
To schedule a reboot, execute one of the following commands in user view:
· scheduler reboot at time [ date ]
· scheduler reboot delay time
By default, no device reboot time is specified.
|
|
CAUTION: This task enables the device to reboot at a scheduled time, which causes service interruption. Before configuring this task, make sure you fully understand its impact on your live network. |
Restoring the factory-default configuration
About this task
If you want to use the device in a different scenario or you cannot troubleshoot the device by using other methods, use this task to restore the factory-default configuration.
This task does not delete .bin files.
Procedure
1. Execute the following command in user view to restore the factory-default configuration for the device:
restore factory-default
2. Reboot the device.
reboot
|
|
CAUTION: This command restores the device to the factory default settings. Before executing this command, make sure you fully understand its impact on your live network. |
When the command prompts you to choose whether to save the running configuration, enter N. If you choose to save the running configuration, the device loads the saved configuration at startup.
Verifying device stability
About this task
The device/card startup process takes some time. If the values of the status fields do not change to Stable, use this feature to identify the devices/cards that are not in Stable state.
Restrictions and guidelines
Procedure
To display system stability and status information, execute the following command in any view:
display system stable state
Troubleshooting
If the system is not in stable state, you can use other commands to identify the faulty components. For example:
· Use the display device command to identify the device operating status.
· Use the display ha service-group command to display the status of HA service groups and identify the groups in batch backup state.
· Use the display system internal process state command in probe view to display service operating status.
