Contents

Cloud connection commands· 1

cloud-management backup-server domain· 1

cloud-management keepalive· 3

cloud-management ping· 3

cloud-management server domain· 4

cloud-management server password· 6

cloud-management server port 7

cloud-management unbinding-code· 7

display cloud-management state· 8

 

Cloud connection commands

The following compatibility matrixes show the support of hardware platforms for cloud connections:

 

Hardware platform	Module type	Cloud connection compatibility
M9006 M9010 M9014	Blade IV firewall module	Yes
	Blade V firewall module	Yes
	NAT module	No
M9010-GM	Encryption module	Yes
M9016-V	Blade V firewall module	Yes
M9008-S M9012-S	Blade IV firewall module	Yes
	Intrusion prevention service (IPS) module	Yes
	Video network gateway module	Yes
M9008-S-V	Blade IV firewall module	Yes
M9000-AI-E4	Blade V firewall module	Yes
M9000-AI-E8 M9000-AI-E16	Blade V firewall module	Yes
M9000-AK001	Blade V firewall module	Yes
M9000-X06 M9000-X06-B M9000-X06-B-G M9000-X06-G M9000-X10	Blade VI firewall module	Yes
M9000-AI-X06 M9000-AI-X10	Blade VI firewall module	Yes

‌

cloud-management backup-server domain

Use cloud-management backup-server domain to specify a backup cloud server by its domain name.

Use undo cloud-management backup-server domain to remove one or all backup cloud servers.

Syntax

cloud-management backup-server domain domain-name [ port port-number ] [ vpn-instance vpn-instance-name ] [ source-ip ipv4-address ]

undo cloud-management backup-server domain [ domain-name [ port port-number ] ]

Default

No backup cloud server is specified.

Views

System view

Predefined user roles

network-admin

context-admin

Parameters

domain-name: Specifies a backup cloud server by its domain name, a case-insensitive string of 1 to 253 characters. If you do not specify this parameter in the undo cloud-management backup-server domain command, all backup cloud servers will be deleted.

port port-number: Specifies the TCP port number used by the device to initiate the authentication to the backup cloud server. The value range is 1 to 65535. If you do not specify this option, this command uses the port number specified by the cloud-management server port command.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance by its name, a case-sensitive string of 1 to 31 characters. If you do not specify this option, the backup cloud server is on the public network.

source-ip ipv4-address: Specifies the source IPv4 address for the device that connects to the backup cloud server. It must be the same as the IPv4 address configured on the device. If you do not specify this option, the device uses the primary IPv4 address of the egress interface to connect to the backup cloud server.

Usage guidelines

Before configuring this command, make sure a DNS server is configured to translate domain names.

You can specify a maximum of eight backup servers by repeating the cloud-management backup-server domain command. Each server domain name supports a maximum of three port numbers. If you execute this command multiple times to configure a backup cloud server with the same domain name and the same port number, the most recent configuration takes effect.

When establishing a cloud connection, the device can connect to only one cloud server at one time according to the sequence in which the servers are stored. The server domain names are stored in alphabet order and port numbers are in descending order. To view the connected server, execute the display cloud-management state command.

If multiple servers exist in the intranet and the NAT device has only one public IP address, you can execute this command to specify different port numbers for one server domain name.

When establishing a cloud connection, the first specified server has the highest priority. When the connected server fails, the device switches to another server and does not switch back to the original server even if the original server recovers.

For a device to establish a cloud connection to the cloud server, perform either of the following tasks:

·     Specify the domain name of the cloud server on the device through CLI.

·     Configure VLAN interface 1 of the device as a DHCP client and the cloud server as the DHCP server. The device obtains the IP address of the DHCP server and parses the option 253 field in the DHCP packets to obtain the domain name of the cloud server. For more information about the option 253 field, see DHCP configuration in Layer 3—IP Services Configuration Guide.

The domain name obtained through DHCP has a higher priority than the domain name configured manually.

If a device obtains the domain name of the cloud server through DHCP after establishing a cloud connection to the cloud server with the manually configured domain name, the device performs the following tasks:

·     If the automatically obtained and manually configured domain names are identical, the device retains the cloud connection.

·     If the automatically obtained and manually configured domain names are different, the device tears down the cloud connection and then establishes a cloud connection to the cloud server with the automatically obtained domain name.

Examples

# Specify the server with domain name example.com and port number 10001 as a backup cloud server.

<Sysname> system-view

[Sysname] cloud-management backup-server domain example.com port 10001

Related commands

display cloud-management state

cloud-management keepalive

Use cloud-management keepalive to set the keepalive interval for the local device to send keepalive packets to the cloud server.

Use undo cloud-management keepalive to restore the default.

Syntax

cloud-management keepalive interval

undo cloud-management keepalive

Default

The keepalive interval is 180 seconds.

Views

System view

Predefined user roles

network-admin

context-admin

Parameters

interval: Specifies the keepalive interval in the range of 10 to 600 seconds.

Usage guidelines

If the device does not receive a response from the cloud server within three keepalive intervals, the device sends a registration request to re-establish the cloud connection.

Examples

# Set the keepalive interval to 360 seconds.

<Sysname> system-view

[Sysname] cloud-management keepalive 360

cloud-management ping

Use cloud-management ping to set the interval at which the local device sends ping packets to the cloud server.

Use undo cloud-management ping to restore the default.

Syntax

cloud-management ping interval

undo cloud-management ping

Default

The local device sends ping packets to the cloud server at intervals of 60 seconds.

Views

System view

Predefined user roles

network-admin

context-admin

Parameters

interval: Specifies the interval at which the local device sends ping packets to the cloud server, in the range of 10 to 600 seconds.

Usage guidelines

After the connection to the cloud server is established, the local device sends ping packets to the server periodically to prevent NAT entry aging. Reduce the interval value if the network condition is poor or the NAT entry aging time is short.

The cloud server does not respond to ping packets.

Examples

# Configure the local device to send ping packets to the cloud server at intervals of 120 seconds.

<Sysname> system-view

[Sysname] cloud-management ping 120

cloud-management server domain

Use cloud-management server domain to specify the primary cloud server by its domain name.

Use undo cloud-management server domain to restore the default.

Syntax

cloud-management server domain domain-name [ port port-number ] [ vpn-instance vpn-instance-name ] [ source-ip ipv4-address ]

undo cloud-management server domain

Default

No primary cloud server is specified.

Views

System view

Predefined user roles

network-admin

context-admin

Parameters

domain-name: Specifies the primary cloud server by its domain name, a case-insensitive string of 1 to 253 characters.

port port-number: Specifies the TCP port number used by the device to initiate the authentication to the primary cloud server. The value range is 1 to 65535. If you do not specify this option, this command uses the port number specified by the cloud-management server port command.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance by its name, a case-sensitive string of 1 to 31 characters. If you do not specify this option, the primary cloud server is on the public network.

source-ip ipv4-address: Specifies the source IPv4 address for the device that connects to the primary cloud server. It must be the same as the IPv4 address configured on the device. If you do not specify this option, the device uses the primary IPv4 address of the egress interface to connect to the primary cloud server.

Usage guidelines

Before configuring this command, make sure a DNS server is configured to translate domain names.

Only one primary cloud server is supported. If you execute the command multiple times, the most recent configuration takes effect.

If multiple servers exist in the intranet and the NAT device has only one public IP address, you can execute this command to specify different port numbers for one server domain name.

For a device to establish a cloud connection to the cloud server, perform either of the following tasks:

·     Specify the domain name of the cloud server on the device through CLI.

·     Configure VLAN interface 1 of the device as a DHCP client and the cloud server as the DHCP server. The device obtains the IP address of the DHCP server and parses the option 253 field in the DHCP packets to obtain the domain name of the cloud server. For more information about the option 253 field, see DHCP configuration in Layer 3—IP Services Configuration Guide.

The domain name obtained through DHCP has a higher priority than the domain name configured manually.

If a device obtains the domain name of the cloud server through DHCP after establishing a cloud connection to the cloud server with the manually configured domain name, the device performs the following tasks:

·     If the automatically obtained and manually configured domain names are identical, the device retains the cloud connection.

·     If the automatically obtained and manually configured domain names are different, the device tears down the cloud connection and then establishes a cloud connection to the cloud server with the automatically obtained domain name.

Examples

# Specify the server with domain name example.com and port number 10001 as the primary cloud server.

<Sysname> system-view

[Sysname] cloud-management server domain example.com port 10001

Related commands

display cloud-management state

cloud-management server password

Use cloud-management server password to set the password for establishing cloud connections to the cloud server.

Use cloud-management server password to restore the default.

Syntax

cloud-management server password { cipher | simple } string

undo cloud-management server password

Default

No password is set for establishing cloud connections to the cloud server.

Views

System view

Predefined user roles

network-admin

context-admin

Parameters

cipher: Specifies the password in encrypted form.

simple: Specifies the password in plaintext form. For security purposes, the password specified in plaintext form will be stored in encrypted form.

string: Specifies the password. The plaintext form is a case-sensitive string of 1 to 63 characters. The encrypted form is a case-sensitive string of 1 to 117 characters.

Usage guidelines

After you change the password, the device terminates the cloud connections that have been established (if any) and uses the new password to establish cloud connections.

A device can use either of the following methods to obtain the password for establishing cloud connections to the cloud server:

·     Execute this command on the device to specify the password for establishing cloud connections to the cloud server.

·     Configure VLAN interface 1 of the device as a DHCP client and the cloud server as the DHCP server. The device obtains the IP address of the DHCP server and parses the option 252 field in the DHCP packets to obtain the password for connection to the cloud server. For more information about the option 252 field, see DHCP configuration in Layer 3—IP Services Configuration Guide.

The password obtained through DHCP has a higher priority than the password configured manually.

If a device obtains the password for connection to the cloud server through DHCP after establishing a cloud connection to the cloud server with the manually configured password, the device performs the following tasks:

·     If the automatically obtained and manually configured passwords are identical, the device retains the cloud connection.

·     If the automatically obtained and manually configured passwords are different, the device tears down the cloud connection and then establishes a cloud connection to the cloud server with the automatically obtained password.

Examples

# Set the password for establishing cloud connections to the cloud server to 12345678 in plaintext format.

<Sysname> system-view

[Sysname] cloud-management server password simple 12345678

cloud-management server port

Use cloud-management server port to specify the TCP port number used by the device to initiate the authentication to a cloud server.

Use undo cloud-management server port to restore the default.

Syntax

cloud-management server port port-number

undo cloud-management server port

Default

TCP port number 19443 is used by the device to initiate the authentication to a cloud server.

Views

System view

Predefined user roles

network-admin

context-admin

Parameters

port-number: Specifies a TCP port number used by the device to initiate the authentication to a cloud server. The value range is 1 to 65535.

Usage guidelines

If you configure the primary cloud server or a backup cloud server without specifying a TCP port number, the device uses the port number specified by this command to initiate the authentication to a cloud server.

Examples

# Specify the TCP port number used by the device to initiate the authentication to a cloud server as 80.

<Sysname> system-view

[Sysname] cloud-management server port 80

Related commands

display cloud-management state

cloud-management unbinding-code

Use cloud-management unbinding-code to send the verification code for device unbinding to the cloud server.

Syntax

cloud-management unbinding-code code

Views

System view

Predefined user roles

network-admin

context-admin

Parameters

code: Specifies the verification code obtained from the cloud server. The verification code is a case-sensitive string of 16 characters.

Usage guidelines

A device can be registered on the cloud server by only one user.

To register a device that has been registered by another user, you need to take the following steps:

1.     Obtain a verification code for device unbinding from the cloud server.

2.     Execute this command on the device to send the verification code to the cloud server.

3.     Register the device on the cloud server.

Examples

# Send the verification code for device unbinding to the cloud server.

[Sysname] cloud-management unbinding-code A6B9C3C2D5A8Z1S7

Related commands

cloud-management server domain

display cloud-management state

Use display cloud-management state to display cloud connection state information.

Syntax

display cloud-management state

Views

Any view

Predefined user roles

network-admin

network-operator

context-admin

context-operator

Examples

# Display cloud connection state information.

<Sysname> display cloud-management state

Cloud connection state                      : Established

Device state                                : Request_success

Cloud server address                        : 139.217.27.153

Cloud server domain name                    : oasis.h3c.com

Cloud connection mode                       : Https

Cloud server authentication port            : 19443

Cloud server connection port                : 443

Connected at                                : Wed Jan 27 14:18:40 2018

Duration                                    : 00d 00h 02m 01s

Process state                               : Message received

Failure reason                              : N/A

Last down reason                            : socket connection error (Details:N/A)

Last down at                                : Wed Jan 27 13:18:40 2018

Last report failure reason                  : N/A

Last report failure at                      : N/A

Dropped packets after reaching buffer limit : 0

Total dropped packets                       : 1

Last report incomplete reason               : N/A

Last report incomplete at                   : N/A

Buffer full count                           : 0

Table 1 Command output

Field	Description
Cloud connection state	Cloud connection state: Unconnected, Request, and Established.
Device state	Local device state: ·     Idle—In idle state. ·     Connecting—Connecting to the cloud server. ·     Request_CAS_url—Sent a central authentication service (CAS) URL request. ·     Request_CAS_url_success—Requesting CAS URL succeeded. ·     Request_CAS_TGT—Sent a ticket granting ticket (TGT) request. ·     Request_CAS_TGT_success—Requesting TGT succeeded. ·     Request_CAS_ST—Sent a service ticket (ST) request. ·     Request_CAS_ST_success—Requesting ST succeeded. ·     Request_cloud_auth—Sent an authentication request. ·     Request_cloud_auth_success—Authentication succeeded. ·     Register—Sent a registration request. ·     Register_success—Registration succeeded. ·     Request—Sent a handshake request. ·     Request_success—Handshake succeeded.
Cloud server address	IP address of the cloud server.
Cloud server domain name	Domain name of the cloud server.
Cloud server authentication port	TCP port number used by the device to initiate the authentication to a cloud server.
Cloud server connection port	TCP port number used to establish cloud connections.
Connected at	Time when the cloud connection was established.
Duration	Duration since the establishment of the cloud connection.
Process state	Cloud connection processing state: ·     DNS not parsed. ·     DNS parsed. ·     Message not sent. ·     Message sent. ·     Message not received. ·     Message received.
Failure reason	Cloud connection failure reason: ·     DNS parse failed. ·     Socket connection failed. ·     SSL creation failed. ·     Sending CAS url request failed. ·     Sending CAS TGT failed. ·     Sending CAS ST failed. ·     Sending cloud auth failed. ·     Sending register failed. ·     Processing CAS url response failed. ·     Processing CAS TGT response failed. ·     Processing CAS ST response failed. ·     Processing cloud auth response failed. ·     Processing register response failed. ·     Sending handshake request failed. ·     Processing handshake failed. ·     Sending websocket request failed. ·     Processing websocket packet failed.
Last down reason	Reason for the most recent cloud connection interruption: ·     Device or process rebooted. ·     Socket connection error. ·     Configuration changed. ·     Received websocket close packet from cloud. ·     Keepalive expired. ·     Packet processing failed. ·     Main connection went down. ·     Cloud reset connection. ·     Memory reached threshold.
Last down at	Time when the cloud connection went down most recently.
Last report failure reason	Reason for the most recent cloud connection packet sending failure: ·     Tunnel is being deleted. ·     Tunnel socket is invalid. ·     Failed to convert string to json. ·     Failed to convert json to string. ·     Failed to create message node. ·     Tunnel is not ready. ·     Failed to create packet buffer. ·     SSL sending failure. If the reason is SSL sending failure, one of the following detailed reason will be displayed: ·     ssl error none. ·     ssl error ssl. ·     ssl error read. ·     ssl error write. ·     ssl error x509 lookup. ·     ssl error syscall. ·     ssl error zero return. ·     ssl error connect. ·     ssl error accept.
Last report failure at	Time when the most recent cloud connection packet sending failure occurred.
Dropped packets after reaching buffer limit	Number of packets that are dropped because the CMTNL buffer limit is reached.
Total dropped packets	Total number of dropped packets.
Last report incomplete reason	Reason for the most recent unfinished packet sending: ·     Interrupted system call. ·     Socket buffer is full.
Last report incomplete at	Time when the most recent unfinished packet sending occurred.
Buffer full count	Number of times that the buffer becomes full.

‌