HP a-MSR Router Series High Security Command Reference

HP MSR Router Series Security Command Reference
Abstract This document describes the commands and command syntax options available for the HP products. This document is intended for network planners, field technical support and servicing engineers, and network administrators who work with HP products.
Part number: 5998-2046 Version 2 Software version: CMW520-R2207P02 Document version: 6PW100-20110810 March 2012
Legal and notice information

Copyright 201 2012 Hewlett-Packard Development Company, L.P. 1, No part of this documentation may be reproduced or transmitted in any form or by any means without prior written consent of Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.
Contents
AAA configuration commands 1 General AAA configuration commands 1 aaa nas-id profile 1 access-limit enable 1 accounting command 2 accounting default 3 accounting dvpn 3 accounting lan-access 4 accounting login 5 accounting optional 6 accounting portal 7 accounting ppp 7 accounting ssl-vpn 8 accounting voip 9 authentication default 10 authentication dvpn 10 authentication lan-access 11 authentication login 12 authentication portal 13 authentication ppp 14 authentication voip 14 authentication super 15 authorization command 16 authorization default 17 authorization dvpn 18 authorization lan-access 18 authorization login 19 authorization portal 20 authorization ppp 21 authorization voip 22 authorization-attribute user-profile 23 cut connection 23 display connection 24 display domain 26 domain 28 domain default enable 29 idle-cut enable 29 ip pool 30 nas-id bind vlan 31 self-service-url enable 32 state (ISP domain view) 32 Local user configuration commands 33 access-limit 33 authorization-attribute (local user view/user group view) 34 bind-attribute 35 display local-user 36 display user-group 38 expiration-date (local user view) 39 group 40
iii
local-user 41 local-user password-display-mode 42 password 42 service-type 43 state (local user view) 44 user-group 45 validity-date (local user view) 45 RADIUS configuration commands 46 accounting-on enable 46 attribute 25 car 47 data-flow-format (RADIUS scheme view) 48 display radius scheme 48 display radius statistics 51 display stop-accounting-buffer (for RADIUS) 54 key (RADIUS scheme view) 55 nas-ip (RADIUS scheme view) 56 primary accounting (RADIUS scheme view) 57 primary authentication (RADIUS scheme view) 59 radius client 60 radius nas-ip 61 radius scheme 62 radius trap 62 reset radius statistics 63 reset stop-accounting-buffer (for RADIUS) 64 retry 64 retry realtime-accounting 65 retry stop-accounting (RADIUS scheme view) 66 secondary accounting (RADIUS scheme view) 67 secondary authentication (RADIUS scheme view) 68 security-policy-server 70 server-type 71 state primary 71 state secondary 72 stop-accounting-buffer enable (RADIUS scheme view) 73 timer quiet (RADIUS scheme view) 74 timer realtime-accounting (RADIUS scheme view) 74 timer response-timeout (RADIUS scheme view) 75 user-name-format (RADIUS scheme view) 76 vpn-instance (RADIUS scheme view) 77 HWTACACS configuration commands 78 data-flow-format (HWTACACS scheme view) 78 display hwtacacs 78 display stop-accounting-buffer (for HWTACACS) 82 hwtacacs nas-ip 82 hwtacacs scheme 83 key (HWTACACS scheme view) 84 nas-ip (HWTACACS scheme view) 85 primary accounting (HWTACACS scheme view) 86 primary authentication (HWTACACS scheme view) 87 primary authorization 88 reset hwtacacs statistics 89 reset stop-accounting-buffer (for HWTACACS) 89 retry stop-accounting (HWTACACS scheme view) 90 secondary accounting (HWTACACS scheme view) 90 secondary authentication (HWTACACS scheme view) 91
iv
secondary authorization 92 stop-accounting-buffer enable (HWTACACS scheme view) 93 timer quiet (HWTACACS scheme view) 94 timer realtime-accounting (HWTACACS scheme view) 94 timer response-timeout (HWTACACS scheme view) 95 user-name-format (HWTACACS scheme view) 96 vpn-instance (HWTACACS scheme view) 97 RADIUS server configuration commands 97 authorization-attribute (RADIUS-server user view) 97 description (RADIUS-server user view) 98 expiration-date (RADIUS-server user view) 99 password (RADIUS-server user view) 99 radius-server client-ip 101 radius-server user 101
802.1X configuration commands 103 display dot1x 103 dot1x 106 dot1x authentication-method 107 dot1x auth-fail vlan 108 dot1x domain-delimiter 109 dot1x guest-vlan 110 dot1x handshake 111 dot1x handshake secure 112 dot1x mandatory-domain 113 dot1x max-user 114 dot1x multicast-trigger 115 dot1x port-control 115 dot1x port-method 116 dot1x quiet-period 117 dot1x re-authenticate 118 dot1x retry 119 dot1x supp-proxy-check 119 dot1x timer 121 dot1x unicast-trigger 122 reset dot1x statistics 123 EAD fast deployment configuration commands 124 dot1x free-ip 124 dot1x timer ead-timeout 125 dot1x url 125 MAC authentication configuration commands 127 display mac-authentication 127 mac-authentication 129 mac-authentication domain 130 mac-authentication max-user 131 mac-authentication timer 132 mac-authentication user-name-format 132 reset mac-authentication statistics 134 Port security configuration commands 136 display port-security 136 display port-security mac-address block 138 display port-security mac-address security 140 display port-security preshared-key user 141 port-security authorization ignore 142
v
port-security enable 143 port-security intrusion-mode 144 port-security mac-address security 144 port-security max-mac-count 146 port-security ntk-mode 147 port-security oui 148 port-security port-mode 148 port-security timer autolearn aging 152 port-security preshared-key 152 port-security timer disableport 154 port-security trap 154 port-security tx-key-type 11key 155
IPsec configuration commands 157 ah authentication-algorithm 157 connection-name 157 cryptoengine enable 158 display ipsec policy 158 display ipsec policy-template 162 display ipsec profile 164 display ipsec proposal 166 display ipsec sa 167 display ipsec session 168 display ipsec statistics 170 display ipsec tunnel 171 encapsulation-mode 173 esp authentication-algorithm 174 esp encryption-algorithm 175 ike-peer (IPsec policy view, IPsec policy template view, IPsec profile view) 176 ipsec anti-replay check 176 ipsec anti-replay window 177 ipsec binding policy 177 ipsec cpu-backup enable 179 ipsec decrypt check 179 ipsec invalid-spi-recovery enable 180 ipsec policy (interface view) 181 ipsec policy (system view) 181 ipsec policy isakmp template 182 ipsec policy local-address 183 ipsec policy-template 184 ipsec profile (system view) 184 ipsec profile (tunnel interface view) 185 ipsec proposal 186 ipsec sa global-duration 186 ipsec session idle-time 187 pfs 188 policy enable 189 proposal (IPsec policy view/IPsec policy template view/IPsec profile view) 189 qos pre-classify 190 reset ipsec sa 191 reset ipsec session 192 reset ipsec statistics 192 reverse-route 193 reverse-route preference 196 reverse-route tag 197
vi
sa authentication-hex 197 sa duration 198 sa encryption-hex 199 sa spi 200 sa string-key 201 security acl 202 transform 203 tunnel local 204 tunnel remote 205
IKE configuration commands 206 authentication-algorithm 206 authentication-method 206 certificate domain 207 dh 207 display ike dpd 208 display ike peer 209 display ike proposal 210 display ike sa 211 dpd 215 encryption-algorithm 215 exchange-mode 216 id-type 217 ike dpd 217 ike local-name 218 ike next-payload check disabled 219 ike peer (system view) 219 ike proposal 220 ike sa keepalive-timer interval 221 ike sa keepalive-timer timeout 221 ike sa nat-keepalive-timer interval 222 interval-time 222 local 223 local-address 224 local-name 224 nat traversal 225 peer 226 pre-shared-key 226 proposal (IKE peer view) 227 remote-address 228 remote-name 229 reset ike sa 229 sa duration 230 time-out 231 PKI configuration commands 232 attribute 232 ca identifier 233 certificate request entity 233 certificate request from 234 certificate request mode 235 certificate request polling 235 certificate request url 236 common-name 237 country 237 crl check 238
vii
crl update-period 238 crl url 239 display pki certificate 240 display pki certificate access-control-policy 241 display pki certificate attribute-group 242 display pki crl domain 243 fqdn 245 ip (PKI entity view) 245 ldap-server 246 locality 246 organization 247 organization-unit 248 pki certificate access-control-policy 248 pki certificate attribute-group 249 pki delete-certificate 249 pki domain 250 pki entity 250 pki import-certificate 251 pki request-certificate domain 252 pki retrieval-certificate 252 pki retrieval-crl domain 253 pki validate-certificate 253 root-certificate fingerprint 254 rule (PKI CERT ACP view) 255 state 256
Public key configuration commands 257 display public-key local public 257 display public-key peer 258 peer-public-key end 260 public-key-code begin 260 public-key-code end 261 public-key local create 262 public-key local destroy 263 public-key local export dsa 264 public-key local export rsa 265 public-key peer 266 public-key peer import sshkey 267 RSH configuration commands 268 rsh 268 Portal configuration commands 270 access-user detect 270 display portal acl 270 display portal connection statistics 273 display portal free-rule 276 display portal interface 277 display portal local-server 278 display portal server 279 display portal server statistics 280 display portal tcp-cheat statistics 282 display portal user 284 portal auth-network 285 portal auth-network destination 286 portal delete-user 287
viii
portal domain 288 portal free-rule 288 portal local-server 289 portal local-server enable 290 portal local-server ip 291 portal max-user 292 portal move-mode auto 293 portal nas-id-profile 294 portal nas-ip 294 portal nas-port-type 295 portal offline-detect interval 295 portal redirect-url 296 portal server 297 portal server banner 298 portal server method 299 portal server server-detect 300 portal server user-sync 301 portal web-proxy port 303 reset portal connection statistics 304 reset portal server statistics 304 reset portal tcp-cheat statistics 304 web-redirect 305
Firewall configuration commands 307 Packet-filter firewall configuration commands 307 display firewall ethernet-frame-filter 307 display firewall ipv6 statistics 308 display firewall-statistics 309 firewall default 311 firewall enable 311 firewall ethernet-frame-filter 312 firewall fragments-inspect 312 firewall fragments-inspect { high | low } 313 firewall ipv6 default 314 firewall ipv6 enable 314 firewall ipv6 fragments-inspect 315 firewall packet-filter 315 firewall packet-filter ipv6 316 reset firewall ethernet-frame-filter 317 reset firewall ipv6 statistics 318 reset firewall-statistics 318 ASPF configuration commands 319 aging-time 319 aspf-policy 320 detect 320 display aspf all 321 display aspf interface 323 display aspf policy 323 display aspf session 324 display port-mapping 326 firewall aspf 327 log enable 328 port-mapping 328 reset aspf session 329
ix
SSH2.0 configuration commands 330 SSH2.0 server configuration commands 330 display ssh server 330 display ssh user-information 331 ssh server authentication-retries 332 ssh server authentication-timeout 333 ssh server compatible-ssh1x enable 334 ssh server enable 334 ssh server rekey-interval 335 ssh user 336 SSH2.0 client configuration commands 337 display ssh client source 337 display ssh server-info 338 ssh client authentication server 339 ssh client first-time enable 340 ssh client ipv6 source 340 ssh client source 341 ssh2 342 ssh2 ipv6 343 SFTP server configuration commands 344 sftp server enable 344 sftp server idle-timeout 345 SFTP client configuration commands 345 bye 345 cd 346 cdup 346 delete 347 dir 348 display sftp client source 348 exit 349 get 350 help 350 ls 351 mkdir 351 put 352 pwd 352 quit 353 remove 353 rename 354 rmdir 354 sftp 355 sftp client ipv6 source 356 sftp client source 357 sftp ipv6 357 SSL configuration commands 360 ciphersuite 360 client-verify enable 361 client-verify weaken 361 close-mode wait 362 display ssl client-policy 363 display ssl server-policy 364 handshake timeout 365 pki-domain 366 prefer-cipher 367
x
server-verify enable 367 session 368 ssl client-policy 369 ssl server-policy 369 version 370
User profile configuration commands 371 display user-profile 371 user-profile enable 372 user-profile 372 ARP attack protection configuration commands 374 ARP defense against IP packet attacks configuration commands 374 arp source-suppression enable 374 arp source-suppression limit 374 display arp source-suppression 375 Source MAC address based ARP attack detection configuration commands 376 arp anti-attack source-mac 376 arp anti-attack source-mac aging-time 377 arp anti-attack source-mac exclude-mac 377 arp anti-attack source-mac threshold 378 display arp anti-attack source-mac 379 ARP packet source MAC address consistency check configuration commands 380 arp anti-attack valid-ack enable 380 ARP active acknowledgement configuration commands 380 arp anti-attack active-ack enable 380 ARP automatic scanning and fixed ARP configuration commands 381 arp fixup 381 arp scan 382 IP source guard configuration commands 384 display ip check source 384 display user-bind 385 ip check source 387 user-bind 389 Attack detection and protection configuration commands 391 attack-defense apply policy 391 attack-defense policy 391 blacklist enable 392 blacklist ip 393 defense icmp-flood action drop-packet 394 defense icmp-flood enable 394 defense icmp-flood ip 395 defense icmp-flood rate-threshold 396 defense scan add-to-blacklist 397 defense scan blacklist-timeout 398 defense scan enable 398 defense scan max-rate 399 defense syn-flood action 400 defense syn-flood enable 400 defense syn-flood ip 401 defense syn-flood rate-threshold 402 defense udp-flood action drop-packet 403 defense udp-flood enable 404 defense udp-flood ip 404 defense udp-flood rate-threshold 405
xi
display attack-defense policy 406 display attack-defense statistics interface 410 display blacklist 412 display flow-statistics statistics 414 display flow-statistics statistics interface 415 flow-statistics enable 417 reset attack-defense statistics interface 417 signature-detect 418 signature-detect action drop-packet 419 signature-detect large-icmp max-length 419
TCP attack protection configuration commands 421 display tcp status 421 tcp anti-naptha enable 422 tcp state 422 tcp syn-cookie enable 423 tcp timer check-state 424 Connection limit configuration commands 425 connection-limit default action 425 connection-limit default amount 425 connection-limit policy 426 display connection-limit policy 427 display connection-limit statistics 428 display nat connection-limit 430 limit acl 431 nat connection-limit-policy 432 Password control configuration commands 434 display password-control 434 display password-control blacklist 435 password 436 password-control { aging | composition | history | length } enable 437 password-control aging 438 password-control alert-before-expire 439 password-control authentication-timeout 440 password-control complexity 440 password-control composition 441 password-control enable 442 password-control expired-user-login 442 password-control history 443 password-control length 444 password-control login idle-time 444 password-control login-attempt 445 password-control password update interval 446 password-control super aging 447 password-control super composition 448 password-control super length 448 reset password-control blacklist 449 reset password-control history-record 449 HABP configuration commands 451 display habp 451 display habp table 452 display habp traffic 452 habp client vlan 453 habp enable 454
xii
habp server vlan 454 habp timer 455
URPF configuration commands 456 ip urpf 456 Support and other resources 457 Contacting HP 457 Subscription service 457 Related information 457 Documents 457 Websites 457 Conventions 457 Index 460
xiii
AAA configuration commands

General AAA configuration commands
aaa nas-id profile
Description
Use aaa nas-id profile to create a NAS ID profile and enter its view. A NAS ID profile maintains the bindings between NAS IDs and VLANs. Use undo aaa nas-id profile to remove a NAS ID profile. Related commands: nas-id bind vlan.
Syntax
aaa nas-id profile profile-name undo aaa nas-id profile profile-name
View
System view
Default level
2: System level
Parameters
profile-name: Name of the NAS ID profile, a case-insensitive string of 1 to 16 characters.
Examples
# Create a NAS ID profile named aaa.
<Sysname> system-view [Sysname] aaa nas-id profile aaa [Sysname-nas-id-prof-aaa]
access-limit enable
Description
Use access-limit enable to enable limitation of the number of users in an ISP domain and set the allowed maximum number. After the number of users reaches the allowed maximum number, no more users will be accepted. Use undo access-limit enable to restore the default. By default, there is no limit to the number of users in an ISP domain. System resources are limited, and user connections may compete for network resources when there are many users. Setting a proper limit to the number of users helps provide reliable system performance. Related commands: display domain.
Syntax
access-limit enable max-user-number undo access-limit enable
View
ISP domain view
Default level
2: System level
Parameters
max-user-number: Maximum number of users that the ISP domain can accommodate, in the range of 1 to 2147483646.
Examples
# Set a limit of 500 user connections for ISP domain test.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] access-limit enable 500
accounting command
Description
Use accounting command to specify the command line accounting method. Use undo accounting command to restore the default. By default, the default accounting method for the ISP domain is used for command line accounting. The specified HWTACACS scheme must have been configured. Command line accounting can use only a HWTACACS scheme. Related commands: accounting default and hwtacacs scheme.
Syntax
accounting command hwtacacs-scheme hwtacacs-scheme-name undo accounting command
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a caseinsensitive string of 1 to 32 characters.
Examples
# Configure ISP domain test to use HWTACACS scheme hwtac for command line accounting.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] accounting command hwtacacs-scheme hwtac
accounting default
Description
Use accounting default to configure the default accounting method for an ISP domain. Use undo accounting default to restore the default. By default, the default accounting method of an ISP domain is local. The specified RADIUS or HWTACACS scheme must have been configured. The default accounting method will be used for all users for whom no specific accounting methods are configured. Local accounting is only for monitoring and controlling the number of local user connections; it does not provide the statistics function that the accounting feature generally provides. Related commands: local-user, hwtacacs scheme, and radius scheme.
Syntax
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme radius-scheme-name [ local ] } undo accounting default
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a caseinsensitive string of 1 to 32 characters. local: Performs local accounting. none: Does not perform any accounting. radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Examples
# Configure the default accounting method for ISP domain test to use RADIUS accounting scheme rd and use local accounting as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] accounting default radius-scheme rd local
accounting dvpn
Description
Use accounting dvpn to configure the accounting method for DVPN users. Use undo accounting dvpn to restore the default. By default, the default accounting method for the ISP domain is used for DVPN users.
The specified RADIUS scheme must have been configured. Related commands: local-user, accounting default, and radius scheme.
Syntax
accounting dvpn { local | none | radius-scheme radius-scheme-name [ local ] } undo accounting dvpn
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local accounting. none: Does not perform any accounting. radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Examples
# Configure ISP domain test to use local accounting for DVPN users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] accounting dvpn local
# Configure ISP domain test to use RADIUS accounting scheme rd for DVPN users and use local accounting as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] accounting dvpn radius-scheme rd local
accounting lan-access
Description
Use accounting lan-access to configure the accounting method for LAN users. Use undo accounting lan-access to restore the default. By default, the default accounting method for the ISP domain is used for LAN users. The specified RADIUS scheme must have been configured. Related commands: local-user, accounting default, and radius scheme.
Syntax
accounting lan-access { local | none | radius-scheme radius-scheme-name [ local | none ] } undo accounting lan-access
View
ISP domain view
Default level
2: System level
4
Parameters
Examples
# Configure ISP domain test to use local accounting for LAN users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] accounting lan-access local
# Configure ISP domain test to use RADIUS accounting scheme rd for LAN users and use local accounting as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] accounting lan-access radius-scheme rd local
accounting login
Description
Use accounting login to configure the accounting method for login users (users logging in through the console, AUX, or Asyn port or accessing through Telnet). Use undo accounting login to restore the default. By default, the default accounting method for the ISP domain is used for login users. The specified RADIUS or HWTACACS scheme must have been configured. Accounting is not supported for login users that use FTP. Related commands: local-user, accounting default, hwtacacs scheme, and radius scheme.
Syntax
accounting login { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme radius-scheme-name [ local ] } undo accounting login
View
ISP domain view
Default level
2: System level
Parameters
5
Examples
# Configure ISP domain test to use local accounting for login users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] accounting login local
# Configure ISP domain test to use RADIUS accounting scheme rd for login users and use local accounting as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] accounting login radius-scheme rd local
accounting optional
Description
Use accounting optional to enable the accounting optional feature. Use undo accounting optional to disable the feature. By default, the feature is disabled. After you configure the accounting optional command for a domain, a user that will be disconnected otherwise can continue to use the network resources when no accounting server is available or the communication with the current accounting server fails. However, the device will not send real-time accounting updates for the user anymore. The accounting optional feature applies to scenarios where accounting is not important. NOTE: After you configure the accounting optional command, the setting configured by the accesslimit command in local user view is not effective.
Syntax
accounting optional undo accounting optional
View
ISP domain view
Default level
2: System level
Parameters
None
Examples
# Enable the accounting optional feature for users in domain test.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] accounting optional
accounting portal
Description
Use accounting portal to configure the accounting method for portal users. Use undo accounting portal to restore the default. By default, the default accounting method for the ISP domain is used for portal users. The specified RADIUS scheme must have been configured. Related commands: local-user, accounting default, and radius scheme.
Syntax
accounting portal { local | none | radius-scheme radius-scheme-name [ local ] } undo accounting portal
View
ISP domain view
Default level
2: System level
Parameters
Examples
# Configure ISP domain test to use local accounting for portal users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] accounting portal local
# Configure ISP domain test to use RADIUS scheme rd for accounting on portal users and use local accounting as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] accounting portal radius-scheme rd local
accounting ppp
Description
Use accounting ppp to configure the accounting method for PPP users. Use undo accounting ppp to restore the default. By default, the default accounting method for the ISP domain is used for PPP users. The specified RADIUS or HWTACACS scheme must have been configured. Related commands: local-user, accounting default, hwtacacs scheme, and radius scheme.
Syntax
accounting ppp { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme radius-scheme-name [ local ] } undo accounting ppp
View
ISP domain view
Default level
2: System level
Parameters
Examples
# Configure ISP domain test to use local accounting for PPP users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] accounting ppp local
# Configure ISP domain test to use RADIUS accounting scheme rd for PPP users and use local accounting as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] accounting ppp radius-scheme rd local
accounting ssl-vpn
Description
Use accounting ssl-vpn to configure the accounting method for SSL VPN user. Use undo accounting ssl-vpn to restore the default. By default, the default accounting method for the ISP domain is used for SSL VPN users. The specified RADIUS scheme must have been configured. Related commands: accounting default and radius scheme.
Syntax
accounting ssl-vpn radius-scheme radius-scheme-name undo accounting ssl-vpn
View
ISP domain view
Default level
2: System level
Parameters
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters
Examples
# Configure ISP domain test to use RADIUS accounting scheme rd for SSL VPN users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] accounting ssl-vpn radius-scheme rd
accounting voip
Description
Use accounting voip to configure the RADIUS accounting method for VoIP users. Use undo accounting voip to restore the default. By default, the default accounting method for the ISP domain is used for VoIP users. The specified RADIUS scheme must have been configured. To implement VoIP user accounting, you must complete these tasks: Enable the accounting function for VoIP service. Configure an accounting method for VoIP users.
For more information about the commands to be used to enable accounting for VoIP service, see Voice Command Reference. Related commands: accounting default and radius scheme.
Syntax
accounting voip radius-scheme radius-scheme-name undo accounting voip
View
ISP domain view
Default level
2: System level
Parameters
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters
Examples
# Configure ISP domain test to use RADIUS accounting scheme rd for VoIP users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] accounting voip radius-scheme rd
authentication default
Description
Use authentication default to configure the default authentication method for an ISP domain. Use undo authentication default to restore the default. By default, the default authentication method of an ISP domain is local. The specified RADIUS or HWTACACS scheme must have been configured. The default authentication method will be used for all users for whom no specific authentication methods are configured. Related commands: local-user, hwtacacs scheme, and radius scheme.
Syntax
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radiusscheme radius-scheme-name [ local ] } undo authentication default
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a caseinsensitive string of 1 to 32 characters. local: Performs local authentication. none: Does not perform any authentication. radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Examples
# Configure the default authentication method for ISP domain test to use RADIUS authentication scheme rd and use local authentication as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authentication default radius-scheme rd local
authentication dvpn
Description
Use authentication dvpn to configure the authentication method for DVPN users. Use undo authentication dvpn to restore the default. By default, the default authentication method for the ISP domain is used for DVPN users. The specified RADIUS scheme must have been configured. Related commands: local-user, authentication default, and radius scheme.
10
Syntax
authentication dvpn { local | none | radius-scheme radius-scheme-name [ local ] } undo authentication dvpn
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local authentication. none: Does not perform any authentication. radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Examples
# Configure ISP domain test to use local authentication for DVPN users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authentication dvpn local
# Configure ISP domain test to use RADIUS authentication scheme rd for DVPN users and use local authentication as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authentication dvpn radius-scheme rd local
authentication lan-access
Description
Use authentication lan-access to configure the authentication method for LAN users. Use undo authentication lan-access to restore the default. By default, the default authentication method for the ISP domain is used for LAN users. The specified RADIUS scheme must have been configured. Related commands: local-user, authentication default, and radius scheme.
Syntax
authentication lan-access { local | none | radius-scheme radius-scheme-name [ local | none ] } undo authentication lan-access
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local authentication.
11
none: Does not perform any authentication. radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Examples
# Configure ISP domain test to use local authentication for LAN users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authentication lan-access local
# Configure ISP domain test to use RADIUS authentication scheme rd for LAN users and use local authentication as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authentication lan-access radius-scheme rd local
authentication login
Description
Use authentication login to configure the authentication method for login users (users logging in through the console, AUX, or Asyn port or accessing through Telnet or FTP). Use undo authentication login to restore the default. By default, the default authentication method for the ISP domain is used for login users. The specified RADIUS or HWTACACS scheme must have been configured. Related commands: local-user, authentication default, hwtacacs scheme, and radius scheme.
Syntax
authentication login { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme radius-scheme-name [ local ] } undo authentication login
View
ISP domain view
Default level
2: System level
Parameters
Examples
# Configure ISP domain test to use local authentication for login users.
<Sysname> system-view
12
[Sysname] domain test [Sysname-isp-test] authentication login local
# Configure ISP domain test to use RADIUS authentication scheme rd for login users and use local authentication as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authentication login radius-scheme rd local
authentication portal
Description
Use authentication portal to configure the authentication method for portal users. Use undo authentication portal to restore the default. By default, the default authentication method for the ISP domain is used for portal users. The specified RADIUS scheme must have been configured. Related commands: local-user, authentication default, and radius scheme.
Syntax
authentication portal { local | none | radius-scheme radius-scheme-name [ local ] } undo authentication portal
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local authentication. none: Does not perform any authentication. radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Examples
# Configure ISP domain test to use local authentication for portal users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authentication portal local
# Configure ISP domain test to use RADIUS scheme rd for authentication of portal users and use local authentication as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authentication portal radius-scheme rd local
13
authentication ppp
Description
Use authentication ppp to configure the authentication method for PPP users. Use undo authentication ppp to restore the default. By default, the default authentication method for the ISP domain is used for PPP users. The specified RADIUS or HWTACACS scheme must have been configured. Related commands: local-user, authentication default, hwtacacs scheme, and radius scheme.
Syntax
authentication ppp { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme radius-scheme-name [ local ] } undo authentication ppp
View
ISP domain view
Default level
2: System level
Parameters
Examples
# Configure ISP domain test to use local authentication for PPP users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authentication ppp local
# Configure ISP domain test to use RADIUS authentication scheme rd for PPP users and use local authentication as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authentication ppp radius-scheme rd local
authentication voip
Description
Use authentication voip to configure the authentication method for VoIP users. Use undo authentication voip to restore the default. By default, the default authentication method for the ISP domain is used for VoIP users. The specified RADIUS scheme must have been configured.
14
To implement VoIP user authentication, you must complete the following tasks: Enable the authentication function for VoIP service. Configure an authentication method for VoIP users.
For more information about the commands to be used to enable authentication for VoIP service, see Voice Command Reference. Related commands: authentication default and radius scheme.
Syntax
authentication voip radius-scheme radius-scheme-name undo authentication voip
View
ISP domain view
Default level
2: System level
Parameters
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Examples
# Configure ISP domain test to use RADIUS authentication scheme rd for VoIP users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authentication voip radius-scheme rd
authentication super
Description
Use authentication super to configure the authentication method for user privilege level switching. Use undo authentication super to restore the default. By default, the default authentication method for the ISP domain is used for user privilege level switching authentication. The specified RADIUS or HWTACACS authentication scheme must have been configured. Related commands: hwtacacs scheme and radius scheme; super authentication-mode (Fundamentals Command Reference).
Syntax
authentication super { hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name } undo authentication super
View
ISP domain view
Default level
2: System level
15
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a caseinsensitive string of 1 to 32 characters. radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Examples
# Configure ISP domain test to use HWTACACS scheme tac for user privilege level switching authentication.
<Sysname> system-view [Sysname] super authentication-mode scheme [Sysname] domain test [Sysname-domain-test] authentication super hwtacacs-scheme tac
authorization command
Description
Use authorization command to configure the command line authorization method. Use undo authorization command to restore the default. By default, the default authorization method for the ISP domain is used for command line authorization. The specified HWTACACS scheme must have been configured. With command line authorization configured, a user who has logged in to the device can execute only the commands with a level lower than or equal to that of the local user. Related commands: local-user, authorization default, and hwtacacs scheme.
Syntax
authorization command { hwtacacs-scheme hwtacacs-scheme-name [ local | none ] | local | none } undo authorization command
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a caseinsensitive string of 1 to 32 characters. local: Performs local authorization. none: Does not perform any authorization exchange. In this case, an authenticated user can access only commands of Level 0.
Examples
# Configure ISP domain test to use local command line authorization.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authorization command local
16
# Configure ISP domain test to use HWTACACS scheme hwtac for command line authorization and use local authorization as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authorization command hwtacacs-scheme hwtac local
authorization default
Description
Use authorization default to configure the default authorization method for an ISP domain. Use undo authorization default to restore the default. By default, the default authorization method for the ISP domain of an ISP domain is local. The specified RADIUS or HWTACACS scheme must have been configured. The default authorization method will be used for all users for whom no specific authorization methods are configured. The RADIUS authorization configuration takes effect only when the authentication method and authorization method of the ISP domain use the same RADIUS scheme. Related commands: local-user, hwtacacs scheme, and radius scheme.
Syntax
authorization default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme radius-scheme-name [ local ] } undo authorization default
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a caseinsensitive string of 1 to 32 characters. local: Performs local authorization. none: Does not perform any authorization exchange. After passing authentication, non-login users can access the network, FTP users can access the root directory of the device, and other login users can access only the commands of Level 0. radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Examples
# Configure the default authorization method for ISP domain test to use RADIUS authorization scheme rd and use local authorization as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authorization default radius-scheme rd local
17
authorization dvpn
Description
Use authorization dvpn to configure the authorization method for DVPN users. Use undo authorization dvpn to restore the default. By default, the default authorization method for the ISP domain is used for DVPN users. The specified RADIUS scheme must have been configured. The RADIUS authorization configuration takes effect only when the authentication method and authorization method of the ISP domain use the same RADIUS scheme. Related commands: local-user, authorization default, and radius scheme.
Syntax
authorization dvpn { local | none | radius-scheme radius-scheme-name [ local ] } undo authorization dvpn
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local authorization. none: Does not perform any authorization exchange. In this case, an authenticated LAN user can access the network directly. radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Examples
# Configure ISP domain test to use local authorization for DVPN users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authorization dvpn local
# Configure ISP domain test to use RADIUS authorization scheme rd for DVPN users and use local authorization as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authorization dvpn radius-scheme rd local
authorization lan-access
Description
Use authorization lan-access to configure the authorization method for LAN users. Use undo authorization lan-access to restore the default. By default, the default authorization method for the ISP domain is used for LAN users. The specified RADIUS scheme must have been configured.
18
The RADIUS authorization configuration takes effect only when the authentication method and authorization method of the ISP domain use the same RADIUS scheme. Related commands: local-user, authorization default, and radius scheme.
Syntax
authorization lan-access { local | none | radius-scheme radius-scheme-name [ local | none ] } undo authorization lan-access
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local authorization. none: Does not perform any authorization exchange. In this case, an authenticated LAN user can access the network directly. radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Examples
# Configure ISP domain test to use local authorization for LAN users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authorization lan-access local
# Configure ISP domain test to use RADIUS authorization scheme rd for LAN users and use local authorization as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authorization lan-access radius-scheme rd local
authorization login
Description
Use authorization login to configure the authorization method for login users (users logging in through the console, AUX, or Asyn port or accessing through Telnet or FTP). Use undo authorization login to restore the default. By default, the default authorization method for the ISP domain is used for login users. The specified RADIUS or HWTACACS scheme must have been configured. The RADIUS authorization configuration takes effect only when the authentication method and authorization method of the ISP domain use the same RADIUS scheme. Related commands: local-user, authorization default, hwtacacs scheme, and radius scheme.
Syntax
authorization login { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme radius-scheme-name [ local ] }
19
undo authorization login
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a caseinsensitive string of 1 to 32 characters. local: Performs local authorization. none: Does not perform any authorization exchange. After passing authentication, FTP users can access the root directory of the device, and other login users can access only the commands of Level 0. radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Examples
# Configure ISP domain test to use local authorization for login users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authorization login local
# Configure ISP domain test to use RADIUS authorization scheme rd for login users and use local authorization as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authorization login radius-scheme rd local
authorization portal
Description
Use authorization portal to configure the authorization method for portal users. Use undo authorization portal to restore the default. By default, the default authorization method for the ISP domain is used for portal users. The specified RADIUS scheme must have been configured. The RADIUS authorization configuration takes effect only when the authentication method and authorization method of the ISP domain use the same RADIUS scheme. Related commands: local-user, authorization default, and radius scheme.
Syntax
authorization portal { local | none | radius-scheme radius-scheme-name [ local ] } undo authorization portal
View
ISP domain view
Default level
2: System level
20
Parameters
local: Performs local authorization. none: Does not perform any authorization exchange. In this case, an authenticated portal user can access the network directly. radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Examples
# Configure ISP domain test to use local authorization for portal users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authorization portal local
# Configure ISP domain test to use RADIUS scheme rd for authorization of portal users and use local authorization as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authorization portal radius-scheme rd local
authorization ppp
Description
Use authorization ppp to configure the authorization method for PPP users. Use undo authorization ppp to restore the default. By default, the default authorization method for the ISP domain is used for PPP users. The specified RADIUS or HWTACACS scheme must have been configured. The RADIUS authorization configuration takes effect only when the authentication method and authorization method of the ISP domain use the same RADIUS scheme. Related commands: local-user, authorization default, hwtacacs scheme, and radius scheme.
Syntax
authorization ppp { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme radius-scheme-name [ local ] } undo authorization ppp
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a caseinsensitive string of 1 to 32 characters. local: Performs local authorization. none: Does not perform any authorization exchange. In this case, an authenticated PPP user can access the network directly.
21
Examples
# Configure ISP domain test to use local authorization for PPP users.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authorization ppp local
# Configure ISP domain test to use RADIUS authorization scheme rd for PPP users and use local authorization as the backup.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authorization ppp radius-scheme rd local
authorization voip
Description
Use authorization voip to configure the authorization method for VoIP users. Use undo authorization voip to restore the default. By default, the default authorization method for the ISP domain is used for VoIP users. The specified RADIUS scheme must have been configured. The RADIUS authorization configuration takes effect only when the authentication method and authorization method of the ISP domain use the same RADIUS scheme. To implement VoIP user authorization, you must complete the following tasks: Enable the authorization function for VoIP service. Configure an authorization method for VoIP users.
For more information about the commands to be used to enable authorization for VoIP service, see Voice Command Reference. Related commands: authorization default and radius scheme.
Syntax
authorization voip radius-scheme radius-scheme-name undo authorization voip
View
ISP domain view
Default level
2: System level
Parameters
Examples
# Configure ISP domain test to use RADIUS authorization scheme rd for VoIP users.
22
[Sysname] domain test [Sysname-isp-test] authorization voip radius-scheme rd
authorization-attribute user-profile
Description
Use authorization-attribute user-profile to specify the default authorization user profile for an ISP domain. Use undo authorization-attribute user-profile to restore the default. By default, an ISP domain has no default authorization user profile. After a user of an ISP domain passes authentication, if the server (or the access device in the case of local authentication) does not authorize any user profile to the ISP domain, the system uses the user profile specified by the authorization-attribute user-profile command as that of the ISP domain. If you configure the authorization-attribute user-profile command repeatedly, only the last one takes effect.
Syntax
authorization-attribute user-profile profile-name undo authorization-attribute user-profile
View
ISP domain view
Default level
3: Manage level
Parameters
profile-name: Name of the user profile, a case-sensitive string of 1 to 31 characters. For more information about user profile configuration, see Security Configuration Guide.
Examples
# Specify the default authorization user profile for domain test as profile1.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] authorization-attribute user-profile profile1
cut connection
Description
Use cut connection to tear down the specified user connections forcibly. This command applies to only LAN access, portal, and PPP user connections. For 802.1X users whose usernames carry the version number or contain spaces, you cannot cut the connections by username. For 802.1X users whose usernames use a forward slash (/) or backward slash (\) as the domain name delimiter, you cannot cut their connections by username. For example, the cut connection user-name aaa\bbb command cannot cut the connections of the user aaa\bbb. An interface that is configured with a mandatory authentication domain treats users of the corresponding access type as users in the mandatory authentication domain. For example, if you configure an 802.1X
23
mandatory authentication domain on an interface, the interface will use the domains AAA methods for all its 802.1X users. To cut connections of such users, use the cut connection domain isp-name command and specify the mandatory authentication domain. Related commands: display connection and service-type.
Syntax
cut connection { access-type { dot1x | mac-authentication | portal } | all | domain isp-name | interface interface-type interface-number | ip ip-address | mac mac-address | ucibindex ucib-index | user-name user-name | vlan vlan-id }
View
System view
Default level
2: System level
Parameters
access-type: Specifies the user connections of the specified access type. dot1x: Indicates 802.1X authentication. mac-authentication: Indicates MAC address authentication. portal: Indicates portal authentication.
all: Specifies all user connections. domain isp-name: Specifies the user connections of an ISP domain. The isp-name argument refers to the name of an existing ISP domain and is a string of 1 to 24 characters. interface interface-type interface-number: Specifies the user connections on an interface. Only Layer 2 Ethernet interfaces and WLAN virtual interfaces are supported. ip ip-address: Specifies the user connections for an IP address. mac mac-address: Specifies the user connections for a MAC address, with mac-address in the format H-HH. ucibindex ucib-index: Specifies the user connection that uses the connection index. The value range is from 0 to 4294967295. user-name user-name: Specifies the user connections that use the username. The user-name argument is a case-sensitive string of 1 to 80 characters. For a username entered without a domain name, the system assumes that the user is in the default domain or the mandatory authentication domain. vlan vlan-id: Specifies the user connections of a VLAN, with vlan-id ranging from 1 to 4094.
Examples
# Tear down all connections of ISP domain test.
<Sysname> system-view [Sysname] cut connection domain test
display connection
Description
Use display connection to display information about AAA user connections. This command does not display information about FTP user connections.
24
With no parameter specified, this command displays brief information about all AAA user connections. If you specify the ucibindex ucib-index option, this command displays detailed information; otherwise, this command displays brief information. If an interface is configured with a mandatory authentication domain (for example, an 802.1X mandatory authentication domain), users accessing the interface through the specified access type are treated as users in the mandatory authentication domain. To display connections of such users, specify the mandatory authentication domain for the display connection domain isp-name command. For 802.1X users whose usernames use a forward slash (/) or backward slash (\) as the domain name delimiter, you cannot query the connections by username. For example, the display connection user-name aaa\bbb command cannot display the connections of the user aaa\bbb. Related commands: cut connection.
Syntax
display connection [ access-type { dot1x | mac-authentication | portal } | domain isp-name | interface interface-type interface-number | ip ip-address | mac mac-address | ucibindex ucib-index | user-name user-name | vlan vlan-id ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
access-type: Specifies the user connections of the specified access type. dot1x: Indicates 802.1X authentication. mac-authentication: Indicates MAC address authentication. portal: Indicates portal authentication.
domain isp-name: Specifies the user connections of an ISP domain. The isp-name argument refers to the name of an existing ISP domain and is a case-insensitive string of 1 to 24 characters. interface interface-type interface-number: Specifies the user connections on an interface. Only Layer 2 Ethernet interfaces and WLAN virtual interfaces are supported. ip ip-address: Specifies the user connections of an IP address. mac mac-address: Specifies the user connections of a MAC address, with mac-address in the format H-HH. ucibindex ucib-index: Specifies the user connection that uses the connection index. The value range is in the range of 0 to 4294967295. user-name user-name: Specifies the user connections that use the username. The user-name argument is a case-sensitive string of 1 to 80 characters. For a username entered without a domain name, the system assumes that the user is in the default domain name or the mandatory authentication domain. vlan vlan-id: Specifies the user connections of a VLAN, with vlan-id ranging from 1 to 4094. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression.
25
include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display information about all AAA user connections.
<Sysname> display connection Index=1 ,Username=telnet@system
IP=10.0.0.1 Total 1 connection(s) matched.
# Display information about AAA user connections using the index of 0. Table 1 Output description Field
Username IP IPv6
Description
Username of the connection, in the format username@domain IPv4 address of the user IPv6 address of the user
display domain
Description
Use display domain to display the configuration information of ISP domains. If you do not specify any ISP domain, the command displays the configuration information of all ISP domains. Related commands: access-limit enable, domain, and state.
Syntax
display domain [ isp-name ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
isp-name: Name of an existing ISP domain, a string of 1 to 24 characters. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
26
Examples
# Display the configuration information of all ISP domains.
<Sysname> display domain 0 Domain : system State : Active Disabled : local : local : local Access-limit :
Accounting method : Required Default authentication scheme Default authorization scheme Default accounting scheme Domain User Template: Idle-cut : Disabled Self-service : Disabled Authorization attributes : 1 Domain : test State : Active Access-limit : Disabled Accounting method : Required Default authentication scheme Default authorization scheme Default accounting scheme Domain User Template: Idle-cut : Disabled Self-service : Disabled Authorization attributes : Default Domain Name: system Total 2 domain(s). : local : local : local
Table 2 Output description Field

Domain State
Description
ISP domain name. Status of the ISP domain, active or blocked. Users in an active ISP domain can request network services, and users in a blocked ISP domain cannot. Limit on the number of user connections. If there is no limit on the number, the value of this field is Disable. Indicates whether accounting is required. If accounting is required, when no accounting server is available or communication with the accounting server fails, user connections will be torn down. Otherwise, users can continue to use network services. Default authentication method. Default authorization method. Default accounting method. 27
Access-limit
Accounting method
Default authentication scheme Default authorization scheme Default accounting scheme
Field
Domain User Template
Description
Indicates some functions and attributes set for users in the domain. Indicates whether the idle cut function is enabled. With the idle cut function enabled for a domain, the system logs out any user in the domain whose traffic is less than the specified minimum traffic during the idle timeout period. Indicates whether the self service function is enabled. With the self service function enabled, users can launch a browser and enter the self service URL in the address bar to access the self service pages and perform self service operations. Default authorization attributes for the ISP domain.
Idle-cut
Self-service
Authorization attributes
domain
Description
Use domain isp-name to create an ISP domain and enter ISP domain view. Use undo domain to remove an ISP domain. By default, there is a system predefined ISP domain named system in the system. All ISP domains are in active state when they are created. The system predefined ISP domain system cannot be deleted; you can only modify its configuration. NOTE: To delete the ISP domain that is used as the default ISP domain, you must change it to a nondefault ISP domain first by using the undo domain default enable command. Related commands: state and display domain.
Syntax
domain isp-name undo domain isp-name
View
System view
Default level
3: Manage level
Parameters
isp-name: ISP domain name, a case-insensitive string of 1 to 24 characters that contains no forward slash (/), backward slash (\), colon (:), asterisk (*), question mark (?), less-than sign (<), greater-than sign (>), or the @ sign.
Examples
# Create ISP domain test, and enter ISP domain view.
28
<Sysname> system-view [Sysname] domain test [Sysname-isp-test]
domain default enable

Description
Use domain default enable to specify the default ISP domain. Users without any domain name carried in the usernames are considered to be in the default domain. Use undo domain default enable to restore the default. By default, the default ISP domain is the system predefined ISP domain system. There can be only one default ISP domain. The specified domain must already exist; otherwise, users without any domain name carried in the username cannot pass authentication. To delete the ISP domain that is used as the default ISP domain, you must change it to a non-default ISP domain first by using the domain default disable command. Related commands: domain, state, and display domain.
Syntax
domain default enable isp-name undo domain default enable
View
System view
Default level
3: Manage level
Parameters
isp-name: Name of the ISP domain, a case-insensitive string of 1 to 24 characters.
Examples
# Create a new ISP domain named test, and configure it as the default ISP domain.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] quit [Sysname] domain default enable test
idle-cut enable
Description
Use idle-cut enable to enable the idle cut function and set the relevant parameters. With the idle cut function enabled for a domain, the device checks the traffic of each online user in the domain at the idle timeout interval, and logs out any user in the domain whose traffic during the idle timeout interval is less than the specified minimum traffic. Use undo idle-cut enable to restore the default. By default, the function is disabled.
29
You can also set the idle timeout interval on the server to make the server log out users whose traffic during the idle timeout interval is less than 10240 bytes, but your setting on the server takes effect only when you disable the idle cut function on the device. Related commands: domain.
Syntax
idle-cut enable minute [ flow ] undo idle-cut enable
View
ISP domain view
Default level
2: System level
Parameters
minute: Idle timeout interval, in the range of 1 to 600 minutes. flow: Minimum traffic during the idle timeout period, which is in the range of 1 to 10240000 bytes and defaults to 10240.
Examples
# Enable the idle cut function and set the idle timeout interval to 50 minutes and the traffic threshold to 1024 bytes for ISP domain test.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] idle-cut enable 50 1024
ip pool
Description
Use ip pool to configure an address pool for assigning addresses to PPP users. Use undo ip pool to delete an address pool. By default, no IP address pool is configured for PPP users. An IP address pool configured in system view is used to assign IP addresses to PPP users who do not need to be authenticated. To specify the address pool used for assigning an IP address to the peer device, use the remote address command in interface view. An IP address pool configured in ISP domain view is used to assign IP addresses to the ISP domains PPP users who must be authenticated. Configure IP address pools for ISP domains in scenarios where an interface serves a great amount of PPP users but the address resources are inadequate. For example, an Ethernet interface running PPPoE can accommodate up to 4096 users. However, only one address pool with up to 1024 addresses can be configured on its VT. This is obviously far from what is required. To address the issue, configure address pools for ISP domains and assign addresses from them to the PPP users by domain. Related commands: remote address (Layer 2WAN Command Reference).
Syntax
ip pool pool-number low-ip-address [ high-ip-address ] undo ip pool pool-number
30
View
System view, ISP domain view
Default level
2: System level
Parameters
pool-number: Address pool number, in the range of 0 to 99. low-ip-address and high-ip-address: Start and end IP addresses of the address pool. Up to 1024 addresses are allowed for an address pool. If you do not specify the end IP address, there will be only one IP address in the pool, namely the start IP address.
Examples
# Configure the IP address pool 0 with the address range of 129.102.0.1 to 129.102.0.10.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] ip pool 0 129.102.0.1 129.102.0.10
nas-id bind vlan

Description
Use nas-id bind vlan to bind a NAS ID with a VLAN. Use undo nas-id bind vlan to remove a NAS ID-VLAN binding. By default, no NAS ID-VLAN binding exists. In a NAS ID profile view, you can configure multiple NAS IDVLAN bindings. A NAS ID can be bound with more than one VLAN, but one VLAN can be bound with only one NAS ID. If you bind a VLAN with different NAS IDs, only the last binding takes effect. Related commands: aaa nas-id profile.
Syntax
nas-id nas-identifier bind vlan vlan-id undo nas-id nas-identifier bind vlan vlan-id
View
NAS ID profile view
Default level
2: System level
Parameters
nas-identifier: NAS ID, a case-sensitive string of 1 to 20 characters vlan-id: ID of the VLAN to be bound with the NAS ID, in the range of 1 to 4094.
Examples
# Bind NAS ID 222 with VLAN 2.
<Sysname> system-view [Sysname] aaa nas-id profile aaa [Sysname-nas-id-prof-aaa] nas-id 222 bind vlan 2
31
self-service-url enable
Description
Use self-service-url enable to enable the self-service server location function and specify the URL of the self-service server. Use undo self-service-url enable to restore the default. By default, the self-service server location function is disabled. With the self-service function, users can manage and control their accounts and passwords. Only the RADIUS server systems provided by the IMC support the self-service function.
Syntax
self-service-url enable url-string undo self-service-url enable
View
ISP domain view
Default level
2: System level
Parameters
url-string: URL of the self-service server, a string of 1 to 64 characters. It must start with http:// and contain no question mark. This URL was specified by the RADIUS server administrator during RADIUS server installation.
Examples
# For ISP domain test, enable the self-service server location function and specify the URL of the selfservice server for changing user password to http://10.153.89.94/selfservice.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] self-service-url enable http://10.153.89.94/selfservice
state (ISP domain view)

Description
Use state to set the status of an ISP domain. Use undo state to restore the default. By default, an ISP domain is in active state. By blocking an ISP domain, you disable users of the domain that are offline from requesting network services. The online users are not affected.
Syntax
state { active | block } undo state
View
ISP domain view
32
Default level
2: System level
Parameters
active: Places the ISP domain in active state to allow the users in the ISP domain to request network services. block: Places the ISP domain in blocked state to prevent users in the ISP domain from requesting network services.
Examples
# Place the current ISP domain test to the state of blocked.
<Sysname> system-view [Sysname] domain test [Sysname-isp-test] state block
Local user configuration commands

access-limit
Description
Use access-limit to limit the number of concurrent users of a local user account. Use undo access-limit to remove the limitation. By default, there is no limit to the number of users who concurrently use the same local user account. This command takes effect only when local accounting is used for the user account. This limit is not effective for FTP users because accounting is not available for FTP users. Related commands: display local-user.
Syntax
access-limit max-user-number undo access-limit
View
Local user view
Default level
3: Manage level
Parameters
max-user-number: Maximum number of concurrent users of the current local user account, in the range of 1 to 1024.
Examples
# Limit the maximum number of concurrent users of local user account abc to 5.
<Sysname> system-view [Sysname] local-user abc [Sysname-luser-abc] access-limit 5
33
authorization-attribute (local user view/user group view)

Description
Use authorization-attribute to configure authorization attributes for the local user or user group. After the local user or a local user of the user group passes authentication, the device will assign these attributes to the user. Use undo authorization-attribute to remove authorization attributes and restore the defaults. By default, no authorization attribute is configured for a local user or user group. Every configurable authorization attribute has its definite application environments and purposes. Consider the service types of users when assigning authorization attributes. Authorization attributes configured for a user group are effective for all local users in the group. You can group local users to improve configuration and management efficiency. An authorization attribute configured in local user view takes precedence over the same attribute configured in user group view. If an authorization attribute is configured in user group view but not in local user view, the setting in user group view takes effect. If only one user is playing the role of security log administrator in the system, you cannot delete the user account, or remove or change the users role, unless you configure another user as a security log administrator first. A local user can play only one role at a moment. If you perform the role configuration repeatedly, only the last role configuration takes effect.
Syntax
authorization-attribute { acl acl-number | callback-number callback-number | idle-cut minute | level level | user-profile profile-name | user-role { guest | guest-manager | security-audit } | vlan vlan-id | workdirectory directory-name } * undo authorization-attribute { acl | callback-number | idle-cut | level | user-profile | user-role | vlan | work-directory } *
View
Local user view, user group view
Default level
3: Manage level
Parameters
acl acl-number: Specifies the authorization ACL. The ACL number must be in the range of 2000 to 5999. After passing authentication, a local user is authorized to access the network resources specified by this ACL. callback-number callback-number: Specifies the authorization PPP callback number. callback-number is a case-sensitive string of 1 to 64 characters. After a local user passes authentication, the device uses this number to call the user. idle-cut minute: Sets the idle timeout interval. With the idle cut function enabled, an online user whose idle period exceeds the specified idle timeout interval will be logged out. minute indicates the idle timeout interval, in the range of 1 to 120 minutes. level level: Specifies the user level, which can be 0 for visit level, 1 for monitor level, 2 for system level, and 3 for manage level. A smaller number means a lower level. If the user interfaces authentication
34
mode is scheme, which commands users can use after login in depends on this argument. By default, the user level is 0, and users can use only commands of level 0 after login. user-profile profile-name: Specifies the authorization user profile. profile-name is a case-sensitive string of 1 to 32 characters. It can consist of English letters, digits, and underlines and must start with an English letter. After a user passes authentication and gets online, the device uses the settings in the user profile to restrict the access behavior of the user. For more information about user profiles, see Security Configuration Guide. user-role: Specifies the role for the local user. This keyword is available in only local user view. Users playing different roles can access different levels of commands. If you specify no role for a local user, the access right of the user after login depends on other authorization attributes. Supported roles include: guest: A guest user account is usually created through the web interface. guest-manager: After passing authentication, a guest manager can only use the web interface to access guest-related pages to, for example, create, modify, or change guest user accounts. security-audit: A local user playing this role is a security log administrator After passing authentication, a security log administrator can manage security log files, for example, save security log files. For more information about the commands that a security log administrator can use, see Network Management and Monitoring Command Reference.
vlan vlan-id: Specifies the authorized VLAN. vlan-id is in the range of 1 to 4094. After passing authentication, a local user can access the resources in this VLAN. work-directory directory-name: Specifies the work directory, if the user or users use the FTP or SFTP service. directory-name is a case-insensitive string of 1 to 135 characters. The directory must already exist. By default, an FTP or SFTP user can access the root directory of the device.
Examples
# Configure the authorized VLAN of local user abc as VLAN 2.
<Sysname> system-view [Sysname] local-user abc [Sysname-luser-abc] authorization-attribute vlan 2
# Configure the authorized VLAN of user group abc as VLAN 3.

<Sysname> system-view [Sysname] user-group abc [Sysname-ugroup-abc] authorization-attribute vlan 3
bind-attribute
Description
Use bind-attribute to configure binding attributes for a local user. Use undo bind-attribute to remove binding attributes of a local user. By default, no binding attribute is configured for a local user. Binding attributes are checked upon authentication of a local user. If the binding attributes of a local user do not match the configured ones, the user will fail the checking and the authentication. Binding attribute checking does not take the service types of the users into account. A configured binding attribute is effective for all types of users. Be cautious when deciding which binding attributes should be configured for which type of local users. For example, an IP address binding is applicable to only 802.1X authentication that supports IP address upload. If you configure an IP address binding for an
35
authentication method that does not support IP address upload, for example, MAC authentication, the local authentication will fail.
Syntax
bind-attribute { call-number call-number [ : subcall-number ] | ip ip-address | location port slot-number subslot-number port-number | mac mac-address | vlan vlan-id } * undo bind-attribute { call-number | ip | location | mac | vlan } *
View
Local user view
Default level
3: Manage level
Parameters
call-number call-number: Specifies a calling number for ISDN user authentication. The call-number argument is a string of 1 to 64 characters. This option is applicable to only PPP users. subcall-number: Specifies the sub-calling number. The total length of the calling number and the subcalling number cannot be more than 62 characters. ip ip-address: Specifies the IP address of the user. This option is applicable to only 802.1X users. location port slot-number subslot-number port-number: Specifies the port to which the user is bound. The slot-number argument is in the range of 0 to 255, the subslot-number argument is in the range of 0 to 15, and the port-number argument is in the range of 0 to 255. This option is applicable to only LAN users. mac mac-address: Specifies the MAC address of the user in the format H-H-H. This option is applicable to only LAN users. vlan vlan-id: Specifies the VLAN to which the user belongs. The vlan-id argument is in the range of 1 to 4094. This option is applicable to only LAN users.
Examples
# Configure the bound IP of local user abc as 3.3.3.3.
<Sysname> system-view [Sysname] local-user abc [Sysname-luser-abc] bind-attribute ip 3.3.3.3
display local-user
Description
Use display local-user to display configuration and statistics information about local users. If you do not specify any parameter, the command displays information about all local users Related commands: local-user.
Syntax
display local-user [ idle-cut { disable | enable } | service-type { dvpn | ftp | lan-access | pad | portal | ppp | ssh | telnet | terminal | web } | state { active | block } | user-name user-name | vlan vlan-id ] [ | { begin | exclude | include } regular-expression ]
View
Any view
36
Default level
1: Monitor level
Parameters
idle-cut { disable | enable }: Specifies local users with the idle cut function disabled or enabled. service-type: Specifies the local users that use a specified type of service. dvpnDVPN tunnel users. ftpFTP users. lan-accessUsers accessing the network through Ethernet, such as 802.1X users. padX.25 PAD users. portalPortal users. pppPPP users. sshSSH users. telnetTelnet users. terminalUsers logging in through the console port, AUX port, or Asyn port. WebWeb users.
state { active | block }: Specifies local users in the state of active or blocked. A local user in active state can access network services, but a local user in blocked state cannot. user-name user-name: Specifies all local users using the specified username. The username is a casesensitive string of 1 to 55 characters and does not contain the domain name. vlan vlan-id: Specifies all local users in a VLAN. The VLAN ID ranges from 1 to 4094. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display information about all local users.
<Sysname> display local-user The contents of local user abc: State: ServiceType: Access-limit: Max AccessNum: User-group: Bind attributes: IP address: Bind location: MAC address: Vlan ID: Authorization attributes: Idle TimeOut: 10(min) 1.2.3.4 0/4/1 (SLOT/SUBSLOT/PORT) 00-01-00-02-00-03 100 Active lan-access Enabled 300 system Current AccessNum: 0
37
Work Directory: User Privilege: Acl ID: Vlan ID: User Profile: Expiration date: Password aging: Password length: Password composition:
cfa0:/ 3 2000 100 prof1 12:12:12-2018/09/16 Enabled (30 days) Enabled (4 characters) Enabled (4 types, 2 characters per type)
Total 1 local user(s) matched.

State ServiceType
Description
Status of the local user, active or blocked Service types that the local user can use, including DVPN, FTP, LAN, PAD, PPP, Portal, SSH, Telnet, and terminal Limit on the number of user connections that use the current username Current number of user connections that use the current username Maximum number of user connections that use the current username Binding attributes of the local user VLAN to which the user is bound Calling number of the ISDN user Authorization attributes of the local user Idle timeout interval of the user, in minutes Authorized PPP callback number of the local user Directory that the FTP user can access Authorized VLAN of the local user User profile for local user authorization Expiration time of the local user Aging time of the local user password Minimum length of the local user password Password composition policy of the local user
Access-limit Current AccessNum Max AccessNum Bind attributes VLAN ID Calling Number Authorization attributes Idle TimeOut Callback-number Work Directory VLAN ID User Profile Expiration date Password aging Password length Password composition
display user-group
Description
Use display user-group to display configuration information about one or all user groups. If you do no specify any user group name, the command displays information about all users groups. Related commands: user-group.
38
Syntax
display user-group [ group-name ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
2: System level
Parameters
group-name: User group name, a case-insensitive string of 1 to 32 characters. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display configuration information about user group abc.
<Sysname> display user-group abc The contents of user group abc: Authorization attributes: Idle-cut: Work Directory: Level: Acl Number: Vlan ID: User-Profile: Callback-number: Password aging: Password length: Password composition: 120(min) cfa0:/ 1 2000 1 1 1 Enabled (1 days) Enabled (4 characters) Enabled (1 types, 1 characters per type)
Total 1 user group(s) matched.
expiration-date (local user view)

Description
Use expiration-date to set the expiration time of a local user. Use undo expiration-date to remove the configuration. By default, a local user has no expiration time and no time validity checking is performed. When some users need to access the network temporarily, create a guest account and specify a validity time and an expiration time for the account to control the validity of the account. When a user uses the guest account for local authentication and passes the authentication, the access device checks whether the current system time is between the validity time and the expiration time. If so, it permits the user to access the network. Otherwise, it denies the access request of the user. Related commands: validity-date.
39
Syntax
expiration-date time undo expiration-date
View
Local user view
Default level
3: Manage level
Parameters
time: Expiration time of the local user, in the format HH:MM:SS-MM/DD/YYYY, HH:MM:SSYYYY/MM/DD, MM/DD/YYYY-HH:MM:SS, or YYYY/MM/DD-HH:MM:SS. HH:MM:SS indicates the time, where HH ranges from 0 to 23, MM and SS range from 0 to 59. MM/DD/YYYY or YYYY/MM/DD indicates the date, where YYYY ranges from 2000 to 2035, MM ranges from 1 to 12, and the range of DD depends on the month. Except for the zeros in 00:00:00, leading zeros can be omitted. For example, 2:2:0-2008/2/2 equals to 02:02:00-2008/02/02.
Examples
# Set the expiration time of user abc to 12:10:20 on May 31, 2008.
<Sysname> system-view [Sysname] local-user abc [Sysname-luser-abc] expiration-date 12:10:20-2008/05/31
group
Description
Use group to assign a local user to a user group. Use undo group to restore the default. By default, a local user belongs to the system default user group system.
Syntax
group group-name undo group
View
Local user view
Default level
3: Manage level
Parameters
group-name: User group name, a case-insensitive string of 1 to 32 characters.
Examples
# Assign local user 1 1 to user group abc. 1
<Sysname> system-view [Sysname] local-user 111 [Sysname-luser-111] group abc
40
local-user
Description
Use local-user to add a local user and enter local user view. Use undo local-user to remove the specified local users. By default, no local user is configured. Related commands: display local-user and service-type.
Syntax
local-user user-name undo local-user { user-name | all [ service-type { dvpn | ftp | lan-access | pad | portal | ppp | ssh | telnet | terminal | web } ] }
View
System view
Default level
3: Manage level
Parameters
user-name: Name for the local user, a case-sensitive string of 1 to 55 characters that does not contain the domain name. It cannot contain any backward slash (\), forward slash (/), vertical line (|), colon (:), asterisk (*), question mark (?), less-than sign (<), greater-than sign (>), and the @ sign and cannot be a, al, or all. all: Specifies all users. service-type: Specifies the users of a type. dvpnUsers using DVPN tunnel. ftpFTP users. lan-accessUsers accessing the network through an Ethernet, such as 802.1X users. padUsers using x.25 PAD. portalPortal users. pppPPP users. sshSSH users. telnetTelnet users. terminalUsers logging in through the console port, AUX port, or Asyn port. WebWeb users.
Examples
# Add a local user named user1.
<Sysname> system-view [Sysname] local-user user1 [Sysname-luser-user1]
41
local-user password-display-mode
Description
Use local-user password-display-mode to set the password display mode for all local users. Use undo local-user password-display-mode to restore the default. By default, the password display mode is auto. If you configure the local-user password-display-mode cipher-force command, all existing local user passwords will be displayed in cipher text, regardless of the configuration of the password command. If you also save the configuration and restart the device, all existing local user passwords will always be displayed in cipher text, no matter how you configure the local-user password-display-mode command or the password command. The passwords configured after you restore the display mode to auto by using the local-user password-display-mode auto command, however, are displayed as defined by the password command. Related commands: display local-user and password.
Syntax
local-user password-display-mode { auto | cipher-force } undo local-user password-display-mode
View
System view
Default level
2: System level
Parameters
auto: Displays the password of a local user in the mode that is specified for the user by using the password command. cipher-force: Displays the passwords of all local users in cipher text.
Examples
# Specify to display the passwords of all users in cipher text.
<Sysname> system-view [Sysname] local-user password-display-mode cipher-force
password
Description
Use password to configure a password for a local user and specify whether to display the password in cipher text or plain text. Use undo password to delete the password of a local user. If you configure the local-user password-display-mode cipher-force command, all existing local user passwords will be displayed in cipher text, regardless of the configuration of the password command. If you also save the configuration and restart the device, all existing local user passwords will always be displayed in cipher text, no matter how you configure the local-user password-display-mode command or the password command. The passwords configured after you restore the display mode to auto by using the local-user password-display-mode auto command, however, are displayed as defined by the password command.
42
With the cipher keyword specified, a password of up to 16 characters in plain text will be encrypted into a password of 24 characters in cipher text, and a password of 16 to 63 characters in plain text will be encrypted into a password of 88 characters in cipher text. For a password of 24 characters, if the system can decrypt the password, the system treats it as a password in cipher text. Otherwise, the system treats it as a password in plain text. Related commands: display local-user and local-user password-display-mode.
Syntax
password { cipher | simple } password undo password
View
Local user view
Default level
2: System level
Parameters
cipher: Displays the password in cipher text. simple: Displays the password in plain text. password: Password for the local user, case sensitive. It must be in plain text if you specify the simple keyword and can be in plain or cipher text if you specify the cipher keyword. A password in plain text must be a string of 1 to 63 characters that contains no blank space, for example, aabbcc. A password in cipher text must be a string of 24 or 88 characters, for example, _(TT8F]Y\5SQ=^Q`MAF4<1!!.
Examples
# Set the password of local user user1 to 123456 and set the display mode to plain text.
<Sysname> system-view [Sysname] local-user user1 [Sysname-luser-user1] password simple 123456
service-type
Description
Use service-type to specify the service types that a user can use. Use undo service-type to delete one or all service types configured for a user. By default, a user is authorized with no service. You can execute the service-type command repeatedly to specify multiple service types for a user.
Syntax
service-type { dvpn | ftp | lan-access | { pad | ssh | telnet | terminal } * | portal | ppp | web } undo service-type { dvpn | ftp | lan-access | { pad | ssh | telnet | terminal } * | portal | ppp | web }
View
Local user view
Default level
3: Manage level
43
Parameters
dvpn: Authorizes the user to use the DVPN service. ftp: Authorizes the user to use the FTP service. The user can use the root directory of the FTP server by default. lan-access: Authorizes the user to use the LAN access service. Such users are mainly Ethernet users, for example, 802.1X users. pad: Authorizes the user to use the PAD service. ssh: Authorizes the user to use the SSH service. telnet: Authorizes the user to use the Telnet service. terminal: Authorizes the user to use the terminal service, allowing the user to login from the console, AUX or Asyn port. portal: Authorizes the user to use the Portal service. ppp: Authorizes the user to use the PPP service. Web: Authorizes the user to use the Web service.
Examples
# Authorize user user1 to use the Telnet service.
<Sysname> system-view [Sysname] local-user user1 [Sysname-luser-user1] service-type telnet
state (local user view)

Description
Use state to set the status of a local user. Use undo state to restore the default. By default, a local user is in active state. By blocking a user, you disable the user from requesting network services. No other users are affected. Related commands: local-user.
Syntax
state { active | block } undo state
View
Local user view
Default level
2: System level
Parameters
active: Places the local user in active state to allow the local user to request network services. block: Places the local user in blocked state to prevent the local user from requesting network services.
44
Examples
# Place local user user1 to the blocked state.
<Sysname> system-view [Sysname] local-user user1 [Sysname-luser-user1] state block
user-group
Description
Use user-group to create a user group and enter its view. Use undo user-group to remove a user group. A user group consists of a group of local users and has a set of local user attributes. You can configure local user attributes for a user group to implement centralized management of user attributes for the local users in the group. Configurable user attributes include password control attributes and authorization attributes. A user group with one or more local users cannot be removed. The system predefined user group system cannot be removed but you can change its configurations. Related commands: display user-group.
Syntax
user-group group-name undo user-group group-name
View
System view
Default level
3: Manage level
Parameters
group-name: User group name, a case-insensitive string of 1 to 32 characters.
Examples
# Create a user group named abc and enter its view.
<Sysname> system-view [Sysname] user-group abc [Sysname-ugroup-abc]
validity-date (local user view)

Description
Use validity-date to set the validity time of a local user. Use undo validity-date to remove the configuration. By default, a local user has no validity time and no time validity checking is performed. When some users need to access the network temporarily, create a guest account and specify a validity time and an expiration time for the account to control the validity of the account. When a user uses the guest account for local authentication and passes the authentication, the access device checks whether
45
the current system time is between the validity time and the expiration time. If so, it permits the user to access the network. Otherwise, it denies the access request of the user. Related command: expiration-date.
Syntax
validity-date time undo validity-date
View
Local user view
Default level
3: Manage level
Parameters
time: Validity time of the local user, in the format HH:MM:SS-MM/DD/YYYY, HH:MM:SSYYYY/MM/DD, MM/DD/YYYY-HH:MM:SS, or YYYY/MM/DD-HH:MM:SS. HH:MM:SS indicates the time, where HH ranges from 0 to 23, MM and SS range from 0 to 59. MM/DD/YYYY or YYYY/MM/DD indicates the date, where YYYY ranges from 2000 to 2035, MM ranges from 1 to 12, and the range of DD depends on the month. Except for the zeros in 00:00:00, leading zeros can be omitted. For example, 2:2:0-2008/2/2 equals to 02:02:00-2008/02/02.
Examples
# Set the validity time of user abc to 12:10:20 on April 30, 2008, and the expiration time to 12:10:20 on May 31, 2008.
<Sysname> system-view [Sysname] local-user abc [Sysname-luser-abc] validity-date 12:10:20-2008/04/30 [Sysname-luser-abc] expiration-date 12:10:20-2008/05/31
RADIUS configuration commands

accounting-on enable
Description
Use accounting-on enable to configure the accounting-on feature. This feature enables the device to, after rebooting, automatically sends an accounting-on message to the RADIUS server to log out online users. Use undo accounting-on enable to disable the accounting-on feature. By default, the accounting-on feature is disabled. Parameters set with the accounting-on enable command take effect immediately. NOTE: After executing the accounting-on enable command, issue the save command to make sure that the command takes effect after the device reboots. For information about the save command, see Fundamentals Command Reference. Related commands: radius scheme.
46
Syntax
accounting-on enable [ interval seconds | send send-times ] * undo accounting-on enable
View
RADIUS scheme view
Default level
2: System level
Parameters
seconds: Time interval for retransmitting an accounting-on packet in seconds, ranging from 1 to 15. The default is 3 seconds. send-times: Maximum number of accounting-on packet transmission attempts, ranging from 1 to 255. The default is 50.
Examples
# Enable the accounting-on feature for RADIUS authentication scheme radius1, set the retransmission interval to 5 seconds, and set the transmission attempts to 15.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] accounting-on enable interval 5 send 15
attribute 25 car
Description
Use attribute 25 car to specify to interpret the RADIUS class attribute (attribute 25) as CAR parameters. Use undo attribute 25 car to restore the default. By default, RADIUS attribute 25 is not interpreted as CAR parameters. Related commands: display radius scheme and display connection.
Syntax
attribute 25 car undo attribute 25 car
View
RADIUS scheme view
Default level
2: System level
Parameters
None
Examples
# Specify to interpret RADIUS attribute 25 as CAR parameters.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] attribute 25 car
47
data-flow-format (RADIUS scheme view)

Description
Use data-flow-format to set the traffic statistics unit for data flows or packets. Use undo data-flow-format to restore the default. By default, the unit for data flows is byte and that for data packets is one-packet. The unit for data flows and that for packets must be consistent with those on the RADIUS server. Otherwise, accounting cannot be performed correctly. Related commands: display radius scheme.
Syntax
data-flow-format { data { byte | giga-byte | kilo-byte | mega-byte } | packet { giga-packet | kilopacket | mega-packet | one-packet } } * undo data-flow-format { data | packet }
View
RADIUS scheme view
Default level
2: System level
Parameters
data { byte | giga-byte | kilo-byte | mega-byte }: Specifies the unit for data flows, which can be byte, kilobyte, megabyte, or gigabyte. packet { giga-packet | kilo-packet | mega-packet | one-packet }: Specifies the unit for data packets, which can be one-packet, kilo-packet, mega-packet, or giga-packet.
Examples
# Set the traffic statistics unit for data flows and that for packets to kilobytes and kilo-packets respectively in RADIUS scheme radius1.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] data-flow-format data kilo-byte packet kilo-packet
display radius scheme

Description
Use display radius scheme to display the configuration information of RADIUS schemes. If you do not specify any RADIUS scheme, the command displays the configuration information of all RADIUS schemes. Related commands: radius scheme.
Syntax
display radius scheme [ radius-scheme-name ] [ | { begin | exclude | include } regular-expression ]
View
Any view
48
Default level
2: System level
Parameters
radius-scheme-name: RADIUS scheme name. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display the configuration information of all RADIUS schemes.
<Sysname> display radius scheme -----------------------------------------------------------------SchemeName Index : 0 Primary Auth Server: IP: 1.1.1.1 Encryption Key : 345 VPN instance IP: 1.1.1.1 Encryption Key : 345 VPN instance IP: 1.1.2.1 Encryption Key : N/A VPN instance IP: 1.1.3.1 Encryption Key : N/A VPN instance IP: 1.1.2.1 Encryption Key : N/A VPN instance : N/A Auth Server Encryption Key : 123 Acct Server Encryption Key : N/A VPN instance : 1 : 3 : 3 : 12 : 5 : 500 : 5 Accounting-On packet disable, send times : 50 , interval : 3s Interval for timeout(second) Retransmission times for timeout Interval for realtime accounting(minute) Retransmission times of realtime-accounting packet Retransmission times of stop-accounting packet Quiet-interval(min) : N/A Port: 1813 State: block Second Acct Server: : N/A Port: 1812 State: active : 1 Port: 1812 State: active Second Auth Server: : 1 Port: 1813 State: active Primary Acct Server: Port: 1812 State: active : radius1 Type : extended
49
Username format Data flow unit Packet unit Total 1 RADIUS scheme(s).
: without-domain : Byte : one
------------------------------------------------------------------

SchemeName Index Type Primary Auth Server Primary Acct Server Second Auth Server Second Acct Server IP Port State
Description
Name of the RADIUS scheme. Index number of the RADIUS scheme. Type of the RADIUS server, extended or standard. Information about the primary authentication server. Information about the primary accounting server. Information about the secondary authentication server. Information about the secondary accounting server. IP address of the server. Service port of the server. If no port configuration is performed, the default port number is displayed. Status of the server, active or blocked. Shared key for authentication or accounting packets, in cipher text or plain text. If no shared key is configured, the value of this field is N/A. This shared key is used only when no specific shared key is specified for the RADIUS server. MPLS L3VPN that the server belongs to. If no VPN instance is specified for the server, the value of this field is N/A. Shared key of authentication packets, in cipher text or plain text. Shared key of accounting packets, in cipher text or plain text. MPLS L3VPN that the scheme belongs to. If no VPN instance is specified for the scheme, the value of this field is N/A. The accounting-on feature is disabled. Retransmission times of accounting-on packets. Interval at which the device retransmits accounting-on packets. RADIUS server response timeout period, in seconds. Maximum number of attempts for transmitting a RADIUS packet to a single RADIUS server. Interval for realtime accounting, in minutes. Maximum number of accounting attempts Maximum number of stop-accounting attempts Quiet interval for the primary server. 50
Encryption Key
VPN instance Auth Server Encryption Key Acct Server Encryption Key VPN instance Accounting-On packet disable send times interval Interval for timeout(second) Retransmission times for timeout Interval for realtime accounting(minute) Retransmission times of realtime-accounting packet Retransmission times of stopaccounting packet Quiet-interval(min)
Field
Username format Data flow unit Packet unit NAS-IP address
Description
Format of the usernames to be sent to the RADIUS server. Unit for data flows sent to the RADIUS server. Unit for packets sent to the RADIUS server. Source IP address for RADIUS packets to be sent.
display radius statistics

Description
Use display radius statistics to display statistics about RADIUS packets. Related commands: radius scheme.
Syntax
display radius statistics [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
2: System level
Parameters
|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display statistics about RADIUS packets.
<Sysname> display radius statistics state statistic(total=1024): DEAD = 1024 AcctStart = 0 AcctStop = 0 Sent PKT total Code = Code = Code = 2 3 5 AuthProc = 0 RLTSend = 0 OnLine = 0 = 1547 AuthSucc = 0 RLTWait = 0 Stop = 0
Received and Sent packets statistic: Received PKT total = 23 Err = 0 Err = 0 Err = 0 Err = 0 RADIUS received packets statistic: Num = 15 Num = 4 Num = 4 Num = 0
Code = 11
Running statistic: RADIUS received messages statistic: Auth request Num = 24 Err = 0 Succ = 24
51
Account request Account off request PKT auth timeout PKT acct_timeout Realtime Account timer PKT response Session ctrl pkt Normal author request Set policy result Accounting on request Accounting on response Distribute request Auth accept Auth reject Auth continue Account success Account failure Server ctrl req RecError_MSG_sum = 0 SndMSG_Fail_sum Timer_Err Alloc_Mem_Err State Mismatch Other_Error = 0 = 0 = 0 = 0 = 0
Num = 4 Num = 503 Num = 15 Num = 1509 Num = 0 Num = 23 Num = 0 Num = 0 Num = 0 Num = 1 Num = 0 Num = 0 Num = 0 Num = 0 Num = 0 Num = 4 Num = 3 Num = 0
Err = 0 Err = 0 Err = 5 Err = 503 Err = 0 Err = 0 Err = 0 Err = 0 Err = 0 Err = 0 Err = 0 Err = 0
Succ = 4 Succ = 503 Succ = 10 Succ = 1006 Succ = 0 Succ = 23 Succ = 0 Succ = 0 Succ = 0 Succ = 1 Succ = 0 Succ = 0
RADIUS sent messages statistic:
No-response-acct-stop packet = 1 Discarded No-response-acct-stop packet for buffer overflow = 0

state statistic DEAD AuthProc AuthSucc AcctStart RLTSend RLTWait AcctStop OnLine Stop Received and Sent packets statistic
Description
User statistics, by state Number of idle users, 1024 at most Number of users waiting for authentication Number of users who have passed authentication Number of users for whom accounting has been started Number of users for whom the system sends real-time accounting packets Number of users waiting for real-time accounting Number of users in the state of accounting waiting stopped Number of online users Number of users in the state of stop Statistics for packets received and sent by the RADIUS module
52
Field
Sent PKT total Received PKT total RADIUS received packets statistic Code Num Err Succ Running statistic RADIUS received messages statistic Auth request EAP auth request Account request Account off request PKT auth timeout PKT acct_timeout Realtime Account timer PKT response Session ctrl pkt Normal author request Set policy result Accounting on request Accounting on response RADIUS sent messages statistic Auth accept Auth reject Auth continue Account success Account failure Server ctrl req RecError_MSG_sum SndMSG_Fail_sum Timer_Err Alloc_Mem_Err
Description
Number of packets sent Number of packets received Statistics for packets received by the RADIUS module Packet type Total number of packets Number of packets that the device failed to process Number of messages that the device successfully processed Statistics for RADIUS messages received and sent by the RADIUS module Statistics for received RADIUS messages Counts of normal authentication requests Counts of EAP authentication requests Counts of accounting requests Counts of stop-accounting requests Counts of authentication timeout messages Counts of accounting timeout messages Counts of realtime accounting requests Counts of responses from servers Counts of session control packets Counts of normal authorization requests Counts of responses to the Set policy packets Counts of accounting on requests Counts of accounting-on responses Statistics for sent RADIUS messages Number of accepted authentication packets Number of rejected authentication packets Number of authentication continuing packets Number of accounting succeeded packets Number of accounting failed packets Number of server control requests Number of received packets in error Number of packets that failed to be sent out Number of packets for indicating timer startup failures Number of packets for indication memory allocation failures
53
Field
State Mismatch Other_Error No-response-acct-stop packet Discarded No-response-acct-stop packet for buffer overflow
Description
Number of packets for indicating mismatching status Number of packets for indicating other types of errors Number of times that no response was received for stop-accounting packets Number of stop-accounting packets that were buffered but then discarded due to full memory
display stop-accounting-buffer (for RADIUS)

Description
Use display stop-accounting-buffer to display information about the stop-accounting requests buffered in the device. NOTE: If the device sends a stop-accounting request to a RADIUS server but receives no response, it retransmits it up to a certain number of times (defined by the retry command). If the device still receives no response, it considers the stop-accounting attempt a failure, buffers the request, and makes another stop-accounting attempt. The maximum number of the stop-accounting attempts is defined by the retry stop-accounting command. If all attempts fail, the device discards the request. Related commands: reset stop-accounting-buffer, stop-accounting-buffer enable, user-name-format, retry, and retry stop-accounting.
Syntax
display stop-accounting-buffer { radius-scheme radius-scheme-name | session-id session-id | time-range start-time stop-time | user-name user-name } [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
2: System level
Parameters
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters. session-id session-id: Specifies a session by its ID. The ID is a string of 1 to 50 characters. time-range start-time stop-time: Specifies a time range by its start time and end time in the format HH:MM:SS-MM/DD/YYYY or HH:MM:SS-YYYY/MM/DD. user-name user-name: Specifies a user by the username, a case-sensitive string of 1 to 80 characters. Whether the user-name argument should include the domain name depends on the setting configured by the user-name-format command for the RADIUS scheme. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.
54
begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display information about the stop-accounting requests buffered for user abc.
<Sysname> display stop-accounting-buffer user-name abc RDIdx Session-ID 1 1 1000326232325010 1000326232326010 user name abc abc Happened time 23:27:16-08/31/2006 23:33:01-08/31/2006
Total 2 record(s) Matched
key (RADIUS scheme view)

Description
Use key to set the shared key for RADIUS authentication/authorization or accounting packets. Use undo key to restore the default. By default, no shared key is configured. The shared keys specified during the configuration of the RADIUS servers, if any, take precedence. The shared keys configured on the device must match those configured on the RADIUS servers. Related commands: display radius scheme.
Syntax
key { accounting | authentication } [ cipher | simple ] key undo key { accounting | authentication }
View
RADIUS scheme view
Default level
2: System level
Parameters
accounting: Sets the shared key for RADIUS accounting packets. authentication: Sets the shared key for RADIUS authentication/authorization packets. cipher: Sets and displays the key in cipher text. simple: Sets and displays the key in plain text. key: Shared key, case-sensitive. Follow the following guidelines: With the cipher keyword specified, the key must be a ciphertext string of 12, 24, 32, 44, 64, 76, 88, 96, 108, 120, 128, 140, 152, 160, 172, or 184 characters, for example, _(TT8F]Y\5SQ=^Q`MAF4<1!!. With the simple keyword specified, the key must be a plaintext string of 1 to 128 characters, for example aabbcc.
55
With neither the cipher keyword nor the cipher keyword specified, the key must be a plaintext string of 1 to 64 characters, and the key will be displayed in cipher text.
Examples
# For RADIUS scheme radius1, set the shared key for authentication/authorization packets to the ciphertext string IT8Q4sHnitM= and specify to display the key in cipher text.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] key authentication cipher IT8Q4sHnitM= [Sysname-radius-radius1] display this # radius scheme radius1 key authentication cipher IT8Q4sHnitM= #
# For RADIUS scheme radius1, set the shared key for accounting packets to the plaintext string ok and specify to display the key in plain text.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] key accounting simple ok [Sysname-radius-radius1] display this # radius scheme radius1 key accounting simple ok #
# For RADIUS scheme radius1, set the shared key for accounting packets to the plaintext string ok and specify to display the key in cipher text.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] key accounting ok [Sysname-radius-radius1] display this # radius scheme radius1 key accounting cipher aMjIsi9yePg= #
nas-ip (RADIUS scheme view)

Description
Use nas-ip to specify a source IP address for outgoing RADIUS packets. Use undo nas-ip to restore the default. By default, the source IP address of an outgoing RADIUS packet is that configured by the radius nas-ip command in system view; if the radius nas-ip command is not configured, the source IP address is the IP address of the outbound interface. The source IP address of RADIUS packets that a NAS sends must match the IP address of the NAS that is configured on the RADIUS server. A RADIUS server identifies a NAS by its IP address. Upon receiving a RADIUS packet, a RADIUS server checks whether the source IP address of the packet is the IP address of any managed NAS. If yes, the server processes the packet. If not, the server drops the packet.
56
The source IP address specified for outgoing RADIUS packets must be of the same IP version as the IP addresses of the RADIUS servers in the RADIUS scheme. Otherwise, the source IP address configuration will not take effect. A RADIUS scheme can have only one source IP address for outgoing RADIUS packets. If you specify a new source IP address for the same RADIUS scheme, the new one overwrites the old one. NOTE: The setting configured by the nas-ip command in RADIUS scheme view is only for the RADIUS scheme, whereas that configured by the radius nas-ip command in system view is for all RADIUS schemes. The setting in RADIUS scheme view takes precedence. Related commands: radius nas-ip.
Syntax
nas-ip { ip-address | ipv6 ipv6-address } undo nas-ip
View
RADIUS scheme view
Default level
2: System level
Parameters
ip-address: IPv4 address in dotted decimal notation. It must be an address of the device and cannot be 0.0.0.0, 255.255.255.255, a class D address, a class E address, or a loopback address. ipv6 ipv6-address: Specifies an IPv6 address. It must be an address of the device and must be a unicast address that is neither a loopback address nor a link-local address.
Examples
# Set the source IP address for outgoing RADIUS packets to 10.1.1.1.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] nas-ip 10.1.1.1
primary accounting (RADIUS scheme view)

Description
Use primary accounting to specify the primary RADIUS accounting server. Use undo primary accounting to remove the configuration. By default, no primary RADIUS accounting server is specified. The IP addresses of the accounting servers and those of the authentication/authorization servers must be of the same IP version. The IP addresses of the primary and secondary accounting servers must be different from each other; otherwise, the configuration fails. If the specified server resides on an MPLS L3VPN, specify the VPN by using the vpn-instance vpninstance-name option.
57
If you change the primary accounting server when the device has already sent a start-accounting request to the server, the communication with the primary server will time out, and the device will look for a server in active state from the new primary server on. If you remove an accounting server being used by users, the device cannot send real-time accounting requests and stop-accounting requests anymore for the users, and does not buffer the stop-accounting requests. NOTE: The shared key configured by this command takes precedence over that configured by using the key
accounting [ cipher | simple ] key command.
The VPN specified by this command takes precedence over the VPN specified for the RADIUS scheme. Related commands: key and vpn-instance (RADIUS scheme view).
Syntax
primary accounting { ip-address | ipv6 ipv6-address } [ port-number | key [ cipher | simple ] key | vpninstance vpn-instance-name ] * undo primary accounting
View
RADIUS scheme view
Default level
2: System level
Parameters
ip-address: IPv4 address of the primary accounting server. ipv6 ipv6-address: IPv6 address of the primary accounting server. port-number: Service port number of the primary accounting server, a UDP port number in the range of 1 to 65535. The default is 1813. key [ cipher | simple ] key: Specifies the shared key (case-sensitive) for exchanging accounting packets with the primary RADIUS accounting server. Follow these guidelines: With the cipher keyword specified, the key must be a ciphertext string of 12, 24, 32, 44, 64, 76, 88, or 96 characters, for example, _(TT8F]Y\5SQ=^Q`MAF4<1!!, and the key will be displayed in cipher text. With the simple keyword specified, the key must be a plaintext string of 1 to 64 characters, for example aabbcc, and the key will be displayed in plain text. With neither the cipher keyword nor the cipher keyword specified, the key must be a plaintext string of 1 to 64 characters, and the key will be displayed in cipher text. This shared key must be the same as that configured on the RADIUS server.
vpn-instance vpn-instance-name: Specifies the MPLS L3VPN that the primary RADIUS accounting server belongs to, where vpn-instance-name is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Examples
# For RADIUS scheme radius1, set the IP address of the primary accounting server to 10.1 10.1.2, the UDP port to 1813, and the shared key to the plaintext string IT8Q4sHnitM=, and specify to display the key in cipher text.
58
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] primary accounting 10.110.1.2 1813 key cipher IT8Q4sHnitM=
primary authentication (RADIUS scheme view)

Description
Use primary authentication to specify the primary RADIUS authentication/authorization server. Use undo primary authentication to remove the configuration. By default, no primary RADIUS authentication/authorization server is specified. The IP addresses of the authentication/authorization servers and those of the accounting servers must be of the same IP version. The IP addresses of the primary and secondary authentication/authorization servers must be different from each other. Otherwise, the configuration fails. If the specified server resides on an MPLS L3VPN, specify the VPN by using the vpn-instance vpninstance-name option. If you remove the primary authentication server when an authentication process is in progress, the communication with the primary server will time out, and the device will look for a server in active state from the new primary server on. NOTE: The shared key configured by this command takes precedence over that configured by using the key
authentication [ cipher | simple ] key command.
The VPN specified by this command takes precedence over the VPN specified for the RADIUS scheme. Related commands: key and vpn-instance (RADIUS scheme view).
Syntax
primary authentication { ip-address | ipv6 ipv6-address } [ port-number | key [ cipher | simple ] key | vpn-instance vpn-instance-name ] * undo primary authentication
View
RADIUS scheme view
Default level
2: System level
Parameters
ip-address: IPv4 address of the primary authentication/authorization server. ipv6 ipv6-address: IPv6 address of the primary authentication/authorization server. port-number: Service port number of the primary authentication/authorization server, a UDP port number in the range of 1 to 65535. The default is 1812. key [ cipher | simple ] key: Specifies the shared key (case-sensitive) for exchanging authentication and authorization packets with the primary RADIUS authentication/authorization server. Follow these guidelines:
59
With the cipher keyword specified, the key must be a ciphertext string of 12, 24, 32, 44, 64, 76, 88, or 96 characters, for example, _(TT8F]Y\5SQ=^Q`MAF4<1!!, and the key will be displayed in cipher text. With the simple keyword specified, the key must be a plaintext string of 1 to 64 characters, for example aabbcc, and the key will be displayed in plain text. With neither the cipher keyword nor the cipher keyword specified, the key must be a plaintext string of 1 to 64 characters, and the key will be displayed in cipher text. This shared key must be the same as that configured on the RADIUS server.
vpn-instance vpn-instance-name: Specifies the MPLS L3VPN that the primary RADIUS authentication/authorization server belongs to, where vpn-instance-name is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Examples
# For RADIUS scheme radius1, set the IP address of the primary authentication/authorization server to 10.1 10.1.1, the UDP port to 1812, and the shared key to the plaintext string hello, and specify to display the key in cipher text.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] primary authentication 10.110.1.1 1812 key hello
radius client
Description
Use radius client enable to enable the RADIUS listening port of a RADIUS client. Use undo radius client to disable the RADIUS listening port of a RADIUS client. By default, the RADIUS listening port is enabled. When the listening port of the RADIUS client is disabled: No more stop-accounting requests of online users cannot be sent out or buffered, and the RADIUS server can no longer receive logoff requests from online users. After a user goes offline, the RADIUS server still has the users record during a certain period of time. The buffered accounting packets cannot be sent out and will be deleted from the buffer when the configured maximum number of attempts is reached, affecting the precision of user accounting. If local authentication, authorization, or accounting is configured as the backup, the device performs local authentication, authorization, or accounting instead after the RADIUS request fails. Local accounting is only for monitoring and controlling the number of local user connections; it does not provide the statistics function that the accounting feature generally provides.
Syntax
radius client enable undo radius client
View
System view
Default level
2: System level
60
Parameters
None
Examples
# Enable the listening port of the RADIUS client.
<Sysname> system-view [Sysname] radius client enable
radius nas-ip
Description
Use radius nas-ip to specify a source address for outgoing RADIUS packets. Use undo radius nas-ip to remove the configuration. By default, the source IP address of an outgoing RADIUS packet is the IP address of the outbound interface. You can specify up to one public-network source IP address and 15 private-network source IP addresses. A newly specified public-network source IP address overwrites the previous one. Each VPN can have only one private-network source IP address. A private-network source IP address newly specified for a VPN overwrites the previous one. The source IP address of RADIUS packets that a NAS sends must match the IP address of the NAS that is configured on the RADIUS server. A RADIUS server identifies a NAS by its IP address. Upon receiving a RADIUS packet, a RADIUS server checks whether the source IP address of the packet is the IP address of any managed NAS. If yes, the server processes the packet. If not, the server drops the packet. NOTE: The setting configured by the nas-ip command in RADIUS scheme view is only for the RADIUS scheme, whereas that configured by the radius nas-ip command in system view is for all RADIUS schemes. The setting in RADIUS scheme view takes precedence. Related commands: nas-ip.
Syntax
radius nas-ip { ip-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ] undo radius nas-ip { ip-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ]
View
System view
Default level
2: System level
Parameters
ip-address: IPv4 address in dotted decimal notation. It must be an address of the device and cannot be 0.0.0.0, 255.255.255.255, a class D address, a class E address, or a loopback address. ipv6 ipv6-address: Specifies an IPv6 address. It must be a unicast address of the device that is neither a loopback address nor a link-local address. vpn-instance vpn-instance-name: Specifies the MPLS L3VPN that the source IPv4 address belongs to. vpninstance-name is a case-sensitive string of 1 to 31 characters. With a VPN specified, the command
61
specifies a private-network source IPv4 address. With no VPN specified, the command specifies a publicnetwork source IPv4 address.
Examples
# Set the IP address for the device to use as the source address of the RADIUS packets to 129.10.10.1.
<Sysname> system-view [Sysname] radius nas-ip 129.10.10.1
radius scheme
Description
Use radius scheme to create a RADIUS scheme and enter RADIUS scheme view. Use undo radius scheme to delete a RADIUS scheme. By default, no RADIUS scheme is defined. A RADIUS scheme can be referenced by more than one ISP domain at the same time. A RADIUS scheme referenced by ISP domains cannot be removed. Related commands: display radius scheme.
Syntax
radius scheme radius-scheme-name undo radius scheme radius-scheme-name
View
System view
Default level
3: Manage level
Parameters
radius-scheme-name: RADIUS scheme name, a case-insensitive string of 1 to 32 characters.
Examples
# Create a RADIUS scheme named radius1 and enter RADIUS scheme view.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1]
radius trap
Description
Use radius trap to enable the trap function for RADIUS. Use undo radius trap to disable the trap function for RADIUS. By default, the trap function is disabled for RADIUS. With the trap function for RADIUS, a NAS sends a trap message in the following cases: The status of a RADIUS server changes. If a NAS sends a request but receives no response before the maximum number of attempts is exceeded, it places the server to blocked state and sends a trap
62
message. If a NAS receives a response from a RADIUS server it considered unreachable, it considers that the RADIUS server is reachable again and also sends a trap message. The ratio of the number of failed transmission attempts to the total number of authentication request transmission attempts reaches the threshold.
Syntax
radius trap { accounting-server-down | authentication-error-threshold | authentication-server-down } undo radius trap { accounting-server-down | authentication-error-threshold | authentication-serverdown }
View
System view
Default level
2: System level
Parameters
accounting-server-down: Sends traps when the reachability of the accounting server changes. authentication-error-threshold: Sends traps when the number of authentication failures exceed the specified threshold. The threshold is represented by the ratio of the number of failed request transmission attempts to the total number of transmission attempts. It ranges from 1 to 100 and defaults to 30. This threshold can only be configured through the MIB. authentication-server-down: Sends traps when the reachability of the authentication server changes.
Examples
# Enable the device to send traps in response to accounting server reachability changes.
<Sysname> system-view [Sysname] radius trap accounting-server-down
reset radius statistics

Description
Use reset radius statistics to clear RADIUS statistics. Related commands: display radius statistics.
Syntax
reset radius statistics
View
User view
Default level
2: System level
Parameters
None
Examples
# Clear RADIUS statistics.
<Sysname> reset radius statistics
63
reset stop-accounting-buffer (for RADIUS)

Description
Use reset stop-accounting-buffer to clear the buffered stop-accounting requests for which no responses have been received. Related commands: stop-accounting-buffer enable and display stop-accounting-buffer.
Syntax
reset stop-accounting-buffer { radius-scheme radius-scheme-name | session-id session-id | time-range start-time stop-time | user-name user-name }
View
User view
Default level
2: System level
Parameters
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters. session-id session-id: Specifies a session by its ID, a string of 1 to 50 characters. time-range start-time stop-time: Specifies a time range by its start time and end time in the format HH:MM:SS-MM/DD/YYYY or HH:MM:SS-YYYY/MM/DD. user-name user-name: Specifies a username. The username is a case-sensitive string of 1 to 80 characters. The format of the user-name argument (whether the domain name must be included) must comply with that specified in the RADIUS scheme.
Examples
# Clear the buffered stop-accounting requests for user user0001@test.
<Sysname> reset stop-accounting-buffer user-name user0001@test
# Clear the buffered stop-accounting requests in the time range from 0:0:0 to 23:59:59 on August 31, 2006.
<Sysname> reset stop-accounting-buffer time-range 0:0:0-08/31/2006 23:59:59-08/31/2006
retry
Description
Use retry to set the maximum number of attempts for transmitting a RADIUS packet to a single RADIUS server. Use undo retry to restore the default. By default, the maximum number of RADIUS packet transmission attempts is 3. Because RADIUS uses UDP packets to transmit data, the communication is not reliable. If the device does not receive a response to its request from the RADIUS server within the response timeout period, it retransmits the RADIUS request. If the number of transmission attempts exceeds the limit but the device still receives no response from the RADIUS server, the device considers the request a failure. The maximum number of packet transmission attempts multiplied by the RADIUS server response timeout period cannot be greater than 75.
64
Related commands: radius scheme and timer response-timeout.
Syntax
retry retry-times undo retry
View
RADIUS scheme view
Default level
2: System level
Parameters
retry-times: Maximum number of RADIUS packet transmission attempts, in the range of 1 to 20.
Examples
# Set the maximum number of RADIUS request transmission attempts to 5 for RADIUS scheme radius1.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] retry 5
retry realtime-accounting
Description
Use retry realtime-accounting to set the maximum number of accounting attempts. Use undo retry realtime-accounting to restore the default. By default, the maximum number of accounting attempts is 5. A RADIUS server usually checks whether a user is online by using a timeout timer. If it receives no realtime accounting request for a user in the timeout period from the NAS, it considers that there may be line or device failures and stops accounting for the user. This may happen when some unexpected failure occurs. To cooperate with this feature of the RADIUS server, the NAS needs to keep pace with the server in disconnecting the user. The maximum number of accounting attempts, together with some other parameters, enables the NAS to disconnect the user in time. NOTE: The maximum number of accounting attempts, together with some other parameters, controls how the NAS sends accounting request packets. Suppose that the RADIUS server response timeout period is three seconds (set with the timer response-timeout command), the maximum number of RADIUS packet transmission attempts is three (set with the retry command), the real-time accounting interval is 12 minutes (set with the timer realtime-accounting command), and the maximum number of accounting attempts is five (set with the retry realtime-accounting command). In this case, the device generates an accounting request every 12 minutes, and retransmits the request if it sends the request but receives no response within three seconds. If the device receives no response after transmitting the request three times, it considers the accounting attempt a failure, and makes another accounting attempt. If five consecutive accounting attempts fail, the device cuts the user connection. Related commands: retry, timer response-timeout, and timer realtime-accounting.
65
Syntax
retry realtime-accounting retry-times undo retry realtime-accounting
View
RADIUS scheme view
Default level
2: System level
Parameters
retry-times: Maximum number of accounting attempts, in the range of 1 to 255.
Examples
# Set the maximum number of accounting attempts to 10 for RADIUS scheme radius1.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] retry realtime-accounting 10
retry stop-accounting (RADIUS scheme view)

Description
Use retry stop-accounting to set the maximum number of stop-accounting attempts. Use undo retry stop-accounting to restore the default. By default, the maximum number of stop-accounting attempts is 500. NOTE: The maximum number of stop-accounting attempts, together with some other parameters, controls how the NAS deals with stop-accounting request packets. Suppose that the RADIUS server response timeout period is three seconds (set with the timer response-timeout command), the maximum number of transmission attempts is five (set with the retry command), and the maximum number of stop-accounting attempts is 20 (set with the retry stop-accounting command). For each stop-accounting request, if the device receives no response within three seconds, it retransmits the request. If it receives no responses after retransmitting the request five times, it considers the stop-accounting attempt a failure, buffers the request, and makes another stop-accounting attempt. If 20 consecutive attempts fail, the device discards the request. Related commands: retry, retry stop-accounting, timer response-timeout, and display stop-accountingbuffer.
Syntax
retry stop-accounting retry-times undo retry stop-accounting
View
RADIUS scheme view
66
Default level
2: System level
Parameters
retry-times: Maximum number of stop-accounting attempts, in the range of 10 to 65535.
Examples
# Set the maximum number of stop-accounting attempts to 1000 for RADIUS scheme radius1.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] retry stop-accounting 1000
secondary accounting (RADIUS scheme view)

Description
Use secondary accounting to specify secondary RADIUS accounting servers for a RADIUS scheme. Use undo secondary accounting to remove a secondary RADIUS accounting server. By default, no secondary RADIUS accounting server is specified. You can configure up to 16 secondary RADIUS accounting servers for a RADIUS scheme by executing this command repeatedly. After the configuration, if the primary server fails, the device looks for a secondary server in active state (a secondary RADIUS accounting server configured earlier has a higher priority) and tries to communicate with it. The IP addresses of the accounting servers and those of the authentication/authorization servers must be of the same IP version. The IP addresses of the primary and secondary accounting servers must be different from each other. Otherwise, the configuration fails. If the specified server resides on an MPLS VPN, specify the VPN by using the vpn-instance vpn-instancename option. If you remove a secondary accounting server when the device has already sent a start-accounting request to the server, the communication with the secondary server will time out, and the device will look for a server in active state from the primary server on. If you remove an accounting server being used by online users, the device cannot send real-time accounting requests and stop-accounting requests anymore for the users, and does not buffer the stopaccounting requests. NOTE: The shared key configured by this command takes precedence over that configured by using the key
The VPN specified by this command takes precedence over the VPN specified for the RADIUS scheme. Related commands: key, state, and vpn-instance (RADIUS scheme view).
Syntax
secondary accounting { ipv4-address | ipv6 ipv6-address } [ port-number | key [ cipher | simple ] key | vpn-instance vpn-instance-name ] * undo secondary accounting [ ipv4-address | ipv6 ipv6-address ]
67
View
RADIUS scheme view
Default level
2: System level
Parameters
ipv4-address: IPv4 address of the secondary accounting server, in dotted decimal notation. ipv6 ipv6-address: IPv6 address of the secondary accounting server. port-number: Service port number of the secondary accounting server, a UDP port number 65535. The default is 1813. of 1 to
key [ cipher | simple ] key: Specifies the shared key (case-sensitive) for exchanging accounting packets with the secondary RADIUS accounting server. Follow these guidelines: With the cipher keyword specified, the key must be a ciphertext string of 12, 24, 32, 44, 64, 76, 88, or 96 characters, for example, _(TT8F]Y\5SQ=^Q`MAF4<1!!, and the key will be displayed in cipher text. With the simple keyword specified, the key must be a plaintext string of 1 to 64 characters, for example aabbcc, and the key will be displayed in plain text. With neither the cipher keyword nor the cipher keyword specified, the key must be a plaintext string of 1 to 64 characters, and the key will be displayed in cipher text. This shared key must be the same as that configured on the RADIUS server.
vpn-instance vpn-instance-name: Specifies the MPLS L3VPN that the secondary RADIUS accounting server belongs to, where vpn-instance-name is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Examples
# For RADIUS scheme radius1, set the IP address of the secondary accounting server to 10.1 10.1.1, the UDP port to 1813, and the shared key to the ciphertext string IT8Q4sHnitM=, and specify to display the key in cipher text.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] secondary accounting 10.110.1.1 1813 key cipher IT8Q4sHnitM=
# For RADIUS scheme radius2, specify two secondary accounting servers with the server IP addresses of 10.1 10.1.1 and 10.1 10.1.2 and the UDP port number of 1813. Set the shared keys to plaintext string hello, and specify to display the keys in cipher text.
<Sysname> system-view [Sysname] radius scheme radius2 [Sysname-radius-radius2] secondary accounting 10.110.1.1 1813 key hello [Sysname-radius-radius2] secondary accounting 10.110.1.2 1813 key hello
secondary authentication (RADIUS scheme view)

Description
Use secondary authentication to specify secondary RADIUS authentication/authorization servers for a RADIUS scheme. Use undo secondary authentication to remove a secondary RADIUS authentication/authorization server. By default, no secondary RADIUS authentication/authorization server is specified.
68
You can configure up to 16 secondary RADIUS authentication/authorization servers for a RADIUS scheme by executing this command repeatedly. After the configuration, if the primary server fails, the device looks for a secondary server in active state (a secondary RADIUS authentication/authorization server configured earlier has a higher priority) and tries to communicate with it. The IP addresses of the authentication/authorization servers and those of the accounting servers must be of the same IP version. The IP addresses of the primary and secondary authentication/authorization servers must be different from each other. Otherwise, the configuration fails. If the specified server resides on an MPLS VPN, specify the VPN by using the vpn-instance vpn-instancename option. If you remove a secondary authentication server in use in the authentication process, the communication with the secondary server will time out, and the device will look for a server in active state from the primary server on. NOTE: The shared key configured by this command takes precedence over that configured by using the key
The VPN specified by this command takes precedence over the VPN specified for the RADIUS scheme. Related commands: key, radius scheme, state, and vpn-instance (RADIUS scheme view).
Syntax
secondary authentication { ipv4-address | ipv6 ipv6-address } [ port-number | key [ cipher | simple ] key | vpn-instance vpn-instance-name ] * undo secondary authentication [ ipv4-address | ipv6 ipv6-address ]
View
RADIUS scheme view
Default level
2: System level
Parameters
ipv4-address: IPv4 address of the secondary authentication/authorization server, in dotted decimal notation. ipv6 ipv6-address: IPv6 address of the secondary authentication/authorization server. port-number: Service port number of the secondary authentication/authorization server, a UDP port number in the range of 1 to 65535. The default is 1812. key [ cipher | simple ] key: Specifies the shared key (case-sensitive) for exchanging authentication/authorization packets with the secondary RADIUS authentication/authorization server. Follow these guidelines: With the cipher keyword specified, the key must be a ciphertext string of 12, 24, 32, 44, 64, 76, 88, or 96 characters, for example, _(TT8F]Y\5SQ=^Q`MAF4<1!!, and the key will be displayed in cipher text. With the simple keyword specified, the key must be a plaintext string of 1 to 64 characters, for example aabbcc, and the key will be displayed in plain text.
69
With neither the cipher keyword nor the cipher keyword specified, the key must be a plaintext string of 1 to 64 characters, and the key will be displayed in cipher text. This shared key must be the same as that configured on the RADIUS server.
vpn-instance vpn-instance-name: Specifies the MPLS L3VPN that the secondary RADIUS authentication/authorization server belongs to, where vpn-instance-name is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Examples
# For RADIUS scheme radius1, set the IP address of the secondary authentication/authorization server to 10.1 10.1.2, the UDP port to 1812, and the shared key to the ciphertext string IT8Q4sHnitM=, and specify to display the key in cipher text.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] secondary authentication 10.110.1.2 1812 key cipher IT8Q4sHnitM=
# Specify two secondary authentication/authorization servers for RADIUS scheme radius2, with the server IP addresses of 10.1 10.1.1 and 10.1 10.1.2, and the UDP port number of 1813. Set the shared keys to plaintext string hello and specify to display the key in plain text.
<Sysname> system-view [Sysname] radius scheme radius2 [Sysname-radius-radius2] secondary authentication 10.110.1.1 1812 key simple hello [Sysname-radius-radius2] secondary authentication 10.110.1.2 1812 key simple hello
security-policy-server
Description
Use security-policy-server to specify a security policy server for a RADIUS scheme. Use undo security-policy-server to remove one or all security policy servers for a RADIUS scheme. By default, no security policy server is specified for a RADIUS scheme. You can specify up to eight security policy servers for a RADIUS scheme. You can change security policy servers for a RADIUS scheme only when no user is using the scheme.
Syntax
security-policy-server ip-address undo security-policy-server { ip-address | all }
View
RADIUS scheme view
Default level
2: System level
Parameters
ip-address: Specifies a security policy server by its IP address. all: Specifies all security policy servers.
Examples
# Specify security policy server 10.1 10.1.2 for RADIUS scheme radius1.
70
[Sysname] radius scheme radius1 [Sysname-radius-radius1] security-policy-server 10.110.1.2
server-type
Description
Use server-type to configure the RADIUS server type. Use undo server-type to restore the default. By default, the supported RADIUS server type is standard.
Syntax
server-type { extended | standard } undo server-type
View
RADIUS scheme view
Default level
2: System level
Parameters
extended: Specifies the extended RADIUS server (generally IMC), which requires the RADIUS client and RADIUS server to interact according to the procedures and packet formats provisioned by the proprietary RADIUS protocol. standard: Specifies the standard RADIUS server, which requires the RADIUS client and RADIUS server to interact according to the procedures and packet format of the standard RADIUS protocol (RFC 2865 and 2866 or their successors).
Examples
# Configure the RADIUS server type of RADIUS scheme radius1 as standard.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] server-type standard
state primary
Description
Use state primary to set the status of a primary RADIUS server. By default, the primary RADIUS server specified for a RADIUS scheme is in active state. During an authentication or accounting process, the device first tries to communicate with the primary server if the primary server is in active state. If the primary server is unavailable, the device changes the status of the primary server to blocked, starts a quiet timer for the server, and then tries to communicate with a secondary server in active state (a secondary RADIUS server configured earlier has a higher priority). When the quiet timer of the primary server times out, the status of the server changes to active automatically. If you set the status of the server to blocked before the quiet timer times out, the status of the server cannot change back to active automatically unless you set the status to active manually. When the primary server and secondary servers are both in blocked state, the device communicates with the primary server.
71
Related commands: display radius scheme and state secondary.
Syntax
state primary { accounting | authentication } { active | block }
View
RADIUS scheme view
Default level
2: System level
Parameters
accounting: Sets the status of the primary RADIUS accounting server. authentication: Sets the status of the primary RADIUS authentication/authorization server. active: Specifies the active state, the normal operation state. block: Specifies the blocked state, the out-of-service state.
Examples
# Set the status of the primary server in RADIUS scheme radius1 to blocked.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] state primary authentication block
state secondary
Description
Use state secondary to set the status of a secondary RADIUS server. By default, every secondary RADIUS server specified in a RADIUS scheme is in active state. If no IP address is specified, this command changes the status of all configured secondary servers for authentication/authorization or accounting. If the device finds that a secondary server in active state is unreachable, the device changes the status of the secondary server to blocked, starts a quiet timer for the server, and continues to try to communicate with the next secondary server in active state (a secondary RADIUS server configured earlier has a higher priority). When the quiet timer of a server times out, the status of the server changes to active automatically. If you set the status of the server to blocked before the quiet timer times out, the status of the server cannot change back to active automatically unless you set the status to active manually. If all configured secondary servers are unreachable, the device considers the authentication or accounting attempt a failure. Related commands: display radius scheme and state primary.
Syntax
state secondary { accounting | authentication } [ ip ipv4-address | ipv6 ipv6-address ] { active | block }
View
RADIUS scheme view
Default level
2: System level
72
Parameters
accounting: Sets the status of the secondary RADIUS accounting server. authentication: Sets the status of the secondary RADIUS authentication/authorization server. ip ipv4-address: Specifies the IPv4 address of the secondary RADIUS server. ipv6 ipv6-address: Specifies the IPv6 address of the secondary RADIUS server. active: Specifies the active state, the normal operation state. block: Specifies the blocked state, the out-of-service state.
Examples
# Set the status of all the secondary servers in RADIUS scheme radius1 to blocked.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] state secondary authentication block
stop-accounting-buffer enable (RADIUS scheme view)

Description
Use stop-accounting-buffer enable to enable the device to buffer stop-accounting requests to which no responses are received. Use undo stop-accounting-buffer enable to disable the buffering function. By default, the device buffers stop-accounting requests to which no responses are received. Stop-accounting requests affect the charge to users. A NAS must make its best effort to send every stopaccounting request to the RADIUS accounting servers. For each stop-accounting request getting no response in the specified period of time, the NAS buffers and resends the packet until it receives a response or the number of transmission attempts reaches the configured limit. In the latter case, the NAS discards the packet. However, if you have removed the accounting server, stop-accounting messages are not buffered. Related commands: reset stop-accounting-buffer and display stop-accounting-buffer.
Syntax
stop-accounting-buffer enable undo stop-accounting-buffer enable
View
RADIUS scheme view
Default level
2: System level
Parameters
None
Examples
# Enable the device to buffer the stop-accounting requests to which no responses are received.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] stop-accounting-buffer enable
73
timer quiet (RADIUS scheme view)

Description
Use timer quiet to set the quiet timer for the servers, that is, the duration during which the servers stay blocked before resuming the active state. Use undo timer quiet to restore the default. By default, the server quiet period is 5 minutes. You can use the to adjust the duration during which a server must stay quiet, and control whether the device changes the status of an unreachable server. For example, if you determine that the primary server is unreachable because the devices port connected to the server is out of service temporarily or the server is busy, you can set the server quiet period to 0 so that the device uses the primary server whenever possible. Be sure to set the server quiet timer properly. Too short a quiet timer may result in frequent authentication or accounting failures because the device has to repeatedly try to communicate with an unreachable server that is in active state. Related commands: display radius scheme.
Syntax
timer quiet minutes undo timer quiet
View
RADIUS scheme view
Default level
2: System level
Parameters
minutes: Server quiet period in minutes, in the range of 0 to 255. If you set this argument to 0, when the device needs to send an authentication or accounting request but finds that the current server is unreachable, it does not change the servers status that it maintains. It simply sends the request to the next server in active state. As a result, when the device needs to send a request of the same type for another user, it still tries to send the request to the current server because the current server is in active state.
Examples
# Set the quiet timer for the servers to 10 minutes.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] timer quiet 10
timer realtime-accounting (RADIUS scheme view)

Description
Use timer realtime-accounting to set the real-time accounting interval. Use undo timer realtime-accounting to restore the default. By default, the real-time accounting interval is 12 minutes.
74
For real-time accounting, a NAS must transmit the accounting information of online users to the RADIUS accounting server periodically. This command sets the interval. When the real-time accounting interval on the device is zero, the device will send online user accounting information to the RADIUS accounting server at the real-time accounting interval configured on the server (if any) or will not send online user accounting information. Different real-time accounting intervals impose different performance requirements on the NAS and the RADIUS server. A shorter interval helps achieve higher accounting precision but requires higher performance. Use a longer interval when there are a large number of users (1000 or more). Table 6 Recommended real-time accounting intervals Number of users
1 to 99 100 to 499 500 to 999 1000 or more
Real-time accounting interval (minute)

3 6 12 15 or longer
Related commands: retry realtime-accounting.
Syntax
timer realtime-accounting minutes undo timer realtime-accounting
View
RADIUS scheme view
Default level
2: System level
Parameters
minutes: Real-time accounting interval in minutes, zero or a multiple of 3 in the range of 3 to 60.
Examples
# Set the real-time accounting interval to 51 minutes for RADIUS scheme radius1.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] timer realtime-accounting 51
timer response-timeout (RADIUS scheme view)

Description
Use timer response-timeout to set the RADIUS server response timeout timer. Use undo timer to restore the default. By default, the RADIUS server response timeout period is 3 seconds. If a NAS receives no response from the RADIUS server in a period of time after sending a RADIUS request (authentication/authorization or accounting request), it resends the request so that the user has more opportunity to obtain the RADIUS service. The NAS uses the RADIUS server response timeout timer to control the transmission interval.
75
The maximum number of RADIUS packet transmission attempts multiplied by the RADIUS server response timeout period cannot be greater than 75. Related commands: retry.
Syntax
timer response-timeout seconds undo timer response-timeout
View
RADIUS scheme view
Default level
2: System level
Parameters
seconds: RADIUS server response timeout period in seconds, in the range of 1 to 10.
Examples
# Set the RADIUS server response timeout timer to 5 seconds for RADIUS scheme radius1.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] timer response-timeout 5
user-name-format (RADIUS scheme view)

Description
Use user-name-format to specify the format of the username to be sent to a RADIUS server. By default, the ISP domain name is included in the username. A username is generally in the format userid@isp-name, of which isp-name is used by the device to determine the ISP domain to which a user belongs. Some earlier RADIUS servers, however, cannot recognize a username including an ISP domain name. Before sending a username including a domain name to such a RADIUS server, the device must remove the domain name. This command allows you to specify whether to include a domain name in a username to be sent to a RADIUS server. If a RADIUS scheme defines that the username is sent without the ISP domain name, do not apply the RADIUS scheme to more than one ISP domain, avoiding the confused situation where the RADIUS server regards two users in different ISP domains but with the same userid as one. For 802.1X users using EAP authentication, the user-name-format command configured for a RADIUS scheme does not take effect and the device does not change the usernames from clients before forwarding them to the RADIUS server. If the RADIUS scheme is used for roaming wireless users, specify the keep-original keyword. Otherwise, authentication of the wireless users may fail. Related commands: radius scheme.
Syntax
user-name-format { keep-original | with-domain | without-domain }
View
RADIUS scheme view
76
Default level
2: System level
Parameters
keep-original: Sends the username to the RADIUS server as it is entered. with-domain: Includes the ISP domain name in the username sent to the RADIUS server. without-domain: Excludes the ISP domain name from the username sent to the RADIUS server.
Examples
# Specify the device to remove the domain name in the username sent to the RADIUS servers for the RADIUS scheme radius1.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] user-name-format without-domain
vpn-instance (RADIUS scheme view)

Description
Use vpn-instance to specify a VPN instance for a RADIUS scheme. Use undo vpn-instance to remove the configuration. The VPN instance specified here applies to for all IPv4 servers in the RADIUS scheme for which no specific VPN instance is specified. The VPN instance specified here is not effective for IPv6 RADIUS servers. Related commands: display radius scheme.
Syntax
vpn-instance vpn-instance-name undo vpn-instance
View
RADIUS scheme view
Default level
2: System level
Parameters
vpn-instance-name: Name of the MPLS VPN, a case-sensitive string of 1 to 31 characters.
Examples
# Specify VPN instance test for RADIUS scheme radius1.
<Sysname> system-view [Sysname] radius scheme radius1 [Sysname-radius-radius1] vpn-instance test
77
HWTACACS configuration commands

data-flow-format (HWTACACS scheme view)
Description
Use data-flow-format to set the traffic statistics unit for data flows or packets. Use undo data-flow-format to restore the default. By default, the unit for data flows is byte and that for data packets is one-packet. The unit for data flows and that for packets must be consistent with those on the HWTACACS server. Otherwise, accounting cannot be performed correctly. Related commands: display hwtacacs.
Syntax
data-flow-format { data { byte | giga-byte | kilo-byte | mega-byte } | packet { giga-packet | kilopacket | mega-packet | one-packet } } * undo data-flow-format { data | packet }
View
HWTACACS scheme view
Default level
2: System level
Parameters
data { byte | giga-byte | kilo-byte | mega-byte }: Specifies the unit for data flows, which can be byte, kilobyte, megabyte, or gigabyte. packet { giga-packet | kilo-packet | mega-packet | one-packet }: Specifies the unit for data packets, which can be one-packet, kilo-packet, mega-packet, or giga-packet.
Examples
# Set the traffic statistics unit for data flows and that for packets to kilobytes and kilo-packets respectively in HWTACACS scheme hwt1.
<Sysname> system-view [Sysname] hwtacacs scheme hwt1 [Sysname-hwtacacs-hwt1] data-flow-format data kilo-byte packet kilo-packet
display hwtacacs
Description
Use display hwtacacs to display the configuration information of HWTACACS schemes or the statistics for the HWTACACS servers specified in HWTACACS schemes. If no HWTACACS scheme is specified, the command displays the configuration information of all HWTACACS schemes. Related commands: hwtacacs scheme.
78
Syntax
display hwtacacs [ hwtacacs-scheme-name [ statistics ] ] [ | { begin | exclude | include } regularexpression ]
View
Any view
Default level
2: System level
Parameters
hwtacacs-scheme-name: HWTACACS scheme name. statistics: Displays the statistics for the HWTACACS servers specified in the HWTACACS scheme. Without this keyword, the command displays the configuration information of the HWTACACS scheme. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display the configuration information of HWTACACS scheme gy.
<Sysname> display hwtacacs gy -------------------------------------------------------------------HWTACACS-server template name Primary-authentication-server VPN instance Primary-authorization-server VPN instance Primary-accounting-server VPN instance Secondary-authentication-server VPN instance Secondary-authorization-server VPN instance Secondary-accounting-server VPN instance Current-authentication-server VPN instance Current-authorization-server VPN instance Current-accounting-server VPN instance NAS-IP-address key authentication key authorization key accounting : gy : 172.31.1.11:49 : vpn1 : 172.31.1.11:49 : vpn1 : 172.31.1.11:49 : vpn1 : 0.0.0.0:0 : : 0.0.0.0:0 : : 0.0.0.0:0 : : 172.31.1.11:49 : : 172.31.1.11:49 : : 172.31.1.11:49 : : 0.0.0.0 : 790131 : 790131 : 790131
79
VPN instance Quiet-interval(min) Response-timeout-interval(sec) Acct-stop-PKT retransmit times Username format Data traffic-unit Packet traffic-unit
: : 5 : 5 : 100 : with-domain : B : one-packet
Realtime-accounting-interval(min) : 12
--------------------------------------------------------------------

HWTACACS-server template name
Description
Name of the HWTACACS scheme. IP address and port number of the primary authentication server. If no primary authentication server is specified, the value of this field is 0.0.0.0:0. This rule is also applicable to the following eight fields.
Primary-authentication-server
Primary-authorization-server Primary-accounting-server Secondary-authentication-server Secondary-authorization-server Secondary-accounting-server Current-authentication-server Current-authorization-server Current-accounting-server VPN instance NAS-IP-address key authentication key authorization key accounting Acct-stop-PKT retransmit times Data traffic-unit Packet traffic-unit
IP address and port number of the primary authorization server. IP address and port number of the primary accounting server. IP address and port number of the secondary authentication server. IP address and port number of the secondary authorization server. IP address and port number of the secondary accounting server. IP address and port number of the currently used authentication server. IP address and port number of the currently used authorization server. IP address and port number of the currently used accounting server. MPLS L3VPN to which the server belongs. IP address of the NAS. If no NAS is specified, the value of this field is 0.0.0.0. Key for authentication. Key for authorization. Key for accounting. Number of stop-accounting packet transmission attempts. Unit for data flows. Unit for data packets.
80
# Display the statistics for the servers specified in HWTACACS scheme gy.
<Sysname> display hwtacacs gy statistics ---[HWTACACS template gy primary authentication]--HWTACACS server open number: 10 HWTACACS server close number: 10 HWTACACS authen client access request packet number: 10 HWTACACS authen client access response packet number: 6 HWTACACS authen client unknown type number: 0 HWTACACS authen client timeout number: 4 HWTACACS authen client packet dropped number: 4 HWTACACS authen client access request change password number: 0 HWTACACS authen client access request login number: 5 HWTACACS authen client access request send authentication number: 0 HWTACACS authen client access request send password number: 0 HWTACACS authen client access connect abort number: 0 HWTACACS authen client access connect packet number: 5 HWTACACS authen client access response error number: 0 HWTACACS authen client access response failure number: 0 HWTACACS authen client access response follow number: 0 HWTACACS authen client access response getdata number: 0 HWTACACS authen client access response getpassword number: 5 HWTACACS authen client access response getuser number: 0 HWTACACS authen client access response pass number: 1 HWTACACS authen client access response restart number: 0 HWTACACS authen client malformed access response number: 0 HWTACACS authen client round trip time(s): 5 ---[HWTACACS template gy primary authorization]--HWTACACS server open number: 1 HWTACACS server close number: 1 HWTACACS author client request packet number: 1 HWTACACS author client response packet number: 1 HWTACACS author client timeout number: 0 HWTACACS author client packet dropped number: 0 HWTACACS author client unknown type number: 0 HWTACACS author client request EXEC number: 1 HWTACACS author client request PPP number: 0 HWTACACS author client request VPDN number: 0 HWTACACS author client response error number: 0 HWTACACS author client response EXEC number: 1 HWTACACS author client response PPP number: 0 HWTACACS author client response VPDN number: 0 HWTACACS author client round trip time(s): 3 ---[HWTACACS template gy primary accounting]--HWTACACS server open number: 0 HWTACACS server close number: 0 HWTACACS account client request packet number: 0 HWTACACS account client response packet number: 0 HWTACACS account client unknown type number: 0 HWTACACS account client timeout number: 0
81
HWTACACS account client packet dropped number: 0 HWTACACS account client request command level number: 0 HWTACACS account client request connection number: 0 HWTACACS account client request EXEC number: 0 HWTACACS account client request network number: 0 HWTACACS account client request system event number: 0 HWTACACS account client request update number: 0 HWTACACS account client response error number: 0 HWTACACS account client round trip time(s): 0
display stop-accounting-buffer (for HWTACACS)

Description
Use display stop-accounting-buffer to display information about the stop-accounting requests buffered in the device. Related commands: reset stop-accounting-buffer, stop-accounting-buffer enable, and retry stopaccounting.
Syntax
display stop-accounting-buffer hwtacacs-scheme hwtacacs-scheme-name [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a caseinsensitive string of 1 to 32 characters. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display information about the buffered stop-accounting requests for HWTACACS scheme hwt1.
<Sysname> display stop-accounting-buffer hwtacacs-scheme hwt1 Total 0 record(s) Matched
hwtacacs nas-ip
Description
Use hwtacacs nas-ip to specify a source IP address for outgoing HWTACACS packets. Use undo hwtacacs nas-ip to remove the configuration.
82
By default, the source IP address of a packet sent to the server is the IP address of the outbound interface. The source IP address of HWTACACS packets that a NAS sends must match the IP address of the NAS that is configured on the HWTACACS server. An HWTACACS server identifies a NAS by IP address. Upon receiving an HWTACACS packet, an HWTACACS server checks whether the source IP address of the packet is the IP address of any managed NAS. If yes, the server processes the packet. If not, the server drops the packet. You can specify up to one public-network source IP address and 15 private-network source IP addresses. A newly specified public-network source IP address overwrites the previous one. Each VPN can have only one private-network source IP address specified. A private-network source IP address newly specified for a VPN overwrites the previous one. NOTE: The setting configured by the nas-ip command in HWTACACS scheme view is only for the HWTACACS scheme, whereas that configured by the hwtacacs nas-ip command in system view is for all HWTACACS schemes. The setting in HWTACACS scheme view takes precedence. Related commands: nas-ip.
Syntax
hwtacacs nas-ip ip-address [ vpn-instance vpn-instance-name ] undo hwtacacs nas-ip ip-address [ vpn-instance vpn-instance-name ]
View
System view
Default level
2: System level
Parameters
ip-address: IP address in dotted decimal notation. It must be an address of the device and cannot be 0.0.0.0, 255.255.255.255, a class D address, a class E address, or a loopback address. vpn-instance vpn-instance-name: Specifies the MPLS L3VPN that the source IP address belongs to. vpninstance-name is a case-sensitive string of 1 to 31 characters. With a VPN specified, the command specifies a private-network source IP address. With no VPN specified, the command specifies a publicnetwork source IP address.
Examples
# Set the IP address for the device to use as the source address of the HWTACACS packets to 129.10.10.1.
<Sysname> system-view [Sysname] hwtacacs nas-ip 129.10.10.1
hwtacacs scheme
Description
Use hwtacacs scheme to create an HWTACACS scheme and enter HWTACACS scheme view. Use undo hwtacacs scheme to delete an HWTACACS scheme. By default, no HWTACACS scheme exists.
83
An HWTACACS scheme can be referenced by more than one ISP domain at the same time. An HWTACACS scheme referenced by ISP domains cannot be removed. You cannot delete an HWTACACS scheme with online users.
Syntax
hwtacacs scheme hwtacacs-scheme-name undo hwtacacs scheme hwtacacs-scheme-name
View
System view
Default level
3: Manage level
Parameters
hwtacacs-scheme-name: HWTACACS scheme name, a case-insensitive string of 1 to 32 characters.
Examples
# Create an HWTACACS scheme named hwt1 and enter HWTACACS scheme view.
<Sysname> system-view [Sysname] hwtacacs scheme hwt1 [Sysname-hwtacacs-hwt1]
key (HWTACACS scheme view)

Description
Use key to set the shared key for HWTACACS authentication, authorization, or accounting packets. Use undo key to remove the configuration. By default, no shared key is configured. The shared keys configured on the device must match those configured on the HWTACACS servers. Related commands: display hwtacacs.
Syntax
key { accounting | authentication | authorization } key undo key { accounting | authentication | authorization }
View
Default level
2: System level
Parameters
accounting: Sets the shared key for HWTACACS accounting packets. authentication: Sets the shared key for HWTACACS authentication packets. authorization: Sets the shared key for HWTACACS authorization packets. key: Shared key, a case-sensitive string of 1 to 64 characters.
84
Examples
# Set the shared key for HWTACACS accounting packets to hello for HWTACACS scheme hwt1.
<Sysname> system-view [Sysname] hwtacacs scheme hwt1 [Sysname-hwtacacs-hwt1] key accounting hello
nas-ip (HWTACACS scheme view)

Description
Use nas-ip to specify a source address for outgoing HWTACACS packets. Use undo nas-ip to restore the default. By default, the source IP address of an outgoing HWTACACS packet is configured by the hwtacacs nasip command in system view; if the hwtacacs nas-ip command is not configured, the source IP address is the IP address of the outbound interface. The source IP address of HWTACACS packets that a NAS sends must match the IP address of the NAS that is configured on the HWTACACS server. An HWTACACS server identifies a NAS by IP address. Upon receiving an HWTACACS packet, an HWTACACS server checks whether the source IP address of the packet is the IP address of any managed NAS. If yes, the server processes the packet. If not, the server drops the packet. If you configure the command repeatedly, only the last configuration takes effect. NOTE: The setting configured by the nas-ip command in HWTACACS scheme view is only for the HWTACACS scheme, whereas that configured by the hwtacacs nas-ip command in system view is for all HWTACACS schemes. The setting in HWTACACS scheme view takes precedence. Related commands: hwtacacs nas-ip.
Syntax
nas-ip ip-address undo nas-ip
View
Default level
2: System level
Parameters
ip-address: IP address in dotted decimal notation. It must be an address of the device and cannot be 0.0.0.0, 255.255.255.255, a class D address, a class E address, or a loopback address.
Examples
# Set the source address for outgoing HWTACACS packets to 10.1.1.1.
<Sysname> system-view [Sysname] hwtacacs scheme hwt1 [Sysname-hwtacacs-hwt1] nas-ip 10.1.1.1
85
primary accounting (HWTACACS scheme view)

Description
Use primary accounting to specify the primary HWTACACS accounting server. Use undo primary accounting to remove the configuration. By default, no primary HWTACACS accounting server is specified. The IP addresses of the primary and secondary accounting servers must be different. Otherwise, the configuration fails. If the specified server resides on an MPLS VPN, specify the VPN by using the vpn-instance vpn-instancename option. If you configure the command repeatedly, only the last configuration takes effect. You can remove an accounting server only when it is not used by any active TCP connection to send accounting packets. Removing an accounting server affects only accounting processes that occur after the remove operation. NOTE: The VPN specified by this command takes precedence over the VPN specified for the HWTACACS scheme. Related commands: display hwtacacs and vpn-instance (HWTACACS scheme view).
Syntax
primary accounting ip-address [ port-number | vpn-instance vpn-instance-name ] * undo primary accounting
View
Default level
2: System level
Parameters
ip-address: IP address of the primary HWTACACS accounting server, in dotted decimal notation. The default is 0.0.0.0. port-number: Service port number of the primary HWTACACS accounting server. It ranges from 1 to 65535 and defaults to 49. vpn-instance vpn-instance-name: Specifies the MPLS L3VPN that the primary HWTACACS accounting server belongs to, where vpn-instance-name is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Examples
# Specify the IP address and port number of the primary accounting server for HWTACACS scheme test1 as 10.163.155.12 and 49.
<Sysname> system-view [Sysname] hwtacacs scheme test1 [Sysname-hwtacacs-test1] primary accounting 10.163.155.12 49
86
primary authentication (HWTACACS scheme view)

Description
Use primary authentication to specify the primary HWTACACS authentication server. Use undo primary authentication to remove the configuration. By default, no primary HWTACACS authentication server is specified. The IP addresses of the primary and secondary authentication servers must be different. Otherwise, the configuration fails. If the specified server resides on an MPLS VPN, specify the VPN by using the vpn-instance vpn-instancename option. If you configure the command repeatedly, only the last configuration takes effect. You can remove an authentication server only when it is not used by any active TCP connection to send authentication packets. Removing an authentication server affects only authentication processes that occur after the remove operation. NOTE: The VPN specified by this command takes precedence over the VPN specified for the HWTACACS scheme. Related commands: display hwtacacs and vpn-instance (HWTACACS scheme view).
Syntax
primary authentication ip-address [ port-number | vpn-instance vpn-instance-name ] * undo primary authentication
View
Default level
2: System level
Parameters
ip-address: IP address of the primary HWTACACS authentication server, in dotted decimal notation. The default is 0.0.0.0. port-number: Service port number of the primary HWTACACS authentication server. It ranges from 1 to 65535 and defaults to 49. vpn-instance vpn-instance-name: Specifies the MPLS L3VPN that the primary HWTACACS authentication server belongs to, where vpn-instance-name is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Examples
# Specify the IP address and port number of the primary authentication server for HWTACACS scheme hwt1 as 10.163.155.13 and 49.
<Sysname> system-view [Sysname] hwtacacs scheme hwt1 [Sysname-hwtacacs-hwt1] primary authentication 10.163.155.13 49
87
primary authorization
Description
Use primary authorization to specify the primary HWTACACS authorization server. Use undo primary authorization to remove the configuration. By default, no primary HWTACACS authorization server is specified. The IP addresses of the primary and secondary authorization servers must be different. Otherwise, the configuration fails. If the specified server resides on an MPLS VPN, specify the VPN by using the vpn-instance vpn-instancename option. If you configure the command repeatedly, only the last configuration takes effect. You can remove an authorization server only when it is not used by any active TCP connection to send authorization packets. Removing an authorization server affects only authorization processes that occur after the remove operation. NOTE: The VPN specified by this command takes precedence over the VPN specified for the HWTACACS scheme. Related commands: display hwtacacs and vpn-instance (HWTACACS scheme view).
Syntax
primary authorization ip-address [ port-number | vpn-instance vpn-instance-name ] * undo primary authorization
View
Default level
2: System level
Parameters
ip-address: IP address of the primary HWTACACS authorization server, a valid unicast address in dotted decimal notation. The default is 0.0.0.0. port-number: Service port number of the primary HWTACACS authorization server. It ranges from 1 to 65535 and defaults to 49. vpn-instance vpn-instance-name: Specifies the MPLS L3VPN that the primary HWTACACS authorization server belongs to, where vpn-instance-name is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Examples
# Configure the IP address and port number of the primary authorization server for HWTACACS scheme hwt1 as 10.163.155.13 and 49.
<Sysname> system-view [Sysname] hwtacacs scheme hwt1 [Sysname-hwtacacs-hwt1] primary authorization 10.163.155.13 49
88
reset hwtacacs statistics

Description
Use reset hwtacacs statistics to clear HWTACACS statistics. Related commands: display hwtacacs.
Syntax
reset hwtacacs statistics { accounting | all | authentication | authorization }
View
User view
Default level
1: Monitor level
Parameters
accounting: Clears HWTACACS accounting statistics. all: Clears all HWTACACS statistics. authentication: Clears HWTACACS authentication statistics. authorization: Clears HWTACACS authorization statistics.
Examples
# Clear all HWTACACS statistics.
<Sysname> reset hwtacacs statistics all
reset stop-accounting-buffer (for HWTACACS)

Description
Use reset stop-accounting-buffer to clear the buffered stop-accounting requests that get no responses. Related commands: stop-accounting-buffer enable and display stop-accounting-buffer.
Syntax
reset stop-accounting-buffer hwtacacs-scheme hwtacacs-scheme-name
View
User view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a caseinsensitive string of 1 to 32 characters.
Examples
# Clear the buffered stop-accounting requests for HWTACACS scheme hwt1.
<Sysname> reset stop-accounting-buffer hwtacacs-scheme hwt1
89
retry stop-accounting (HWTACACS scheme view)

Description
Use retry stop-accounting to set the maximum number of stop-accounting request transmission attempts. Use undo retry stop-accounting to restore the default. By default, the maximum number of stop-accounting request transmission attempts is 100. Related commands: reset stop-accounting-buffer and display stop-accounting-buffer.
Syntax
retry stop-accounting retry-times undo retry stop-accounting
View
Default level
2: System level
Parameters
retry-times: Maximum number of stop-accounting request transmission attempts, in the range of 1 to 300.
Examples
# Set the maximum number of stop-accounting request transmission attempts to 50.
<Sysname> system-view [Sysname] hwtacacs scheme hwt1 [Sysname-hwtacacs-hwt1] retry stop-accounting 50
secondary accounting (HWTACACS scheme view)

Description
Use secondary accounting to specify the secondary HWTACACS accounting server. Use undo secondary accounting to remove the configuration. By default, no secondary HWTACACS accounting server is specified. The IP addresses of the primary and secondary accounting servers must be different. Otherwise, the configuration fails. If you configure the command repeatedly, only the last configuration takes effect. If the specified server resides on an MPLS VPN, specify the VPN by using the vpn-instance vpn-instancename option. You can remove an accounting server only when it is not used by any active TCP connection to send accounting packets. Removing an accounting server affects only accounting processes that occur after the remove operation. NOTE: The VPN specified by this command takes precedence over the VPN specified for the HWTACACS scheme.
90
Related commands: display hwtacacs and vpn-instance (HWTACACS scheme view).
Syntax
secondary accounting ip-address [ port-number | vpn-instance vpn-instance-name ] * undo secondary accounting
View
Default level
2: System level
Parameters
ip-address: IP address of the secondary HWTACACS accounting server, in dotted decimal notation. The default is 0.0.0.0. port-number: Service port number of the secondary HWTACACS accounting server. It ranges from 1 to 65535 and defaults to 49. vpn-instance vpn-instance-name: Specifies the MPLS L3VPN that the secondary HWTACACS accounting server belongs to, where vpn-instance-name is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Examples
# Specify the IP address and port number of the secondary accounting server for HWTACACS scheme hwt1 as 10.163.155.12 with TCP port number 49.
<Sysname> system-view [Sysname] hwtacacs scheme hwt1 [Sysname-hwtacacs-hwt1] secondary accounting 10.163.155.12 49
secondary authentication (HWTACACS scheme view)

Description
Use secondary authentication to specify the secondary HWTACACS authentication server. Use undo secondary authentication to remove the configuration. By default, no secondary HWTACACS authentication server is specified. The IP addresses of the primary and secondary authentication servers must be different. Otherwise, the configuration fails. If the specified server resides on an MPLS VPN, specify the VPN by using the vpn-instance vpn-instancename option. If you configure the command repeatedly, only the last configuration takes effect. You can remove an authentication server only when it is not used by any active TCP connection to send authentication packets is using it. Removing an authentication server affects only authentication processes that occur after the remove operation. NOTE: The VPN specified by this command takes precedence over the VPN specified for the HWTACACS scheme.
91
Related commands: display hwtacacs and vpn-instance (HWTACACS scheme view).
Syntax
secondary authentication ip-address [ port-number | vpn-instance vpn-instance-name ] * undo secondary authentication
View
Default level
2: System level
Parameters
ip-address: IP address of the secondary HWTACACS authentication server, in dotted decimal notation. The default is 0.0.0.0. port-number: Service port number of the secondary HWTACACS authentication server. It ranges from 1 to 65535 and defaults to 49. vpn-instance vpn-instance-name: Specifies the MPLS L3VPN that the secondary HWTACACS authentication server belongs to, where vpn-instance-name is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Examples
# Specify the IP address and port number of the secondary authentication server for HWTACACS scheme hwt1 as 10.163.155.13 with TCP port number 49.
<Sysname> system-view [Sysname] hwtacacs scheme hwt1 [Sysname-hwtacacs-hwt1] secondary authentication 10.163.155.13 49
secondary authorization
Description
Use secondary authorization to specify the secondary HWTACACS authorization server. Use undo secondary authorization to remove the configuration. By default, no secondary HWTACACS authorization server is specified. The IP addresses of the primary and secondary authorization servers cannot be the same. Otherwise, the configuration fails. If the specified server resides on an MPLS VPN, you also need to specify that VPN with the secondary authorization to ensure normal communication with the server. The VPN specified here takes precedence over the VPN specified for the HWTACACS scheme. If you configure the command repeatedly, only the last configuration takes effect. You can remove an authorization server only when it is not used by any active TCP connection to send authorization packets. Removing an authorization server affects only authorization processes that occur after the remove operation. Related commands: display hwtacacs and vpn-instance (HWTACACS scheme view).
Syntax
secondary authorization ip-address [ port-number | vpn-instance vpn-instance-name ] *
92
undo secondary authorization
View
Default level
2: System level
Parameters
ip-address: IP address of the secondary HWTACACS authorization server, in dotted decimal notation. The default is 0.0.0.0. port-number: Service port number of the secondary HWTACACS authorization server. It ranges from 1 to 65535 and defaults to 49. vpn-instance vpn-instance-name: Specifies the MPLS L3VPN that the secondary HWTACACS authorization server belongs to, where vpn-instance-name is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Examples
# Configure the secondary authorization server 10.163.155.13 with TCP port number 49.
<Sysname> system-view [Sysname] hwtacacs scheme hwt1 [Sysname-hwtacacs-hwt1] secondary authorization 10.163.155.13 49
stop-accounting-buffer enable (HWTACACS scheme view)

Description
Use stop-accounting-buffer enable to enable the device to buffer stop-accounting requests to which no responses are received. Use undo stop-accounting-buffer enable to disable the buffering function. By default, the device buffers stop-accounting requests to which no responses are received. Stop-accounting requests affect the charge to users. A NAS must make its best effort to send every stopaccounting request to the HWTACACS accounting servers. For each stop-accounting request getting no response in the specified period of time, the NAS buffers and resends the packet until it receives a response or the number of transmission attempts reaches the configured limit. In the latter case, the NAS discards the packet. Related commands: reset stop-accounting-buffer and display stop-accounting-buffer.
Syntax
stop-accounting-buffer enable undo stop-accounting-buffer enable
View
Default level
2: System level
Parameters
None
93
Examples
# In HWTACACS scheme hwt1, enable the device to buffer the stop-accounting requests getting no responses.
<Sysname> system-view [Sysname] hwtacacs scheme hwt1 [Sysname-hwtacacs-hwt1] stop-accounting-buffer enable
timer quiet (HWTACACS scheme view)

Description
Use timer quiet to set the quiet timer for the primary server, that is, the duration that the status of the primary server stays blocked before resuming the active state. Use undo timer quiet to restore the default. By default, the primary server quiet period is 5 minutes. Related commands: display hwtacacs.
Syntax
timer quiet minutes undo timer quiet
View
Default level
2: System level
Parameters
minutes: Primary server quiet period, in minutes. It ranges from 1 to 255.
Examples
# Set the quiet timer for the primary server to 10 minutes.
<Sysname> system-view [Sysname] hwtacacs scheme hwt1 [Sysname-hwtacacs-hwt1] timer quiet 10
timer realtime-accounting (HWTACACS scheme view)

Description
Use timer realtime-accounting to set the real-time accounting interval. Use undo timer realtime-accounting to restore the default. By default, the real-time accounting interval is 12 minutes. For real-time accounting, a NAS must transmit the accounting information of online users to the HWTACACS accounting server periodically. This command is for setting the interval. The setting of the real-time accounting interval somewhat depends on the performance of the NAS and the HWTACACS server. A shorter interval requires higher performance. Use a longer interval when there are a large number of users (more than 1000, inclusive).
94
Table 8 Recommended real-time accounting intervals Number of users

1 to 99 100 to 499 500 to 999 1000 or more
Real-time accounting interval (minute)

3 6 12 15 or more
Syntax
timer realtime-accounting minutes undo timer realtime-accounting
View
Default level
2: System level
Parameters
minutes: Real-time accounting interval in minutes, zero or a multiple of 3 in the range of 3 to 60. A value of zero means Do not send online user accounting information to the HWTACACS server.
Examples
# Set the real-time accounting interval to 51 minutes for HWTACACS scheme hwt1.
<Sysname> system-view [Sysname] hwtacacs scheme hwt1 [Sysname-hwtacacs-hwt1] timer realtime-accounting 51
timer response-timeout (HWTACACS scheme view)

Description
Use timer response-timeout to set the HWTACACS server response timeout timer. Use undo timer to restore the default. By default, the HWTACACS server response timeout time is 5 seconds. HWTACACS is based on TCP. If the server response timeout timer or the TCP timeout timer times out, the device will be disconnected from the HWTACACS server. Related commands: display hwtacacs.
Syntax
timer response-timeout seconds undo timer response-timeout
View
Default level
2: System level
95
Parameters
seconds: HWTACACS server response timeout period in seconds, in the range of 1 to 300.
Examples
# Set the HWTACACS server response timeout timer to 30 seconds for HWTACACS scheme hwt1.
<Sysname> system-view [Sysname] hwtacacs scheme hwt1 [Sysname-hwtacacs-hwt1] timer response-timeout 30
user-name-format (HWTACACS scheme view)

Description
Use user-name-format to specify the format of the username to be sent to an HWTACACS server. By default, the ISP domain name is included in the username. A username is generally in the format userid@isp-name, of which isp-name is used by the device to determine the ISP domain to which a user belongs. Some earlier HWTACACS servers, however, cannot recognize a username including an ISP domain name. Before sending a username including a domain name to such an HWTACACS server, the device must remove the domain name. This command allows you to specify whether to include a domain name in a username to be sent to an HWTACACS server. If an HWTACACS scheme defines that the username is sent without the ISP domain name, do not apply the HWTACACS scheme to more than one ISP domain, avoiding the confused situation where the HWTACACS server regards two users in different ISP domains but with the same userid as one. If the HWTACACS scheme is used for wireless users, specify the keep-original keyword. Otherwise, authentication of the wireless users may fail.
Syntax
user-name-format { keep-original | with-domain | without-domain }
View
Default level
2: System level
Parameters
keep-original: Sends the username to the HWTACACS server as it is entered. with-domain: Includes the ISP domain name in the username sent to the HWTACACS server. without-domain: Excludes the ISP domain name from the username sent to the HWTACACS server.
Examples
# Specify the device to remove the ISP domain name in the username sent to the HWTACACS servers for the HWTACACS scheme hwt1.
<Sysname> system-view [Sysname] hwtacacs scheme hwt1 [Sysname-hwtacacs-hwt1] user-name-format without-domain
96
vpn-instance (HWTACACS scheme view)

Description
Use vpn-instance to specify a VPN for the HWTACACS scheme. Use undo vpn-instance to remove the configuration. The VPN specified here takes effect for all servers in the HWTACACS scheme for which no specific VPN instance is specified. Related commands: display hwtacacs.
Syntax
vpn-instance vpn-instance-name undo vpn-instance
View
Default level
2: System level
Parameters
vpn-instance-name: Name of MPLS L3VPN instance, a case-sensitive string of 1 to 31 characters.
Examples
# Specify VPN instance test for HWTACACS scheme hwt1.
<Sysname> system-view [Sysname] hwtacacs scheme hwt1 [Sysname-hwtacacs-hwt1] vpn-instance test
RADIUS server configuration commands

The following table shows the command and router compatibility: Command
RADIUS server configuration commands
MSR900
No
MSR20-1X
Yes
MSR20
Yes
MSR30
Yes
MSR50
No
authorization-attribute (RADIUS-server user view)

Description
Use authorization-attribute to specify the authorization attributes (ACL and VLAN) that the RADIUS server will assign to the RADIUS client in a response message after the RADIUS user passes RADIUS authentication. The RADIUS client uses the assigned authorization attributes to control the access of the RADIUS user. Use undo authorization-attribute to remove the configuration. By default, no authorization attribute is configured. Related commands: radius-server user.
97
Syntax
authorization-attribute { acl acl-number | vlan vlan-id } * undo authorization-attribute { acl | vlan } *
View
RADIUS-server user view
Default level
2: System level
Parameters
acl acl-number: Specifies the number of an ACL in the range of 2000 to 5999. vlan vlan-id: Specifies the ID of a VLAN in the range of 1 to 4094.
Examples
# Configure the authorized VLAN for RADIUS user user1 as VLAN 3.
<Sysname> system-view [Sysname] radius-server user user1 [Sysname-rdsuser-user1] authorization-attribute vlan 3
description (RADIUS-server user view)

Description
Use description to configure a description for the RADIUS user. The description is used for user information management. Use undo description to remove the user description. By default, no description is configured for the RADIUS user. Related commands: radius-server user.
Syntax
description text undo description
View
Default level
2: System level
Parameters
text: Description of the RADIUS user, a case-sensitive string of 1 to 255 characters.
Examples
# Configure a description of VIP user for RADIUS user user1.
<Sysname> system-view [Sysname] radius-server user user1 [Sysname-rdsuser-user1] description VIP user
98
expiration-date (RADIUS-server user view)

Description
Use expiration-date to configure the expiration time of a RADIUS user. Use undo expiration-date to remove the configuration. By default, a RADIUS user has no expiration time and no expiration check is performed. If a user needs to access the network temporarily, create a guest account for the user and specify an expiration time for the account. After the user passes authentication, the RADIUS server checks whether the current system time is before the expiration time. If yes, it permits the user to access the network. Otherwise, it denies the access request of the user. If you change the system time manually or the system time is changed in any other way, the access device uses the new system time for expiration check. Related commands: radius-server user.
Syntax
expiration-date time undo expiration-date
View
Default level
2: System level
Parameters
time: Expiration time of the RADIUS user, in the format HH:MM:SS-MM/DD/YYYY or HH:MM:SSYYYY/MM/DD. HH:MM:SS indicates the time, where HH ranges from 0 to 23, MM and SS range from 0 to 59. YYYY/MM/DD indicates the date, where YYYY ranges from 2000 to 2035, MM ranges from 1 to 12, and the range of DD depends on the month. Except for the zeros in 00:00:00, leading zeros can be omitted. For example, 2:2:0-2010/2/2 equals 02:02:00-2010/02/02.
Examples
# Configure user user1 to expire in 12:10:20 on May 31, 2012.
<Sysname> system-view [Sysname] radius-server user user1 [Sysname-rdsuser-user1] expiration-date 12:10:20-2012/05/31
password (RADIUS-server user view)

Description
Use password to configure a password for the RADIUS user. Use undo password to delete the password of the RADIUS user. By default, no password is configured for the RADIUS user. Related commands: radius-server user.
Syntax
password [ cipher | simple ] password
99
undo password
View
Default level
2: System level
Parameters
cipher: Sets and displays the password in cipher text. simple: Sets and displays the password in plain text. password: Password for the RADIUS user, case sensitive. Follow these guidelines: With the cipher keyword specified, the password must be a ciphertext string of 12, 24, 32, 44, 64, 76, 88, 96, 108, 120, 128, 140, 152, 160, 172, or 184 characters, for example, _(TT8F]Y\5SQ=^Q`MAF4<1!!. With the simple keyword specified, the password must be a plaintext string of 1 to 128 characters, for example, aabbcc. With neither the cipher keyword nor the cipher keyword specified, the password must be a plaintext string of 1 to 128 characters, and the key will be displayed in cipher text.
Examples
# Set the password of user1 to plaintext string 123456 and specify to display the password in plain text.
<Sysname> system-view [Sysname] radius-server user1 [Sysname-rdsuser-user1] password simple 123456 [Sysname-rdsuser-user1] display this # radius-server user1 password simple 123456 # return
# Set the password of user2 to ciphertext string TEzJOUGCmuE= and specify to display the password in cipher text.
<Sysname> system-view [Sysname] radius-server user2 [Sysname-rdsuser-user2] password cipher TEzJOUGCmuE= [Sysname-rdsuser-user2] display this # radius-server user2 password cipher TEzJOUGCmuE= # return
# Set the password of user3 to plaintext 123456 and specify to display the password in cipher text.
<Sysname> system-view [Sysname] radius-server user3 [Sysname-rdsuser-user3] password 123456 [Sysname-rdsuser-user3] display this #
100
radius-server user3 password cipher xz8n+yXxN+I= # return
radius-server client-ip
Description
Use radius-server client-ip to specify a RADIUS client. Use undo radius-server client-ip to delete the specified RADIUS client or all RADIUS clients. The IP address of the RADIUS client specified on the RADIUS server must be consistent with the source IP address of RADIUS packets configured on the RADIUS client,. The shared key specified on the RADIUS serer must be consistent with that configured on the RADIUS client. To specify multiple RADIUS clients, execute this command repeatedly. The maximum number of RADIUS clients that can be configured depends on the storage space.
Syntax
radius-server client-ip ip-address [ key string ] undo radius-server client-ip { ip-address | all }
View
System view
Default level
2: System level
Parameters
ip-address: IPv4 address of the RADIUS client. key string: Shared key for communication with the RADIUS client, a case-sensitive string of 1 to 64 characters. all: Specifies all RADIUS clients.
Examples
# Specify RADIUS client 10.1.1.1 and the shared key as 1234.
<Sysname> system-view [Sysname] radius-server client-ip 10.1.1.1 key 1234
radius-server user
Description
Use radius-server user to create a RADIUS user and enter RADIUS-server user view. Use undo radius-server user to delete the specified RADIUS user or all RADIUS users. By default, no RADIUS user exists. The maximum number of RADIUS users that can be created depends on the device model.
101
If the access device is configured to send usernames that carry the domain name to the RADIUS server, the username of the RADIUS user configured here must contain the domain name. If not, the username of the RADIUS user configured here does not contain the domain name. Related commands: user-name-format (RADIUS scheme view).
Syntax
radius-server user user-name undo radius-server user { user-name | all }
View
System view
Default level
2: System level
Parameters
user-name: user-name: RADIUS username, a case-sensitive string of 1 to 64 characters that can contain the domain name. It cannot contain question mark (?),less-than sign (<), greater-than sign (>), backward slash (\), quotation mark (), percent sign (%), apostrophe ('), ampersand (&), number sign (#), or spaces and cannot be a, al, or all. all: Removes all RADIUS users.
Examples
# Create RADIUS user user1 and enter its view.
<Sysname> system-view [Sysname] radius-server user user1 [Sysname-rdsuser-user1]
102
802.1X configuration commands

display dot1x
Description
Use display dot1x to display information about 802.1X. If you specify neither the sessions keyword nor the statistics keyword, the command displays all information about 802.1X, including session information, statistics, and configurations. Related commands: reset dot1x statistics, dot1x, dot1x retry, dot1x max-user, dot1x port-control, dot1x port-method, and dot1x timer.
Syntax
display dot1x [ sessions | statistics ] [ interface interface-list ] [ | { begin | exclude | include } regularexpression ]
View
Any view
Default level
1: Monitor level
Parameters
sessions: Displays 802.1X session information. statistics: Displays 802.1X statistics. interface interface-list: Specifies an Ethernet port list, which can contain multiple Ethernet ports. The interface-list argument is in the format of interface-list = { interface-type interface-number [ to interfacetype interface-number ] } & <1-10>, where interface-type represents the port type, interface-number represents the port number, and & <1-10> means that you can provide up to 10 ports or port ranges. The start port number must be smaller than the end number and the two ports must be the same type. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display all information about 802.1X.
<Sysname> display dot1x Equipment 802.1X protocol is enabled CHAP authentication is enabled Proxy trap checker is disabled Proxy logoff checker is disabled
103
Configuration: Transmit Period Quiet Period Supp Timeout Reauth Period
30 s, 60 s, 30 s, 3600 s
Handshake Period Server Timeout 3
15 s 100 s
Quiet Period Timer is disabled
The maximal retransmitting times The maximum 802.1X user resource number is 1024 per slot Total current used 802.1X resource number is 1 Ethernet4/0 is link-up disabled 802.1X protocol is enabled Proxy trap checker is Handshake is disabled Handshake secure is disabled 802.1X unicast-trigger is enabled Periodic reauthentication is disabled The port is an authenticator Authenticate Mode is Auto Port Control Type is Mac-based 802.1X Multicast-trigger is enabled Mandatory authentication domain: NOT configured Guest VLAN: 4 Auth-fail VLAN: NOT configured Max number of on-line users is 256 EAPOL Packet: Tx 1087, Rx 986 Sent EAP Request/Identity Packets : 943 EAP Request/Challenge Packets: 60 EAP Success Packets: 29, Fail Packets: 55 Received EAPOL Start Packets : 60 EAPOL LogOff Packets: 24 EAP Response/Identity Packets : 724 EAP Response/Challenge Packets: 54 Error Packets: 0 Controlled User(s) amount to 1 Proxy logoff checker is disabled

Equipment 802.1X protocol is enabled CHAP authentication is enabled Proxy trap checker is disabled Proxy logoff checker is disabled Transmit Period Handshake Period Reauth Period
Description
Specifies whether 802.1X is enabled globally Specifies whether CHAP authentication is enabled Specifies whether the device sends a trap when detecting that a user is accessing the network through a proxy Specifies whether the device logs off the user when detecting that the user is accessing the network through a proxy Username request timeout timer in seconds Handshake timer in seconds Periodic re-authentication timer in seconds 104
Field
Quiet Period Quiet Period Timer is disabled Supp Timeout Server Timeout The maximal retransmitting times URL Free IP EAD timeout The maximum 802.1X user resource number per slot Total current used 802.1X resource number Ethernet4/0 is link-up 802.1X protocol is disabled Proxy trap checker is disabled Proxy logoff checker is disabled Handshake is disabled Handshake secure is disabled 802.1X unicast-trigger is disabled Periodic reauthentication is disabled The port is an authenticator Authentication Mode is Auto Port Control Type is Mac-based 802.1X Multicast-trigger is enabled Mandatory authentication domain Guest VLAN Auth-fail VLAN Max number of on-line users EAPOL Packet Sent EAP Request/Identity Packets EAP Request/Challenge Packets
Description
Quiet timer in seconds Status of the quiet timer. In this example, the quiet timer is enabled. Client timeout timer in seconds Server timeout timer in seconds Maximum number of attempts for sending an authentication request to a client Redirect URL for unauthenticated users using a web browser to access the network Freely accessible network segment EAD rule timer in minutes Maximum number of concurrent 802.1X user per card Total number of online 802.1X users Status of the port. In this example, Ethernet 4/0 is up. Specifies whether 802.1X is enabled on the port Specifies whether the port sends a trap when detecting that a user is accessing the network through a proxy Specifies whether the port logs off the user when detecting the user is accessing the networking through a proxy Specifies whether handshake is enabled on the port Specifies whether handshake security is enabled on the port Specifies whether unicast trigger is enabled on the port. Specifies whether periodic online user re-authentication is enabled on the port Role of the port Authorization state of the port Access control method of the port Specifies whether the 802.1X multicast-trigger function is enabled Mandatory authentication domain on the port 802.1X guest VLAN configured on the port. NOT configured is displayed if no guest VLAN is configured. Auth-Fail VLAN configured on the port. NOT configured is displayed if no Auth-Fail VLAN is configured. Maximum number of concurrent 802.1X users on the port Number of sent (Tx) and received (Rx) EAPOL packets Number of sent EAP-Request/Identity packets Number of sent EAP-Request/Challenge packets 105
Field
EAP Success Packets Received EAPOL Start Packets EAPOL LogOff Packets EAP Response/Identity Packets EAP Response/Challenge Packets Error Packets Controlled User(s) amount
Description
Number of sent EAP Success packets Number of received EAPOL-Start packets Number of received EAPOL-LogOff packets Number of received EAP-Response/Identity packets Number of received EAP-Response/Challenge packets Number of received error packets Number of authenticated users on the port
dot1x
Description
Use dot1x command in system view to enable 802.1X globally. Use undo dot1x command in system view to disable 802.1X globally. Use dot1x interface command in system view or the dot1x command in interface view to enable 802.1X for specified ports. Use undo dot1x interface command in system view or the undo dot1x command in interface view to disable 802.1X for specified ports. By default, 802.1X is neither enabled globally nor enabled for any port. 802.1X must be enabled both globally in system view and for the intended ports in system view or interface view. Otherwise, it does not function. You can configure 802.1X parameters either before or after enabling 802.1X. Related commands: display dot1x.
Syntax
In system view: dot1x [ interface interface-list ] undo dot1x [ interface interface-list ] In Ethernet interface view: dot1x undo dot1x
View
System view, Ethernet interface view
Default level
2: System level
Parameters
interface interface-list: Specifies a port list, which can contain multiple ports. The interface-list argument is in the format of interface-list = { interface-type interface-number [ to interface-type interface-number ] } & <1-10>, where interface-type represents the port type, interface-number represents the port number, and &
106
<1-10> means that you can provide up to 10 ports or port ranges. The start port number must be smaller than the end number and the two ports must be of the same type.
Examples
# Enable 802.1X for ports Ethernet 1/1, and Ethernet 1/5 to Ethernet 1/7.
<Sysname> system-view [Sysname] dot1x interface ethernet 1/1 ethernet 1/5 to ethernet 1/7
Or
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] dot1x [Sysname-Ethernet1/1] quit [Sysname] interface ethernet 1/5 [Sysname-Ethernet1/5] dot1x [Sysname-Ethernet1/5] quit [Sysname] interface ethernet 1/6 [Sysname-Ethernet1/6] dot1x [Sysname-Ethernet1/6] quit [Sysname] interface ethernet 1/7 [Sysname-Ethernet1/7] dot1x
# Enable 802.1X globally.

<Sysname> system-view [Sysname] dot1x
dot1x authentication-method
Description
Use dot1x authentication-method to specify an EAP message handling method. Use undo dot1x authentication-method to restore the default. By default, the network access device performs EAP termination and uses CHAP to communicate with the RADIUS server. The network access device terminates or relays EAP packets:
1.
In EAP termination mode, the access device re-encapsulates and sends the authentication data from the client in standard RADIUS packets to the RADIUS server, and performs either CHAP or PAP authentication with the RADIUS server. In this mode the RADIUS server supports only MD5Challenge EAP authentication, and username+password EAP authentication initiated by an iNode client. PAP transports usernames and passwords in clear text. The authentication method applies to scenarios that do not require high security. To use PAP, the client must be an HP iNode 802.1X client. CHAP transports username in plaintext and encrypted password over the network. It is more secure than PAP. In EAP relay mode, the access device relays EAP messages between the client and the RADIUS server. The EAP relay mode supports multiple EAP authentication methods, such as MD5-Challenge, EAP-TL, and PEAP. To use this mode, you must make sure that the RADIUS server supports the EAPMessage and Message-Authenticator attributes, and uses the same EAP authentication method as the client. If this mode is used, the user-name-format command configured in RADIUS scheme view
107

2.
does not take effect. For more information about the user-name-format command, see the chapter RADIUS configuration commands. Local authentication supports PAP and CHAP. If RADIUS authentication is used, you must configure the network access device to use the same authentication method (PAP, CHAP, or EAP) as the RADIUS server. Related commands: display dot1x.
Syntax
dot1x authentication-method { chap | eap | pap } undo dot1x authentication-method
View
System view
Default level
2: System level
Parameters
chap: Sets the access device to perform EAP termination and use the CHAP to communicate with the RADIUS server. eap: Sets the access device to relay EAP packets, and supports any of the EAP authentication methods to communicate with the RADIUS server. pap: Sets the access device to perform EAP termination and use the PAP to communicate with the RADIUS server.
Examples
# Enable the access device to terminate EAP packets and perform PAP authentication with the RADIUS server.
<Sysname> system-view [Sysname] dot1x authentication-method pap
dot1x auth-fail vlan

Descriptions
Use dot1x auth-fail vlan to configure an Auth-Fail VLAN for a port. An Auth-Fail VLAN accommodates users that have failed 802.1X authentication because of the failure to comply with the organization security strategy, such as using a wrong password. Use undo dot1x auth-fail vlan to restore the default. By default, no Auth-Fail VLAN is configured on a port. You must enable 802.1X multicast trigger function for an Auth-Fail VLAN to take effect on a port that performs port-based access control. When you change the access control method from port-based to MAC-based on a port that is in an AuthFail VLAN, the port is removed from the Auth-Fail VLAN. To delete a VLAN that has been configured as an Auth-Fail VLAN, you must remove the Auth-Fail VLAN configuration first. You can configure both an Auth-Fail VLAN and a guest VLAN for a port.
108
Related commands: dot1x and dot1x port-method. NOTE: Auth-Fail VLAN is not supported on ports that perform MAC-based access control.
Syntax
dot1x auth-fail vlan authfail-vlan-id undo dot1x auth-fail vlan
View
Ethernet interface view
Default level
2: System level
Parameters
authfail-vlan-id: Specifies the ID of the Auth-Fail VLAN for the port, in the range of 1 to 4094. The VLAN must already exist.
Examples
# Configure VLAN 3 as the Auth-Fail VLAN for port Ethernet 1/1.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] dot1x auth-fail vlan 3
dot1x domain-delimiter
Description
Use dot1x domain-delimiter to specify a set of domain name delimiters supported by the access device. Any character in the configured set can be used as the domain name delimiter for 802.1X authentication users. Use undo dot1x domain-delimiter to restore the default. By default, the access device supports only the at sign (@) delimiter for 802.1X users. The delimiter set you configured overrides the default setting. If @ is not included in the delimiter set, the access device will not support the 802.1X users that use @ as the domain name delimiter. If a username string contains multiple configured delimiters, the leftmost delimiter is the domain name delimiter. For example, if you configure @, /, and \ as delimiters, the domain name delimiter for the username string 123/22\@abc is the forward slash (/). The cut connection user-name user-name and display connection user-name user-name commands are not available for 802.1X users that use / or \ as the domain name delimiter. For more information about the two commands, see the chapter AAA configuration commands.
Syntax
dot1x domain-delimiter string undo dot1x domain-delimiter
109
View
System view
Default level
2: System level
Parameters
string: Specifies a set of 1 to 16 domain name delimiters for 802.1X users. No space is required between delimiters. Available delimiters include the at sign (@), backslash (/), and forward slash (\).
Examples
# Specify the characters @, /, and \ as domain name delimiters.
<Sysname> system-view [Sysname] dot1x domain-delimiter @\/
dot1x guest-vlan
Description
Use dot1x guest-vlan to configure an 802.1X guest VLAN for the specified or all ports. Use undo dot1x guest-vlan to remove the 802.1X guest VLAN on the specified or all ports. By default, no 802.1X guest VLAN is configured on a port. You must enable 802.1X for an 802.1X guest VLAN to take effect. To have the 802.1X guest VLAN take effect, complete the following tasks: Enable 802.1X both globally and on the interface. On the port performs port-based access control, enable the 802.1X multicast trigger function.
When you change the access control method from port-based to MAC-based on a port that is in a guest VLAN, the port is removed from the guest VLAN. To delete a VLAN that has been configured as a guest VLAN, you must remove the guest VLAN configuration first. You can configure both an Auth-Fail VLAN and an 802.1X guest VLAN on a port. Related commands: dot1x, dot1x port-method, and dot1x multicast-trigger. NOTE: Guest VLAN is not supported on ports that perform MAC-based access control.
Syntax
In system view: dot1x guest-vlan guest-vlan-id [ interface interface-list ] undo dot1x guest-vlan [ interface interface-list ] In interface view: dot1x guest-vlan guest-vlan-id undo dot1x guest-vlan
110
View
Default level
2: System level
Parameters
guest-vlan-id: Specifies the ID of the VLAN to be specified as the 802.1X guest VLAN, in the range of 1 to 4094. It must already exist. interface interface-list: Specifies a port list. The interface-list argument is in the format of interface-list = { interface-type interface-number [ to interface-type interface-number ] } & <1-10>, where interface-type represents the port type, interface-number represents the port number, and & <1-10> means that you can provide up to 10 ports or port ranges. The start port number must be smaller than the end number and the two ports must be of the same type. If no interface is specified, you configure an 802.1X guest VLAN for all Layer 2 Ethernet ports.
Examples
# Specify VLAN 999 as the 802.1X guest VLAN for port Ethernet 1/1
<Sysname> system-view [Sysname] dot1x guest-vlan 999 interface ethernet 1/1
# Specify VLAN 10 as the 802.1X guest VLAN for ports Ethernet 1/2 to Ethernet 1/5.
<Sysname> system-view [Sysname] dot1x guest-vlan 10 interface ethernet 1/2 to ethernet 1/5
# Specify VLAN 7 as the 802.1X guest VLAN for all ports.

<Sysname> system-view [Sysname] dot1x guest-vlan 7
# Specify VLAN 3 as the 802.1X guest VLAN for port Ethernet 1/7.
<Sysname> system-view [Sysname] interface ethernet 1/7 [Sysname-Ethernet1/7] dot1x guest-vlan 3
dot1x handshake
Description
Use dot1x handshake to enable the online user handshake function. The function enables the device to periodically send handshake messages to the client to check whether a user is online. Use undo dot1x handshake to disable the function. By default, the function is enabled. The 802.1X proxy detection function depends on the online user handshake function. Enable handshake before enabling proxy detection and disable proxy detection before disabling handshake. HP recommends that you use the iNode client software to guarantee the normal operation of the online user handshake function.
Syntax
dot1x handshake undo dot1x handshake
111
View
Ethernet Interface view
Default level
2: System level
Parameters
None
Examples
# Enable the online user handshake function.
<Sysname> system-view [Sysname] interface ethernet 1/4 [Sysname-Ethernet1/4] dot1x handshake
dot1x handshake secure

Description
Use dot1x handshake secure to enable the online user handshake security function. The function enables the device to prevent users from using illegal client software. Use undo dot1x handshake secure to disable the function. By default, the function is disabled. The online user handshake security function is implemented based on the online user handshake function. To bring the security function into effect, make sure the online user handshake function is enabled. HP recommends you use the iNode client software and IMC server to guarantee the normal operation of the online user handshake security function. Related commands: dot1x handshake.
Syntax
dot1x handshake secure undo dot1x handshake secure
View
Default level
2: System level
Parameters
None
Examples
# Enable the online user handshake security function.
<Sysname> system-view [Sysname] interface ethernet 1/4 [Sysname-Ethernet1/4] dot1x handshake secure
112
dot1x mandatory-domain
Description
Use dot1x mandatory-domain to specify a mandatory 802.1X authentication domain on a port. Use undo dot1x mandatory-domain to remove the mandatory authentication domain. By default, no mandatory authentication domain is specified. When authenticating an 802.1X user trying to access the port, the system selects an authentication domain in the following order: the mandatory domain, the ISP domain specified in the username, and the default ISP domain. To display or cut all 802.1X connections in a mandatory domain, use the display connection domain ispname or cut connection domain isp-name command. The output of the display connection command without any parameters displays domain names input by users at login. For more information about the display connection command or the cut connection command, see the chapter AAA configuration commands. Related commands: display dot1x.
Syntax
dot1x mandatory-domain domain-name undo dot1x mandatory-domain
View
Default level
2: System level
Parameters
domain-name: Specifies the ISP domain name, a case-insensitive string of 1 to 24 characters. The specified domain must already exist.
Examples
# Configure the mandatory authentication domain my-domain for 802.1X users on Ethernet 1/1.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] dot1x mandatory-domain my-domain
# After 802.1X user usera passes the authentication, execute the display connection to display the user connection information on Ethernet 1/1. For more information about the display connection command, see the chapter AAA configuratio commands.
[Sysname-Ethernet1/1] display connection interface ethernet 1/1 Index=68 IP=3.3.3.3 IPv6=N/A Total 1 connection(s) matched. ,Username=usera@my-domian
MAC=0015-e9a6-7cfe
113
dot1x max-user
Description
Use dot1x max-user to set the maximum number of concurrent 802.1X users on a port. Use undo dot1x max-user to restore the default. By default, the maximum number of concurrent 802.1X users on a port is 256. In system view: If you do not specify the interface-list argument, the command applies to all ports. If you specify the interface-list argument, the command applies to the specified ports.
In Ethernet port view, the interface-list argument is not available and the command applies to only the Ethernet port. Related commands: display dot1x.
Syntax
In system view: dot1x max-user user-number [ interface interface-list ] undo dot1x max-user [ interface interface-list ] In Ethernet interface view: dot1x max-user user-number undo dot1x max-user
View
Default level
2: System level
Parameters
user-number: Specifies the maximum number of concurrent 802.1X users on a port. The value is in the range of 1 to 256. interface interface-list: Specifies an Ethernet port list, which can contain multiple Ethernet ports. The interface-list argument is in the format of interface-list = { interface-type interface-number [ to interfacetype interface-number ] } & <1-10>, where interface-type represents the port type, interface-number represents the port number, and & <1-10> means that you can provide up to 10 ports or port ranges. The start port number must be smaller than the end number and the two ports must be of the same type.
Examples
# Set the maximum number of concurrent 802.1X users on port Ethernet 1/1 to 32.
<Sysname> system-view [Sysname] dot1x max-user 32 interface ethernet 1/1
Or
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] dot1x max-user 32
114
# Configure Ethernet 1/2 through Ethernet 1/5 each to support a maximum of 32 concurrent 802.1X users.
<Sysname> system-view [Sysname] dot1x max-user 32 interface ethernet 1/2 to ethernet 1/5
dot1x multicast-trigger
Description
Use dot1x multicast-trigger to enable the 802.1X multicast trigger function. The device acts as the initiator and periodically multicasts Identify EAP-Request packets out of a port to detect 802.1X clients and trigger authentication. Use undo dot1x multicast-trigger to disable the function. By default, the multicast trigger function is enabled. You can use the dot1x timer tx-period to set the interval for sending multicast Identify EAP-Request packets. Related commands: display dot1x.
Syntax
dot1x multicast-trigger undo dot1x multicast-trigger
View
Default level
2: System level
Parameters
None
Examples
# Enable the multicast trigger function on interface Ethernet 1/1.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] dot1x multicast-trigger
dot1x port-control
Description
Use dot1x port-control to set the authorization state for the specified or all ports. Use undo dot1x port-control to restore the default. The default port authorization state is auto. In system view, if no interface-list argument is specified, the command applies to all ports. Related commands: display dot1x.
Syntax
In system view:
115
dot1x port-control { authorized-force | auto | unauthorized-force } [ interface interface-list ] undo dot1x port-control [ interface interface-list ] In Ethernet interface view: dot1x port-control { authorized-force | auto | unauthorized-force } undo dot1x port-control
View
Default level
2: System level
Parameters
authorized-force: Places the specified or all ports in the authorized state, enabling users on the ports to access the network without authentication. auto: Places the specified or all ports initially in the unauthorized state to allow only EAPOL packets to pass, and after a user passes authentication, sets the port in the authorized state to allow access to the network. You can use this option in most scenarios. unauthorized-force: Places the specified or all ports in the unauthorized state, denying any access requests from users on the ports. interface interface-list: Specifies an Ethernet port list, which can contain multiple Ethernet ports. The interface-list argument is in the format of interface-list = { interface-type interface-number [ to interfacetype interface-number ] } & <1-10>, where interface-type represents the port type, interface-number represents the port number, and & <1-10> means that you can provide up to 10 ports or port ranges. The start port number must be smaller than the end number and the two ports must be of the same type.
Examples
# Set the authorization state of port Ethernet 1/1 to unauthorized-force.
<Sysname> system-view [Sysname] dot1x port-control unauthorized-force interface ethernet 1/1
Or
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] dot1x port-control unauthorized-force
# Set the authorization state of ports Ethernet 1/2 through Ethernet 1/5 to unauthorized-force.
<Sysname> system-view [Sysname] dot1x port-control unauthorized-force interface ethernet 1/2 to ethernet 1/5
dot1x port-method
Description
Use dot1x port-method to specify an access control method for the specified or all ports. Use undo dot1x port-method to restore the default. By default, MAC-based access control applies. In system view, if no interface-list argument is specified, the command applies to all ports.
116
Related commands: display dot1x.
Syntax
In system view: dot1x port-method { macbased | portbased } [ interface interface-list ] undo dot1x port-method [ interface interface-list ] In Ethernet interface view: dot1x port-method { macbased | portbased } undo dot1x port-method
View
Default level
2: System level
Parameters
macbased: Uses MAC-based access control on a port to separately authenticate each user attempting to access the network. In this approach, when an authenticated user logs off, no other online users are affected. portbased: Uses port-based access control on a port. In this approach, once an 802.1X user passes authentication on the port, any subsequent user can access the network through the port without authentication. When the authenticated user logs off, all other users are logged off. interface interface-list: Specifies an Ethernet port list, which can contain multiple Ethernet ports. The interface-list argument is in the format of interface-list = { interface-type interface-number [ to interfacetype interface-number ] } & <1-10>, where interface-type represents the port type, interface-number represents the port number, and & <1-10> means that you can provide up to 10 ports or port ranges for this argument. The start port number must be smaller than the end number and the two ports must be the same type.
Examples
# Configure port Ethernet 1/1 to implement port-based access control.
<Sysname> system-view [Sysname] dot1x port-method portbased interface ethernet 1/1
Or
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] dot1x port-method portbased
# Configure ports Ethernet 1/2 through Ethernet 1/5 to implement port-based access control.
<Sysname> system-view [Sysname] dot1x port-method portbased interface ethernet 1/2 to ethernet 1/5
dot1x quiet-period
Description
Use dot1x quiet-period to enable the quiet timer. When a client fails 802.1X authentication, the device must wait a period of time before it can process authentication requests from the client.
117
Use undo dot1x quiet-period to disable the timer. By default, the quiet timer is disabled. Related commands: display dot1x and dot1x timer.
Syntax
dot1x quiet-period undo dot1x quiet-period
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable the quiet timer.
<Sysname> system-view [Sysname] dot1x quiet-period
dot1x re-authenticate
Description
Use dot1x re-authenticate to enable the periodic online user re-authentication function. Use undo dot1x re-authenticate to disable the function. By default, the periodic online user re-authentication function is disabled. Periodic re-authentication enables the access device to periodically authenticate online 802.1X users on a port. This function tracks the connection status of online users and updates the authorization attributes assigned by the server, such as the ACL, VLAN, and user profile-based QoS. You can use the dot1x timer reauth-period to configure the interval for re-authentication. Related commands: dot1x timer reauth-period.
Syntax
dot1x re-authenticate undo dot1x re-authenticate
View
Default level
2: System level
Parameters
None
118
Examples
# Enable the 802.1X periodic online user re-authentication function on Ethernet 1/1 and set the periodic re-authentication interval to 1800 seconds.
<Sysname> system-view [Sysname] dot1x timer reauth-period 1800 [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] dot1x re-authenticate
dot1x retry
Description
Use dot1x retry to set the maximum number of attempts for sending an authentication request to a client. Use undo dot1x retry to restore the default. By default, the device sends an authentication request to a client twice at most. After the network access device sends an authentication request to a client, if the device receives no response from the client within the username request timeout timer (set with the dot1x timer tx-period txperiod-value command) or the client timeout timer (set with the dot1x timer supp-timeout supp-timeoutvalue command), the device retransmits the authentication request. The network access device stops retransmitting the request, if it has made the maximum number of request transmission attempts but still received no response. This command applies to all ports of the device. Related commands: display dot1x.
Syntax
dot1x retry max-retry-value undo dot1x retry
View
System view
Default level
2: System level
Parameters
max-retry-value: Specifies the maximum number of attempts for sending an authentication request to a client, in the range of 1 to 10.
Examples
# Set the maximum number of attempts for sending an authentication request to a client as 9.
<Sysname> system-view [Sysname] dot1x retry 9
dot1x supp-proxy-check
Description
Use dot1x supp-proxy-check to enable the proxy detection function and set the processing method on the specified ports or all ports.
119
Use undo dot1x supp-proxy-check to disable the function on the specified ports or all ports. By default, the proxy detection function is disabled. Users can use an authenticated 802.1X client as a network access proxy to bypass monitoring and accounting. This function requires the cooperation of the iNode client software. In system view: If you do not specify the interface-list argument, the command applies to all ports. If you specify the interface-list argument, the command applies to the specified ports.
In Ethernet port view, the interface-list argument is not available and the command applies to only the Ethernet port. The proxy detection function must be enabled both globally in system view and for the intended ports in system view or Ethernet interface view. Otherwise, it does not work. Related commands: display dot1x.
Syntax
In system view: dot1x supp-proxy-check { logoff | trap } [ interface interface-list ] undo dot1x supp-proxy-check { logoff | trap } [ interface interface-list ] In Ethernet interface view: dot1x supp-proxy-check { logoff | trap } undo dot1x supp-proxy-check { logoff | trap }
View
Default level
2: System level
Parameters
logoff: Logs off a user accessing the network through a proxy. trap: Sends a trap to the network management system when a user is detected accessing the network through a proxy. interface interface-list: Specifies an Ethernet port list, which can contain multiple Ethernet ports. The interface-list argument is in the format of interface-list = { interface-type interface-number [ to interfacetype interface-number ] } & <1-10>, where interface-type represents the port type, interface-number represents the port number, and & <1-10> means that you can provide up to 10 ports or port ranges. The start port number must be smaller than the end number and the two ports must be of the same type.
Examples
# Configure ports Ethernet 1/1 to 1/8 to log off users accessing the network through a proxy.
<Sysname> system-view [Sysname] dot1x supp-proxy-check logoff [Sysname] dot1x supp-proxy-check logoff interface ethernet 1/1 to ethernet 1/8
# Configure port Ethernet 1/9 to send a trap when a user is detected accessing the network through a proxy.
120
[Sysname] dot1x supp-proxy-check trap [Sysname] dot1x supp-proxy-check trap interface ethernet 1/9
Or
<Sysname> system-view [Sysname] dot1x supp-proxy-check trap [Sysname] interface ethernet 1/9 [Sysname-Ethernet1/9] dot1x supp-proxy-check trap
dot1x timer
Description
Use dot1x timer to set 802.1X timers. Use undo dot1x timer to restore the defaults. By default, the handshake timer is 15 seconds, the quiet timer is 60 seconds, the periodic reauthentication timer is 3600 seconds, the server timeout timer is 100 seconds, the client timeout timer is 30 seconds, and the username request timeout timer is 30 seconds. You can set the client timeout timer to a high value in a low-performance network, set the quiet timer to a high value in a vulnerable network or a low value for quicker authentication response, or adjust the server timeout timer to adapt to the performance of different authentication servers. In most cases, the default settings are sufficient. The network device uses the following 802.1X timers: Handshake timer (handshake-period)Sets the interval at which the access device sends client handshake requests to check the online status of a client that has passed authentication. If the device receives no response after sending the maximum number of handshake requests, it considers that the client has logged off. Quiet timer (quiet-period)Starts when a client fails authentication. The access device must wait the time period before it can process the authentication attempts from the client. Periodic re-authentication timer (reauth-period)Sets the interval at which the network device periodically re-authenticates online 802.1X users. To enable periodic online user re-authentication on a port, use the dot1x re-authenticate command. The change to the periodic re-authentication timer applies to the users that have been online only after the old timer expires. Server timeout timer (server-timeout)Starts when the access device sends a RADIUS AccessRequest packet to the authentication server. If no response is received when this timer expires, the access device retransmits the request to the server. Client timeout timer (supp-timeout)Starts when the access device sends an EAP-Request/MD5 Challenge packet to a client. If no response is received when this timer expires, the access device retransmits the request to the client. Username request timeout timer (tx-period)Starts when the device sends an EAP-Request/Identity packet to a client in response to an authentication request. If the device receives no response before this timer expires, it retransmits the request. The timer also sets the interval at which the network device sends multicast EAP-Request/Identity packets to detect clients that cannot actively request authentication.
Related commands: display dot1x.
121
Syntax
dot1x timer { handshake-period handshake-period-value | quiet-period quiet-period-value | reauthperiod reauth-period-value | server-timeout server-timeout-value | supp-timeout supp-timeout-value | txperiod tx-period-value } undo dot1x timer { handshake-period | quiet-period | reauth-period | server-timeout | supp-timeout | tx-period }
View
System view
Default level
2: System level
Parameters
handshake-period-value: Sets the handshake timer in seconds. It is in the range of 5 to 1024. quiet-period-value: Sets the quiet timer in seconds. It is in the range of 10 to 120. reauth-period-value: Sets the periodic re-authentication timer in seconds. It is in the range of 60 to 7200. server-timeout-value: Sets the server timeout timer in seconds. It is in the range of 100 to 300. supp-timeout-value: Sets the client timeout timer in seconds. It is in the range of 1 to 120. tx-period-value: Sets the username request timeout timer in seconds. It is in the range of 10 to 120.
Examples
# Set the server timeout timer to 150 seconds.
<Sysname> system-view [Sysname] dot1x timer server-timeout 150
dot1x unicast-trigger
Description
Use dot1x unicast-trigger to enable the 802.1X unicast trigger function. Use undo dot1x unicast-trigger to disable the function. By default, the unicast trigger function is disabled. The unicast trigger function enables the network access device to initiate 802.1X authentication when it receives a data frame from an unknown source MAC address. The device sends a unicast Identity EAP/Request packet to the unknown source MAC address, and retransmits the packet if it has received no response within a period of time (set with the dot1x timer tx-period command). This process continues until the maximum number of request attempts (set with the dot1x retry command) is reached. Related commands: display dot1x, dot1x timer supp-timeout, and dot1x retry.
Syntax
dot1x unicast-trigger undo dot1x unicast-trigger
View
122
Default level
2: System level
Parameters
None
Examples
# Enable the unicast trigger function for interface Ethernet 1/1.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] dot1x unicast-trigger
reset dot1x statistics

Description
Use reset dot1x statistics to clear 802.1X statistics. If a list of ports is specified, the command clears 802.1X statistics for all the specified ports. If no ports are specified, the command clears all 802.1X statistics. Related commands: display dot1x.
Syntax
reset dot1x statistics [ interface interface-list ]
View
User view
Default level
2: System level
Parameters
interface interface-list: Specifies an Ethernet port list, which can contain multiple Ethernet ports. The interface-list argument is in the format of interface-list = { interface-type interface-number [ to interfacetype interface-number ] } & <1-10>, where interface-type represents the port type, interface-number represents the port number, and & <1-10> means that you can provide up to 10 ports or port ranges. The start port number must be smaller than the end number and the two ports must be of the same type.
Examples
# Clear 802.1X statistics on port Ethernet 1/1.
<Sysname> reset dot1x statistics interface ethernet 1/1
123
EAD fast deployment configuration commands

dot1x free-ip
Description
Use dot1x free-ip to configure a free IP. Users can access the segment before passing 802.1X authentication. Use undo dot1x free-ip to remove the specified or all free IP addresses. By default, no free IP is configured. When global MAC authentication, Layer-2 portal authentication, or port security is enabled, the free IP does not take effect. You can configure up to 16 free IP addresses on your router. Related commands: display dot1x. The following table shows the command and router compatibility: Command
dot1x free-ip
MSR900
No
MSR20-1X
No
MSR20
No
MSR30
Only available on MSR3011E and MSR30-11F
MSR50
No
Syntax
dot1x free-ip ip-address { mask-address | mask-length } undo dot1x free-ip { ip-address { mask | mask-length } | all }
View
System view
Default level
2: System level
Parameters
ip-address: Specifies a freely accessible IP address segment, also called "a free IP." mask: Specifies an IP address mask. mask-length: Specifies IP address mask length. all: Removes all free IP addresses.
Examples
# Configure 192.168.0.0/24 as a free IP address.
<Sysname> system-view [Sysname] dot1x free-ip 192.168.0.0 24
124
dot1x timer ead-timeout

Description
Use dot1x timer ead-timeout to set the EAD rule timer. Use undo dot1x timer ead-timeout to restore the default. By default, the timer is 30 minutes. EAD fast deployment automatically creates an ACL rule, or EAD rule, to open access to the redirect URL for each redirected user seeking to access the network. The EAD rule timer sets the lifetime of each ACL rule. When the timer expires or the user passes authentication, the rule is removed. If users fail to download EAD client or pass authentication before the timer expires, they must reconnect to the network to access the free IP. To prevent ACL rule resources from being used up, you can shorten the timer when the amount of EAD users is large. Related commands: display dot1x. The following table shows the command and router compatibility: Command
dot1x timer eadtimeout
MSR900
No
MSR20-1X
No
MSR20
No
MSR30
Only available on MSR30-11E and MSR3011F
MSR50
No
Syntax
dot1x timer ead-timeout ead-timeout-value undo dot1x timer ead-timeout
View
System view
Default level
2: System level
Parameters
ead-timeout-value: Specifies the EAD rule timer in minutes. The value is in the range of 1 to 1440.
Examples
# Set the EAD rule timer to 5 minutes.
<Sysname> system-view [Sysname] dot1x timer ead-timeout 5
dot1x url
Description
Use dot1x url to configure a redirect URL. When a user uses a web browser to access networks other than the free IP, the device redirects the user to the redirect URL. Use undo dot1x url to remove the redirect URL. By default, no redirect URL is defined.
125
The redirect URL must be on the free IP subnet. If you configure the dot1x url command multiple times, the last configured URL takes effect. Related commands: display dot1x and dot1x free-ip. The following table shows the command and router compatibility: Command
dot1x url
MSR900
No
MSR20-1X
No
MSR20
No
MSR30
Only available on MSR3011E and MSR30-11F
MSR50
No
Syntax
dot1x url url-string undo dot1x url
View
System view
Default level
2: System level
Parameters
url-string: Specifies the redirect URL, a case-sensitive string of 1 to 64 characters in the format http://string.
Examples
# Configure the redirect URL as http://192.168.0.1.
<Sysname> system-view [Sysname] dot1x url http://192.168.0.1
126
MAC authentication configuration commands

display mac-authentication
Description
Use display mac-authentication to display MAC authentication settings and statistics, including the global settings, and port-specific settings and MAC authentication and online user statistics. If you specify a list of ports, the command displays port-specific settings and statistics only for the specified ports. If you do not specify any port, the command displays port-specific settings and statistics for all ports.
Syntax
display mac-authentication [ interface interface-list ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
2: System level
Parameters
interface interface-list: Specifies a port list, in the format of { interface-type interface-number [ to interfacetype interface-number ] }&<1-10>, where &<1-10> indicates that you can specify up to 10 port ranges. The start port and end port of a port range must be of the same type and the end port number must be greater than the start port number. A port range defined without the to interface-type interface-number portion comprises only one port. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display all MAC authentication settings and statistics.
<Sysname> display mac-authentication MAC address authentication is enabled. User name format is MAC address in lowercase, like xxxxxxxxxxxx Fixed username:mac Fixed password:not configured Offline detect period is 300s Quiet period is 60s. Server response timeout value is 100s the max allowed user number is 1024 per slot
127
Current user number amounts to 0 Current domain: not configured, use default domain Silent Mac User info: MAC Addr Ethernet1/1 is link-up MAC address authentication is enabled Authenticate success: 0, failed: 0 Max number of on-line users is 128 Current online user number is 0 MAC Addr Authenticate state AuthIndex From Port Port Index
(output omitted) Table 10 Output description Field

MAC address authentication is enabled
Description
Whether MAC authentication is enabled Type of user account, which can be MAC-based or shared.
If MAC-based accounts are used, this field displays User

User name format is MAC address in lowercase, like xxxxxxxxxxxx name format is MAC address and the format settings for usernames and passwords. For example, MAC addresses without hyphens in lower case.
If a shared account is used, this field displays "User

name format is fixed account." Fixed username: Username of the shared account for MAC authentication users. If MAC-based accounts are used, this field displays mac. Password of the shared account for MAC authentication users. If MAC-based accounts are used, this field displays not configured. Setting of the offline detect timer Setting of the quiet timer Setting of the server timeout timer Maximum number of users each slot supports Number of online users Authentication domain that is currently used Information about silent MAC addresses. A MAC address is marked silent when it fails a MAC authentication, and at the same time, a quiet timer starts. Before the timer expires, the device drops any packet from the MAC address and does not perform MAC authentication for the MAC address. Status of the link on port Ethernet 1/1. In this example, the link is up. Whether MAC authentication is enabled on port Ethernet 1/1.
Fixed password: Offline detect period Quiet period Server response timeout value the max allowed user number Current user number amounts to Current domain: not configured, use default domain
Silent Mac User info
Ethernet1/1 is link-up MAC address authentication is enabled
128
Field
Authenticate success: 0, failed: 0
Description
MAC authentication statistics, including the number of successful and unsuccessful authentication attempts Maximum number of concurrent online users allowed on the port. If MAC authentication is not enabled on the port, the field displays 0. Number of online users on the port. MAC address of the online user. User status. Possible values include the following:
Max number of on-line users
Current online user number MAC Addr
MAC_AUTHENTICATOR_CONNECTThe user is
logging in.
MAC_AUTHENTICATOR_SUCCESSThe user has

Authenticate state passed the authentication.
MAC_AUTHENTICATOR_FAILThe user failed the

authentication.
MAC_AUTHENTICATOR_LOGOFFThe user has logged

off. AuthIndex Authenticator index.
mac-authentication
Description
Use mac-authentication command in system view to enable MAC authentication globally. Use mac-authentication interface interface-list in system view to enable MAC authentication on a list of ports, or the mac-authentication command in interface view to enable MAC authentication on a port. Use undo mac-authentication command in system view to disable MAC authentication globally. Use undo mac-authentication interface interface-list in system view to disable MAC authentication on a list of ports, or the undo mac-authentication in interface view to disable MAC authentication on a port. By default, MAC authentication is not enabled globally or on any port. To use MAC authentication on a port, you must enable the function both globally and on the port.
Syntax
In system view: mac-authentication [ interface interface-list ] undo mac-authentication [ interface interface-list ] In Ethernet interface view: mac-authentication undo mac-authentication
View
129
Default level
2: System level
Parameters
interface interface-list: Specifies an Ethernet port list, in the format of { interface-type interface-number [ to interface-type interface-number ] }&<1-10>, where &<1-10> indicates that you can specify up to 10 port ranges. The start port and end port of a port range must be of the same type and the end port number must be greater than the start port number. A port range defined without the to interface-type interfacenumber portion comprises only one port.
Examples
# Enable MAC authentication globally.
<Sysname> system-view [Sysname] mac-authentication Mac-auth is enabled globally.
# Enable MAC authentication on port Ethernet 1/1.

<Sysname> system-view [Sysname] mac-authentication interface Ethernet 1/1 Mac-auth is enabled on port Ethernet1/1.
Or
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] mac-authentication Mac-auth is enabled on port Ethernet1/1.
mac-authentication domain
Description
Use mac-authentication domain to specify a global authentication domain in system view or a port specific authentication domain in interface view for MAC authentication users. Use undo mac-authentication domain to restore the default. By default, the default authentication domain is used for MAC authentication users. For more information about the default authentication domain, see the domain default enable command in the chapter AAA configuration commands. The global authentication domain is applicable to all MAC authentication enabled ports. A port specific authentication domain is applicable only to the port. You can specify different authentication domains on different ports. A port chooses an authentication domain for MAC authentication users in this order: port specific domain, global domain, and the default authentication domain. Related commands: display mac-authentication.
Syntax
mac-authentication domain domain-name undo mac-authentication domain
130
View
System view, interface view
Default level
2: System level
Parameters
domain-name: Specifies an authentication domain by its name. The domain name takes a case-insensitive string of 1 to 24 characters. The domain name cannot contain any forward slash (/), colon (:), asterisk (*), question mark (?), less-than sign (<), greater-than sign (>), or at sign (@).
Examples
# Specify the domain1 domain as the global authentication domain for MAC authentication users.
<Sysname> system-view [Sysname] mac-authentication domain domain1
# Specify the aabbcc domain as the authentication domain for MAC authentication users on port Ethernet 1/1.
[Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] mac-authentication domain aabbcc
mac-authentication max-user
Description
Use mac-authentication max-user to set the maximum number of concurrent MAC authentication users on a port. Use undo mac-authentication max-user to restore the default. By default, the maximum number of concurrent MAC authentication users on a port is 256.
Syntax
mac-authentication max-user user-number undo mac-authentication max-user
View
Interface view
Default level
2: System level
Parameters
user-number: Specifies a maximum number of concurrent MAC authentication users on the port. The value is in the range of 1 to 256.
Examples
# Configure port Ethernet 1/1 to support up to 32 concurrent MAC authentication users.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] mac-authentication max-user 32
131
mac-authentication timer
Description
Use mac-authentication timer to set the MAC authentication timers. Use undo mac-authentication timer to restore the defaults. By default, the offline detect timer is 300 seconds, the quiet timer is 60 seconds, and the server timeout timer is 100 seconds. Related commands: display mac-authentication.
Syntax
mac-authentication timer { offline-detect offline-detect-value | quiet quiet-value | server-timeout servertimeout-value } undo mac-authentication timer { offline-detect | quiet | server-timeout }
View
System view
Default level
2: System level
Parameters
offline-detect offline-detect-value: Sets the offline detect timer, in the range of 60 to 65535 seconds. This timer sets the interval that the device waits for traffic from a user before it regards the user idle. If a user connection has been idle for two consecutive intervals, the device logs the user out and stops accounting for the user. quiet quiet-value: Sets the quiet timer, in the range of 1 to 3600 seconds. This timer sets the interval that the device must wait before it can perform MAC authentication for a user that has failed MAC authentication. All packets from the MAC address are dropped during the quiet time. This quiet mechanism prevents repeated authentication from affecting system performance. server-timeout server-timeout-value: Sets the server timeout timer in seconds, in the range of 100 to 300. This timer sets the interval that the access device waits for a response from a RADIUS server before it regards the RADIUS server unavailable. If the timer expires during MAC authentication, the user cannot access the network.
Examples
# Set the server timeout timer to 150 seconds.
<Sysname> system-view [Sysname] mac-authentication timer server-timeout 150
mac-authentication user-name-format
Description
Use mac-authentication user-name-format to configure the type of user accounts for MAC authentication users. Use undo mac-authentication user-name-format to restore the default. By default, each user's MAC address is used as the username and password for MAC authentication, and letters must be input in lower case without hyphens.
132
MAC authentication supports the following types of user account: One MAC-based user account for each user. A user can pass MAC authentication only when its MAC address matches a MAC-based user account. This approach is suitable for an insecure environment. One shared user account for all users. Any user can pass MAC authentication on any MAC authentication enabled port. You can use this approach in a secure environment to limit network resources accessible to MAC authentication users, for example, by assigning an authorized ACL or VLAN for the shared account.
Related commands: display mac-authentication.
Syntax
mac-authentication user-name-format { fixed [ account name ] [ password { cipher | simple } password ] | mac-address [ { with-hyphen | without-hyphen } [ lowercase | uppercase ] ] } undo mac-authentication user-name-format
View
System view
Default level
2: System level
Parameters
fixed: Uses a shared account for all MAC authentication users. account name: Specifies the username for the shared account. The name takes a case-insensitive string of 1 to 55 characters. If no username is specified, the default name mac applies. password { cipher | simple } password: Specifies the password for the shared user account: The cipher option specifies an encrypted password, which is saved in cipher text. You can input 1 to 63 characters in plain text, or 24 or 88 characters in cipher text, for the password. If you input no more than 16 characters in plain text, the string is encrypted into a 24-character password. If you input 16 to 63 characters in plain text, the string is encrypted into an 88-character password. The system treats a 24-character password as a cipher text password, if it can decrypt the password. If not, the system treats the password as a plain text password. The simple option specifies a plain text password. You can type a password of 1 to 63 characters only in plain text. The password is saved in plain text.
mac-address: Uses MAC-based user accounts for MAC authentication users. If this option is specified, you must create one user account for each user, and use the MAC address of the user as both the username and password for the account. You can also specify the format of username and password: with-hyphenHyphenates the MAC address, for example xx-xx-xx-xx-xx-xx. without-hyphenExcludes hyphens from the MAC address, for example, xxxxxxxxxxxx. lowercaseInputs letters in lower case. uppercaseCapitalizes letters.
Examples
# Configure a shared account for MAC authentication users: set the username as abc and password as xyz, and display the password in plain text.
<Sysname> system-view [Sysname] mac-authentication user-name-format fixed account abc password simple xyz
133
[Sysname] display this # mac-authentication user-name-format fixed account abc password simple xyz #
# Configure a shared account for MAC authentication users: set the username as abc and password as xyz, and display the password in cipher text.
<Sysname> system-view [Sysname] mac-authentication user-name-format fixed account abc password cipher xyz [Sysname] display this # mac-authentication user-name-format fixed account abc password cipher 5Q4$,*^18 N'Q=^Q`MAF4<1!! #
# Configure a shared account for MAC authentication users: set the username as abc and password as 5Q4$,*^18N'Q=^Q`MAF4<1!!, and display the password in cipher text.
<Sysname> system-view [Sysname] mac-authentication user-name-format fixed account abc password cipher 5Q4$,*^18 N'Q=^Q`MAF4<1!!
# Use MAC-based user accounts for MAC authentication users, and each MAC address must be hyphenated, and in upper case.
<Sysname> system-view [Sysname] mac-authentication user-name-format mac-address with-hyphen uppercase
reset mac-authentication statistics

Description
Use reset mac-authentication statistics to clear MAC authentication statistics. If no port list is specified, the command clears all global and port-specific MAC authentication statistics. If a port list is specified, the command clears the MAC authentication statistics on the specified ports. Related commands: display mac-authentication.
Syntax
reset mac-authentication statistics [ interface interface-list ]
View
User view
Default level
2: System level
Parameters
interface interface-list: Specifies a port list, in the format of { interface-type interface-number [ to interfacetype interface-number ] }&<1-10>, where &<1-10> indicates that you can specify up to 10 port ranges. The start port and end port of a port range must be of the same type and the end port number must be greater than the start port number. A port range defined without the to interface-type interface-number portion comprises only one port.
134
Examples
# Clear MAC authentication statistics on port Ethernet 1/1.
<Sysname> reset mac-authentication statistics interface ethernet 1/1
135
Port security configuration commands

display port-security
Description
Use display port-security to display port security configuration information, operation information, and statistics for one or more ports. If the interface interface-list parameter is not provided, the command displays port security information, operation information, and status about all ports. Related commands: port-security enable, port-security port-mode, port-security ntk-mode, port-security intrusion-mode, port-security max-mac-count, port-security mac-address security, port-security authorization ignore, port-security oui, and port-security trap.
Syntax
display port-security [ interface interface-list ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
2: System level
Parameters
interface interface-list: Specifies Ethernet ports by an Ethernet port list in the format of { interface-type interface-number [ to interface-type interface-number ] }&<1-10>, where &<1-10> means that you can specify up to 10 ports or port ranges. The starting port and ending port of a port range must be of the same type, and the ending port number must be greater than the starting port number. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, case-sensitive string of 1 to 256 characters.
Examples
# Display port security configuration information, operation information, and statistics about all ports.
<Sysname> display port-security Equipment port-security is enabled Trap is enabled AutoLearn aging time is 1 minutes Disableport Timeout: 20s OUI value: Index is 1, Index is 2, OUI value is 000d1a OUI value is 003c12
136
GigabitEthernet1/1 is link-down Port mode is userLoginWithOUI NeedToKnow mode is NeedToKnowOnly Intrusion Portection mode is disableport-temporarily Max MAC address number is 50 Stored MAC address number is 0 Authorization is ignored GigabitEthernet1/2 is link-down Port mode is noRestriction NeedToKnow mode is disabled Intrusion mode is NoAction Max MAC address number is not configured Stored MAC address number is 0 Authorization is permitted

Equipment port-security Trap
Description
Whether the port security is enabled or not. Whether trapping for MAC address learning is enabled or not. If it is enabled, the port sends trap information after it learns a new MAC address. Sticky MAC aging timer. The timer applies to all automatically learned or manually configured sticky MAC addresses. Silence timeout period of the port that receives illegal packets, in seconds. List of OUI values allowed Port security mode, which can be one of the following modes:
AutoLearn aging time Disableport Timeout OUI value
Port mode
autoLearn macAddressWithRadius macAddressElseUserLoginSecure macAddressElseUserLoginSecureExt secure userLogin userLoginSecure userLoginSecureExt macAddressOrUserLoginSecure macAddressOrUserLoginSecureExt userLoginWithOUI presharedKey macAddressAndPresharedKey userLoginSecureExtOrPresharedKey
137
Field
Description
NTK mode, which can be one of the following modes:
NeedToKnowOnly: Allows only unicast packets with authenticated

destination MAC addresses. NeedToKnow mode
NeedToKnowWithBroadcast: Allows only unicast packets and

broadcasts with authenticated destination MAC addresses.
NeedToKnowWithMulticast: Allows unicast packets, multicasts and

broadcasts with authenticated destination MAC addresses. Intrusion protection action mode, which can be one of the following modes:
BlockMacAddress: Adds the source MAC address of the illegal

Intrusion mode packet to the blocked MAC address list.
DisablePortTemporarily: Shuts down the port that receives illegal

packets for some time.
NoAction: Performs no intrusion protection.

Max MAC address number Stored MAC address number Maximum number of MAC addresses that port security allows on the port. Number of MAC addresses stored Whether the authorization information from the server is ignored or not:
permitted: Authorization information from the RADIUS server takes

Authorization effect.
ignored: Authorization information from the RADIUS server does not

take effect.
display port-security mac-address block

Description
Use display port-security mac-address block to display information about blocked MAC addresses. With no keyword or argument specified, the command displays information about all blocked MAC addresses. Related commands: port-security intrusion-mode.
Syntax
display port-security mac-address block [ interface interface-type interface-number ] [ vlan vlan-id ] [ count ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
2: System level
Parameters
interface interface-type interface-number: Specifies a port by its type and number. vlan vlan-id: Specifies a VLAN by its ID, in the range of 1 to 4094. count: Displays only the count of the blocked MAC addresses.
138
|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, case-sensitive string of 1 to 256 characters.
Examples
# Display information about all blocked MAC addresses.
<Sysname> display port-security mac-address block MAC ADDR 0002-0002-0002 000d-88f8-0577 --From Port Ethernet1/1 Ethernet1/1 --VLAN ID 1 1
2 mac address(es) found
# Display the count of all blocked MAC addresses.

<Sysname> display port-security mac-address block count --- 2 mac address(es) found ---
# Display information about all blocked MAC addresses of port Ethernet 1/1.
<Sysname> display port-security mac-address block interface ethernet1/1 MAC ADDR 000d-88f8-0577 --From Port Ethernet1/1 --VLAN ID 1
# Display information about all blocked MAC addresses of port Ethernet 1/1 in VLAN 1.
<Sysname> display port-security mac-address block interface ethernet 1/1 vlan 1 MAC ADDR 000d-88f8-0577 --From Port Ethernet1/1 --VLAN ID 1

MAC ADDR From Port VLAN ID x mac address(es) found
Description
Blocked MAC address Port having received frames with the blocked MAC address being the source address ID of the VLAN to which the port belongs Number of blocked MAC addresses
139
display port-security mac-address security

Description
Use display port-security mac-address security to display information about secure MAC addresses. Secure MAC addresses are those that are automatically learned by the port in autoLearn mode or configured by the port-security mac-address security command. With no keyword or argument specified, the command displays information about all secure MAC addresses. Related commands: port-security mac-address security.
Syntax
display port-security mac-address security [ interface interface-type interface-number ] [ vlan vlan-id ] [ count ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
2: System level
Parameters
interface interface-type interface-number: Specifies a port by its type and number. vlan vlan-id: Specifies a VLAN by its ID, in the range of 1 to 4094. count: Displays only the count of the secure MAC addresses. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, case-sensitive string of 1 to 256 characters.
Examples
# Display information about all secure MAC addresses.
<Sysname> display port-security mac-address security MAC ADDR 0002-0002-0002 000d-88f8-0577 --VLAN ID 1 1 STATE Security Security --PORT INDEX Ethernet1/1 Ethernet1/1 AGING TIME(s) NOAGED NOAGED
# Display only the count of the secure MAC addresses.

<Sysname> display port-security mac-address security count 2 mac address(es) found
# Display information about secure MAC addresses in VLAN 1.

<Sysname> display port-security mac-address security vlan 1 MAC ADDR 0002-0002-0002 VLAN ID 1 STATE Security PORT INDEX Ethernet1/1 AGING TIME(s) NOAGED
140
000d-88f8-0577 ---
Security ---
Ethernet1/1
NOAGED
# Display information about secure MAC addresses on port Ethernet 1/1.

<Sysname> display port-security mac-address security interface ethernet1/1 MAC ADDR 000d-88f8-0577 --VLAN ID 1 STATE Security --PORT INDEX Ethernet1/1 AGING TIME(s) NOAGED
# Display information about secure MAC addresses of port Ethernet 1/1 in VLAN 1.
<Sysname> display port-security mac-address security interface ethernet 1/1 vlan 1 MAC ADDR 000d-88f8-0577 --VLAN ID 1 STATE Security --PORT INDEX Ethernet1/1 AGING TIME(s) NOAGED

MAC ADDR VLAN ID STATE PORT INDEX AGING TIME(s) x mac address(es) found
Description
Secure MAC address ID of the VLAN to which the port belongs Type of the MAC address added. "Security" means it is a secure MAC address. Port to which the secure MAC address belongs Period of time before the secure MAC address ages out. "NOAGED" is displayed for secure MAC addresses. Number of secure MAC addresses stored
display port-security preshared-key user

Description
Use display port-security preshared-key user to display information about PSK users on a specific port or all PSK users. If the interface interface-type interface-number parameters are not provided, the command displays information about PSK users on all ports.
Syntax
display port-security preshared-key user [ interface interface-type interface-number ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
2: System level
141
Parameters
interface interface-type interface-number: Specifies a port by its type and number. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, case-sensitive string of 1 to 256 characters.
Examples
# Display information about PSK users on all ports.
<Sysname> display port-security preshared-key user Index 0 1 Mac-Address 0000-1122-3344 0000-1133-2244 VlanID 1 2 Interface wlan-bss-1 wlan-bss-2 -----------------------------------------------------
# Display information about PSK users on WLAN port WLAN-BSS 1.

<Sysname> display port-security preshared-key user interface wlan-bss 1 Index 0 Mac-Address 0000-1122-3344 VlanID 1 Interface wlan-bss-1 -----------------------------------------------------

Index Mac-Address VlanID Interface
Description
Index of the user MAC address of the user VLAN ID of the user Port that the user accesses
port-security authorization ignore

Description
Use port-security authorization ignore to configure a port to ignore the authorization information from the RADIUS server. Use undo port-security authorization ignore to restore the default. By default, a port uses the authorization information from the RADIUS server. After a user passes RADIUS authentication, the RADIUS server performs authorization based on the authorization attributes configured for the users account. For example, it may assign a VLAN. Related commands: display port-security.
Syntax
port-security authorization ignore
142
undo port-security authorization ignore
View
Ethernet interface view, WLAN-Ethernet interface view, WLAN-BSS interface view
Default level
2: System level
Parameters
None
Examples
# Configure port GigabitEthernet 1/1 to ignore the authorization information from the RADIUS server.
<Sysname> system-view [Sysname] interface gigabitethernet 1/1 [Sysname-GigabitEthernet1/1] port-security authorization ignore
port-security enable
Description
Use port-security enable to enable port security. Use undo port-security enable to disable port security. By default, port security is disabled. You must disable global 802.1X and MAC authentication before you enable port security on a port. Enabling or disabling port security resets the following security settings to the default: 802.1X access control mode is MAC-based, and the port authorization state is auto. Port security mode is noRestrictions.
When port security is enabled, you cannot manually enable 802.1X or MAC authentication, or change the access control mode or port authorization state. The port security automatically modifies these settings in different security modes. You cannot disable port security when online users are present. Related commands: display port-security, dot1x, dot1x port-method, dot1x port-control, and macauthentication.
Syntax
port-security enable undo port-security enable
View
System view
Default level
2: System level
Parameters
None
143
Examples
# Enable port security.
<Sysname> system-view [Sysname] port-security enable
port-security intrusion-mode
Description
Use port-security intrusion-mode to configure the intrusion protection feature so that the port takes the pre-defined actions when intrusion protection is triggered on the port. Use undo port-security intrusion-mode to restore the default. By default, intrusion protection is disabled. To restore the connection of the port, use the undo shutdown command. Related commands: display port-security, display port-security mac-address block, and port-security timer disableport.
Syntax
port-security intrusion-mode { blockmac | disableport-temporarily } undo port-security intrusion-mode
View
Layer 2 Ethernet interface view, WLAN-BSS interface view
Default level
2: System level
Parameters
blockmac: Adds the source MAC addresses of illegal frames to the blocked MAC address list and discards frames with blocked source MAC addresses. This implements illegal traffic filtering on the port. A blocked MAC address is restored to normal after being blocked for three minutes, which is fixed and cannot be changed. To view the blocked MAC address list, use the display port-security mac-address block command. disableport-temporarily: Disables the port for a specific period of time whenever it receives an illegal frame. Use port-security timer disableport to set the period.
Examples
# Configure port GigabitEthernet 1/1 to block the source MAC addresses of illegal frames after intrusion protection is triggered.
<Sysname> system-view [Sysname] interface gigabitethernet 1/1 [Sysname-GigabitEthernet1/1] port-security intrusion-mode blockmac
port-security mac-address security

Description
Use port-security mac-address security to add a secure MAC address in Layer 2 Ethernet interface view or system view.
144
Use undo port-security mac-address security to remove a secure MAC address in system view. By default, no secure MAC address entry is configured. Secure MAC addresses are MAC addresses configured or learned in autoLearn mode. They can survive link down/up events, and once saved, can survive a device reboot. You can bind a MAC address to only one port in a VLAN. When a port is operating in autoLearn mode, you can add important or frequently used MAC addresses as sticky or static secure MAC addresses to avoid the secure MAC address limit causing authentication failure. Static secure MAC addresses never age out unless you remove them by using the undo port-security macaddress security command, changing the port security mode, or disabling the port security feature. Dynamic secure MAC addresses, also called "sticky MAC addresses," can by manually configured or dynamically learned in autoLearn mode. Sticky MAC addresses do not age out by default. You can use the port-security timer autolearn aging to set an aging timer for them. When the timer expires, the sticky MAC addresses are removed. NOTE: You cannot change the type of a secure address entry that has been added or add two entries that are identical
except for their entry type. For example, you cannot add the port-security mac-address security sticky 1-1-1 vlan 10 entry when a port-security mac-address security 1-1-1 vlan 10 entry exists. To add the new entry, you must delete the old entry.
To enable port security on a port, use the port-security enable command, and to set the port in autoLearn
mode, use the port-security port-mode autolearn command.
Related commands: display port-security and port-security timer autolearn aging.
Syntax
In Layer 2 Ethernet interface view: port-security mac-address security [ sticky ] mac-address vlan vlan-id In system view: port-security mac-address security [ sticky ] mac-address interface interface-type interface-number vlan vlan-id undo port-security mac-address security [ [ mac-address [ interface interface-type interface-number ] ] vlan vlan-id ]
View
Layer 2 Ethernet interface view, system view
Default level
2: System level
Parameters
sticky: Specifies a sticky MAC address. If you do not provide this keyword, the command configures a static secure MAC address. mac-address: Secure MAC address, in the H-H-H format. interface interface-type interface-number: Specifies a Layer 2 Ethernet port by its type and number.
145
vlan vlan-id: Specifies the VLAN that has the secure MAC address. The vlan-id argument represents the ID of the VLAN in the range of 1 to 4094. Make sure that you have assigned the Layer 2 port to the specified VLAN.
Examples
# Enable port security, set port GigabitEthernet 1/1 in autoLearn mode, and add a static secure MAC address 0001-0001-0002 in VLAN 10.
<Sysname> system-view [Sysname] port-security enable [Sysname] interface gigabitethernet 1/1 [Sysname-GigabitEthernet1/1] port-security max-mac-count 100 [Sysname-GigabitEthernet1/1] port-security port-mode autolearn [Sysname-GigabitEthernet1/1] quit [Sysname] port-security mac-address security 0001-0001-0002 interface gigabitethernet 1/1 vlan 10
# Enable port security, set port GigabitEthernet 1/1 in autoLearn mode, and add a sticky MAC address 0001-0002-0003 in VLAN 4 in interface view.
<Sysname> system-view [Sysname] port-security enable [Sysname] interface gigabitethernet 1/1 [Sysname-GigabitEthernet1/1] port-security max-mac-count 100 [Sysname-GigabitEthernet1/1] port-security port-mode autolearn [Sysname-GigabitEthernet1/1] port-security mac-address security 0001-0002-0003 vlan 4
port-security max-mac-count
Description
Use port-security max-mac-count to set the maximum number of MAC addresses that port security allows on a port. Use undo port-security max-mac-count to restore the default setting. By default, port security has no limit on the number of MAC addresses on a port. In autoLearn mode, this command sets the maximum number of secure MAC addresses (both configured and automatically learned) on the port. In any other mode that enables 802.1X, MAC authentication, or both, this command sets the maximum number of authenticated MAC addresses on the port. The actual maximum number of concurrent users that the port accepts equals this limit or the authentication methods limit on the number of concurrent users, whichever is smaller. For example, in userLoginSecureExt mode, if 802.1X allows less concurrent users than port securitys limit on the number of MAC addresses, port securitys limit takes effect. You cannot change port securitys limit on the number of MAC addresses when the port is operating in autoLearn mode or is a wireless port that has online users. Related commands: display port-security.
Syntax
port-security max-mac-count count-value undo port-security max-mac-count
146
View
Ethernet interface view, WLAN-Ethernet interface view, WLAN-BSS interface view
Default level
2: System level
Parameters
count-value: Specifies the maximum number of MAC addresses that port security allows on the port. The value is in the range of 1 to 1024.
Examples
# Set port securitys limit on the number of MAC addresses to 100 on port GigabitEthernet 1/1.
<Sysname> system-view [Sysname] interface gigabitethernet 1/1 [Sysname-GigabitEthernet1/1] port-security max-mac-count 100
port-security ntk-mode
Description
Use port-security ntk-mode to configure the NTK feature. Use undo port-security ntk-mode to restore the default. By default, NTK is disabled on a port and all frames are allowed to be sent. The NTK feature checks the destination MAC addresses in outbound frames to allow frames to be sent to only devices passing authentication, preventing illegal devices from intercepting network traffic. If a wireless port has online users, you cannot change its NTK settings. Related commands: display port-security.
Syntax
port-security ntk-mode { ntk-withbroadcasts | ntk-withmulticasts | ntkonly } undo port-security ntk-mode
View
Ethernet interface view, WLAN-BSS interface view
Default level
2: System level
Parameters
ntk-withbroadcasts: Forwards only broadcast frames and unicast frames with authenticated destination MAC addresses. ntk-withmulticasts: Forwards only broadcast frames, multicast frames, and unicast frames with authenticated destination MAC addresses. ntkonly: Forwards only unicast frames with authenticated destination MAC addresses.
Examples
# Set the NTK mode of port GigabitEthernet 1/1 to ntkonly, allowing the port to forward received packets to only devices passing authentication.
147
[Sysname] interface gigabitethernet 1/1 [Sysname-GigabitEthernet1/1] port-security ntk-mode ntkonly
port-security oui
Description
Use port-security oui to configure an OUI value for user authentication. This value is used when the port security mode is userLoginWithOUI. Use undo port-security oui to delete the OUI value with the specified OUI index. By default, no OUI value is configured. An OUI, the first 24 binary bits of a MAC address, is assigned by IEEE to uniquely identify a device vendor. Use this command when you configure a device to allow packets from certain wired devices to pass authentication or to allow packets from certain wireless devices to initiate authentication. For example, when a company allows only IP phones of vendor A in the Intranet, use this to set the OUI of vendor A. Related commands: display port-security.
Syntax
port-security oui oui-value index index-value undo port-security oui index index-value
View
System view
Default level
2: System level
Parameters
oui-value: Specifies an OUI string, a 48-bit MAC address in the H-H-H format. The system uses only the 24 high-order bits as the OUI value. index-value: Specifies the OUI index, in the range of 1 to 16.
Examples
# Configure an OUI value of 000d2a, setting the index to 4.
<Sysname> system-view [Sysname] port-security oui 000d-2a10-0033 index 4
port-security port-mode
Description
IMPORTANT: If you are configuring the autoLearn mode, first set port securitys limit on the number of MAC addresses by using the port-security max-mac-count command. You cannot change the setting when the port is operating in autoLearn mode. Use port-security port-mode to set the port security mode of a port.
148
Use undo port-security port-mode to restore the default. By default, a port operates in noRestrictions mode, where port security does not take effect. To change the security mode of a port security enabled port, you must set the port in noRestictions mode first. When the port has online users, you cannot change port security mode. When port security is enabled, you cannot manually enable 802.1X or MAC authentication, or change the access control mode or port authorization state. The port security automatically modifies these settings in different security modes. The support of ports for security modes varies: The presharedKey, macAddressAndPresharedKey, and userlLoginSecureExtOrPresharedKey modes apply to only WLAN-BSS and WLAN-Ethernet ports. The autoLearn, secure, and userLogin modes apply to only Layer 2 Ethernet ports. The userloginWithOUI mode applies to only Layer 2 Ethernet ports.
Table 15 Port security modes supported by different types of ports Port type Supported security modes
autolearn, mac-authentication, mac-else-userlogin-secure, mac-else-userloginsecure-ext, secure, userlogin, userlogin-secure, userlogin-secure-ext, userloginsecure-or-mac, userlogin-secure-or-mac-ext, userlogin-withoui For the autoLearn, secure, and userLogin modes support on Layer 2 Ethernet ports for your router, see the compatibility table. WLAN-BSS mac-and-psk, mac-authentication, mac-else-userlogin-secure, mac-else-userloginsecure-ext, psk, userlogin-secure, userlogin-secure-ext, userlogin-secure-ext-or-psk, userlogin-secure-or-mac, userlogin-secure-or-mac-ext mac-and-psk, mac-authentication, mac-else-userlogin-secure, mac-else-userloginsecure-ext, psk, userlogin-secure, userlogin-secure-ext, userlogin-secure-ext-or-psk, userlogin-secure-or-mac, userlogin-secure-or-mac-ext
Layer 2 Ethernet port
WLAN-Ethernet port
The following table shows the autoLearn, secure and userLogin modes on Layer 2 Ethernet ports and router compatibility: Keyword
autolearn
MSR900
No
MSR20-1X
No
MSR20
No
MSR30
Only available on MSR30-11E and MSR30-11F routers Only available on MSR30-11E and MSR30-11F routers Only available on other MSR30 series with FSW modules installed
MSR50
No
secure
No
No
No
No Only available on MSR50 routers with FSW modules installed
userlogin
Yes
Yes
Yes
Related commands: display port-security.
Syntax
port-security port-mode { autolearn | mac-and-psk | mac-authentication | mac-else-userlogin-secure | mac-else-userlogin-secure-ext | psk | secure | userlogin | userlogin-secure | userlogin-secure-ext |
149
userlogin-secure-ext-or-psk | userlogin-secure-or-mac | userlogin-secure-or-mac-ext | userlogin-withoui } undo port-security port-mode
View
Interface view
Default level
2: System level
Parameters
Keyword Security mode Description
In this mode, a port can learn MAC addresses, and allows frames sourced from learned or configured the MAC addresses to pass. These dynamically learned MAC addresses are secure MAC addresses. You can also configure secure MAC addresses by using the portsecurity mac-address security command. A secure MAC address never ages out by default. In addition, you can configure MAC addresses manually by using the macaddress dynamic and mac-address static commands for a port in autoLearn mode. When the number of secure MAC addresses reaches the upper limit set by the port-security max-mac-count command, the port changes to secure mode. macAddressAndPres haredKey macAddressWithRad ius In this mode, a user must pass MAC authentication and then use the pre-configured PSK to negotiate with the device. Only when the negotiation succeeds, can the user access the device. In this mode, a port performs MAC authentication for users and services multiple users. This mode is the combination of the macAddressWithRadius and userLoginSecure modes, with MAC authentication having a higher priority. mac-else-userloginsecure macAddressElseUserL oginSecure
Autolearn
autoLearn
mac-and-psk
mac-authentication
Upon receiving a non-802.1X frame, a port in this

mode performs only MAC authentication.
Upon receiving an 802.1X frame, the port performs

MAC authentication and then, if MAC authentication fails, 802.1X authentication. mac-else-userloginsecure-ext macAddressElseUserL oginSecureExt Similar to the macAddressElseUserLoginSecure mode except that a port in this mode supports multiple 802.1X and MAC authentication users. In this mode, a user must use a pre-configured static key, also called "the PSK," to negotiate with the device and can access the port only after the negotiation succeeds.
Psk
presharedKey
150
Keyword
Security mode
Description
In this mode, MAC address learning is disabled on the port and you can configure MAC addresses by using the mac-address static and mac-address dynamic commands. The port permits only frames sourced from secure MAC addresses and MAC addresses you manually configured by using the mac-address static and mac-address dynamic commands. In this mode, a port performs 802.1X authentication and implements port-based access control.
Secure
secure
Userlogin
userLogin
If one 802.1X user passes authentication, all the other 802.1X users of the port can access the network without authentication. In this mode, a port performs 802.1X authentication and implements MAC-based access control. It services only one user passing 802.1X authentication. Similar to the userLoginSecure mode except that this mode supports multiple online 802.1X users. In this mode, a user interacts with the device, choosing to undergo UserLoginSecure mode or use the PSK to negotiate with the device. This mode is the combination of the userLoginSecure and macAddressWithRadius modes.
userlogin-secure
userLoginSecure
userlogin-secure-ext userlogin-secure-ext-orpsk
userLoginSecureExt userLoginSecureExtO rPresharedKey
For wired users, the port performs MAC

userlogin-secure-or-mac macAddressOrUserL oginSecure authentication upon receiving non-802.1X frames and performs 802.1X authentication upon receiving 802.1X frames.
For wireless users, the port performs 802.1X

authentication first. If 802.1X authentication fails, MAC authentication is performed. userlogin-secure-ormac-ext macAddressOrUserL oginSecureExt Similar to the macAddressOrUserLoginSecure mode except that a port in this mode supports multiple 802.1X and MAC authentication users. Similar to the userLoginSecure mode. In addition, a port in this mode also permits frames from a user whose MAC address contains a specific OUI.
For wired users, the port performs 802.1X

userlogin-withoui userLoginWithOUI authentication upon receiving 802.1X frames, and performs OUI check upon receiving non-802.1X frames.
For wireless users, the port performs OUI check at

first. If the OUI check fails, the port performs 802.1X authentication.
Examples
# Enable port security and set port GigabitEthernet 1/1 in secure mode.
<Sysname> system-view [Sysname] port-security enable
151
[Sysname] interface gigabitethernet 1/1 [Sysname-GigabitEthernet1/1] port-security port-mode secure
# Change the port security mode of port GigabitEthernet 1/1 to userLogin.

[Sysname-GigabitEthernet1/1] undo port-security port-mode [Sysname-GigabitEthernet1/1] port-security port-mode userlogin
# Set WLAN port WLAN-BSS 1 to operate in secure mode.

<Sysname> system-view [Sysname] interface wlan-bss 1 [Sysname-WLAN-BSS1] port-security port-mode secure
port-security timer autolearn aging

Description
Use port-security timer autolearn aging to set the sticky MAC aging timer. The timer applies to all automatically learned or manually configured sticky MAC addresses. Use undo port-security timer autolearn to restore the default. By default, sticky MAC addresses never age out. Related commands: display port-security and port-security mac-address security.
Syntax
port-security timer autolearn aging time-value undo port-security timer autolearn aging
View
System view
Default level
2: System level
Parameters
time-value: Sets the aging timer in minutes for sticky MAC addresses. The value is in the range of 0 to 129600. To disable the aging timer, set the timer to 0.
Examples
# Set the sticky MAC aging timer to 30 minutes.
<Sysname> system-view [Sysname] port-security timer autolearn aging 30
port-security preshared-key
Description
Use port-security preshared-key to configure a PSK. Use undo port-security preshared-key to remove the PSK. By default, no PSK is configured.
Syntax
port-security preshared-key { pass-phrase | raw-key } [ cipher | simple ] key
152
undo port-security preshared-key
View
WLAN-BSS interface view, WLAN-Ethernet interface view
Default level
2: System level
Parameters
pass-phrase: Enters a PSK in the form of a character string. raw-key: Enters a PSK in the form of a hexadecimal number. [ cipher | simple ] key: Specifies a PSK. The cipher key option specifies an encrypted PSK, which is saved in cipher text. You can input a character or hexadecimal string of 12, 24, 32, 44, 64, 76, 88, or 96 characters for the key argument. The simple key option option specifies a plain text PSK, which is saved in plain text. You can input a character string of 8 to 63 displayable characters or a hexadecimal string of 64 characters for the key argument. If neither cipher nor simple is specified, you set a plain text key to be saved in cipher text. The key can be a character string of 8 to 63 displayable characters or a hexadecimal string of 64 characters.
Examples
# Configure the plain text PSK abcdefgh on port WLAN-BSS 1.
<Sysname> system-view [Sysname] interface wlan-bss 1 [Sysname-WLAN-BSS1] port-security preshared-key pass-phrase simple abcdefgh [Sysname-WLAN-BSS1] display this # interface WLAN-BSS1 port-security preshared-key pass-phrase simple abcdefgh
# Configure the hexadecimal string 123456789abcdefg123456789abcdefg123456789abcdefg123456789abcdefg as the PSK on port WLANBSS 1.

<Sysname> system-view [Sysname] interface wlan-bss 1 [Sysname-WLAN-BSS1] port-security preshared-key 1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef [Sysname-WLAN-BSS1] display this # interface WLAN-BSS1 port-security preshared-key wrWR2LZofLwr2ACYLngxuQ9pYV1V9LLZJd50 pass-phrase raw-key cipher raw-key
n2zqJ8+SjvGtjYslb87B/RypUlYIaHKVcKH/JjPqC0NbNE+qzQ6Ap/wd97Ei
# Configure PSK in cipher text wrWR2LZofLzlEY9ZdYsidw== on port WLAN-BSS 1.

<Sysname> system-view [Sysname] interface wlan-bss 1 [Sysname-WLAN-BSS1] port-security preshared-key raw-key cipher wrWR2LZofLzlEY9ZdYsidw==
153
[Sysname-WLAN-BSS1] display this # interface WLAN-BSS1 port-security preshared-key pass-phrase cipher wrWR2LZofLzlEY9ZdYsidw==
port-security timer disableport

Description
Use port-security timer disableport to set the silence period during which the port remains disabled. Use undo port-security timer disableport to restore the default. By default, the silence period is 20 seconds. If you configure the intrusion protection policy as disabling the port temporarily whenever it receives an illegal frame, use this to set the silence period. Related commands: display port-security.
Syntax
port-security timer disableport time-value undo port-security timer disableport
View
System view
Default level
2: System level
Parameters
time-value: Specifies the silence period during which the port remains disabled, in seconds. It is in the range of 20 to 300.
Examples
# Configure the intrusion protection policy as disabling the port temporarily whenever it receives an illegal frame and set the silence period to 30 seconds.
<Sysname> system-view [Sysname] port-security timer disableport 30 [Sysname] interface gigabitethernet 1/1 [Sysname-GigabitEthernet1/1] port-security intrusion-mode disableport-temporarily
port-security trap
Description
Use port-security trap to enable port security traps. Use undo port-security trap to disable port security traps. By default, port security traps are disabled. You can enable certain port security traps for monitoring user behaviors. Related commands: display port-security.
154
Syntax
port-security trap { addresslearned | dot1xlogfailure | dot1xlogoff | dot1xlogon | intrusion | ralmlogfailure | ralmlogoff | ralmlogon } undo port-security trap { addresslearned | dot1xlogfailure | dot1xlogoff | dot1xlogon | intrusion | ralmlogfailure | ralmlogoff | ralmlogon }
View
System view
Default level
2: System level
Parameters
addresslearned: Enables MAC address learning traps. The port security module sends traps when a port learns a new MAC address. dot1xlogfailure: Enables 802.1X authentication failure traps. The port security module sends traps when an 802.1X authentication fails. dot1xlogon: Enables 802.1X authentication success traps. The port security module sends traps when an 802.1X authentication is passed. dot1xlogoff: Enables 802.1X user logoff event traps. The port security module sends traps when an 802.1X user is logged off. intrusion: Enables intrusion traps. The port security module sends traps when it detects illegal frames. ralmlogfailure: Enables MAC authentication failure traps. The port security module sends traps when a MAC authentication fails. ralmlogoff: Enables MAC authentication user logoff traps. The port security module sends traps when a MAC authentication user is logged off. ralmlogon: Enables MAC authentication success traps. The port security module sends traps when a MAC authentication is passed. NOTE: RALM means RADIUS authentication based on MAC address.
Examples
# Enable MAC address learning traps.
<Sysname> system-view [Sysname] port-security trap addresslearned
port-security tx-key-type 11key

Description
Use port-security tx-key-type 1 1key to enable key negotiation of the 1 1key type. Use undo port-security tx-key-type to disable key negotiation of the 1 1key type. By default, key negotiation of the 1 1key type is disabled.
155
Syntax
port-security tx-key-type 1 1key undo port-security tx-key-type
View
WLAN-BSS interface view, WLAN-Ethernet interface view
Default level
2: System level
Parameters
None
Examples
# Enable key negotiation of the 1 1key type on port WLAN-BSS 1.
<Sysname> system-view [Sysname] interface wlan-bss 1 [Sysname-WLAN-BSS1] port-security tx-key-type 11key
156
IPsec configuration commands

The MSR series routers support ACL-based IPsec in either standard or aggregation data flow protection mode.
ah authentication-algorithm
Description
Use ah authentication-algorithm to specify an authentication algorithm for the AH protocol. Use undo ah authentication-algorithm to restore the default. By default, MD5 is used. Before specifying the authentication algorithm for AH, be sure to use the transform to specify the security protocol as AH or both AH and ESP. Related commands: ipsec proposal and transform.
Syntax
ah authentication-algorithm { md5 | sha1 } undo ah authentication-algorithm
View
IPsec proposal view
Default level
2: System level
Parameters
md5: Uses MD5. sha1: Uses SHA1.
Examples
# Configure IPsec proposal prop1 to use AH and SHA1.
<Sysname> system-view [Sysname] ipsec proposal prop1 [Sysname-ipsec-proposal-prop1] transform ah [Sysname-ipsec-proposal-prop1] ah authentication-algorithm sha1
connection-name
Description
Use connection-name to configure an IPsec connection name. This name functions only as a description of the IPsec policy. Use undo connection-name to restore the default. By default, no IPsec connection name is configured.
157
Syntax
connection-name name undo connection-name
View
IPsec policy view, IPsec policy template view
Default level
2: System level
Parameters
name: IPsec connection name, a case-insensitive string of 1 to 32 characters.
Example
# Set IPsec connection name to CenterToA.
<Sysname> system-view [Sysname] ipsec policy policy1 1 isakmp [Sysname-ipsec-policy-isakmp-policy1-1] connection-name CenterToA
cryptoengine enable
Description
Use cryptoengine enable to enable the encryption engine. Use undo cryptoengine enable to disable the encryption engine.
Syntax
cryptoengine enable undo cryptoengine enable
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable the encryption engine.
<Sysname> system-view [Sysname] cryptoengine enable
display ipsec policy

Description
Use display ipsec policy to display information about IPsec policies. If you do not specify any parameters, the command displays detailed information about all IPsec policies.
158
If you specify the name policy-name option but leave the seq-number argument, the command displays detailed information about the specified IPsec policy group. Related commands: ipsec policy (system view).
Syntax
display ipsec policy [ brief | name policy-name [ seq-number ] ] [ | { begin | exclude | include } regularexpression ]
View
Any view
Default level
1: Monitor level
Parameters
brief: Displays brief information about all IPsec policies. name: Displays detailed information about a specified IPsec policy or IPsec policy group. policy-name: Name of the IPsec policy, a string of 1 to 15 characters. seq-number: Sequence number of the IPsec policy, in the range of 1 to 65535. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display brief information about all IPsec policies.
<Sysname> display ipsec policy brief IPsec-Policy-Name bbbbbbbbbbbbbbb-1 man-1 map-1 nat-1 test-1 toccccc-1 IPsec-Policy-Name man-1 Mode template manual isakmp isakmp isakmp isakmp Mode manual 3400 3000 3500 3200 3003 acl 3400 peer nat test tocccc Local-Address 3.3.3.1 Remote-Address 3.3.3.2 acl ike-peer name Mapped Template aaaaaaaaaaaaaaa ------------------------------------------------------------------------
------------------------------------------------------------------------

IPsec-Policy-Name
Description
Name and sequence number of the IPsec policy separated by hyphen
159
Field
Description
Negotiation mode of the IPsec policy, which can be:
Mode
manual: Manual mode isakmp: IKE negotiation mode template: IPsec policy template mode
ACL referenced by the IPsec policy IKE peer name Referenced IPsec policy template IP address of the local end IP address of the remote end
acl ike-peer name Mapped Template Local-Address Remote-Address
# Display detailed information about all IPsec policies.

<Sysname> display ipsec policy =========================================== IPsec Policy Group: "policy_isakmp" Interface: Ethernet1/1 =========================================== -----------------------------------IPsec policy name: "policy_isakmp" sequence number: 10 mode: isakmp ------------------------------------security data flow : 3000 selector mode: standard ike-peer name: per perfect forward secrecy: None proposal name: prop1 IPsec sa local duration(time based): 3600 seconds IPsec sa local duration(traffic based): 1843200 kilobytes policy enable: True =========================================== IPsec Policy Group: "policy_man" Interface: Ethernet1/2 =========================================== ----------------------------------------IPsec policy name: "policy_man" sequence number: 10 mode: manual ----------------------------------------security data flow : 3002 tunnel local address: 162.105.10.1 tunnel remote address: 162.105.10.2 proposal name: prop1
160
inbound AH setting: AH spi: 12345 (0x3039) AH string-key: AH authentication hex key : 1234567890123456789012345678901234567890 inbound ESP setting: ESP spi: 23456 (0x5ba0) ESP string-key: ESP encryption hex key: 1234567890abcdef1234567890abcdef1234567812345678 ESP authentication hex key: 1234567890abcdef1234567890abcdef outbound AH setting: AH spi: 54321 (0xd431) AH string-key: AH authentication hex key: 1122334455667788990011223344556677889900 outbound ESP setting: ESP spi: 65432 (0xff98) ESP string-key: ESP encryption hex key: 11223344556677889900aabbccddeeff1234567812345678 ESP authentication hex key: 11223344556677889900aabbccddeeff =========================================== IPsec Policy Group: "manual" Interface: Protocol: OSPFv3, RIPng, BGP =========================================== ----------------------------IPsec policy name: "policy001" sequence number: 10 mode: manual ----------------------------security data flow : tunnel local address: tunnel remote address: proposal name: prop1 inbound AH setting: AH spi: AH string-key: AH authentication hex key: inbound ESP setting: ESP spi: 23456 (0x5ba0) ESP string-key: ESP encryption hex key: 1234567890abcdef1234567890abcdef1234567812345678 ESP authentication hex key: 1234567890abcdef1234567890abcdef outbound AH setting: AH spi: AH string-key: AH authentication hex key: outbound ESP setting:
161
ESP spi: 23456 (0x5ba0) ESP string-key: ESP encryption hex key: 1234567890abcdef1234567890abcdef1234567812345678 ESP authentication hex key: 1234567890abcdef1234567890abcdef

security data flow Interface Protocol sequence number
Description
ACL referenced by the IPsec policy. Interface to which the IPsec policy is applied. Name of the protocol to which the IPsec policy is applied. (This field is not displayed when the IPsec policy is not applied to any routing protocol.) Sequence number of the IPsec policy. Negotiation mode of the IPsec policy, which can be:
mode
manual: Manual mode isakmp: IKE negotiation mode template: IPsec policy template mode
Data flow protection mode of the IPsec policy, standard or aggregation. IKE peer referenced by the IPsec policy. Local IP address of the tunnel. Remote IP address of the tunnel. Whether PFS is enabled. Proposal referenced by the IPsec policy. Whether the IPsec policy is enabled or not. AH/ESP settings in the inbound/outbound direction, including the SPI and keys.
selector mode ike-peer name tunnel local address tunnel remote address perfect forward secrecy proposal name policy enable inbound/outbound AH/ESP setting
display ipsec policy-template

Description
Use display ipsec policy-template to display information about IPsec policy templates. If you do not specify any parameters, the command displays detailed information about all IPsec policy templates. If you specify the name template-name option but leave the seq-number argument, the command displays information about the specified IPsec policy template group.
Related commands: ipsec policy-template. Syntax

display ipsec policy-template [ brief | name template-name [ seq-number ] ] [ | { begin | exclude | include } regular-expression ]
162
View
Any view
Default level
1: Monitor level
Parameters
brief: Displays brief information about all IPsec policy templates. name: Displays detailed information about a specified IPsec policy template or IPsec policy template group. template-name: Name of the IPsec policy template, a string of 1 to 41 characters. seq-number: Sequence number of the IPsec policy template, in the range of 1 to 65535. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display brief information about all IPsec policy templates.
<Sysname> display ipsec policy-template brief Policy-template-Name test-tplt300 acl 2200 Remote-Address ------------------------------------------------------

Policy-template-Name acl Remote Address
Description
Name and sequence number of the IPsec policy template separated by hyphen ACL referenced by the IPsec policy template Remote IP address
# Display detailed information about all IPsec policy templates.

<Sysname> display ipsec policy-template =============================================== IPsec Policy Template Group: "test" =============================================== --------------------------------Policy template name: "test" sequence number: 1 ---------------------------------
163
security data flow : ike-peer name: proposal name: None testprop perfect forward secrecy: IPsec sa local duration(time based): 3600 seconds IPsec sa local duration(traffic based): 1843200 kilobytes

security data flow ike-peer name perfect forward secrecy proposal name IPsec sa local duration(time based) IPsec sa local duration(traffic based)
Description
ACL referenced by the IPsec policy template. IKE peer referenced by the IPsec policy template. Whether PFS is enabled. IPsec proposal referenced by the IPsec policy template. Time-based lifetime of the IPsec SAs at the local end. Traffic-based lifetime of the IPsec SAs at the local end.
display ipsec profile

Description
Use display ipsec profile to display the configuration information of IPsec profiles. If you do not specify any parameters, the command displays the configuration information of all IPsec profiles. Related commands: ipsec profile.
Syntax
display ipsec profile [ name profile-name ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
name profile-name: Displays the configuration information of an IPsec profile. The profile-name argument specifies the name of the IPsec profile and is a case-insensitive string of 1 to 15 characters. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Example
# Display the configuration of all IPsec profiles.
164
<Sysname> display ipsec profile =========================================== IPsec profile: "2" Using interface: {Tunnel2} =========================================== ----------------------------IPsec profile name: "2" mode: dvpn ----------------------------security data flow : 0 ike-peer name: proposal name: peer1 prop1 perfect forward secrecy: None IPsec sa local duration(time based): 3600 seconds IPsec sa local duration(traffic based): 1843200 kilobytes =========================================== IPsec profile: "btoa" Using interface: {Tunnel1} =========================================== ----------------------------IPsec profile name: "btoa" mode: tunnel ----------------------------security data flow : 0 ike-peer name: proposal name: btoa method1 perfect forward secrecy: None IPsec sa local duration(time based): 3600 seconds IPsec sa local duration(traffic based): 1843200 kilobytes

Using interface mode
Description
Interface that references the IPsec profile Encapsulation mode for the IPsec profile:
dvpn: DVPN tunnel mode tunnel: IPsec tunnel mode

ACL referenced by the IPsec profile As an IPsec profile does not reference any ACL, this field is displayed as 0. IKE peer referenced by the IPsec profile Whether PFS is enabled IPsec proposal referenced by the IPsec profile 165
security data flow ike-peer name perfect forward secrecy proposal name
Field
IPsec sa local duration(time based) IPsec sa local duration(traffic based)
Description
Time-based SA lifetime at the local end Traffic-based SA lifetime at the local end
display ipsec proposal

Description
Use display ipsec proposal to display information about IPsec proposals. If you do not specify any parameters, the command displays information about all IPsec proposals. Related commands: ipsec proposal.
Syntax
display ipsec proposal [ proposal-name ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
proposal-name: Name of a proposal, a string of 1 to 32 characters. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display information about all IPsec proposals.
<Sysname> display ipsec proposal IPsec proposal name: prop2 encapsulation mode: tunnel transform: ah-new AH protocol: authentication sha1-hmac-96 IPsec proposal name: prop1 encapsulation mode: transport transform: esp-new ESP protocol: authentication md5-hmac-96, encryption des
166

IPsec proposal name encapsulation mode transform AH protocol ESP protocol
Description
Name of the IPsec proposal Encapsulation mode used by the IPsec proposal, transport or tunnel Security protocol(s) used by the IPsec proposal: AH, ESP, or both. If both protocols are configured, IPsec uses ESP before AH. Authentication algorithm used by AH Authentication algorithm and encryption algorithm used by ESP
display ipsec sa
Description
Use display ipsec sa to display information about IPsec SAs. If you do not specify any parameters, the command displays information about all IPsec SAs. Related commands: reset ipsec sa and ipsec sa global-duration.
Syntax
display ipsec sa [brief | policy policy-name [ seq-number ] | remote ip-address ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
brief: Displays brief information about all IPsec SAs. policy: Displays detailed information about IPsec SAs created by using a specified IPsec policy. policy-name: Name of the IPsec policy, a string 1 to 15 characters. seq-number: Sequence number of the IPsec policy, in the range of 1 to 65535. remote ip-address: Displays detailed information about the IPsec SA with a specified remote address. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display brief information about all IPsec SAs.
<Sysname> display ipsec sa brief Src Address Dst Address SPI Protocol Algorithm
167
-------------------------------------------------------10.1.1.1 10.1.1.2 10.1.1.2 10.1.1.1 300 400 ESP ESP E:DES; A:HMAC-MD5-96 E:DES; A:HMAC-MD5-96

Src Address Dst Address SPI Protocol
Description
Local IP address Remote IP address Security parameter index Security protocol used by IPsec Authentication algorithm and encryption algorithm used by the security protocol, where E indicates the encryption algorithm and A indicates the authentication algorithm. A value of NULL means that type of algorithm is not specified.
Algorithm
display ipsec session

Description
Use display ipsec session to display information about IPsec sessions. If you do not specify any parameters, the command displays information about all IPsec sessions. IPsec can find matched tunnels directly by session, reducing the intermediate matching procedures and improving the forwarding efficiency. A session is identified by the quintuplet of protocol, source IP address, source port, destination IP address, and destination port. Related commands: reset ipsec session.
Syntax
display ipsec session [ tunnel-id integer ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
integer: ID of the IPsec tunnel, in the range of 1 to 2000000000. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
168
Examples
# Display information about all IPsec sessions.
<Sysname> display ipsec session -----------------------------------------------------------total sessions : 2 -----------------------------------------------------------tunnel-id : 3 session idle time/total duration (sec) : 36/300 session flow : (8 times matched) Sour Port: Dest Port: 0 0 Protocol : 1 Protocol : 1
Sour Addr : 15.15.15.1 Dest Addr : 15.15.15.2
-----------------------------------------------------------tunnel-id : 4 session idle duration/total duration (sec) : 7/300 session flow : (3 times matched) Sour Port: Dest Port: 0 0 Protocol : 1 Protocol : 1
# Display information about the session with an IPsec tunnel ID of 5.

<Sysname> display ipsec session tunnel-id 5 -----------------------------------------------------------total sessions : 1 -----------------------------------------------------------tunnel-id : 5 session idle time/total duration (sec) : 30/300 session flow : (4 times matched) Sour Port: Dest Port: 0 0 Protocol : 1 Protocol : 1

total sessions tunnel-id session idle time total duration session flow times matched Sour Addr Dest Addr
Description
Total number of IPsec sessions IPsec tunnel ID, same as the connection-id of the IPsec SA Idle duration of the IPsec session in seconds Lifetime of the IPsec session in seconds, defaulted to 300 seconds Flow information of the IPsec session Total number of packets matching the IPsec session Source IP address of the IPsec session Destination IP address of the IPsec session
169
Field
Sour Port Dest Port Protocol
Description
Source port number of the IPsec session Destination port number of the IPsec session Protocol number of the IPsec protected data flow, for example, 1 for ICMP
display ipsec statistics

Description
Use display ipsec statistics to display IPsec packet statistics. If you do not specify any parameters, the command displays the statistics for all IPsec packets. Related commands: reset ipsec statistics.
Syntax
display ipsec statistics [ tunnel-id integer ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
tunnel-id integer: Specifies an IPsec tunnel by its ID, which is in the range of 1 to 2000000000. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display statistics on all IPsec packets.
<Sysname> display ipsec statistics the security packet statistics: input/output security packets: 47/62 input/output security bytes: 3948/5208 input/output dropped security packets: 0/45 dropped security packet detail: not enough memory: 0 can't find SA: 45 queue is full: 0 authentication has failed: 0 wrong length: 0 replay packet: 0
170
packet too long: 0 wrong SA: 0
# Display IPsec packet statistics for Tunnel 3.

<Sysname> display ipsec statistics tunnel-id 3 -----------------------------------------------Connection ID : 3 -----------------------------------------------the security packet statistics: input/output security packets: 5124/8231 input/output security bytes: 52348/64356 input/output dropped security packets: 0/0 dropped security packet detail: not enough memory: 0 queue is full: 0 authentication has failed: 0 wrong length: 0 replay packet: 0 packet too long: 0 wrong SA: 0

Connection ID input/output security packets input/output security bytes input/output dropped security packets dropped security packet detail not enough memory can't find SA queue is full authentication has failed wrong length replay packet packet too long wrong SA
Description
ID of the tunnel Counts of inbound and outbound IPsec protected packets Counts of inbound and outbound IPsec protected bytes Counts of inbound and outbound IPsec protected packets that are discarded by the device Detailed information about inbound/outbound packets that get dropped Number of packets dropped due to lack of memory Number of packets dropped due to finding no security association Number of packets dropped due to full queues Number of packets dropped due to authentication failure Number of packets dropped due to wrong packet length Number of packets replayed Number of packets dropped due to excessive packet length Number of packets dropped due to improper SA
display ipsec tunnel

Description
Use display ipsec tunnel to display information about IPsec tunnels.
171
If you do not specify any parameters, the command displays information about all IPsec tunnels.
Syntax
display ipsec tunnel [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
Examples
# Display information about IPsec tunnels.
<Sysname> display ipsec tunnel total tunnel : 2 -----------------------------------------------connection id: 3 perfect forward secrecy: SA's SPI: inbound: tunnel: local flow: sour addr : 44.44.44.0/255.255.255.0 dest addr : 44.44.44.0/255.255.255.0 current Encrypt-card: None -----------------------------------------------connection id: 5 perfect forward secrecy: SA's SPI: inbound: tunnel: flow: current Encrypt-card: 12345 (0x3039) [ESP] outbound: 12345 (0x3039) [ESP] port: 0 port: 0 protocol : IP protocol : IP address: 44.44.44.44 remote address : 44.44.44.55 187199087 (0xb286e6f) [ESP] outbound: 3562274487 (0xd453feb7) [ESP]
# Display information about IPsec tunnels in aggregation mode.

<Sysname> display ipsec tunnel
172
total tunnel: 2 -----------------------------------------------connection id: 4 perfect forward secrecy: SA's SPI: inbound : tunnel : local address: flow : as defined in acl 3001 current Encrypt-card : None 44.44.44.44 remote address : 44.44.44.45 2454606993 (0x924e5491) [ESP] outbound : 675720232 (0x2846ac28) [ESP]

connection id perfect forward secrecy SA's SPI tunnel flow as defined in acl 3001 current Encrypt-card
Description
Connection ID, used to uniquely identify an IPsec Tunnel Perfect forward secrecy, indicating which DH group is to be used for fast negotiation mode in IKE phase 2 SPIs of the inbound and outbound SAs Local and remote addresses of the tunnel Data flow protected by the IPsec tunnel, including source IP address, destination IP address, source port, destination port and protocol The IPsec tunnel protects all data flows defined by ACL 3001 Encryption module interface used by the current tunnel
encapsulation-mode
Description
Use encapsulation-mode to set the encapsulation mode that the security protocol uses to encapsulate IP packets. Use undo encapsulation-mode to restore the default. By default, a security protocol encapsulates IP packets in tunnel mode. IPsec for IPv6 routing protocols supports only the transport mode. Related commands: ipsec proposal.
Syntax
encapsulation-mode { transport | tunnel } undo encapsulation-mode
View
IPsec proposal view
173
Default level
2: System level
Parameters
transport: Uses transport mode. tunnel: Uses tunnel mode.
Examples
# Configure IPsec proposal prop2 to encapsulate IP packets in transport mode.
<Sysname> system-view [Sysname] ipsec proposal prop2 [Sysname-ipsec-proposal-prop2] encapsulation-mode transport
esp authentication-algorithm
Description
Use esp authentication-algorithm to specify an authentication algorithm for ESP. Use undo esp authentication-algorithm to configure ESP not to perform authentication on packets. By default, the MD5 algorithm is used. Compared with SHA-1, MD5 is faster but less secure. SHA-1 applies to scenarios with higher security and confidentiality requirements. Use MD5 in common scenarios. ESP supports three IP packet protection schemes: encryption only, authentication only, or both encryption and authentication. For ESP, you must specify an encryption algorithm, an authentication algorithm, or both. The undo esp authentication-algorithm command takes effect only if one encryption algorithm is specified for ESP. Related commands: ipsec proposal, esp encryption-algorithm, proposal, and transform.
Syntax
esp authentication-algorithm { md5 | sha1 } undo esp authentication-algorithm
View
IPsec proposal view
Default level
2: System level
Parameters
md5: Uses the MD5 algorithm, which uses a 128-bit key. sha1: Uses the SHA1 algorithm, which uses a 160-bit key.
Examples
# Configure IPsec proposal prop1 to use ESP and specify SHA1 as the authentication algorithm for ESP.
<Sysname> system-view [Sysname] ipsec proposal prop1 [Sysname-ipsec-proposal-prop1] transform esp [Sysname-ipsec-proposal-prop1] esp authentication-algorithm sha1
174
esp encryption-algorithm
Description
Use esp encryption-algorithm to specify an encryption algorithm for ESP. Use undo esp encryption-algorithm to configure ESP not to encrypt packets. By default, the DES algorithm is used. 3DES provides high confidentiality and security, but it is slow in encryption. For a network that requires moderate confidentiality and security, DES is sufficient. ESP supports three IP packet protection schemes: encryption only, authentication only, or both encryption and authentication. For ESP, you must specify an encryption algorithm, an authentication algorithm, or both. The undo esp encryption-algorithm command takes effect only if one authentication algorithm is specified for ESP. Related commands: ipsec proposal, esp authentication-algorithm, proposal, and transform.
Syntax
esp encryption-algorithm { 3des | aes [ key-length ] | des } undo esp encryption-algorithm
View
IPsec proposal view
Default level
2: System level
Parameters
3des: Uses triple DES (3DES) in CBC mode as the encryption algorithm. The 3DES algorithm uses a 168bit key for encryption. aes: Uses the AES in CBC mode as the encryption algorithm. The AES algorithm uses a 128- bit, 192-bit, or 256-bit key for encryption. key-length: Key length for the AES algorithm, which can be 128, 192, and 256 and defaults to 128. This argument is for AES only. des: Uses the DES in CBC mode as the encryption algorithm. The DES algorithm uses a 56-bit key for encryption.
Examples
# Configure IPsec proposal prop1 to use ESP and specify 3DES as the encryption algorithm for ESP.
<Sysname> system-view [Sysname] ipsec proposal prop1 [Sysname-ipsec-proposal-prop1] transform esp [Sysname-ipsec-proposal-prop1] esp encryption-algorithm 3des
175
ike-peer (IPsec policy view, IPsec policy template view, IPsec profile view)
Description
Use ike-peer to reference an IKE peer in an IPsec policy, IPsec policy template, or IPsec profile configured through IKE negotiation. Use undo ike peer to remove the reference. This command applies to only IKE negotiation mode. Related commands: ipsec policy and ipsec profile.
Syntax
ike-peer peer-name undo ike-peer peer-name
View
IPsec policy view, IPsec policy template view, IPsec profile view
Default level
2: System level
Parameters
peer-name: IKE peer name, a string of 1 to 32 characters.
Examples
# Configure a reference to an IKE peer in an IPsec policy.
<Sysname> system-view [Sysname] ipsec policy policy1 10 isakmp [Sysname-ipsec-policy-isakmp-policy1-10] ike-peer peer1
# Configure a reference to an IKE peer in an IPsec profile.

<Sysname> system-view [Sysname] ipsec profile profile1 [Sysname-ipsec-profile- profile1] ike-peer peer1
ipsec anti-replay check

Description
Use ipsec anti-replay check to enable IPsec anti-replay checking. Use undo ipsec anti-replay check to disable IPsec anti-replay checking. By default, IPsec anti-replay checking is enabled.
Syntax
ipsec anti-replay check undo ipsec anti-replay check
View
System view
176
Default level
2: System level
Parameters
None
Examples
# Enable IPsec anti-replay checking.
<Sysname> system-view [Sysname] ipsec anti-replay check
ipsec anti-replay window

Description
Use ipsec anti-replay window to set the size of the anti-replay window. Use undo ipsec anti-replay window to restore the default. By default, the size of the anti-replay window is 32. Your configuration affects only IPsec SAs negotiated later.
Syntax
ipsec anti-replay window width undo ipsec anti-replay window
View
System view
Default level
2: System level
Parameters
width: Size of the anti-replay window. It can be 32, 64, 128, 256, 512, or 1024.
Examples
# Set the size of the anti-replay window to 64.
<Sysname> system-view [Sysname] ipsec anti-replay window 64
ipsec binding policy

Description
Use ipsec binding policy to bind an IPsec policy, IPsec policy group or IPsec profile to the encryption module interface. Use undo ipsec binding policy to remove the binding. By default, an encryption module interface is bound with no IPsec policy, IPsec policy group, or IPsec profile. An IPsec policy group can be bound to an encryption module either before or after it is applied to an interface, as long as you create it first. After binding an IPsec policy group to an encryption module, you
177
must apply it to at least one interface so that the flows matching the policy are to be processed with the encryption module. An encryption module interface can be bound with multiple IPsec policies, IPsec policy groups, or IPsec profiles, provided that those IPsec policies, IPsec policy groups, or IPsec profiles have different names. An IPsec policy, IPsec policy group or IPsec profile can be bound to multiple encryption modules. An IPsec policy template cannot be bound to an encryption module interface, but an IPsec policy originating from an IPsec policy template can. You can specify an encryption module as the primary module when binding an IPsec policy, IPsec policy group, or IPsec profile to the module, and perform this configuration repeatedly to specify any other module as the primary module for the IPsec policy, IPsec policy group or IPsec profile. However, only the last one takes effect. When an IPsec policy, IPsec policy group or IPsec profile is bound to the current encryption module, the IPsec policy, IPsec policy group or IPsec profile with the same name bound before will be overlaid. An IPsec policy, IPsec policy group, or IPsec profile uses the bound primary module to provide security services. If there is no primary module, an IPsec policy, IPsec policy group, or IPsec profile prefers the first encryption module bound to it. Once an IPsec policy, IPsec policy group, or IPsec profile takes a second encryption module as the primary module, the new primary module begins to provide security services immediately. Related commands: ipsec policy (system view) and ipsec profile (system view).
Syntax
ipsec binding policy policy-name [ seq-number ] [ primary ] undo ipsec binding policy policy-name [ seq-number ] [ primary ]
View
Encryption module interface view
Default level
2: System level
Parameters
policy-name: Name of the IPsec policy group or IPsec profile, a case-insensitive string of 1 to 15 characters. Valid characters are English letters and numbers. No minus sign (-) can be included. seq-number: Sequence number of the IPsec policy, in the range of 1 to 65535, with a smaller value indicating a higher priority. primary: Specifies the current encryption module as the primary module of the IPsec policy, IPsec policy group, or IPsec profile.
Examples
# Bind IPsec policy group map to interface Encrypt 1/0.
<Sysname> system-view [Sysname] interface encrypt 1/0 [Sysname-Encrypt1/0] ipsec binding policy map
# Bind the IPsec policy with the name of map1 and sequence number of 10 to interface Encrypt 1/0.
[Sysname] interface encrypt 1/0 [Sysname-Encrypt1/0] ipsec binding policy map1 10
178
# Bind IPsec policy group map to interface Encrypt 1/0 and specify the current encryption module as the primary module.
[Sysname] interface encrypt 1/0 [Sysname-Encrypt1/0] ipsec binding policy map primary
# Bind the IPsec policy with the name of map1 and sequence number of 10 to interface Encrypt 1/0 and specify the current encryption module as the primary module.
[Sysname] interface encrypt 1/0 [Sysname-Encrypt1/0] ipsec binding policy map1 10 primary
# Bind IPsec profile map1 to interface Encrypt 1/0.

<Sysname> system-view [Sysname] interface encrypt 1/0 [Sysname-Encrypt1/0] ipsec binding policy map1
ipsec cpu-backup enable

Description
Use ipsec cpu-backup enable to enable the IPsec module backup function. Use undo ipsec cpu-backup enable to disable the IPsec module backup function. By default, the IPsec module backup function is enabled. The following table shows the command and router compatibility: Feature
ipsec cpu-backup enable
MSR900
No
MSR20-1X
No
MSR20
Yes
MSR30
Yes
MSR50
Yes
Syntax
ipsec cpu-backup enable undo ipsec cpu-backup enable
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable the IPsec module backup function.
<Sysname> system-view [Sysname] ipsec cpu-backup enable
ipsec decrypt check

Description
Use ipsec decrypt check to enable ACL checking of de-encapsulated IPsec packets.
179
Use undo ipsec decrypt check to disable ACL checking of de-encapsulated IPsec packets. By default, ACL checking of de-encapsulated IPsec packets is enabled.
Syntax
ipsec decrypt check undo ipsec decrypt check
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable ACL checking of de-encapsulated IPsec packets.
<Sysname> system-view [Sysname] ipsec decrypt check
ipsec invalid-spi-recovery enable

Description
Use ipsec invalid-spi-recovery enable to enable invalid SPI recovery. Use undo ipsec invalid-spi-recovery enable to restore the default. By default, the invalid SPI recovery is disabled. The receiver discards IPsec packets with invalid SPIs. Invalid SPI recovery enables an IPsec security gateway to send an INVALID SPI NOTIFY message to its peer when it receives an IPsec packet but cannot find any SA with the specified SPI. When the peer receives the message, it deletes the SAs on its side. Then, subsequent traffic triggers the two peers to establish new SAs.
Syntax
ipsec invalid-spi-recovery enable undo ipsec invalid-spi-recovery enable
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable invalid SPI recovery.
<Sysname> system-view [Sysname] ipsec invalid-spi-recovery enable
180
ipsec policy (interface view)

Description
Use ipsec policy to apply an IPsec policy group to an interface. Use undo ipsec policy to remove the application. Only one IPsec policy group can be applied to an interface. To apply another IPsec policy group to the interface, remove the original application first. An IPsec policy group can be applied to more than one interface. With an IPsec policy group applied to an interface, the system uses each IPsec policy in the group to protect certain data flows. For each packet to be sent out an IPsec protected interface, the system checks the IPsec policies of the IPsec policy group in the ascending order of sequence numbers. If it finds an IPsec policy whose ACL matches the packet, it uses the IPsec policy to protect the packet. If it finds no ACL of the IPsec policies matches the packet, it does not provide IPsec protection for the packet and sends the packet out directly. Related commands: ipsec policy (system view).
Syntax
ipsec policy policy-name undo ipsec policy [ policy-name ]
View
Interface view
Default level
2: System level
Parameters
policy-name: Name of the existing IPsec policy group to be applied to the interface, a string of 1 to 15 characters.
Examples
# Apply IPsec policy group pg1 to interface Serial 2/2.
<Sysname> system-view [Sysname] interface serial 2/2 [Sysname-Serial2/2] ipsec policy pg1
ipsec policy (system view)

Description
Use ipsec policy to create an IPsec policy and enter its view. Use undo ipsec policy to delete the specified IPsec policies. By default, no IPsec policy exists. When creating an IPsec policy, you must specify the generation mode. You cannot change the generation mode of an existing IPsec policy; you can only delete the policy and then re-create it with the new mode.
181
IPsec policies with the same name constitute an IPsec policy group. An IPsec policy is identified uniquely by its name and sequence number. In an IPsec policy group, an IPsec policy with a smaller sequence number has a higher priority. The undo ipsec policy command without the seq-number argument deletes an IPsec policy group. Related commands: ipsec policy (interface view) and display ipsec policy.
Syntax
ipsec policy policy-name seq-number [ isakmp | manual ] undo ipsec policy policy-name [ seq-number ]
View
System view
Default level
2: System level
Parameters
policy-name: Name for the IPsec policy, a case-insensitive string of 1 to 15 characters. No minus sign (-) can be included. seq-number: Sequence number for the IPsec policy, in the range of 1 to 65535. isakmp: Sets up SAs through IKE negotiation. manual: Sets up SAs manually.
Examples
# Create an IPsec policy with the name policy1 and specify the manual mode for it.
<Sysname> system-view [Sysname] ipsec policy policy1 101 manual [Sysname-ipsec-policy-manual-policy1-101]
ipsec policy isakmp template

Description
Use ipsec policy isakmp template to create an IPsec policy by referencing an existing IPsec policy template, so that IKE can use the IPsec policy for SA negotiation. Use undo ipsec policy to delete an IPsec policy. Using the undo ipsec policy command without the seq-number argument deletes an IPsec policy group. In an IPsec policy group, an IPsec policy with a smaller sequence number has a higher priority. Related commands: ipsec policy (system view) and ipsec policy-template.
Syntax
ipsec policy policy-name seq-number isakmp template template-name undo ipsec policy policy-name [ seq-number ]
View
System view
182
Default level
2: System level
Parameters
policy-name: Name for the IPsec policy, a case-insensitive string of 1 to 15 characters. No minus sign (-) can be included. seq-number: Sequence number for the IPsec policy, in the range of 1 to 65535. isakmp template template-name: Name of the IPsec policy template to be referenced.
Examples
# Create an IPsec policy with the name policy2 and sequence number 200 by referencing IPsec policy template temp1.
<Sysname> system-view [Sysname] ipsec policy policy2 200 isakmp template temp1
ipsec policy local-address

Description
Use ipsec policy local-address to configure an IPsec policy group as a shared source interface policy group. This equals binding the IPsec policy group to a source interface. Only loopback interfaces can be source interfaces. Use undo ipsec policy local-address to remove a shared source interface policy group. The IPsec policy group and loopback interface to be referenced must have been created. The IPsec policy group to be referenced must have been configured with one or more IPsec policies. When you configure an IPsec policy group to be a shared source interface policy group, if the IPsec policy group has already been applied to an interface and the interface has established IPsec SAs, the IPsec SAs are removed and reestablished. Related commands: ipsec policy (system view) and ipsec policy (interface view).
Syntax
ipsec policy policy-name local-address loopback number undo ipsec policy policy-name local-address
View
System view
Default level
2: System level
Parameters
policy-name: Name of an IPsec policy, a case-insensitive string of 1 to 15 characters. Valid characters are English letters and numbers. No minus sign (-) can be included. loopback number: Specifies a loopback interface by giving its number.
Examples
# Configure IPsec policy group map as a shared source interface policy group, binding it to source interface Loopback 0.
183
<Sysname> system-view [Sysname] ipsec policy map 1 isakmp [Sysname-ipsec-policy-isakmp-map-1] quit [Sysname] interface loopback 0 [Sysname-LoopBack0] ip address 5.5.5.5 24 [Sysname-LoopBack0] quit [Sysname] ipsec policy map local-address loopback 0
ipsec policy-template
Description
Use ipsec policy-template to create an IPsec policy template and enter the IPsec policy template view. Use undo ipsec policy-template to delete the specified IPsec policy template(s). By default, no IPsec policy template exists. Using the undo command without the seq-number argument deletes an IPsec policy template group. In an IPsec policy template group, an IPsec policy template with a smaller sequence number has a higher priority. Related commands: display ipsec policy template.
Syntax
ipsec policy-template template-name seq-number undo ipsec policy-template template-name [ seq-number ]
View
System view
Default level
2: System level
Parameters
template-name: Name for the IPsec policy template, a case-insensitive string of 1 to 41 characters. No minus sign (-) can be included. seq-number: Sequence number for the IPsec policy template, in the range of 1 to 65535.
Examples
# Create an IPsec policy template with the name template1 and the sequence number 100.
<Sysname> system-view [Sysname] ipsec policy-template template1 100 [Sysname-ipsec-policy-template-template1-100]
ipsec profile (system view)

Description
Use ipsec profile to create an IPsec profile and enter its view. An IPsec profile defines the IPsec proposals to be used to protect the data and the IKE negotiation parameters to be used to set up the SAs. Use undo ipsec profile to delete an IPsec profile.
184
By default, no IPsec profile exists. IPsec profiles can be applied to only DVPN interfaces and IPsec tunnel interfaces. Related commands: ipsec profile (tunnel interface view) and display ipsec profile.
Syntax
ipsec profile profile-name undo ipsec profile profile-name
View
System view
Default level
2: System level
Parameters
profile-name: Name for the IPsec profile, a case-insensitive string of 1 to 15 characters.
Examples
# Create IPsec profile profile1 and enter its view.
<Sysname> system-view [Sysname] ipsec profile profile1 [Sysname-ipsec-profile-profile1]
ipsec profile (tunnel interface view)

Description
Use ipsec profile to apply an IPsec profile to a DVPN tunnel interface or an IPsec tunnel interface. Use undo ipsec profile to remove the application. By default, no IPsec profile is applied to a DVPN tunnel interface or an IPsec tunnel interface, and no IPsec protection is provided. Only one IPsec profile can be applied to a tunnel interface. To apply another IPsec profile to the tunnel interface, remove the original application first. An IPsec profile cannot be applied to the DVPN tunnel interface and the IPsec tunnel interface simultaneously. Related commands: ipsec profile (system view); interface tunnel (Layer 3IP Services Command Reference).
Syntax
ipsec profile profile-name undo ipsec profile
View
Tunnel interface view
Default level
2: System level
185
Parameters
profile-name: Name of the IPsec profile, a case-insensitive string of 1 to 15 characters.
Examples
# Apply IPsec profile vtiprofile to the IPsec tunnel interface.
<Sysname> system-view [Sysname] interface tunnel 0 [Sysname-Tunnel0] tunnel-protocol ipsec ipv4 [Sysname-Tunnel0] ipsec profile vtiprofile
# Apply IPsec profile dvpnprofile to the DVPN tunnel interface.

<Sysname> system-view [Sysname] interface tunnel 1 [Sysname-Tunnel1] tunnel-protocol dvpn udp [Sysname-Tunnel1] ipsec profile dvpnprofile
ipsec proposal
Description
Use ipsec proposal to create an IPsec proposal and enter its view. Use undo ipsec proposal to delete an IPsec proposal. By default, no IPsec proposal exists. An IPsec proposal created by using the ipsec proposal command takes the security protocol of ESP, the encryption algorithm of DES, and the authentication algorithm of MD5 by default. Related commands: display ipsec proposal.
Syntax
ipsec proposal proposal-name undo ipsec proposal proposal-name
View
System view
Default level
2: System level
Parameters
proposal-name: Name for the proposal, a case-insensitive string of 1 to 32 characters .
Examples
# Create an IPsec proposal named newprop1.
<Sysname> system-view [Sysname] ipsec proposal newprop1
ipsec sa global-duration
Description
Use ipsec sa global-duration to configure the global SA lifetime.
186
Use undo ipsec sa global-duration to restore the default. By default, the time-based global SA lifetime is 3,600 seconds, and the traffic-based global SA lifetime is 1843200 kilobytes. When negotiating to set up an SA, IKE prefers the lifetime of the IPsec policy or IPsec profile that it uses. If the IPsec policy is not configured with its own lifetime, IKE uses the global SA lifetime. When negotiating to set up an SA, IKE prefers the shorter one of the local lifetime and that proposed by the remote. The SA lifetime applies to only IKE negotiated SAs; it is not effective for manually configured SAs. Related commands: sa duration.
Syntax
ipsec sa global-duration { time-based seconds | traffic-based kilobytes } undo ipsec sa global-duration { time-based | traffic-based }
View
System view
Default level
2: System level
Parameters
seconds: Time-based global SA lifetime in seconds, in the range of 180 to 604800. kilobytes: Traffic-based global SA lifetime in kilobytes, in the range of 2560 to 4294967295.
Examples
# Set the time-based global SA lifetime to 7200 seconds (2 hours).
<Sysname> system-view [Sysname] ipsec sa global-duration time-based 7200
# Set the traffic-based global SA lifetime to 10240 kilobytes (10 Mbytes).

[Sysname] ipsec sa global-duration traffic-based 10240
ipsec session idle-time

Description
Use ipsec session idle-time to set the idle timeout for IPsec sessions. Use undo ipsec session idle-time to restore the default. By default, the IPsec session idle timeout is 300 seconds.
Syntax
ipsec session idle-time seconds undo ipsec session idle-time
View
System view
Default level
2: System level
187
Parameters
Seconds: IPsec session idle timeout in seconds, in the range of 60 to 3,600.
Examples
# Set the IPsec session idle timeout to 600 seconds.
<Sysname> system-view [Sysname] ipsec session idle-time 600
pfs
Description
Use pfs to enable and configure the PFS feature so that the system uses the feature when employing the IPsec policy or IPsec profile to initiate a negotiation. Use undo pfs to remove the configuration. By default, the PFS feature is not used for negotiation. In terms of security and necessary calculation time, the following four groups are in the descending order: 2048-bit Diffie-Hellman group (dh-group14), 1536-bit Diffie-Hellman group (dh-group5), 1024-bit DiffieHellman group (dh-group2) and 768-bit Diffie-Hellman group (dh-group1). This command allows IPsec to perform an additional key exchange process during the negotiation phase 2, providing an additional level of security. The local Diffie-Hellman group must be the same as that of the peer. This command can be used only when the SAs are to be set up through IKE negotiation. Related commands: ipsec policy-template, ipsec policy (system view) and ipsec profile (system view).
Syntax
pfs { dh-group1 | dh-group2 | dh-group5 | dh-group14 } undo pfs
View
Default level
2: System level
Parameters
dh-group1: Uses 768-bit Diffie-Hellman group. dh-group2: Uses 1024-bit Diffie-Hellman group. dh-group5: Uses 1536-bit Diffie-Hellman group. dh-group14: Uses 2048-bit Diffie-Hellman group.
Examples
# Enable and configure PFS for IPsec policy policy1.
<Sysname> system-view [Sysname] ipsec policy policy1 200 isakmp [Sysname-ipsec-policy-isakmp-policy1-200] pfs dh-group1
188
policy enable
Description
Used the policy enable to enable the IPsec policy. Use undo policy enable to disable the IPsec policy. By default, the IPsec policy is enabled. The command is not applicable to manual IPsec policies. If the IPsec policy is not enabled for the IKE peer, the peer cannot take part in the IKE negotiation. Related commands: ipsec policy (system view) and ipsec policy-template.
Syntax
policy enable undo policy enable
View
Default level
2: System level
Parameters
None
Examples
# Enable the IPsec policy with the name policy1 and sequence number 100.
<Sysname> system-view [Sysname] ipsec policy policy1 100 isakmp [Sysname-ipsec-policy-isakmp-policy1-100] policy enable
proposal (IPsec policy view/IPsec policy template view/IPsec profile view)

Description
Use proposal to specify the IPsec proposals for the IPsec policy or IPsec profile to reference. Use undo proposal to remove an IPsec proposal reference by the IPsec policy or IPsec profile. By default, an IPsec policy or IPsec profile references no IPsec proposal. The IPsec proposals must already exist. A manual IPsec policy can reference only one IPsec proposal. To replace a referenced IPsec proposal, use the undo proposal to remove the original proposal binding and then use the proposal to reconfigure one. An IKE negotiated IPsec policy can reference up to six IPsec proposals. The IKE negotiation process will search for and use the exactly matched proposal. An IPsec profile can reference up to six IPsec proposals. The IKE negotiation process will search for and use the exactly matched proposal. Related commands: ipsec proposal, ipsec policy (system view) and ipsec profile (system view).
189
Syntax
proposal proposal-name&<1-6> undo proposal [ proposal-name ]
View
Default level
2: System level
Parameters
proposal-name&<1-6>: Name of the IPsec proposal for the IPsec policy to reference, a string of 1 to 32 characters. &<1-6> means that you can specify the proposal-name argument for up to six times.
Examples
# Configure IPsec policy policy1 to reference IPsec proposal prop1.
<Sysname> system-view [Sysname] ipsec proposal prop1 [Sysname-ipsec-proposal-prop1] quit [Sysname] ipsec policy policy1 100 manual [Sysname-ipsec-policy-manual-policy1-100] proposal prop1
# Configure IPsec profile profile1 to reference IPsec proposal prop2.

<Sysname> system-view [Sysname] ipsec proposal prop2 [Sysname-ipsec-proposal-prop2] quit [Sysname] ipsec profile profile1 [Sysname-ipsec-profile-profile1] proposal prop2
qos pre-classify
Description
Use qos pre-classify to enable packet information pre-extraction. Use undo qos pre-classify to restore the default. By default, packet information pre-extraction is disabled. With the packet information pre-extraction feature enabled, QoS classifies a packet based on the header of the original IP packet, that is, the header of the IP packet that has not been encapsulated by IPsec. Related commands: ipsec policy (system view) and ipsec policy-template.
Syntax
qos pre-classify undo qos pre-classify
View
Default level
2: System level
190
Parameters
None
Examples
# Enable packet information pre-extraction.
<Sysname> system-view [Sysname] ipsec policy policy1 100 manual [Sysname-ipsec-policy-manual-policy1-100] qos pre-classify
reset ipsec sa
Description
Use reset ipsec sa to clear IPsec SAs. IPsec SAs appear in pairs. If you specify the parameters keyword to clear an IPsec SA, the IPsec SA in the other direction is also automatically cleared. If you do not specify any parameter, the command clears all IPsec SAs. Immediately after a manually set up SA is cleared, the system automatically sets up a new SA based on the parameters of the IPsec policy. After IKE negotiated SAs are cleared, the system sets up new SAs only when IKE negotiation is triggered by interesting packets. Related commands: display ipsec sa.
Syntax
reset ipsec sa [ parameters dest-address protocol spi | policy policy-name [ seq-number ] | remote ipaddress ]
View
User view
Default level
2: System level
Parameters
parameters dest-address protocol spi: Specifies IPsec SAs that use the specified destination address, security protocol, and SPI . dest-address: Destination address, in dotted decimal notation. protocol: Security protocol, which can be keyword ah or esp, case insensitive. spi: Security parameter index, in the range of 256 to 4294967295. policy: Specifies IPsec SAs that use an IPsec policy or IPsec profile. policy-name: Name of the IPsec policy or IPsec profile, a case-sensitive string of 1 to 15 alphanumeric characters. seq-number: Sequence number of the IPsec policy, in the range of 1 to 65535. If no seq-number is specified, all the policies in the IPsec policy group named policy-name are specified. remote ip-address: Specifies SAs to or from a remote address, in dotted decimal notation.
Examples
# Clear all IPsec SAs.
191
<Sysname> reset ipsec sa
# Clear the IPsec SA with a remote IP address of 10.1.1.2.

<Sysname> reset ipsec sa remote 10.1.1.2
# Clear all IPsec SAs of IPsec policy template policy1.

<Sysname> reset ipsec sa policy policy1
# Clear the IPsec SA of the IPsec policy with the name of policy1 and sequence number of 10.
<Sysname> reset ipsec sa policy policy1 10
# Clear the IPsec SA with a remote IP address of 10.1.1.2, security protocol of AH, and SPI of 10000.
<Sysname> reset ipsec sa parameters 10.1.1.2 ah 10000
# Clear all IPsec SAs of IPsec profile policy1.

<Sysname> reset ipsec sa policy policy1
reset ipsec session

Description
Use reset ipsec session to clear the sessions of a specified IPsec tunnel or all IPsec tunnels. Related commands: display ipsec session.
Syntax
reset ipsec session [ tunnel-id integer ]
View
User view
Default level
2: System level
Parameters
integer: ID of the IPsec tunnel, in the range of 1 to 2000000000.
Examples
# Clear all IPsec sessions.
<Sysname> reset ipsec session
# Clear the sessions of IPsec tunnel 5.

<Sysname> reset ipsec session tunnel-id 5
reset ipsec statistics

Description
Use reset ipsec statistics to clear IPsec packet statistics. Related commands: display ipsec statistics.
Syntax
reset ipsec statistics
View
User view
192
Default level
2: System level
Parameters
None
Examples
# Clear IPsec packet statistics.
<Sysname> reset ipsec statistics
reverse-route
Description
Use reverse-route to enable and configure the IPsec RRI feature. Use undo reverse-route to disable IPsec RRI. By default, IPsec RRI is disabled. IPsec RRI works in static mode or dynamic mode: Static IPsec RRI creates one static route for each destination address permitted by the ACL that the IPsec policy references. Static IPsec RRI creates static routes immediately after you configure IPsec RRI for an IPsec policy and apply the IPsec policy. When you disable RRI, or remove the ACL or the peer gateway IP address from the policy, IPsec RRI deletes all static routes it has created. The static mode applies to scenarios where the topologies of branch networks seldom change. Dynamic IPsec RRI dynamically creates static routes based on IPsec SAs. Dynamic IPsec RRI creates static routes when the IPsec SAs are established, and deletes the static routes when the IPsec SAs are deleted. The dynamic mode applies to scenarios where the topologies of branch networks change frequently.
The destination and next hop address in a static route created by IPsec RRI depend on your settings. See Table 26. Table 26 Possible IPsec RRI configurations and the generated routing information Command IPsec RRI mode Route destination Next hop address Manual IPsec policy: Peer
tunnel address set with the tunnel remote command reverse-route static Static Destination IP address specified in a permit rule of the ACL that is referenced by the IPsec policy
IPsec policy that uses IKE: The

remote tunnel endpoint, which is the address configured in the remote-address command in IKE view. Address identified by the ipaddress argument Remote tunnel endpoint
reverse-route remote-peer ipaddress static reverse-route reverse-route remote-peer ipaddress Dynamic Protected peer private network
Address identified by the ipaddress argument, typically, the next hop address of the interface where the IPsec policy is applied
193
Command
IPsec RRI mode
Route destination
Protected peer private network
Next hop address

Remote tunnel endpoint The address specified by the ipaddress argument (outgoing interface: the interface where the IPsec policy is applied)
reverse-route remote-peer ipaddress gateway
Remote tunnel endpoint
Enabling, disabling, or changing RRI settings in an IPsec policy deletes all IPsec SAs created or negotiated by the policy. To view static routes created by RRI, use the display ip routing-table command. For information about the routing table, see Layer 3IP Routing Configuration Guide. If you configure an address range in IKE peer view, static IPsec RRI does not take effect. Related commands: reverse-route preference and reverse-route tag.
Syntax
reverse-route [ remote-peer ip-address [ gateway | static ] | static ] undo reverse-route
View
Default level
2: System level
Parameters
static: Enables static IPsec RRI. Static IPsec RRI creates static routes based on the ACL that the IPsec policy references. This keyword is available only in IPsec policy view. If this keyword is not specified, you enable dynamic IPsec RRI, which creates static routes based on IPsec SAs. remote-peer ip-address: Specifies a next hop for the static routes. To use the static routes for route backup and load balancing, specify this option. gateway: Creates two recursive routes: one to the remote tunnel endpoint and the other to the protected remote private network. Use gateway keyword in an IKE-enabled IPsec policy to define an explicit default forwarding path for IPsec traffic.
Examples
# Configure static IPsec RRI to create static routes based on ACL 3000. Take the peer private network 3.0.0.0/24 as the destination and the remote gateway 1.1.1.2 as the next hop.
<Sysname> system-view [Sysname] ike peer 1 [Sysname-ike-peer-1] remote-address 1.1.1.2 [Sysname-ike-peer-1] quit [Sysname] acl number 3000 [Sysname-acl-adv-3000] rule 0 permit ip source 2.0.0.0 0.0.0.255 destination 3.0.0.0 0.0.0.255 [Sysname-acl-adv-3000] quit [Sysname] ipsec policy 1 1 isakmp [Sysname-ipsec-policy-isakmp-1-1] security acl 3000
194
[Sysname-ipsec-policy-isakmp-1-1] proposal tran1 [Sysname-ipsec-policy-isakmp-1-1] ike-peer 1 [Sysname-ipsec-policy-isakmp-1-1] reverse-route static [Sysname-ipsec-policy-isakmp-1-1] quit [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] ipsec policy 1 [Sysname-Ethernet1/1]quit
# Display the routing table. You can see that IPsec RRI has created the static route. (Other routes are omitted.)
[Sysname] display ip routing-table ... Destination/Mask 3.0.0.0/24 Proto Pre Cost 0 NextHop 1.1.1.2 Interface Eth1/1 Static 60
# Configure static IPsec RRI to create static routes based on ACL 3000. Take the peer private network as the destination and 1.1.1.3 as the next hop.
[Sysname] ipsec policy 1 1 isakmp [Sysname-ipsec-policy-isakmp-1-1] reverse-route remote-peer 1.1.1.3 static [Sysname-ipsec-policy-isakmp-1-1] quit
# Display the routing table. You can see that IPsec RRI has created the static route. (Other routes are omitted.)
# Configure dynamic IPsec RRI to create static routes based on IPsec SAs. Take the peer private network as the destination and the remote tunnel endpoint 1.1.1.2 as the next hop.
[Sysname] ipsec policy 1 1 isakmp [Sysname-ipsec-policy-isakmp-1-1] reverse-route [Sysname-ipsec-policy-isakmp-1-1] quit
# Display the routing table. The expected route appears in the table after the IPsec SA negotiation succeeds. (Other routes are omitted.)
# Configure dynamic IPsec RRI to create static routes based on IPsec SAs. Take 1.1.1.3 as the next hop.
[Sysname] ipsec policy 1 1 isakmp [Sysname-ipsec-policy-isakmp-1-1] reverse-route remote-peer 1.1.1.3 [Sysname-ipsec-policy-isakmp-1-1] quit
# Display the routing table. The expected route appears in the routing table after the IPsec SA negotiation succeeds. (Other routes are omitted.)
195
# Configure dynamic IPsec RRI to create two static routes based on an IPsec SA: one to the peer private network 3.0.0.0/24 via the remote tunnel endpoint 1.1.1.2, and the other to the remote tunnel endpoint via 1.1.1.3.
[Sysname]ipsec policy 1 1 isakmp [Sysname-ipsec-policy-isakmp-1-1] reverse-route remote-peer 1.1.1.3 gateway
# Display the routing table. The expected routes appear in the routing table after the IPsec SA negotiation succeeds. (Other routes are omitted.)
[Sysname] display ip routing-table ... Destination/Mask 1.1.1.2/32 3.0.0.0/24 Proto Pre Cost 0 0 NextHop 1.1.1.3 1.1.1.2 Interface Eth1/1 Eth1/1 Static 60 Static 60
reverse-route preference
Description
Use reverse-route preference to change the preference of the static routes created by IPsec RRI. Use undo reverse-route preference to restore the default. The default preference for the static routes created by IPsec RRI is 60. When you change the route preference, static IPsec RRI deletes all static routes it has created and creates new static routes. In contrast, dynamic IPsec RRI applies the new preference only to subsequent static routes. It does not delete or modify static routes it has created. Related commands: reverse-route.
Syntax
reverse-route preference preference-value undo reverse-route preference
View
IPsec policy view
Default level
2: System level
Parameters
preference-value: Sets a preference value for the static routes created by IPsec RRI. The value range is 1 to 255. A smaller value represents a higher preference.
Examples
# Set the preference to 100 for static routes populated by IPsec RRI.
<Sysname>system-view [Sysname] ipsec policy 1 1 isakmp [Sysname-ipsec-policy-isakmp-1-1] reverse-route preference 100
196
reverse-route tag
Description
Use reverse-route tag to set a route tag for the static routes created by IPsec RRI. This tag helps in implementing flexible route control through routing policies. Use undo reverse-route tag to restore the default. By default, the tag value is 0 for the static routes created by IPsec RRI. This command makes sense only when used together with the reverse-route command. When you change the route tag, static IPsec RRI deletes all static routes it has created and creates new static routes. In contrast, dynamic IPsec RRI applies the new route tag only to subsequent static routes. It does not delete or modify static routes it has created. For information about routing policies, see Layer 3IP Routing Configuration Guide. Related commands: reverse-route.
Syntax
reverse-route tag tag-value undo reverse-route tag
View
IPsec policy view
Default level
2: System level
Parameters
tag-value: Sets a route tag for the static routes. The value range is 1 to 4294967295.
Examples
# Set the tag value to 50 for the static routes created by IPsec RRI.
<Sysname>system-view [Sysname] ipsec policy 1 1 isakmp [Sysname-ipsec-policy-isakmp-1-1] reverse-route tag 50
sa authentication-hex
Description
Use sa authentication-hex to configure an authentication key for an SA. Use undo sa authentication-hex to remove the configuration. This command applies to only manual IPsec policies. When configuring a manual IPsec policy, you must set the parameters of both the inbound and outbound SAs. The authentication key for the inbound SA at the local end must be the same as that for the outbound SA at the remote end, and the authentication key for the outbound SA at the local end must be the same as that for the inbound SA at the remote end.
197
With an IPsec policy for an IPv6 routing protocol, the local SPI of the inbound SA and that of the outbound SA must be identical. At both ends of an IPsec tunnel, the keys for the inbound and outbound SAs must be in the same format. Related commands: ipsec policy (system view).
Syntax
sa authentication-hex { inbound | outbound } { ah | esp } hex-key undo sa authentication-hex { inbound | outbound } { ah | esp }
View
IPsec policy view
Default level
2: System level
Parameters
inbound: Specifies the inbound SA through which IPsec processes the received packets. outbound: Specifies the outbound SA through which IPsec processes the packets to be sent. ah: Uses AH. esp: Uses ESP. hex-key: Authentication key for the SA, in hexadecimal format. The length of the key is 16 bytes for MD5 and 20 bytes for SHA1.
Examples
# Configure the authentication keys of the inbound and outbound SAs that use AH as 0x1 12233445566778899aabbccddeeff00 and 0xaabbccddeeff001 100aabbccddeeff00 respectively.
<Sysname> system-view [Sysname] ipsec policy policy1 100 manual [Sysname-ipsec-policy-manual-policy1-100] 112233445566778899aabbccddeeff00 [Sysname-ipsec-policy-manual-policy1-100] aabbccddeeff001100aabbccddeeff00 sa sa authentication-hex authentication-hex inbound outbound ah ah
sa duration
Description
Use sa duration to set an SA lifetime for the IPsec policy or IPsec profile. Use undo sa duration to restore the default. By default, the SA lifetime of an IPsec policy or an IPsec profile equals the current global SA lifetime. By default, the time-based global SA lifetime is 3600 seconds, and traffic-based SA lifetime is 1843200 kilobytes. When negotiating to set up an SA, IKE prefers the lifetime settings of the IPsec policy or IPsec profile that it uses. If the IPsec policy or IPsec proposal is not configured with its own lifetime settings, IKE uses the global SA lifetime settings, which are configured with the ipsec sa global-duration command. When negotiating to set up an SA, IKE prefers the shorter ones of the local lifetime settings and those proposed by the remote.
198
The SA lifetime applies to only IKE negotiated SAs. It is not effective for manually configured SAs. Related commands: ipsec sa global-duration, ipsec policy (system view) and ipsec profile (system view).
Syntax
sa duration { time-based seconds | traffic-based kilobytes } undo sa duration { time-based | traffic-based }
View
Default level
2: System level
Parameters
seconds: Time-based SA lifetime in seconds, in the range of 180 to 604800. kilobytes: Traffic-based SA lifetime in kilobytes, in the range of 2560 to 4294967295.
Examples
# Set the SA lifetime for IPsec policy1 to 7200 seconds (two hours).
<Sysname> system-view [Sysname] ipsec policy policy1 100 isakmp [Sysname-ipsec-policy-isakmp-policy1-100] sa duration time-based 7200
# Set the SA lifetime for IPsec policy policy1 to 20480 kilobytes (20 Mbytes).
<Sysname> system-view [Sysname] ipsec policy policy1 100 isakmp [Sysname-ipsec-policy-isakmp-policy1-100] sa duration traffic-based 20480
# Set the SA lifetime for IPsec profile profile1 to 7200 seconds (two hours).
<Sysname> system-view [Sysname] ipsec profile profile1 [Sysname-ipsec-profile-profile1] sa duration time-based 7200
# Set the SA lifetime for IPsec profile profile1 to 20480 kilobytes (20 Mbytes).
<Sysname> system-view [Sysname] ipsec profile profile1 [Sysname-ipsec-profile-profile1] sa duration traffic-based 20480
sa encryption-hex
Description
Use sa encryption-hex to configure an encryption key for an SA. Use undo sa encryption-hex to remove the configuration. This command applies to only manual IPsec policies. When configuring a manual IPsec policy, you must set the parameters of both the inbound and outbound SAs. The encryption key for the inbound SA at the local end must be the same as that for the outbound SA at the remote end, and the encryption key for the outbound SA at the local end must be the same as that for the inbound SA at the remote end.
199
With an IPsec policy for an IPv6 routing protocol, the local SPI of the inbound SA and that of the outbound SA must be identical. At both ends of an IPsec tunnel, the keys for the inbound and outbound SAs must be in the same format. Related commands: ipsec policy (system view).
Syntax
sa encryption-hex { inbound | outbound } esp hex-key undo sa encryption-hex { inbound | outbound } esp
View
IPsec policy view
Default level
2: System level
Parameters
inbound: Specifies the inbound SA through which IPsec processes the received packets. outbound: Specifies the outbound SA through which IPsec processes the packets to be sent. esp: Uses ESP. hex-key: Encryption key for the SA, in hexadecimal format. The length of the key must be 8 bytes for DESCBC, 24 bytes for 3DES-CBC, 16 bytes for AES128-CBC, 24 bytes for AES192-CBC, and 32 bytes for AES256-CBC.
Examples
# Configure the encryption keys for the inbound and 0x1234567890abcdef and 0xabcdefabcdef1234 respectively.
<Sysname> system-view [Sysname] ipsec policy policy1 100 manual [Sysname-ipsec-policy-manual-policy1-100] sa encryption-hex inbound esp 1234567890abcdef [Sysname-ipsec-policy-manual-policy1-100] sa encryption-hex outbound esp abcdefabcdef1234
outbound
SAs
that
use
ESP
as
sa spi
Description
Use sa spi to configure an SPI for an SA. Use undo sa spi to remove the configuration. This command applies to only manual IPsec policies. When configuring a manual IPsec policy, you must configure parameters for both inbound and outbound SAs. For an ACL-based manual IPsec policy, specify different SPIs for different SAs. The local inbound SA must use the same SPI and keys as the remote outbound SA. The same is true of the local outbound SA and remote inbound SA. When configuring IPsec for an IPv6 routing protocol, follow these guidelines: The inbound and outbound SAs at the local end must use the same SPI. Within a certain network scope, each router must use the same SPI and keys for its inbound and outbound SAs, and all routers must use the same SPI and keys. For OSPFv3, the scope can be
200
directly connected neighbors or an OSPFv3 area. For RIPng, the scope can be directly connected neighbors or a RIPng process. For IPv6 BGP, the scope can be directly connected neighbors or a neighbor group. Related commands: ipsec policy (system view).
Syntax
sa spi { inbound | outbound } { ah | esp } spi-number undo sa spi { inbound | outbound } { ah | esp }
View
IPsec policy view
Default level
2: System level
Parameters
inbound: Specifies the inbound SA through which IPsec processes the received packets. outbound: Specifies the outbound SA through which IPsec processes the packets to be sent. ah: Uses AH. esp: Uses ESP. spi-number: SPI in the SA triplet, in the range of 256 to 4294967295.
Examples
# Set the SPI for the inbound SA to 10000 and that for the outbound SA to 20000 in a manual IPsec policy.
<Sysname> system-view [Sysname] ipsec policy policy1 100 manual [Sysname-ipsec-policy-manual-policy1-100] sa spi inbound ah 10000 [Sysname-ipsec-policy-manual-policy1-100] sa spi outbound ah 20000
sa string-key
Description
Use sa string-key to set a key string for an SA. Use undo sa string-key to remove the configuration. This command applies to only manual IPsec policies. When configuring a manual IPsec policy, you must set parameters for both inbound and outbound SAs. The local inbound SA must use the same SPI and keys as the remote outbound SA. The same is true of the local outbound SA and remote inbound SA. Enter keys in the same format for the local and remote inbound and outbound SAs. For example, if the local inbound SA uses a key in characters, the local outbound SA and remote inbound and outbound SAs must use keys in characters. When configuring an IPsec policy for an IPv6 protocol, follow these guidelines: Within a certain network scope, each router must use the same SPI and keys for its inbound and outbound SAs, and all routers must use the same SPI and keys. For OSPFv3, the scope can be
201
directly connected neighbors or an OSPFv3 area. For RIPng, the scope can be directly connected neighbors or a RIPng process. For IPv6 BGP, the scope can be directly connected neighbors or a neighbor group. Enter the keys in the same format on all routers. For example, if you enter the keys in hexadecimal format on one router, do so across the defined scope.
Related commands: ipsec policy (system view).
Syntax
sa string-key { inbound | outbound } { ah | esp } string-key undo sa string-key { inbound | outbound } { ah | esp }
View
IPsec policy view
Default level
2: System level
Parameters
inbound: Specifies the inbound SA through which IPsec processes the received packets. outbound: Specifies the outbound SA through which IPsec processes the packets to be sent. ah: Uses AH. esp: Uses ESP. string-key: Key string for the SA, consisting of 1 to 255 characters. For different algorithms, enter strings of any length in the specified range. Using this key string, the system automatically generates keys meeting the algorithm requirements. When the protocol is ESP, the system generates the keys for the authentication algorithm and encryption algorithm respectively.
Examples
# Configure the inbound and outbound SAs that use AH to use the keys abcdef and efcdab respectively.
<Sysname> system-view [Sysname] ipsec policy policy1 100 manual [Sysname-ipsec-policy-manual-policy1-100] sa string-key inbound ah abcdef [Sysname-ipsec-policy-manual-policy1-100] sa string-key outbound ah efcdab
# Configure the inbound and outbound SAs that use AH to use the key abcdef.
<Sysname> system-view [Sysname] ipsec policy policy1 100 manual [Sysname-ipsec-policy-manual-policy1-100] sa string-key inbound ah abcdef [Sysname-ipsec-policy-manual-policy1-100] sa string-key outbound ah abcdef
security acl
Description
Use security acl to specify the ACL for the IPsec policy to reference. Use undo security acl to remove the configuration. By default, an IPsec policy references no ACL. With an IKE-dependent IPsec policy configured, data flows can be protected in two modes:
202
Standard mode, in which one tunnel protects one data flow. The data flow permitted by each ACL rule is protected by one tunnel that is established separately for it. Aggregation mode, in which one tunnel protects all data flows permitted by all the rules of an ACL.
When the two peers support both data flow protection modes, they must be configured to work in the same mode. Related commands: ipsec policy (system view).
Syntax
security acl acl-number [ aggregation ] undo security acl
View
Default level
2: System level
Parameters
acl-number: Number of the ACL for the IPsec policy to reference, in the range of 3000 to 3999. aggregation: Uses the data flow protection mode of aggregation. If you do not specify this keyword, the standard mode is used.
Examples
# Configure IPsec policy policy1 to reference ACL 3001.
<Sysname> system-view [Sysname] acl number 3001 [Sysname-acl-adv-3001] rule permit tcp source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 [Sysname-acl-adv-3001] quit [Sysname] ipsec policy policy1 100 manual [Sysname-ipsec-policy-manual-policy1-100] security acl 3001
# Configure IPsec policy policy2 to reference ACL 3002, setting the data flow protection mode to aggregation.
<Sysname> system-view [Sysname] acl number 3002 [Sysname-acl-adv-3002] rule 0 permit ip source 10.1.2.1 0.0.0.255 destination 10.1.2.2 0.0.0.255 [Sysname-acl-adv-3002] rule 1 permit ip source 10.1.3.1 0.0.0.255 destination 10.1.3.2 0.0.0.255 [Sysname] ipsec policy policy2 1 isakmp [Sysname-ipsec-policy-isakmp-policy2-1] security acl 3002 aggregation
transform
Description
Use transform to specify a security protocol for an IPsec proposal. Use undo transform to restore the default.
203
By default, the ESP protocol is used. If ESP is used, the default encryption and authentication algorithms are DES and MD5 respectively. If AH is used, the default authentication algorithm is MD5. If both AH and ESP are used, AH uses the MD5 authentication algorithm by default, and ESP uses the DES encryption algorithm but no authentication algorithm by default. The IPsec proposals at the two ends of an IPsec tunnel must use the same security protocol. Related commands: ipsec proposal.
Syntax
transform { ah | ah-esp | esp } undo transform
View
IPsec proposal view
Default level
2: System level
Parameters
ah: Uses the AH protocol. ah-esp: Uses ESP first and then AH. esp: Uses the ESP protocol.
Examples
# Configure IPsec proposal prop1 to use AH.
<Sysname> system-view [Sysname] ipsec proposal prop1 [Sysname-ipsec-proposal-prop1] transform ah
tunnel local
Description
Use tunnel local to configure the local address of an IPsec tunnel. Use undo tunnel local to remove the configuration. By default, no local address is configured for an IPsec tunnel. This command applies to only manual IPsec policies. The local address, if not configured, will be the address of the interface to which the IPsec policy is applied. Related commands: ipsec policy (system view).
Syntax
tunnel local ip-address undo tunnel local
204
View
IPsec policy view
Default level
2: System level
Parameters
ip-address: Local address for the IPsec tunnel.
Examples
# Set the local address of the IPsec tunnel to the address of Loopback 0, 10.0.0.1.
<Sysname> system-view [Sysname] interface loopback 0 [Sysname-LoopBack0] ip address 10.0.0.1 32 [Sysname-LoopBack0] quit [Sysname] ipsec policy policy1 100 manual [Sysname-ipsec-policy-manual-policy1-100] tunnel local 10.0.0.1
tunnel remote
Description
Use tunnel remote to configure the remote address of an IPsec tunnel. Use undo tunnel remote to remove the configuration. By default, no remote address is configured for the IPsec tunnel. This command applies to only manual IPsec policies. If you configure the remote address repeatedly, the last one takes effect. An IPsec tunnel is established between the local and remote ends. The remote IP address of the local end must be the same as that of the local IP address of the remote end. Related commands: ipsec policy (system view).
Syntax
tunnel remote ip-address undo tunnel remote [ ip-address ]
View
IPsec policy view
Default level
2: System level
Parameters
ip-address: Remote address for the IPsec tunnel.
Examples
# Set the remote address of the IPsec tunnel to 10.1.1.2.
<Sysname> system-view [Sysname] ipsec policy policy1 10 manual [Sysname-ipsec-policy-policy1-10] tunnel remote 10.1.1.2
205
IKE configuration commands

authentication-algorithm
Description
Use authentication-algorithm to specify an authentication algorithm for an IKE proposal. Use undo authentication-algorithm to restore the default. By default, an IKE proposal uses the SHA1 authentication algorithm. Related commands: ike proposal and display ike proposal.
Syntax
authentication-algorithm { md5 | sha } undo authentication-algorithm
View
IKE proposal view
Default level
2: System level
Parameters
md5: Uses HMAC-MD5. sha: Uses HMAC-SHA1.
Examples
# Set MD5 as the authentication algorithm for IKE proposal 10.
<Sysname> system-view [Sysname] ike proposal 10 [Sysname-ike-proposal-10] authentication-algorithm md5
authentication-method
Description
Use authentication-method to specify an authentication method for an IKE proposal. Use undo authentication-method to restore the default. By default, an IKE proposal uses the pre-shared key authentication method. Related commands: ike proposal and display ike proposal.
Syntax
authentication-method { pre-share | rsa-signature } undo authentication-method
206
View
IKE proposal view
Default level
2: System level
Parameters
pre-share: Uses the pre-shared key method. rsa-signature: Uses the RSA digital signature method.
Examples
# Specify that IKE proposal 10 uses the pre-shared key authentication method.
<Sysname> system-view [Sysname] ike proposal 10 [Sysname-ike-proposal-10] authentication-method pre-share
certificate domain
Description
Use certificate domain to configure the PKI domain of the certificate when IKE uses digital signature as the authentication mode. Use undo certificate domain to remove the configuration. Related commands: authentication-method and pki domain.
Syntax
certificate domain domain-name undo certificate domain
View
IKE peer view
Default level
2: System level
Parameters
domain-name: Name of the PKI domain, a string of 1 to 15 characters.
Examples
# Configure the PKI domain as abcde for IKE negotiation.
<Sysname> system-view [Sysname] ike peer peer1 [Sysname-ike-peer-peer1] certificate domain abcde
dh
Description
Use dh to specify the DH group to be used in key negotiation phase 1 for an IKE proposal. Use undo dh to restore the default.
207
By default, group1, the 768-bit Diffie-Hellman group, is used. Related commands: ike proposal and display ike proposal.
Syntax
dh { group1 | group2 | group5 | group14 } undo dh
View
IKE proposal view
Default level
2: System level
Parameters
group1: Uses the 768-bit Diffie-Hellman group for key negotiation in phase 1 group2: Uses the 1024-bit Diffie-Hellman group for key negotiation in phase 1. group5: Uses the 1536-bit Diffie-Hellman group for key negotiation in phase 1. group14: Uses the 2048-bit Diffie-Hellman group for key negotiation in phase 1.
Examples
# Specify 768-bit Diffie-Hellman for IKE proposal 10.
<Sysname> system-view [Sysname] ike proposal 10 [Sysname-ike-proposal-10] dh group1
display ike dpd

Description
Use display ike dpd to display information about DPD detectors. If you do not specify any parameters, the command displays information about all DPD detectors. Related commands: ike dpd.
Syntax
display ike dpd [ dpd-name ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
dpd-name: DPD name, a string of 1 to 32 characters. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression.
208
Examples
# Display information about all DPD detectors.
<Sysname> display ike dpd --------------------------IKE dpd: dpd1 references: 1 interval-time: 10 time_out: 5 ---------------------------

references Interval-time time_out
Description
Number of IKE peers that use the DPD detector DPD query trigging interval in seconds DPD packet retransmission interval in seconds
display ike peer

Description
Use display ike peer to display information about IKE peers. If you do not specify any parameters, the command displays information about all IKE peers. Related commands: ike peer.
Syntax
display ike peer [ peer-name ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
peer-name: Name of the IKE peer, a string of 1 to 32 characters. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
209
Examples
# Display information about all IKE peers.
<Sysname> display ike peer --------------------------IKE Peer: rtb4tunn exchange mode: main on phase 1 pre-shared-key simple 123 peer id type: ip peer ip address: 44.44.44.55 local ip address: peer name: nat traversal: disable dpd: dpd1 ---------------------------

exchange mode pre-shared-key peer id type peer ip address local ip address peer name nat traversal dpd
Description
IKE negotiation mode in phase 1 Pre-shared key used in phase 1 ID type used in phase 1 IP address of the remote security gateway IP address of the local security gateway Name of the remote security gateway Whether NAT traversal is enabled Name of the peer DPD detector
display ike proposal

Description
Use display ike proposal to view the settings of all IKE proposals. This command displays the configuration information of all IKE proposals in the descending order of proposal priorities. Related commands: authentication-method, algorithm, dh, and sa duration. ike proposal, encryption-algorithm, authentication-
Syntax
display ike proposal [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
210
Parameters
Examples
# Display the settings of all IKE proposals.
<Sysname> display ike proposal priority authentication authentication encryption Diffie-Hellman duration method 10 11 default PRE_SHARED PRE_SHARED PRE_SHARED algorithm SHA MD5 SHA algorithm DES_CBC DES_CBC DES_CBC group MODP_1024 MODP_768 MODP_768 (seconds) 5000 50000 86400 --------------------------------------------------------------------------

priority authentication method authentication algorithm encryption algorithm Diffie-Hellman group duration (seconds)
Description
Priority of the IKE proposal Authentication method used by the IKE proposal Authentication algorithm used by the IKE proposal Encryption algorithm used by the IKE proposal DH group used in IKE negotiation phase 1 ISAKMP SA lifetime of the IKE proposal in seconds
display ike sa
Description
Use display ike sa to display information about the current IKE SAs. If you do not specify any parameters or keywords, the command displays brief information about the current IKE SAs. Related commands: ike proposal and ike peer.
Syntax
display ike sa [ verbose [ connection-id connection-id | remote-address remote-address ] ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
211
Parameters
verbose: Displays detailed information. connection-id: Displays detailed information about IKE SAs by connection ID, in the range of 1 to 2000000000. remote-address: Displays detailed information about IKE SAs by remote address.
|: Filters command output by specifying a regular expression. For more information about regular
expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display brief information about the current IKE SAs.
<Sysname> display ike sa total phase-1 SAs: connection-id 1 2 flag meaning RD--READY ST--STAYALIVE RL--REPLACED FDFADING TOTIMEOUT peer 202.38.0.2 202.38.0.2 1 flag RD|ST RD|ST phase 1 2 doi IPSEC IPSEC
----------------------------------------------------------

total phase-1 SAs connection-id peer
Description
Total number of SAs for phase 1 Identifier of the ISAKMP SA Remote IP address of the SA Status of the SA:
RD (READY): The SA has been established. ST (STAYALIVE): This end is the initiator of the tunnel negotiation. RL (REPLACED): The tunnel has been replaced by a new one and will be
flag deleted later.
FD (FADING): The soft lifetime is over but the tunnel is still in use. The tunnel
will be deleted when the hard lifetime is over.
TO (TIMEOUT): The SA has received no keepalive packets after the last

keepalive timeout. If no keepalive packets are received before the next keepalive timeout, the SA will be deleted. The phase the SA belongs to: phase
Phase 1: The phase for establishing the ISAKMP SA. Phase 2: The phase for negotiating the security service. IPsec SAs are
established in this phase. Interpretation domain the SA belongs to
doi
212
# Display detailed information about the current IKE SAs.

<Sysname> display ike sa verbose --------------------------------------------connection id: 2 vpn-instance: 1 transmitting entity: initiator --------------------------------------------local ip: 4.4.4.4 local id type: IPV4_ADDR local id: 4.4.4.4 remote ip: 4.4.4.5 remote id type: IPV4_ADDR remote id: 4.4.4.5 authentication-method: PRE-SHARED-KEY authentication-algorithm: HASH-SHA1 encryption-algorithm: DES-CBC life duration(sec): 86400 remaining key duration(sec): 86379 exchange-mode: MAIN diffie-hellman group: GROUP1 nat traversal: NO
# Display detailed information about the IKE SA with the connection ID of 2.

<Sysname> display ike sa verbose connection-id 2 --------------------------------------------connection id: 2 vpn-instance: vpn1 transmitting entity: initiator --------------------------------------------local ip: 4.4.4.4 local id type: IPV4_ADDR local id: 4.4.4.4 remote ip: 4.4.4.5 remote id type: IPV4_ADDR remote id: 4.4.4.5 authentication-method: PRE-SHARED-KEY authentication-algorithm: HASH-SHA1 encryption-algorithm: DES-CBC life duration(sec): 86400 remaining key duration(sec): 82480 exchange-mode: MAIN diffie-hellman group: GROUP1 nat traversal: NO
213
# Display detailed information about the IKE SA with the remote address of 4.4.4.5.
<Sysname> display ike sa verbose remote-address 4.4.4.5 --------------------------------------------connection id: 2 vpn-instance: vpn1 transmitting entity: initiator --------------------------------------------local ip: 4.4.4.4 local id type: IPV4_ADDR local id: 4.4.4.4 remote ip: 4.4.4.5 remote id type: IPV4_ADDR remote id: 4.4.4.5 authentication-method: PRE-SHARED-KEY authentication-algorithm: HASH-SHA1 encryption-algorithm: DES-CBC life duration(sec): 86400 remaining key duration(sec): 82236 exchange-mode: MAIN diffie-hellman group: GROUP1 nat traversal: NO

connection id vpn-instance transmitting entity local ip local id type local id remote ip remote id type remote id authentication-method authentication-algorithm encryption-algorithm life duration(sec) remaining key duration(sec) exchange-mode diffie-hellman group
Description
Identifier of the ISAKMP SA MPLS L3VPN that the protected data belongs to Entity in the IKE negotiation IP address of the local gateway Identifier type of the local gateway Identifier of the local gateway IP address of the remote gateway Identifier type of the remote gateway Identifier of the remote security gateway Authentication method used by the IKE proposal Authentication algorithm used by the IKE proposal Encryption algorithm used by the IKE proposal Lifetime of the ISAKMP SA in seconds Remaining lifetime of the ISAKMP SA in seconds IKE negotiation mode in phase 1 DH group used for key negotiation in IKE phase 1 214
Field
nat traversal
Description
Whether NAT traversal is enabled
dpd
Description
Use dpd to apply a DPD detector to an IKE peer. Use undo dpd to remove the application. By default, no DPD detector is applied to an IKE peer.
Syntax
dpd dpd-name undo dpd
View
IKE peer view
Default level
2: System level
Parameters
dpd-name: DPD detector name, a string of 1 to 32 characters.
Examples
# Apply dpd1 to IKE peer peer1.
<Sysname> system-view [Sysname] ike peer peer1 [Sysname-ike-peer-peer1] dpd dpd1
encryption-algorithm
Description
Use encryption-algorithm to specify an encryption algorithm for an IKE proposal. Use undo encryption-algorithm to restore the default. By default, an IKE proposal uses the 56-bit DES encryption algorithm in CBC mode. Related commands: ike proposal and display ike proposal.
Syntax
encryption-algorithm { 3des-cbc | aes-cbc [ key-length ] | des-cbc } undo encryption-algorithm
View
IKE proposal view
Default level
2: System level
215
Parameters
3des-cbc: Uses the 3DES algorithm in CBC mode as the encryption algorithm. The 3DES algorithm uses 168-bit keys for encryption. aes-cbc: Uses the AES algorithm in CBC mode as the encryption algorithm. The AES algorithm uses 128bit, 192-bit, or 256-bit keys for encryption. key-length: Key length for the AES algorithm, which can be 128, 192 or 256 bits and is defaulted to 128 bits. des-cbc: Uses the DES algorithm in CBC mode as the encryption algorithm. The DES algorithm uses 56-bit keys for encryption.
Examples
# Use 56-bit DES in CBC mode as the encryption algorithm for IKE proposal 10.
<Sysname> system-view [Sysname] ike proposal 10 [Sysname-ike-proposal-10] encryption-algorithm des-cbc
exchange-mode
Description
Use exchange-mode to select an IKE negotiation mode. Use undo exchange-mode to restore the default. By default, main mode is used. If the user at the remote end of an IPsec tunnel obtains IP address automatically (for example, a dial-up user), and pre-shared key authentication is used, it is a good practice to set the IKE negotiation mode to aggressive.
Related commands: id-type. Syntax

exchange-mode { aggressive | main } undo exchange-mode
View
IKE peer view
Default level
2: System level
Parameters
aggressive: Aggressive mode. main: Main mode.
Examples
# Specify that IKE negotiation works in main mode.
<Sysname> system-view [Sysname] ike peer peer1 [Sysname-ike-peer-peer1] exchange-mode main
216
id-type
Description
Use id-type to select the type of the ID for IKE negotiation. Use undo id-type to restore the default. By default, the ID type is IP address. In main mode, only the ID type of IP address can be used in IKE negotiation and SA creation. In aggressive mode, either type can be used. If the ID type of FQDN is used, configure a name without any at sign (@) for the local security gateway, for example, foo.bar.com. If the ID type of user FQDN is used, configure a name with an at sign (@) for the local security gateway, for example, [email protected]. Related commands: local-name, ike local-name, remote-name, remote-address, local-address, and exchange-mode.
Syntax
id-type { ip | name | user-fqdn } undo id-type
View
IKE peer view
Default level
2: System level
Parameters
ip: Uses an IP address as the ID during IKE negotiation. name: Uses a name of the FQDN type as the ID during IKE negotiation. user-fqdn: Uses a name of the user FQDN type as the ID during IKE negotiation.
Examples
# Use ID type of name during IKE negotiation.
<Sysname> system-view [Sysname] ike peer peer1 [Sysname-ike-peer-peer1] id-type name
ike dpd
Description
Use ike dpd to create a DPD detector and enter IKE DPD view. Use undo ike dpd to remove a DPD detector. DPD irregularly detects dead IKE peers. It works as follows:
1. 2.
When the local end sends an IPsec packet, it checks the time the last IPsec packet was received from the peer. If the time interval exceeds the DPD interval, it sends a DPD hello to the peer.
217
3. 4.
If the local end receives no DPD acknowledgement within the DPD packet retransmission interval, it retransmits the DPD hello. If the local end still receives no DPD acknowledgement after having made the maximum number of retransmission attempts (two by default), it considers the peer already dead, and clears the IKE SA and the IPsec SAs based on the IKE SA.
DPD enables an IKE entity to check the liveliness of its peer only when necessary. It generates less traffic than the keepalive mechanism, which exchanges messages periodically. Related commands: display ike dpd, interval-time, and time-out.
Syntax
ike dpd dpd-name undo ike dpd dpd-name
View
System view
Default level
2: System level
Parameters
dpd-name: Name for the DPD detector, a string of 1 to 32 characters.
Examples
# Create a DPD detector named dpd2.
<Sysname> system-view [Sysname] ike dpd dpd2
ike local-name
Description
Use ike local-name to configure a name for the local security gateway. Use undo ike local-name to restore the default. By default, the device name is used as the name of the local security gateway. If you configure the id-type name or id-type user-fqdn command on the initiator, the IKE negotiation peer uses the security gateway name as its ID to initiate IKE negotiation, and you must configure the ike localname command in system view or the local-name command in IKE peer view on the local device. If you configure both the ike local-name command and the local-name command, the name configured by the local-name command is used. The IKE negotiation initiator sends its security gateway name as its ID to the peer, and the peer uses the security gateway name configured with the remote-name to authenticate the initiator. Make sure the local gateway name matches the remote gateway name configured on the peer. Related commands: remote-name and id-type.
Syntax
ike local-name name undo ike local-name
218
View
System view
Default level
2: System level
Parameters
name: Name of the local security gateway for IKE negotiation, a case-sensitive string of 1 to 32 characters.
Examples
# Configure the local security gateway name as app.
<Sysname> system-view [Sysname] ike local-name app
ike next-payload check disabled

Description
Use ike next-payload check disabled to disable the checking of the Next payload field in the last payload of an IKE message during IKE negotiation, gaining interoperation with products assigning the field a value other than zero. Use undo ike next-payload check disabled to restore the default. By default, the Next payload field is checked.
Syntax
ike next-payload check disabled
undo ike next-payload check disabled
View
System view
Default level
2: System level
Parameters
None
Examples
# Disable Next payload field checking for the last payload of an IKE message.
<Sysname> system-view [Sysname] ike next-payload check disabled
ike peer (system view)

Description
Use ike peer to create an IKE peer and enter IKE peer view. Use undo ike peer to delete an IKE peer.
219
Syntax
ike peer peer-name undo ike peer peer-name
View
System view
Default level
2: System level
Parameters
peer-name: IKE peer name, a string of 1 to 32 characters.
Examples
# Create an IKE peer named peer1 and enter IKE peer view.
<Sysname> system-view [Sysname] ike peer peer1 [Sysname-ike-peer-peer1]
ike proposal
Description
Use ike proposal to create an IKE proposal and enter IKE proposal view. Use undo ike proposal to delete an IKE proposal. The system provides a default IKE proposal, which has the lowest priority and uses these settings: Encryption algorithm DES-CBC Authentication algorithm HMAC-SHA1 Authentication method Pre-shared key DH group MODP_768 SA lifetime 86400 seconds
Related commands: display ike proposal.
Syntax
ike proposal proposal-number undo ike proposal proposal-number
View
System view
Default level
2: System level
Parameters
proposal-number: IKE proposal number, in the range of 1 to 65535. The lower the number, the higher the priority of the IKE proposal. During IKE negotiation, a high priority IKE proposal is matched before a low priority IKE proposal.
220
Examples
# Create IKE proposal 10 and enter IKE proposal view.
<Sysname> system-view [Sysname] ike proposal 10 [Sysname-ike-proposal-10]
ike sa keepalive-timer interval

Description
Use ike sa keepalive-timer interval to set the ISAKMP SA keepalive interval. Use undo ike sa keepalive-timer interval to disable the ISAKMP SA keepalive transmission function. By default, no keepalive packet is sent. The keepalive interval configured at the local end must be shorter than the keepalive timeout configured at the remote end. Related commands: ike sa keepalive-timer timeout.
Syntax
ike sa keepalive-timer interval seconds undo ike sa keepalive-timer interval
View
System view
Default level
2: System level
Parameters
seconds: Transmission interval of ISAKMP SA keepalives in seconds, in the range of 20 to 28800.
Examples
# Set the keepalive interval to 200 seconds.
<Sysname> system-view [Sysname] ike sa keepalive-timer interval 200
ike sa keepalive-timer timeout

Description
Use ike sa keepalive-timer timeout to set the ISAKMP SA keepalive timeout. Use undo ike sa keepalive-timer timeout to disable the function. By default, no keepalive packet is sent. The keepalive timeout configured at the local end must be longer than the keepalive interval configured at the remote end. Since it seldom occurs that more than three consecutive packets are lost on a network, the keepalive timeout can be configured to be three times of the keepalive interval. Related commands: ike sa keepalive-timer interval.
221
Syntax
ike sa keepalive-timer timeout seconds undo ike sa keepalive-timer timeout
View
System view
Default level
2: System level
Parameters
seconds: ISAKMP SA keepalive timeout in seconds, in the range of 20 to 28800.
Examples
# Set the keepalive timeout to 20 seconds.
<Sysname> system-view [Sysname] ike sa keepalive-timer timeout 20
ike sa nat-keepalive-timer interval

Description
Use ike sa nat-keepalive-timer interval to set the NAT keepalive interval. Use undo ike sa nat-keepalive-timer interval to disable the function. By default, the NAT keepalive interval is 20 seconds.
Syntax
ike sa nat-keepalive-timer interval seconds undo ike sa nat-keepalive-timer interval
View
System view
Default level
2: System level
Parameters
seconds: NAT keepalive interval in seconds, in the range of 5 to 300.
Examples
# Set the NAT keepalive interval to 5 seconds.
<Sysname> system-view [Sysname] ike sa nat-keepalive-timer interval 5
interval-time
Description
Use interval-time to set the DPD query triggering interval for a DPD detector. Use undo interval-time to restore the default.
222
The default DPD interval is 10 seconds.
Syntax
interval-time interval-time undo interval-time
View
IKE DPD view
Default level
2: System level
Parameters
interval-time: Sets DPD interval in seconds, in the range of 1 to 300 seconds. When the local end sends an IPsec packet, it checks the time the last IPsec packet was received from the peer. If the time interval exceeds the DPD interval, it sends a DPD hello to the peer.
Examples
# Set the DPD interval to 1 second for dpd2.
<Sysname> system-view [Sysname] ike dpd dpd2 [Sysname-ike-dpd-dpd2] interval-time 1
local
Description
Use local to set the subnet type of the local security gateway for IKE negotiation. Use undo local to restore the default. By default, the subnet is a single one. Use this to enable interoperability with a NetScreen device.
Syntax
local { multi-subnet | single-subnet } undo local
View
IKE peer view
Default level
2: System level
Parameters
multi-subnet: Sets the subnet type to multiple. single-subnet: Sets the subnet type to single.
Examples
# Set the subnet type of the local security gateway to multiple.
<Sysname> system-view [Sysname] ike peer xhy
223
[Sysname-ike-peer-xhy] local multi-subnet
local-address
Description
Use local-address to configure the IP address of the local security gateway in IKE negotiation. Use undo local-address to remove the configuration. By default, the primary address of the interface referencing the IPsec policy is used as the local security gateway IP address for IKE negotiation. Use this command if you want to specify a different address for the local security gateway.
Syntax
local-address ip-address undo local-address
View
IKE peer view
Default level
2: System level
Parameters
ip-address: IP address of the local security gateway to be used in IKE negotiation.
Examples
# Set the IP address of the local security gateway to 1.1.1.1.
<Sysname> system-view [Sysname] ike peer xhy [Sysname-ike-peer-xhy] local-address 1.1.1.1
local-name
Description
Use ike local-name to configure a name for the local security gateway to be used in IKE negation. Use undo ike local-name to restore the default. By default, the device name is used as the name of the local security gateway view. If you configure the id-type name or id-type user-fqdn command on the initiator, the IKE negotiation peer uses the security gateway name as its ID to initiate IKE negotiation, and you must configure the ike localname command in system view or the local-name command in IKE peer view on the local device. If you configure both the ike local-name command and the local-name command, the name configured by the local-name command is used. The IKE negotiation initiator sends its security gateway name as its ID to the peer, and the peer uses the security gateway name configured with the remote-name to authenticate the initiator. Make sure the local gateway name matches the remote gateway name configured on the peer. Relate commands: remote-name, id-type.
224
Syntax
local-name name undo local-name
View
IKE peer view
Default level
2: System level
Parameters
name: Name for the local security gateway to be used in IKE negotiation, a case-sensitive string of 1 to 32 characters.
Examples
# Set the name of the local security gateway to localgw in IKE peer view of peer1.
<Sysname> system-view [Sysname] ike peer peer1 [Sysname-ike-peer-peer1] local-name localgw
nat traversal
Description
Use nat traversal to enable the NAT traversal function of IKE/IPsec. Use undo nat traversal to disable the NAT traversal function of IKE/IPsec. By default, the NAT traversal function is disabled.
Syntax
nat traversal undo nat traversal
View
IKE peer view
Default level
2: System level
Parameters
None
Examples
# Enable the NAT traversal function for IKE peer peer1.
<Sysname> system-view [Sysname] ike peer peer1 [Sysname-ike-peer-peer1] nat traversal
225
peer
Description
Use peer to set the subnet type of the peer security gateway for IKE negotiation. Use undo peer to restore the default. By default, the subnet is a single one. Use this to enable interoperability with a NetScreen device.
Syntax
peer { multi-subnet | single-subnet } undo peer
View
IKE peer view
Default level
2: System level
Parameters
multi-subnet: Sets the subnet type to multiple. single-subnet: Sets the subnet type to single.
Examples
# Set the subnet type of the peer security gateway to multiple.
<Sysname> system-view [Sysname] ike peer xhy [Sysname-ike-peer-xhy] peer multi-subnet
pre-shared-key
Description
Use pre-shared-key to configure the pre-shared key to be used in IKE negotiation. Use undo pre-shared-key to remove the configuration. Related commands: authentication-method.
Syntax
pre-shared-key [ cipher | simple ] key undo pre-shared-key
View
IKE peer view
Default level
2: System level
Parameters
key: Plaintext pre-shared key to be displayed in cipher text, a case-sensitive string of 1 to 128 characters.
226
cipher key: Specifies the ciphertext pre-shared key to be displayed in cipher text, a case-sensitive string of 1 to 184 characters. simple key: Specifies the plaintext pre-shared key to be displayed in plain text, a case-sensitive string of 1 to 128 characters.
Examples
# Set the pre-shared key used in IKE negotiation to abcde.
<Sysname> system-view [Sysname] ike peer peer1 [Sysname-ike-peer-peer1] pre-shared-key abcde
proposal (IKE peer view)

Description
Use proposal to specify the IKE proposals for the IKE peer to reference. Use undo proposal to remove one or all IKE proposals referenced by the IKE peer. By default, an IKE peer references no IKE proposals and, when initiating IKE negotiation, it uses the IKE proposals configured in system view. In the IKE negotiation phase 1, the local peer uses the IKE proposals specified for it, if any. An IKE peer can reference up to six IKE proposals. The responder uses the IKE proposals configured in system view for negotiation. Related commands: ike proposal and ike peer (system view).
Syntax
proposal proposal-number&<1-6> undo proposal [ proposal-number ]
View
IKE peer view
Default level
2: System level
Parameters
proposal-number&<1-6>: Sequence number of the IKE proposal for the IKE peer to reference, in the range of 1 to 65535. &<1-6> means that you can specify the proposal-number argument for up to six times. An IKE proposal with a smaller sequence number has a higher priority.
Examples
# Configure IKE peer peer1 to reference IKE proposal 10.
<Sysname> system-view [Sysname] ike peer peer1 [Sysname-ike-peer-peer1] proposal 10
227
remote-address
Description
Use remote-address to configure the IP address of the IPsec remote security gateway. Use undo remote-address to remove the configuration. The IP address configured with the remote-address command must match the local security gateway IP address that the remote security gateway uses for IKE negotiation, which is the IP address configured with the local-address command or, if the local-address command is not configured, the primary IP address of the interface to which the policy is applied. The local peer can be the initiator of IKE negotiation if the remote address is a host IP address or a host name. The local end can only be the responder of IKE negotiation if the remote address is an address range that the local peer can respond to. If the IP address of the remote address changes frequently, configure the host name of the remote gateway with the dynamic keyword so that the local peer can use the up-to-date remote IP address to initiate IKE negotiation. Related commands: id-type ip and local-address.
Syntax
remote-address { hostname [ dynamic ] | low-ip-address [ high-ip-address ] } undo remote-address
View
IKE peer view
Default level
2: System level
Parameters
hostname: Host name of the IPsec remote security gateway, a case-insensitive string of 1 to 255 characters. The host name uniquely identifies the remote IPsec peer and can be resolved to an IP address by the DNS server. dynamic: Specifies to use dynamic address resolution for the IPsec remote peer name. If you do not provide this keyword, the local peer has the remote host name resolved only once after you configure the remote host name. low-ip-address: IP address of the IPsec remote security gateway. It is the lowest address in the address range if you want to specify a range of addresses. high-ip-address: Highest address in the address range if you want to specify a range of addresses.
Examples
# Configure the IP address of the remote security gateway as 10.0.0.1.
<Sysname> system-view [Sysname] ike peer peer1 [Sysname-ike-peer-peer1] remote-address 10.0.0.1
# Configure the host name of the remote gateway as test.com, and specify the local peer to dynamically update the remote IP address.
228
[Sysname] ike peer peer2 [Sysname-ike-peer-peer2] remote-address test.com dynamic
remote-name
Description
Use remote-name to configure the name of the remote gateway. Use undo remote-name to remove the configuration. If you configure the id-type name or id-type user-fqdn command on the initiator, the IKE negotiation initiator sends its security gateway name as its ID for IKE negotiation, and the peer uses the security gateway name configured with the remote-name to authenticate the initiator. Make sure the local gateway name matches the remote gateway name configured on the peer. Related commands: id-type, local-name, and ike local-name.
Syntax
remote-name name undo remote-name
View
IKE peer view
Default level
2: System level
Parameters
name: Name of the peer security gateway for IKE negotiation, a string of 1 to 32 characters.
Examples
# Configure the remote security gateway name as apple for IKE peer peer1.
<Sysname> system-view [Sysname] ike peer peer1 [Sysname-ike-peer-peer1] remote-name apple
reset ike sa
Description
Use reset ike sa to clear tunnels set up by IKE. If you do not specify any parameter, the command clears all ISAKMP SAs. If you specify only the connection-id argument, the command clears all ISAKMP SAs identified by the connection ID. When you clear a local IPsec SA, if the corresponding ISAKMP SA is present, the local end sends a Delete Message to the remote end across the ISAKMP SA, notifying the remote end to delete the corresponding IPsec SA. Otherwise, the local end cannot notify the remote end to clear the corresponding IPsec SA. Related commands: display ike sa.
229
Syntax
reset ike sa [ connection-id ]
View
User view
Default level
2: System level
Parameters
connection-id: Connection ID of the tunnel to be cleared, in the range of 1 to 2000000000.
Examples
# Clear the IPsec tunnel to 202.38.0.2.
<Sysname> display ike sa total phase-1 SAs: connection-id 1 2 flag meaning RD--READY ST--STAYALIVE RL--REPLACED FDFADING TO--TIMEOUT <Sysname> reset ike sa 2 <Sysname> display ike sa total phase-1 SAs: connection-id 1 flag meaning RD--READY ST--STAYALIVE RL--REPLACED FDFADING TOTIMEOUT peer 202.38.0.2 1 flag RD|ST phase 1 doi IPSEC peer 202.38.0.2 202.38.0.2 1 flag RD|ST RD|ST phase 1 2 doi IPSEC IPSEC
----------------------------------------------------------
----------------------------------------------------------
sa duration
Description
Use sa duration to set the ISAKMP SA lifetime for an IKE proposal. Use undo sa duration to restore the default. By default, the ISAKMP SA lifetime is 86400 seconds. Before an SA expires, IKE negotiates a new SA. The new SA takes effect immediately after being set up, and the old one will be cleared automatically when it expires. Related commands: ike proposal and display ike proposal.
Syntax
sa duration seconds undo sa duration
View
IKE proposal view
230
Default level
2: System level
Parameters
Seconds: Specifies the ISAKMP SA lifetime in seconds, in the range of 60 to 604800.
Examples
# Specify the ISAKMP SA lifetime for IKE proposal 10 as 600 seconds (10 minutes).
<Sysname> system-view [Sysname] ike proposal 10 [Sysname-ike-proposal-10] sa duration 600
time-out
Description
Use time-out to set the DPD packet retransmission interval for a DPD detector. Use undo time-out to restore the default. The default DPD packet retransmission interval is 5 seconds.
Syntax
time-out time-out undo time-out
View
IKE DPD view
Default level
2: System level
Parameters
time-out: DPD packet retransmission interval in seconds, in the range of 1 to 60.
Examples
# Set the DPD packet retransmission interval to 1 second for dpd2.
<Sysname> system-view [Sysname] ike dpd dpd2 [Sysname-ike-dpd-dpd2] time-out 1
231
PKI configuration commands

attribute
Description
Use attribute to configure the attribute rules of the certificate issuer name, certificate subject name and alternative certificate subject name. Use undo attribute to delete the attribute rules of one or all certificates.
By default, no restriction exists on the issuer name, subject name, and alternative subject name of a certificate. The attribute of the alternative certificate subject name does not appear as a distinguished name, and therefore the dn keyword is not available for the attribute.
Syntax
attribute id { alt-subject-name { fqdn | ip } | { issuer-name | subject-name } { dn | fqdn | ip } } { ctn | equ | nctn | nequ} attribute-value
undo attribute { id | all }
View
Certificate attribute group view
Default level
2: System level
Parameters
id: Sequence number of the certificate attribute rule, in the range of 1 to 16. alt-subject-name: Specifies the name of the alternative certificate subject. fqdn: Specifies the FQDN of the entity. ip: Specifies the IP address of the entity. issuer-name: Specifies the name of the certificate issuer. subject-name: Specifies the name of the certificate subject. dn: Specifies the distinguished name of the entity. ctn: Specifies the contain operation. equ: Specifies the equal operation. nctn: Specifies the not-contain operation. nequ: Specifies the not-equal operation. attribute-value: Value of the certificate attribute, a case-insensitive string of 1 to 128 characters. all: Specifies all certificate attributes.
Examples
# Create a certificate attribute rule, specifying that the DN in the subject name includes the string of abc.
232
<Sysname> system-view [Sysname] pki certificate attribute-group mygroup [Sysname-pki-cert-attribute-group-mygroup] attribute 1 subject-name dn ctn abc
# Create a certificate attribute rule, specifying that the FQDN in the issuer name cannot be the string of abc.
[Sysname-pki-cert-attribute-group-mygroup] attribute 2 issuer-name fqdn nequ abc
# Create a certificate attribute rule, specifying that the IP address in the alternative subject name cannot be 10.0.0.1.
[Sysname-pki-cert-attribute-group-mygroup] attribute 3 alt-subject-name ip nequ 10.0.0.1
ca identifier
Description
Use ca identifier to specify the trusted CA and bind the device with the CA. Use undo ca identifier to remove the configuration. By default, no trusted CA is specified for a PKI domain. Certificate request, retrieval, revocation, and query all depend on the trusted CA.
Syntax
ca identifier name undo ca identifier
View
PKI domain view
Default level
2: System level
Parameters
name: Name of the trusted CA, a case-insensitive string of 1 to 63 characters.
Examples
# Specify the trusted CA as new-ca.
<Sysname> system-view [Sysname] pki domain 1 [Sysname-pki-domain-1] ca identifier new-ca
certificate request entity

Description
Use certificate request entity to specify the entity for certificate request. Use undo certificate request entity to remove the configuration. By default, no entity is specified for certificate request. Related commands: pki entity.
233
Syntax
certificate request entity entity-name undo certificate request entity
View
PKI domain view
Default level
2: System level
Parameters
entity-name: Name of the entity for certificate request, a case-insensitive string of 1 to 15 characters.
Examples
# Specify the entity for certificate request as entity1.
<Sysname> system-view [Sysname] pki domain 1 [Sysname-pki-domain-1] certificate request entity entity1
certificate request from

Description
Use certificate request from to specify the authority for certificate request. Use undo certificate request from to remove the configuration. By default, no authority is specified for certificate request.
Syntax
certificate request from { ca | ra } undo certificate request from
View
PKI domain view
Default level
2: System level
Parameters
ca: Indicates that the entity requests a certificate from a CA. ra: Indicates that the entity requests a certificate from an RA.
Examples
# Specify that the entity requests a certificate from the CA.
<Sysname> system-view [Sysname] pki domain 1 [Sysname-pki-domain-1] certificate request from ca
234
certificate request mode

Description
Use certificate request mode to set the certificate request mode. Use undo certificate request mode to restore the default. By default, manual mode is used. In auto mode, an entity automatically requests a certificate from an RA or CA when it has no certificate. However, if the certificate will expire or has expired, the entity does not initiate a re-request automatically. To have a new local certificate, you need to request one manually. In manual mode, all operations associated with certificate request are carried out manually. Related commands: pki request-certificate.
Syntax
certificate request mode { auto [ key-length key-length | password { cipher | simple } password ] * | manual } undo certificate request mode
View
PKI domain view
Default level
2: System level
Parameters
auto: Requests a certificate in auto mode. key-length: Length of the RSA keys in bits, in the range of 512 to 2048. It is 1024 bits by default. cipher: Displays the password in cipher text. simple: Displays the password in clear text. password: Password for certificate revocation, a case-sensitive string of 1 to 31 characters. manual: Requests a certificate in manual mode.
Examples
# Specify to request a certificate in auto mode.
<Sysname> system-view [Sysname] pki domain 1 [Sysname-pki-domain-1] certificate request mode auto
certificate request polling

Description
Use certificate request polling to specify the certificate request polling interval and attempt limit. Use undo certificate request polling to restore the defaults. By default, the polling is executed every 20 minutes for up to 50 times.
235
After an applicant makes a certificate request, the CA might need a long period of time if it verifies the certificate request manually. During this period, the applicant needs to query the status of the request periodically to get the certificate as soon as possible after the certificate is signed. Related commands: display pki certificate.
Syntax
certificate request polling { count count | interval minutes } undo certificate request polling { count | interval }
View
PKI domain view
Default level
2: System level
Parameters
count count: Specifies the maximum number of attempts to poll the status of the certificate request, in the range of 1 to 100. interval minutes: Specifies the polling interval in minutes, in the range of 5 to 168.
Examples
# Specify the polling interval as 15 minutes and the maximum number of attempts as 40.
<Sysname> system-view [Sysname] pki domain 1 [Sysname-pki-domain-1] certificate request polling interval 15 [Sysname-pki-domain-1] certificate request polling count 40
certificate request url

Description
Use certificate request url to specify the URL of the server for certificate request through SCEP. Use undo certificate request url to remove the configuration. By default, no URL is specified for a PKI domain.
Syntax
certificate request url url-string undo certificate request url
View
PKI domain view
Default level
2: System level
Parameters
url-string: URL of the server for certificate request, a case-insensitive string of 1 to 127 characters. It comprises the location of the server and the location of CGI command interface script in the format of http://server_location/ca_script_location, where server_location must be an IP address and does not support domain name resolution.
236
Examples
# Specify the URL of the server for certificate request.
<Sysname> system-view [Sysname] pki domain 1 [Sysname-pki-domain-1] certificate http://169.254.0.100/certsrv/mscep/mscep.dll request url
common-name
Description
Use common-name to configure the common name of an entity, which can be, for example, the user name. Use undo common-name to remove the configuration. By default, no common name is specified.
Syntax
common-name name undo common-name
View
PKI entity view
Default level
2: System level
Parameters
name: Common name of an entity, a case-insensitive string of 1 to 31 characters. No comma can be included.
Examples
# Configure the common name of an entity as test.
<Sysname> system-view [Sysname] pki entity 1 [Sysname-pki-entity-1] common-name test
country
Description
Use country to specify the code of the country to which an entity belongs. It is a standard 2-character code, for example, CN for China. Use undo country to remove the configuration. By default, no country code is specified.
Syntax
country country-code-str undo country
237
View
PKI entity view
Default level
2: System level
Parameters
country-code-str: Country code for the entity, a 2-character case-insensitive string.
Examples
# Set the country code of an entity to CN.
<Sysname> system-view [Sysname] pki entity 1 [Sysname-pki-entity-1] country CN
crl check
Description
Use crl check to enable or disable CRL checking. By default, CRL checking is enabled. CRLs are files issued by the CA to publish all certificates that have been revoked. Revocation of a certificate might occur before the certificate expires. CRL checking is intended for checking whether a certificate has been revoked. A revoked certificate is no longer trusted.
Syntax
crl check { disable | enable }
View
PKI domain view
Default level
2: System level
Parameters
disable: Disables CRL checking. enable: Enables CRL checking.
Examples
# Disable CRL checking.
<Sysname> system-view [Sysname] pki domain 1 [Sysname-pki-domain-1] crl check disable
crl update-period
Description
Use crl update-period to set the CRL update period, that is, the interval at which a PKI entity with a certificate downloads the latest CRL from the LDAP server. Use undo crl update-period to restore the default.
238
By default, the CRL update period depends on the next update field in the CRL file.
Syntax
crl update-period hours undo crl update-period
View
PKI domain view
Default level
2: System level
Parameters
hours: CRL update period in hours, in the range of 1 to 720.
Examples
# Set the CRL update period to 20 hours.
<Sysname> system-view [Sysname] pki domain 1 [Sysname-pki-domain-1] crl update-period 20
crl url
Description
Use crl url to specify the URL of the CRL distribution point. Use undo crl url to remove the configuration. By default, no CRL distribution point URL is specified. When the URL of the CRL distribution point is not set, you should acquire the CA certificate and a local certificate, and then acquire a CRL through SCEP.
Syntax
crl url url-string undo crl url
View
PKI domain view
Default level
2: System level
Parameters
url-string: URL of the CRL distribution point, a case-insensitive string of 1 to 127 characters in the format of ldap://server_location or http://server_location, where server_location must be an IP address and does not support domain name resolution.
Examples
# Specify the URL of the CRL distribution point.
<Sysname> system-view [Sysname] pki domain 1 [Sysname-pki-domain-1] crl url ldap://169.254.0.30
239
display pki certificate

Description
Use display pki certificate to display the contents or request status of a certificate. Related commands: certificate request polling, pki domain, and pki retrieval-certificate.
Syntax
display pki certificate { { ca | local } domain domain-name | request-status } [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
2: System level
Parameters
ca: Displays the CA certificate. local: Displays the local certificate. domain-name: Name of the PKI domain, a string of 1 to 15 characters. request-status: Displays the status of a certificate request. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display the local certificate.
<Sysname> display pki certificate local domain 1 Certificate: Data: Version: 3 (0x2) Serial Number: 10B7D4E3 00010000 0086 Issuer: [email protected] C=CN ST=Country A L=City X O=abc OU=bjs CN=new-ca Validity Not Before: Jan 13 08:57:21 2004 GMT
240
Not After : Jan 20 09:07:21 2005 GMT Subject: C=CN ST=Country B L=City Y CN=pki test Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (512 bit) Modulus (512 bit): 00D41D1F Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Alternative Name: DNS: hyf.xxyyzz.net X509v3 CRL Distribution Points: URI:http://1.1.1.1:447/myca.crl

Version Serial Number Signature Algorithm Issuer Validity Subject Subject Public Key Info X509v3 extensions X509v3 CRL Distribution Points
Description
Version of the certificate Serial number of the certificate Signature algorithm Issuer of the certificate Validity period of the certificate Entity holding the certificate Public key information of the entity Extensions of the X.509 (version 3) certificate Distribution points of X.509 (version 3) CRLs
display pki certificate access-control-policy

Description
Use display pki certificate access-control-policy to display information about one or all certificate attribute-based access control policies.
Syntax
display pki certificate access-control-policy { policy-name | all } [ | { begin | exclude | include } regularexpression ]
View
Any view
241
Default level
1: Monitor level
Parameters
policy-name: Name of the certificate attribute-based access control policy, a string of 1 to 16 characters. all: Specifies all certificate attribute-based access control policies. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display information about the certificate attribute-based access control policy named mypolicy.
<Sysname> display pki certificate access-control-policy mypolicy access-control-policy name: mypolicy rule rule 1 deny 2 permit mygroup1 mygroup2

access-control-policy rule number
Description
Name of the certificate attribute-based access control policy Number of the access control rule
display pki certificate attribute-group

Description
Use display pki certificate attribute-group to display information about one or all certificate attribute groups.
Syntax
display pki certificate attribute-group { group-name | all } [ | { begin | exclude | include } regularexpression ]
View
Any view
Default level
1: Monitor level
Parameters
group-name: Name of a certificate attribute group, a string of 1 to 16 characters. all: Specifies all certificate attribute groups.
242
Examples
# Display information about certificate attribute group mygroup.
<Sysname> display pki certificate attribute-group mygroup attribute group name: mygroup attribute attribute 1 subject-name 2 issuer-name dn fqdn ctn nctn abc app

attribute group name attribute number subject-name dn ctn abc issuer-name fqdn nctn app
Description
Name of the certificate attribute group Number of the attribute rule Name of the certificate subject DN of the entity Indicates the contain operations Value of attribute 1 Name of the certificate issuer FQDN of the entity Indicates the not-contain operations Value of attribute 2
display pki crl domain

Description
Use display pki crl domain to display the locally saved CRLs. Related commands: pki domain and pki retrieval-crl.
Syntax
display pki crl domain domain-name [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
2: System level
Parameters
243
Examples
# Display the locally saved CRLs.
<Sysname> display pki crl domain 1 Certificate Revocation List (CRL): Version 2 (0x1) Issuer: C=CN O=abc OU=soft CN=A Test Root Last Update: Jan Next Update: Jan CRL extensions: X509v3 Authority Key Identifier: keyid:0F71448E E075CAB8 ADDB3A12 0B747387 45D612EC Revoked Certificates: Serial Number: 05a234448E Revocation Date: Sep 6 12:33:22 2004 GMT CRL entry extensions: Serial Number: 05a278445E Revocation Date: Sep 7 12:33:22 2004 GMT CRL entry extensions: 5 08:44:19 2004 GMT 5 21:42:13 2004 GMT

Version Signature Algorithm Issuer Last Update Next Update CRL extensions X509v3 Authority Key Identifier
Description
Version of the CRL Signature algorithm used by the CRLs CA issuing the CRLs Last update time Next update time Extensions of CRL CA issuing the CRLs. The certificate version is X.509 v3. ID of the public key
keyid Revoked Certificates 244
A CA might have multiple key pairs. This field indicates the key pair used by the CRLs signature. Revoked certificates
Field
Serial Number Revocation Date
Description
Serial number of the revoked certificate Revocation date of the certificate
fqdn
Description
Use fqdn to configure the FQDN of an entity. Use undo fqdn to remove the configuration. By default, no FQDN is specified for an entity. An FQDN is the unique identifier of an entity on a network. It consists of a host name and a domain name and can be resolved into an IP address.
Syntax
fqdn name-str undo fqdn
View
PKI entity view
Default level
2: System level
Parameters
name-str: FQDN of an entity, a case-insensitive string of 1 to 127 characters.
Examples
# Configure the FQDN of an entity as pki.domain-name.com.
<Sysname> system-view [Sysname] pki entity 1 [Sysname-pki-entity-1] fqdn pki.domain-name.com
ip (PKI entity view)

Description
Use ip to configure the IP address of an entity. Use undo ip to remove the configuration. By default, no IP address is specified for an entity.
Syntax
ip ip-address undo ip
View
PKI entity view
245
Default level
2: System level
Parameters
ip-address: IP address for an entity.
Examples
# Configure the IP address of an entity as 1 1.0.0.1.
<Sysname> system-view [Sysname] pki entity 1 [Sysname-pki-entity-1] ip 11.0.0.1
ldap-server
Description
Use ldap-server to specify an LDAP server for a PKI domain. Use undo ldap-server to remove the configuration. By default, no LDP server is specified for a PKI domain.
Syntax
ldap-server ip ip-address [ port port-number ] [ version version-number ] undo ldap-server
View
PKI domain view
Default level
2: System level
Parameters
ip-address: IP address of the LDAP server, in dotted decimal format. port-number: Port number of the LDAP server, in the range of 1 to 65535. The default is 389. version-number: LDAP version number, either 2 or 3. By default, it is 2.
Examples
# Specify an LDAP server for PKI domain 1.
<Sysname> system-view [Sysname] pki domain 1 [Sysname-pki-domain-1] ldap-server ip 169.254.0.30
locality
Description
Use locality to configure the geographical locality of an entity, which can be, for example, a city name. Use undo locality to remove the configuration. By default, no geographical locality is specified for an entity.
246
Syntax
locality locality-name undo locality
View
PKI entity view
Default level
2: System level
Parameters
locality-name: Name for the geographical locality, a case-insensitive string of 1 to 31 characters. No comma can be included.
Examples
# Configure the locality of an entity as city.
<Sysname> system-view [Sysname] pki entity 1 [Sysname-pki-entity-1] locality city
organization
Description
Use organization to configure the name of the organization to which the entity belongs. Use undo organization to remove the configuration. By default, no organization name is specified for an entity.
Syntax
organization org-name undo organization
View
PKI entity view
Default level
2: System level
Parameters
org-name: Organization name, a case-insensitive string of 1 to 31 characters. No comma can be included.
Examples
# Configure the name of the organization to which an entity belongs as test-lab.
<Sysname> system-view [Sysname] pki entity 1 [Sysname-pki-entity-1] organization test-lab
247
organization-unit
Description
Use organization-unit to specify the name of the organization unit to which this entity belongs. Use undo organization-unit to remove the configuration. By default, no organization unit name is specified for an entity.
Syntax
organization-unit org-unit-name undo organization-unit
View
PKI entity view
Default level
2: System level
Parameters
org-unit-name: Organization unit name for distinguishing different units in an organization, a caseinsensitive string of 1 to 31 characters. No comma can be included.
Examples
# Configure the name of the organization unit to which an entity belongs as group1.
<Sysname> system-view [Sysname] pki entity 1 [Sysname-pki-entity-1] organization-unit group1
pki certificate access-control-policy

Description
Use pki certificate access-control-policy to create a certificate attribute-based access control policy and enter its view. Use undo pki certificate access-control-policy to remove one or all certificate attribute-based access control policies. No access control policy exists by default. Examples # Configure an access control policy named mypolicy and enter its view.
<Sysname> system-view [Sysname] pki certificate access-control-policy mypolicy [Sysname-pki-cert-acp-mypolicy]
Syntax
pki certificate access-control-policy policy-name undo pki certificate access-control-policy { policy-name | all }
View
System view
248
Default level
2: System level
Parameters
policy-name: Name of the certificate attribute-based access control policy, a case-insensitive string of 1 to 16 characters. It cannot be a, al, or all. all: Specifies all certificate attribute-based access control policies.
pki certificate attribute-group

Description
Use pki certificate attribute-group to create a certificate attribute group and enter its view. Use undo pki certificate attribute-group to delete one or all certificate attribute groups. By default, no certificate attribute group exists. Examples # Create a certificate attribute group named mygroup and enter its view.
<Sysname> system-view [Sysname] pki certificate attribute-group mygroup [Sysname-pki-cert-attribute-group-mygroup]
Syntax
pki certificate attribute-group group-name undo pki certificate attribute-group { group-name | all }
View
System view
Default level
2: System level
Parameters
group-name: Name for the certificate attribute group, a case-insensitive string of 1 to 16 characters. It cannot be a, al, or all. all: Specifies all certificate attribute groups.
pki delete-certificate
Description
Use pki delete-certificate to delete the certificate locally stored for a PKI domain.
Syntax
pki delete-certificate { ca | local } domain domain-name
View
System view
Default level
2: System level
249
Parameters
ca: Deletes the locally stored CA certificate. local: Deletes the locally stored local certificate. domain-name: Name of the PKI domain whose certificates are to be deleted, a string of 1 to 15 characters.
Examples
# Delete the local certificate for PKI domain cer.
<Sysname> system-view [Sysname] pki delete-certificate local domain cer
pki domain
Description
Use pki domain to create a PKI domain and enter PKI domain view or enter the view of an existing PKI domain. Use undo pki domain to remove a PKI domain. By default, no PKI domain exists.
Syntax
pki domain domain-name undo pki domain domain-name
View
System view
Default level
2: System level
Parameters
domain-name: PKI domain name, a case-insensitive string of 1 to 15 characters.
Examples
# Create a PKI domain and enter its view.
<Sysname> system-view [Sysname] pki domain 1 [Sysname-pki-domain-1]
pki entity
Description
Use pki entity to create a PKI entity and enter its view. Use undo pki entity to remove a PKI entity. By default, no entity exists. You can configure a variety of attributes for an entity in PKI entity view. An entity is intended only for convenience of reference by other commands.
250
Syntax
pki entity entity-name undo pki entity entity-name
View
System view
Default level
2: System level
Parameters
entity-name: Name for the entity, a case-insensitive string of 1 to 15 characters.
Examples
# Create a PKI entity named en and enter its view.
<Sysname> system-view [Sysname] pki entity en [Sysname-pki-entity-en]
pki import-certificate
Description
Use pki import-certificate to import a CA certificate or local certificate from a file and save it locally. Related commands: pki domain.
Syntax
pki import-certificate { ca | local } domain domain-name { der | p12 | pem } [ filename filename ]
View
System view
Default level
2: System level
Parameters
ca: Specifies the CA certificate. local: Specifies the local certificate. domain-name: Name of the PKI domain, a string of 1 to 15 characters. der: Specifies the certificate format of DER. p12: Specifies the certificate format of P12. pem: Specifies the certificate format of PEM. filename filename: Specifies the name of the certificate file, a case-insensitive string of 1 to 127 characters. It defaults to domain-name_ca.cer, or domain-name_local.cer, the name for the file to be created to save the imported certificate.
Examples
# Import the CA certificate for PKI domain cer in the format of PEM.
251
[Sysname] pki import-certificate ca domain cer pem
pki request-certificate domain

Description
Use pki request-certificate domain to request a local certificate from a CA through SCEP. If SCEP fails, you can use the pkcs10 keyword to print the request information in BASE64 format, or use the pkcs10 filename filename option to save the request information to a local file and send the file to the CA by an out-of-band means. This operation will not be saved in the configuration file. Related commands: pki domain.
Syntax
pki request-certificate domain domain-name [ password ] [ pkcs10 [ filename filename ] ]
View
System view
Default level
2: System level
Parameters
domain-name: Name of the PKI domain name, a string of 1 to 15 characters. password: Password for certificate revocation, a case-sensitive string of 1 to 31 characters. pkcs10: Displays the BASE64-encoded PKCS#10 certificate request information, which can be used to request a certification by an out-of-band means, like phone, disk, or email. filename filename: Specifies the name of the local file for saving the PKCS#10 certificate request, a caseinsensitive string of 1 to 127 characters.
Examples
# Display the PKCS#10 certificate request information.
<Sysname> system-view [Sysname] pki request-certificate domain 1 pkcs10 -----BEGIN CERTIFICATE REQUEST----MIIBTDCBtgIBADANMQswCQYDVQQDEwJqajCBnzANBgkqhkiG9w0BAQEFAAOBjQAw gYkCgYEAw5Drj8ofs9THA4ezkDcQPBy8pvH1kumampPsJmx8sGG52NFtbrDTnTT5 ALx3LJijB3d/ndKpcHT/DfbJVDCn5gdw32tBZyCkEwMHZN3ol2z7Nvdu5TED6iN8 4m+hfp1QWoV6lty3o9pxAXuQl8peUDcfN6WV3LBXYyl1WCtkLkECAwEAAaAAMA0G CSqGSIb3DQEBBAUAA4GBAA8E7BaIdmT6NVCZgv/I/1tqZH3TS4e4H9Qo5NiCKiEw R8owVmA0XVtGMbyqBNcDTG0f5NbHrXZQT5+MbFJOnm5K/mn1ro5TJKMTKV46PlCZ JUjsugaY02GBY0BVcylpC9iIXLuXNIqjh1MBIqVsa1lQOHS7YMvnop6hXAQlkM4c -----END CERTIFICATE REQUEST-----
pki retrieval-certificate
Description
Use pki retrieval-certificate to retrieve a certificate from the server for certificate distribution.
252
Related commands: pki domain.
Syntax
pki retrieval-certificate { ca | local } domain domain-name
View
System view
Default level
2: System level
Parameters
ca: Retrieves the CA certificate. local: Retrieves the local certificate. domain-name: Name of the PKI domain used for certificate request.
Examples
# Retrieve the CA certificate from the certificate issuing server.
<Sysname> system-view [Sysname] pki retrieval-certificate ca domain 1
pki retrieval-crl domain

Description
Use pki retrieval-crl domain to retrieve the latest CRLs from the server for CRL distribution. CRLs help verify the validity of certificates. Related commands: pki domain.
Syntax
pki retrieval-crl domain domain-name
View
System view
Default level
2: System level
Parameters
Examples
# Retrieve CRLs.
<Sysname> system-view [Sysname] pki retrieval-crl domain 1
pki validate-certificate
Description
Use pki validate-certificate to verify the validity of a certificate.
253
The focus of certificate validity verification will check that the certificate is signed by the CA and that the certificate has neither expired nor been revoked. Related commands: pki domain.
Syntax
pki validate-certificate { ca | local } domain domain-name
View
System view
Default level
2: System level
Parameters
ca: Verifies the CA certificate. local: Verifies the local certificate. domain-name: Name of the PKI domain to which the certificate to be verified belongs, a string of 1 to 15 characters.
Examples
# Verify the validity of the local certificate.
<Sysname> system-view [Sysname] pki validate-certificate local domain 1
root-certificate fingerprint
Description
Use root-certificate fingerprint to configure the fingerprint to be used for verifying the validity of the CA root certificate. Use undo root-certificate fingerprint to remove the configuration. By default, no fingerprint is configured for verifying the validity of the CA root certificate.
Syntax
root-certificate fingerprint { md5 | sha1 } string undo root-certificate fingerprint
View
PKI domain view
Default level
2: System level
Parameters
md5: Uses an MD5 fingerprint. sha1: Uses a SHA1 fingerprint. string: Fingerprint to be used. An MD5 fingerprint must be a string of 32 characters in hexadecimal. A SHA1 fingerprint must be a string of 40 characters in hexadecimal.
254
Examples
# Configure an MD5 fingerprint for verifying the validity of the CA root certificate.
<Sysname> system-view [Sysname] pki domain 1 [Sysname-pki-domain-1] root-certificate fingerprint md5 12EF53FA355CD23E12EF53FA355CD23E
# Configure a SHA1 fingerprint for verifying the validity of the CA root certificate.
[Sysname-pki-domain-1] root-certificate D1526110AAD7527FB093ED7FC037B0B3CDDDAD93 fingerprint sha1
rule (PKI CERT ACP view)

Description
Use rule to create a certificate attribute access control rule. Use undo rule to delete one or all access control rules. By default, no access control rule exists. A certificate attribute group must exist to be associated with a rule. Examples # Create an access control rule, specifying that a certificate is considered valid when it matches an attribute rule in certificate attribute group mygroup.
<Sysname> system-view [Sysname] pki certificate access-control-policy mypolicy [Sysname-pki-cert-acp-mypolicy] rule 1 permit mygroup
Syntax
rule [ id ] { deny | permit } group-name undo rule { id | all }
View
PKI certificate access control policy view
Default level
2: System level
Parameters
id: Number of the certificate attribute access control rule, in the range of 1 to 16. The default is the smallest unused number in this range. deny: Indicates that a certificate whose attributes match an attribute rule in the specified attribute group is considered invalid and denied. permit: Indicates that a certificate whose attributes match an attribute rule in the specified attribute group is considered valid and permitted. group-name: Name of the certificate attribute group to be associated with the rule, a case-insensitive string of 1 to 16 characters. It cannot be a, al, or all. all: Specifies all access control rules.
255
state
Description
Use state to specify the name of the state or province where an entity resides. Use undo state to remove the configuration. By default, no state or province is specified.
Syntax
state state-name undo state
View
PKI entity view
Default level
2: System level
Parameters
state-name: State or province name, a case-insensitive string of 1 to 31 characters. No comma can be included.
Examples
# Specify the state where an entity resides.
<Sysname> system-view [Sysname] pki entity 1 [Sysname-pki-entity-1] state country
256
Public key configuration commands

display public-key local public
Description
Use display public-key local public to display the public key information of the local asymmetric key pairs. Related commands: public-key local create.
Syntax
display public-key local { dsa | rsa } public [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
dsa: Specifies a DSA key pair. rsa: Specifies an RSA key pair. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display the public key information of the local RSA key pairs.
<Sysname> display public-key local rsa public ===================================================== Time of Key pair created: 19:59:16 Key name: HOST_KEY Key type: RSA Encryption Key ===================================================== Key code: 30819F300D06092A864886F70D010101050003818D0030818902818100BC4C392A97734A633BA0F1DB01F84EB 51228EC86ADE1DBA597E0D9066FDC4F04776CEA3610D2578341F5D049143656F1287502C06D39D39F28F0F5CB A630DA8CD1C16ECE8A7A65282F2407E8757E7937DCCDB5DB620CD1F471401B7117139702348444A2D8900497A 87B8D5F13D61C4DEFA3D14A7DC07624791FC1D226F62DF30203010001 ===================================================== Time of Key pair created: 19:59:17 2007/10/25 2007/10/25
257
Key name: SERVER_KEY Key type: RSA Encryption Key ===================================================== Key code: 307C300D06092A864886F70D0101010500036B003068026100C51AF7CA926962284A4654B2AACC7B2AE12B2B1 EABFAC1CDA97E42C3C10D7A70D1012BF23ADE5AC4E7AAB132CFB6453B27E054BFAA0A85E113FBDE751EE0ECEF 659529E857CF8C211E2A03FD8F10C5BEC162B2989ABB5D299D1E4E27A13C7DD10203010001
# Display the public key information of the local DSA key pair.
<Sysname> display public-key local dsa public ===================================================== Time of Key pair created: 20:00:16 Key name: HOST_KEY Key type: DSA Encryption Key ===================================================== Key code: 308201B83082012C06072A8648CE3804013082011F02818100D757262C4584C44C211F18BD96E5F061C4F0A42 3F7FE6B6B85B34CEF72CE14A0D3A5222FE08CECE65BE6C265854889DC1EDBD13EC8B274DA9F75BA26CCB98772 3602787E922BA84421F22C3C89CB9B06FD60FE01941DDD77FE6B12893DA76EEBC1D128D97F0678D7722B5341C 8506F358214B16A2FAC4B368950387811C7DA33021500C773218C737EC8EE993B4F2DED30F48EDACE915F0281 810082269009E14EC474BAF2932E69D3B1F18517AD9594184CCDFCEAE96EC4D5EF93133E84B47093C52B20CD3 5D02492B3959EC6499625BC4FA5082E22C5B374E16DD00132CE71B020217091AC717B612391C76C1FB2E88317 C1BD8171D41ECB83E210C03CC9B32E810561C21621C73D6DAAC028F4B1585DA7F42519718CC9B09EEF0381850 002818100CCF1F78E0860BE937FD3CA07D2F2A1B66E74E5D1E16693EB374D677A7A6124EBABD59FE48796C56F 3FF919F999AEB97D1F2B83D9B98AC09BC1F72E80DBE337CB29989A23378EB21C38EE083F11ED6DC8D4DBE001B A85450CEA071C2A471C83761E4CF32C174B418612CDD597B441F0CAA05DC01CB93A0ABB247C06FBA4C79054 2007/10/25

Time of Key pair created
Description
Date and time when the local asymmetric key pair was created Key name, which can be one of the following values:
Key name
HOST_KEYHost public key. SERVER_KEYServer public key. This value is available only for RSA
key pairs. Key type, which can be one of the following values:
Key type Key code
RSA Encryption KeyRSA key pair. DSA Encryption KeyDSA key pair.
Public key data
display public-key peer

Description
Use display public-key peer to display information about the specified or all public keys of remote asymmetric key pairs on the local device. With neither the brief keyword nor the name publickey-name combination specified, the command displays detailed information about all locally saved public keys of remote devices.
258
You can use the public-key peer command or public-key peer import sshkey to get a local copy of a remote device's public key. Related commands: public-key peer and public-key peer import sshkey.
Syntax
display public-key peer [ brief | name publickey-name ] [ | { begin | exclude | include } regularexpression ]
View
Any view
Default level
1: Monitor level
Parameters
brief: Displays brief information about all the public keys of remote devices. name publickey-name: Displays information about a remote device's public key. publickey-name represents a public key by its name, a case-sensitive string of 1 to 64 characters. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display detailed information about the host public key named idrsa of a remote asymmetric key pair.
<Sysname> display public-key peer name idrsa ===================================== Key Name Key Type : idrsa : RSA
Key Module: 1024 ===================================== Key Code: 30819D300D06092A864886F70D010101050003818B00308187028181009C46A8710216CEC0C01C7CE136BA76C 79AA6040E79F9E305E453998C7ADE8276069410803D5974F708496947AB39B3F39C5CE56C95B6AB7442D56393 BF241F99A639DD02D9E29B1F5C1FD05CC1C44FBD6CFFB58BE6F035FAA2C596B27D1231D159846B7CB9A7757C5 800FADA9FD72F65672F4A549EE99F63095E11BD37789955020123

Key Name Key Type Key Module Key Code
Description
Name of the public key Key type, which can be RSA or DSA. Key modulus length in bits Public key data
259
# Display brief information about all locally saved public keys of remote asymmetric key pairs.
<Sysname> display public-key peer brief Type RSA DSA Module 1024 1024 Name idrsa 10.1.1.1 ---------------------------

Type Module Name
Description
Key type, which can be RSA or DSA. Key modulus length in bits Name of the public key
peer-public-key end
Description
Use peer-public-key end to return from public key view to system view. Related commands: public-key peer.
Syntax
peer-public-key end
View
Public key view
Default level
2: System level
Parameters
None
Examples
# Exit public key view.
<Sysname> system-view [Sysname] public-key peer key1 [Sysname-pkey-public-key] peer-public-key end [Sysname]
public-key-code begin
Description
Use public-key-code begin to enter public key code view. Then input the key data in the correct format to specify the public key of a remote asymmetric key pair. Spaces and carriage returns are allowed between characters. If the remote device is an HP device, input the key data displayed by the display public-key local public command so that the key is format compliant.
260
Related commands: public-key peer and public-key-code end.
Syntax
public-key-code begin
View
Public key view
Default level
2: System level
Parameters
None
Examples
# Enter public key code view and input the key.
<Sysname> system-view [Sysname] public-key peer key1 [Sysname-pkey-public-key] public-key-code begin [Sysname-pkey-keycode]30819F300D06092A864886F70D010101050003818D0030818902818100C0EC8014F82515F6335A0A [Sysname-pkey-keycode]EF8F999C01EC94E5760A079BD73E4F4D97F3500EDB308C29481B77E719D1643135877E13B1C531B4 [Sysname-pkey-keycode]FF1877A5E2E7B1FA4710DB0744F66F6600EEFE166F1B854E2371D5B952ADF6B80EB5F52698FCF3D6 [Sysname-pkey-keycode]1F0C2EAAD9813ECB16C5C7DC09812D4EE3E9A0B074276FFD4AF2050BD4A9B1DDE675AC30CB020301 [Sysname-pkey-key-code]0001
public-key-code end
Description
Use public-key-code end to return from public key code view to public key view and to save the configured public key. The system verifies the key before saving it. If the key is not in the correct format, the system discards the key and displays an error message. If the key is valid, the system saves the key. Related commands: public-key peer and public-key-code begin.
Syntax
public-key-code end
View
Public key code view
Default level
2: System level
Parameters
None
261
Examples
# Exit public key code view and save the configured public key.
<Sysname> system-view [Sysname] public-key peer key1 [Sysname-pkey-public-key] public-key-code begin [Sysname-pkey-keycode]30819F300D06092A864886F70D010101050003818D0030818902818100C0EC8014F82515F6335A0A [Sysname-pkey-keycode]EF8F999C01EC94E5760A079BD73E4F4D97F3500EDB308C29481B77E719D1643135877E13B1C531B4 [Sysname-pkey-keycode]FF1877A5E2E7B1FA4710DB0744F66F6600EEFE166F1B854E2371D5B952ADF6B80EB5F52698FCF3D6 [Sysname-pkey-keycode]1F0C2EAAD9813ECB16C5C7DC09812D4EE3E9A0B074276FFD4AF2050BD4A9B1DDE675AC30CB020301 [Sysname-pkey-key-code]0001 [Sysname-pkey-key-code] public-key-code end [Sysname-pkey-public-key]
public-key local create

Description
Use public-key local create to create local asymmetric key pairs. The created local key pairs are saved automatically, and can survive a reboot. By default, no asymmetric key pair is created. When using this to create DSA or RSA key pairs, you are asked to provide the length of the key modulus. The modulus length is in the range of 512 to 2048 bits, and defaults to 1024 bits. If the type of key pair already exists, the system asks you whether you want to overwrite it. Related commands: public-key local destroy and display public-key local public.
Syntax
public-key local create { dsa | rsa }
View
System view
Default level
2: System level
Parameters
dsa: Specifies a DSA key pair. rsa: Specifies an RSA key pair.
Examples
# Create local RSA key pairs.
<Sysname> system-view [Sysname] public-key local create rsa The range of public key size is (512 ~ 2048). NOTES: If the key modulus is greater than 512, It will take a few minutes.
262
Press CTRL+C to abort. Input the bits of the modulus[default = 1024]: Generating Keys... ++++++++++++++++ +++++++ +++++++++ +++
# Create a local DSA key pair.

<Sysname> system-view [Sysname] public-key local create dsa The range of public key size is (512 ~ 2048). NOTES: If the key modulus is greater than 512, It will take a few minutes. Press CTRL+C to abort. Input the bits of the modulus[default = 1024]: Generating Keys... ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++* ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++++++++++++++.++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
public-key local destroy

Description
Use public-key local destroy to destroy the local asymmetric key pairs. Related commands: public-key local create.
Syntax
public-key local destroy { dsa | rsa }
View
System view
Default level
2: System level
Parameters
dsa: DSA key pair. rsa: RSA key pair.
Examples
# Destroy the local RSA key pairs.
<Sysname> system-view [Sysname] public-key local destroy rsa Warning: Confirm to destroy these keys? [Y/N]:y
# Destroy the local DSA key pair.

263
[Sysname] public-key local destroy dsa Warning: Confirm to destroy these keys? [Y/N] :y
public-key local export dsa

Description
Use public-key local export dsa command without the filename argument to display the host public key of the local DSA key pair in a specific format. Use public-key local export dsa command with the filename argument to export the host public key of the local DSA key pair to a specific file. SSH2.0 and OpenSSH are two different public key formats for different requirements. Related commands: public-key local create and public-key local destroy.
Syntax
public-key local export dsa { openssh | ssh2 } [ filename ]
View
System view
Default level
2: System level
Parameters
openssh: Uses the format of OpenSSH. ssh2: Uses the format of SSH2.0. filename: Specifies the name of the file for storing the local public key. For more information about file name, see Fundamentals Configuration Guide.
Examples
# Export the local DSA host public key in OpenSSH format to a file named key.pub.
<Sysname> system-view [Sysname] public-key local export dsa openssh key.pub
# Display the local DSA host public key in SSH2.0 format.

<Sysname> system-view [Sysname] public-key local export dsa ssh2 ---- BEGIN SSH2 PUBLIC KEY ---Comment: "dsa-key-20070625" AAAAB3NzaC1kc3MAAACBANdXJixFhMRMIR8YvZbl8GHE8KQj9/5ra4WzTO9yzhSg06UiL+CM7OZb5sJlhUiJ3B7b0 T7IsnTan3W6Jsy5h3I2Anh+kiuoRCHyLDyJy5sG/WD+AZQd3Xf+axKJPadu68HRKNl/BnjXcitTQchQbzWCFLFqL6 xLNolQOHgRx9ozAAAAFQDHcyGMc37I7pk7Ty3tMPSO2s6RXwAAAIEAgiaQCeFOxHS68pMuadOx8YUXrZWUGEzN/Or pbsTV75MTPoS0cJPFKyDNNdAkkrOVnsZJliW8T6UILiLFs3ThbdABMs5xsCAhcJGscXthI5HHbB+y6IMXwb2BcdQe y4PiEMA8ybMugQVhwhYhxz1tqsAo9LFYXaf0JRlxjMmwnu8AAACBANVcLNEKdDt6xcatpRjxsSrhXFVIdRjxw59qZ nKhl87GsbgP4ccUp3KmcRzuqpz1qNtfgoZOLzHnG1YGxPp7Q2k/uRuuHN0bJfBkOLo2/RyGqDJIqB4FQwmrkwJuau YGqQy+mgE6dmHn0VG4gAkx9MQxDIBjzbZRX0bvxMdNKR22 ---- END SSH2 PUBLIC KEY ----
# Display the local DSA host public key in OpenSSH format.

<Sysname> system-view [Sysname] public-key local export dsa openssh
264
ssh-dss AAAAB3NzaC1kc3MAAACBANdXJixFhMRMIR8YvZbl8GHE8KQj9/5ra4WzTO9yzhSg06UiL+CM7OZb5sJlhUiJ3B7b0 T7IsnTan3W6Jsy5h3I2Anh+kiuoRCHyLDyJy5sG/WD+AZQd3Xf+axKJPadu68HRKNl/BnjXcitTQchQbzWCFLFqL6 xLNolQOHgRx9ozAAAAFQDHcyGMc37I7pk7Ty3tMPSO2s6RXwAAAIEAgiaQCeFOxHS68pMuadOx8YUXrZWUGEzN/Or pbsTV75MTPoS0cJPFKyDNNdAkkrOVnsZJliW8T6UILiLFs3ThbdABMs5xsCAhcJGscXthI5HHbB+y6IMXwb2BcdQe y4PiEMA8ybMugQVhwhYhxz1tqsAo9LFYXaf0JRlxjMmwnu8AAACBANVcLNEKdDt6xcatpRjxsSrhXFVIdRjxw59qZ nKhl87GsbgP4ccUp3KmcRzuqpz1qNtfgoZOLzHnG1YGxPp7Q2k/uRuuHN0bJfBkOLo2/RyGqDJIqB4FQwmrkwJuau YGqQy+mgE6dmHn0VG4gAkx9MQxDIBjzbZRX0bvxMdNKR22 dsa-key
public-key local export rsa

Description
Use public-key local export rsa command without the filename argument to display the host public key of the local RSA key pairs in a specific key format. Use public-key local export rsa command with the filename argument to export the host public key of the local RSA key pairs to a specific file. SSH1, SSH2.0 and OpenSSH are three different public key formats for different requirements. Related commands: public-key local create and public-key local destroy.
Syntax
public-key local export rsa { openssh | ssh1 | ssh2 } [ filename ]
View
System view
Default level
2: System level
Parameters
openssh: Uses the format of OpenSSH. ssh1: Uses the format of SSH1.5. ssh2: Uses the format of SSH2.0. filename: Specifies the name of the file for storing the host public key. For more information about file name, see Fundamentals Configuration Guide.
Examples
# Export the host public key of the local RSA key pairs in OpenSSH format to the file named key.pub.
<Sysname> system-view [Sysname] public-key local export rsa openssh key.pub
# Display the host public key of the local RSA key pairs in SSH2.0 format.
<Sysname> system-view [Sysname] public-key local export rsa ssh2 ---- BEGIN SSH2 PUBLIC KEY ---Comment: "rsa-key-20070625" AAAAB3NzaC1yc2EAAAADAQABAAAAgQDAo0dVYR1S5f30eLKGNKuqb5HU3M0TTSaGlER2GmcRI2sgSegbo1x6ut5NI c5+jJxuRCU4+gMc76iS8d+2d50FqIweEkHHkSG/ddgXt/iAZ6cY81bdu/CKxGiQlkUpbw4vSv+X5KeE7j+o0MpOpz h3W768/+u1riz+1LcwVTs51Q== ---- END SSH2 PUBLIC KEY ----
265
# Display the host public key of the local RSA key pairs in OpenSSH format.
<Sysname> system-view [Sysname] public-key local export rsa openssh ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDAo0dVYR1S5f30eLKGNKuqb5HU3M0TTSaGlER2GmcRI2sgSegbo1x6ut5NI c5+jJxuRCU4+gMc76iS8d+2d50FqIweEkHHkSG/ddgXt/iAZ6cY81bdu/CKxGiQlkUpbw4vSv+X5KeE7j+o0MpOpz h3W768/+u1riz+1LcwVTs51Q== rsa-key
public-key peer
Description
Use public-key peer to specify a name for the public key of a remote asymmetric key pair and enter public key view. Use undo public-key peer to remove the public key. To manually configure the public key of a remote symmetric key pair on the local device, obtain the public key in hexadecimal from the remote device beforehand and perform the following configurations:
1. 2. 3. 4.
Execute the public-key peer command, and then public-key-code begin to enter public key code view. Type the public key of the remote asymmetric key pair. Execute the public-key-code end command to save the public key and return to public key view. Execute the peer-public-key end command to return to system view.
Related commands: public-key-code begin, public-key-code end, peer-public-key end, and display public-key peer.
Syntax
public-key peer keyname undo public-key peer keyname
View
System view
Default level
2: System level
Parameters
keyname: Specifies a name for the public key of a remote asymmetric key pair on the local device, a case-sensitive string of 1 to 64 characters.
Examples
# Specify the name for the public key of a remote asymmetric key pair as key1 and enter public key view.
<Sysname> system-view [Sysname] public-key peer key1 [Sysname-pkey-public-key]
266
public-key peer import sshkey

Description
Use public-key peer import sshkey to import a host public key of a remote asymmetric key pair from the public key file. Use undo public-key peer to remove the specified host public key of a remote asymmetric key pair. After execution of this command, the system automatically transforms the host public key in SSH1, SSH2.0 or OpenSSH format to PKCS format, and imports the key. This operation requires that you get a copy of the public key file from the remote device through FTP or TFTP in binary mode in advance. Related commands: display public-key peer.
Syntax
public-key peer keyname import sshkey filename undo public-key peer keyname
View
System view
Default level
2: System level
Parameters
keyname: Specifies a public key name, a case-sensitive string of 1 to 64 characters. filename: Specifies the name of the file that saves the host public key of a remote asymmetric key pair. For more information about file name, see Fundamentals Configuration Guide.
Examples
# Import the host public key named key2 of a remote asymmetric key pair from the public key file key.pub.
<Sysname> system-view [Sysname] public-key peer key2 import sshkey key.pub
267
RSH configuration commands

rsh
Description
Use rsh to execute an OS command of a remote host. The remote host must run the RSH daemon.
Syntax
rsh host [ user username ] command remote-command
View
User view
Default level
0: Visit level
Parameters
host: IP address or host name of the remote host, a string of 1 to 20 characters. user username: Specifies the username for remote login, which is a string of 1 to 20 characters. If you specify no username, the system name of the device, which can be set by using the sysname command, applies. command remote-command: Specifies the command to be executed remotely. Which commands are available depends on the operating system running on the RSH server.
Examples
# Display information about the directories and files on remote host 169.254.1.100, which is running Windows 2000.
<Sysname> rsh 169.254.1.100 command dir Trying 169.254.1.100 ... Press CTRL+K to abort Volume in drive C is SYSTEM Volume Serial Number is 2A0F-18DF Directory of C:\WRSHDNT 2004-07-13 2004-07-13 2001-05-10 2001-12-05 1996-08-05 1998-10-13 2004-01-02 2003-02-26 1997-08-26 09:10 09:10 09:04 15:36 15:39 16:31 23:05 17:04 16:05 <DIR> <DIR> . .. 162,304 UNWISE.EXE 45,056 wrshdcfg.exe 48,128 ctrlrshd.exe 31,744 forewin.exe 40,625 history.txt 6,822 order.txt 23,552 whoami.exe
268
2001-12-07 2003-06-21 2001-12-09 2001-12-09 2003-06-22 2003-06-23 2003-06-23 2003-06-22 2001-09-02 2003-06-21 2004-01-02 2004-01-02 2001-07-30 2004-07-13
17:28 10:51 16:41 16:26 11:14 18:18 18:18 11:13 15:41 10:32 15:54 15:54 18:05 09:10 21 files 2 directories
122,880 wrshdctl.exe 192,512 wrshdnt.cpl 38,991 wrshdnt.hlp 1,740 wrshdnt.cnt 452,230 wrshdnt.htm 4,803 wrshdnt_header.htm 178 wrshdnt_filelist.xml 156,472 wrshdnt.pdf 49,152 wrshdrdr.exe 69,632 wrshdrun.exe 196,608 wrshdsp.exe 102,400 wrshdnt.exe 766 wrshdnt.ico 3,253 INSTALL.LOG 1,749,848 bytes 2,817,417,216 bytes free
# Set the system time of remote host 169.254.1.100, which is running Windows 2000.
<Sysname> rsh 169.254.1.100 command time Trying 169.254.1.100 ... Press CTRL+K to abort The current time is: 12:00 6:56:42.57 Enter the new time: 12:00
269
Portal configuration commands

access-user detect
Description
Use access-user detect to configure the online portal user detection function. Use undo access-user detect to restore the default. By default, the portal user detection function is not configured on an interface. With this function configured on an interface, the device periodically sends ARP requests to portal users on the interface to check whether the portal users are still online. This command does not support cross-subnet portal authentication (configured by the portal server method command with the layer3 keyword).
Syntax
access-user detect type arp retransmit number interval interval undo access-user detect
View
Interface view
Default level
2: System level
Parameters
type arp: Uses ARP requests as probe packets. retransmit number: Specifies the maximum number of times the device sends probe packets to a user before it receives a reply from the user. If this number is reached but the device still receives no reply from the portal user, the device considers that the portal user offline and logs out the user. number ranges from 2 to 5. interval interval: Specifies the interval for sending probe packets, in the range of 5 to 120, in seconds.
Examples
# Configure the portal user detection function on interface Ethernet 1/1, specifying the probe packets as ARP requests, maximum number of probe attempts as 3, and probe interval as 10 seconds.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] access-user detect type arp retransmit 3 interval 10
display portal acl

Description
Use display portal acl to display the ACLs on a specific interface.
270
Syntax
display portal acl { all | dynamic | static } interface interface-type interface-number [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
all: Displays all portal ACLs, including dynamic and static portal ACLs. dynamic: Displays dynamic portal ACLsACLs generated dynamically after a user passes portal authentication. static: Displays static portal ACLsACLs generated through portal related configuration, such as portalfree rule configuration. interface interface-type interface-number: Displays the ACLs on the specified interface. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display all ACLs on interface Ethernet 1/1.
<Sysname> display portal acl all interface ethernet 1/1 Ethernet1/1 portal ACL rule: Rule 0 Inbound interface : Ethernet1/1 Type Action Source: IP Mask MAC VLAN Protocol Destination: IP Mask Rule 1 Inbound interface : Ethernet1/1 Type : static : 192.168.0.111 : 255.255.255.255 : 0.0.0.0 : 0.0.0.0 : 0000-0000-0000 : 0 : 0 : static : permit
Interface : any
271
Action Source: IP Mask MAC VLAN Protocol Destination: IP Mask Rule 2
: redirect : 0.0.0.0 : 0.0.0.0 : 0000-0000-0000 : 2 : 6 : 0.0.0.0 : 0.0.0.0
Interface : any
Inbound interface : Ethernet1/1 Type Action Source: IP Mask MAC VLAN Protocol Destination: IP Mask Author ACL: Number : 3001 : 0.0.0.0 : 0.0.0.0 : 2.2.2.2 : 255.255.255.255 : 000d-88f8-0eab : 0 : 0 : dynamic : permit
Interface : GigabitEthernet5/0

Rule Inbound interface Type Action Source IP Mask MAC Interface VLAN
Description
Sequence number of the portal ACL, which is numbered from 0 in ascending order Interface to which the portal ACL is bound Type of the portal ACL Match action in the portal ACL Source information in the portal ACL Source IP address in the portal ACL Subnet mask of the source IP address in the portal ACL Source MAC address in the portal ACL Source interface in the portal ACL Source VLAN in the portal ACL
272
Field
Protocol Destination IP Mask Author ACL
Description
Protocol type in the portal ACL Destination information in the portal ACL Destination IP address in the portal ACL Subnet mask of the destination IP address in the portal ACL Authorization ACL information. It is displayed only when the value of the Type field is dynamic. Authorization ACL number assigned by the RADIUS server. None indicates that the server did not assign any ACL.
Number
display portal connection statistics

Description
Use display portal connection statistics to display portal connection statistics on a specific interface or all interfaces.
Syntax
display portal connection statistics { all | interface interface-type interface-number } [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
all: Specifies all interfaces. interface interface-type interface-number: Specifies an interface by its type and number. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display portal connection statistics on interface Ethernet 1/1.
<Sysname> display portal connection statistics interface ethernet 1/1 ---------------Interface: Ethernet1/1----------------------User state statistics: State-Name VOID User-Num 0
273
DISCOVERED WAIT_AUTHEN_ACK WAIT_AUTHOR_ACK WAIT_LOGIN_ACK WAIT_ACL_ACK WAIT_NEW_IP WAIT_USERIPCHANGE_ACK ONLINE WAIT_LOGOUT_ACK WAIT_LEAVING_ACK Message statistics: Msg-Name MSG_AUTHEN_ACK MSG_AUTHOR_ACK MSG_LOGIN_ACK MSG_LOGOUT_ACK MSG_LEAVING_ACK MSG_CUT_REQ MSG_AUTH_REQ MSG_LOGIN_REQ MSG_LOGOUT_REQ MSG_LEAVING_REQ MSG_ARPPKT MSG_PORT_REMOVE MSG_VLAN_REMOVE MSG_IF_REMOVE MSG_IF_SHUT MSG_IF_DISPORTAL MSG_IF_UP MSG_ACL_RESULT MSG_CUT_L3IF MSG_IP_REMOVE MSG_ALL_REMOVE MSG_IFIPADDR_CHANGE MSG_SOCKET_CHANGE MSG_NOTIFY MSG_SETPOLICY MSG_SETPOLICY_RESULT 0
0 0 0 0 0 0 1 0 0
Total 3 3 3 2 0 0 3 3 2 0 0 0 0 6 0 0 0 0 0 0 1 0 8 0 0 0
Err 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Discard 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

User state statistics State-Name User-Num Message statistics 274
Description
Statistics on portal users Name of a user state Number of users in a specific state Statistics on messages
Field
Msg-Name Total Err Discard MSG_AUTHEN_ACK MSG_AUTHOR_ACK MSG_LOGIN_ACK MSG_LOGOUT_ACK MSG_LEAVING_ACK MSG_CUT_REQ MSG_AUTH_REQ MSG_LOGIN_REQ MSG_LOGOUT_REQ MSG_LEAVING_REQ MSG_ARPPKT MSG_PORT_REMOVE MSG_VLAN_REMOVE MSG_IF_REMOVE MSG_IF_SHUT MSG_IF_DISPORTAL MSG_IF_UP MSG_ACL_RESULT MSG_CUT_L3IF MSG_IP_REMOVE MSG_ALL_REMOVE MSG_IFIPADDR_CHANGE MSG_SOCKET_CHANGE MSG_NOTIFY MSG_SETPOLICY MSG_SETPOLICY_RESULT 275
Description
Message type Total number of messages of a specific type Number of erroneous messages of a specific type Number of discarded messages of a specific type Authentication acknowledgment message Authorization acknowledgment message Accounting acknowledgment message Accounting-stop acknowledgment message Leaving acknowledgment message Cut request message Authentication request message Accounting request message Accounting-stop request message Leaving request message ARP message Users-of-a-Layer-2-port-removed message VLAN user removed message Users-removed message, indicating the users on a Layer 3 interface were removed because the Layer 3 interface was removed. Layer 3 interface shutdown message Portal-disabled-on-interface message Layer 3 interface came up message ACL deployment failure message Users-removed message, indicating the users on a Layer 3 interface were removed because they were logged out. User-with-an-IP-removed message All-users-removed message Interface IP address change message Socket change message Notification message Set policy message for assigning security ACL Set policy response message
display portal free-rule

Description
Use display portal free-rule to display information about a specific portal-free rule or all portal-free rules. Related commands: portal free-rule.
Syntax
display portal free-rule [ rule-number ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
rule-number: Specifies the number of a portal-free rule, which ranges from 0 to 255. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display information about portal-free rule 1.
<Sysname> display portal free-rule 1 Rule-Number Source: IP Mask MAC Vlan IP Mask : 2.2.2.0 : 255.255.255.0 : 0000-0000-0000 : 0 : 0.0.0.0 : 0.0.0.0 1:
Interface : any Destination:

Rule-Number Source IP Mask
Description
Number of the portal-free rule Source information in the portal-free rule Source IP address in the portal-free rule Subnet mask of the source IP address in the portalfree rule 276
Field
MAC Interface Vlan Destination IP Mask
Description
Source MAC address in the portal-free rule Source interface in the portal-free rule Source VLAN in the portal-free rule Destination information in the portal-free rule Destination IP address in the portal-free rule Subnet mask of the destination IP address in the portal-free rule
display portal interface

Description
Use display portal interface to display the portal configuration of an interface.
Syntax
display portal interface interface-type interface-number [ | { begin | exclude | include } regularexpression ]
View
Any view
Default level
1: Monitor level
Parameters
interface-type interface-number: Specifies an interface by its type and number. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display the portal configuration of interface Ethernet 1/1.
<Sysname> display portal interface ethernet 1/1 Interface portal configuration: Ethernet1/1: Portal running Portal server: servername Authentication type: Direct Authentication domain: my-domain Authentication network: source address : 0.0.0.0 mask : 0.0.0.0 mask : 255.255.255.0 destination address : 2.2.2.0.
277

Interface portal configuration
Description
Portal configuration on the interface Status of the portal authentication on the interface:
Ethernet 1/1
disabledPortal authentication is disabled. enabledPortal authentication is enabled but is

not functioning.
runningPortal authentication is functioning.

Portal server Authentication type Authentication domain Authentication network address mask Portal server referenced by the interface Portal authentication mode enabled on the interface Authentication domain configured on the interface Information of the portal authentication source subnet and destination subnet IP address of the portal authentication subnet Subnet mask of the IP address of the portal authentication subnet
display portal local-server

Description
Use display portal local-server to display configuration information about the local portal server, including the supported protocol type and the SSID binding information. Related commands: portal local-server.
Syntax
display portal local-server [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
Examples
# Display configuration information about the local portal server.
278
<Sysname> display portal local-server Protocol: HTTP Bind SSID list: ssid1: file1.zip ssid2: file1.zip

Protocol
Description
Protocol supported by the local portal server, HTTP or HTTPS. The MSR routers support only the HTTP protocol. SSID binding list
Bind SSID list
If no binding entry is configured, this field will be null. If the device does not support SSID binding, this field will not be displayed.
display portal server

Description
Use display portal server to display information about a specific portal server or all portal servers. Related commands: portal server.
Syntax
display portal server [ server-name ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
server-name: Name of a portal server, a case-sensitive string of 1 to 32 characters. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display information about portal server aaa.
<Sysname> display portal server aaa Portal server: 1)aaa: IP : 192.168.0.111 VPN instance : vpn1
279
Port Key URL Status
: 50100 : portal : http://192.168.0.111 : Up

1) aaa VPN instance IP Port Key
Description
Number of the portal server Name of the portal server MPLS L3VPN to which the portal server belongs IP address of the portal server Listening port on the portal server Shared key for exchanges between the access device and portal server Not configured is displayed if no key is configured. Address the packets are to be redirected to Not configured is displayed if no address is configured. Current status of the portal server. Possible values include:
URL
N/AThe server is not referenced on any interface, or the server

detection function is not enabled. The reachability of the portal server is unknown. Status
UpThe portal server is referenced on an interface and the portal

server detection function is enabled, and the portal server is reachable.
DownThe portal server is referenced on an interface and the portal

server detection function is enabled, but the portal server is unreachable.
display portal server statistics

Description
Use display portal server statistics to display portal server statistics on a specific interface or all interfaces. With the all keyword specified, the command displays portal server statistics by interface and therefore statistics about a portal server referenced by more than one interface may be displayed repeatedly.
Syntax
display portal server statistics { all | interface interface-type interface-number } [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
280
Parameters
all: Specifies all interfaces. interface interface-type interface-number: Specifies an interface by its type and name. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display portal server statistics on Ethernet 1/1.
<Sysname> display portal server statistics interface ethernet 1/1 ---------------Interface: Ethernet1/1---------------------Server name: Pkt-Name REQ_CHALLENGE ACK_CHALLENGE REQ_AUTH ACK_AUTH REQ_LOGOUT ACK_LOGOUT AFF_ACK_AUTH NTF_LOGOUT REQ_INFO ACK_INFO NTF_USERDISCOVER NTF_USERIPCHANGE AFF_NTF_USERIPCHANGE ACK_NTF_LOGOUT NTF_USERSYNC ACK_NTF_USERSYNC 0 0 0 1 2 0 st Total 3 3 3 3 1 1 3 1 6 6 0 0 0 0 0 0 0 Discard 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Checkerr 0 0 0 0 0 0 0 0 0 0 Invalid packets: 0

Interface Server name Invalid packets Pkt-Name Total Discard
Description
Interface referencing the portal server Name of the portal server Number of invalid packets Packet type Total number of packets Number of discarded packets
281
Field
Checkerr REQ_CHALLENGE ACK_CHALLENGE REQ_AUTH ACK_AUTH REQ_LOGOUT ACK_LOGOUT AFF_ACK_AUTH NTF_LOGOUT REQ_INFO ACK_INFO NTF_USERDISCOVER NTF_USERIPCHANGE AFF_NTF_USERIPCHANGE ACK_NTF_LOGOUT NTF_USERSYNC ACK_NTF_USERSYNC
Description
Number of erroneous packets Challenge request message the portal server sends to the access device Challenge acknowledgment message the access device sends to the portal server Authentication request message the portal server sends to the access device Authentication acknowledgment message the access device sends to the portal server Logout request message the portal server sends to the access device Logout acknowledgment message the access device sends to the portal server Affirmation message the portal server sends to the access device after receiving an authentication acknowledgement message Forced logout notification message the access device sends to the portal server Information request message Information acknowledgment message User discovery notification message the portal server sends to the access device User IP change notification message the access device sends to the portal server User IP change success notification message the portal server sends to the access device Forced logout acknowledgment message from the portal server User synchronization packet the access device received from the portal server User synchronization acknowledgment packet the access device sent to the portal server
display portal tcp-cheat statistics

Description
Use display portal tcp-cheat statistics to display TCP spoofing statistics.
Syntax
display portal tcp-cheat statistics [ | { begin | exclude | include } regular-expression ]
View
Any view
282
Default level
1: Monitor level
Parameters
Examples
# Display TCP spoofing statistics.
<Sysname> display portal tcp-cheat statistics TCP Cheat Statistic: Total Opens: 0 Resets Connections: 0 Current Opens: 0 Packets Received: 0 Packets Sent: 0 Packets Retransmitted: 0 Packets Dropped: 0 HTTP Packets Sent: 0 Connection State: SYN_RECVD: 0 ESTABLISHED: 0 CLOSE_WAIT: 0 LAST_ACK: 0 FIN_WAIT_1: 0 FIN_WAIT_2: 0 CLOSING: 0

TCP Cheat Statistic Total Opens Resets Connections Current Opens Packets Received Packets Sent Packets Retransmitted Packets Dropped HTTP Packets Sent 283
Description
TCP spoofing statistics Total number of opened connections Number of connections reset through RST packets Number of connections being set up Number of received packets Number of sent packets Number of retransmitted packets Number of dropped packets Number of HTTP packets sent
Field
Connection State ESTABLISHED CLOSE_WAIT LAST_ACK FIN_WAIT_1 FIN_WAIT_2 CLOSING
Description
Statistics of connections in various states Number of connections in ESTABLISHED state Number of connections in CLOSE_WAIT state Number of connections in LAST-ACK state Number of connections in FIN_WAIT_1 state Number of connections in FIN_WAIT_2 state Number of connections in CLOSING state
display portal user

Description
Use display portal user to display information about portal users on a specific interface or all interfaces.
Syntax
display portal user { all | interface interface-type interface-number } [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
all: Specifies all interfaces. interface interface-type interface-number: Specifies an interface by its type and name. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display information about portal users on all interfaces.
<Sysname> display portal user all Index:2 State:ONLINE SubState:NONE ACL:NONE Work-mode:Stand-alone VPN instance:NONE
284
MAC 000d-88f8-0eab
IP 2.2.2.2 0
Vlan
Interface
--------------------------------------------------------------------Ethernet1/1 Total 1 user(s) matched, 1 listed.

Index State SubState ACL
Description
Index of the portal user Current status of the portal user Current sub-status of the portal user Authorization ACL of the portal user Users working mode, which can be:
Work-mode
Primary Secondary Stand-alone

The MSR series routers do not support user working modes. Stand-alone is displayed for this field on MSR routers.
VPN instance MAC IP Vlan Interface Total 2 user(s) matched, 2 listed
MPLS L3VPN to which the portal server belongs MAC address of the portal user IP address of the portal user VLAN to which the portal user belongs Interface to which the portal user is attached Total number of portal users
portal auth-network
Description
Use portal auth-network to configure a portal authentication source subnet on an interface. You can use this command to configure multiple portal authentication source subnets on an interface. Then, only HTTP packets from the subnets can trigger portal authentication on the interface. If an unauthenticated user is not on any authentication source subnet, the access device discards all the users packets that do not match any portal-free rule. Use undo portal auth-network to remove a specific portal authentication source subnet or all portal authentication subnets. By default, the portal authentication source subnet is 0.0.0.0/0, meaning that users in all subnets must pass portal authentication. This command is only applicable to cross-subnet authentication (layer3). The portal authentication source subnet for direct authentication (direct) can be any source IP address, and the portal authentication source subnet for re-DHCP authentication (redhcp) is the one determined by the private IP address of the interface connecting the users.
285
You can configure multiple authentication source subnets by executing the portal auth-network command repeatedly. If both an authentication source subnet and destination subnet are configured on an interface, only the authentication destination subnet takes effect.
Syntax
portal auth-network network-address { mask-length | mask } undo portal auth-network { network-address | all }
View
Interface view
Default level
2: System level
Parameters
network-address: IP address of the authentication source subnet. mask-length: Length of the subnet mask, in the range of 0 to 32. mask: Subnet mask, in dotted decimal notation. all: Specifies all authentication source subnets.
Examples
# Configure a portal authentication source subnet of 10.10.10.0/24 on Ethernet 1/1 to allow users from subnet 10.10.10.0/24 to trigger portal authentication.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] portal auth-network 10.10.10.0 24
portal auth-network destination

Description
Use portal auth-network destination to configure an authentication destination subnet on an interface. Then, only users accessing the specified subnet (excluding the destination IP addresses and subnets specified in portal-free rules) trigger portal authentication on the interface. Users can access other networks through the interface without portal authentication. Use undo portal auth-network destination to cancel the specified or all authentication destination subnets. By default, the authentication destination subnet is 0.0.0.0/0, meaning that users accessing any subnets must pass portal authentication. Only the three Layer 3 portal authentication modes (direct, re-DHCP, and cross-subnet) support configuring authentication destination subnets. You can configure up to 16 authentication destination subnets by executing the portal auth-network destination command repeatedly. If both an authentication source subnet and destination subnet are configured on an interface, only the authentication destination subnet takes effect.
286
Syntax
portal auth-network destination network-address { mask-length | mask } undo portal auth-network destination { network-address | all }
View
Interface view
Default level
2: System level
Parameters
network-address: IP address of the authentication destination subnet. mask-length: Length of the subnet mask, in the range of 0 to 32. mask: Subnet mask, in dotted decimal notation. all: Removes all authentication destination subnets.
Examples
# Configure a portal authentication destination subnet of 2.2.2.0/24 on Ethernet 1/2, so that only users accessing subnet 2.2.2.0/24 trigger portal authentication on the interface. Users can access other subnets through the interface without portal authentication.
<Sysname> system-view [Sysname] interface ethernet 1/2 [Sysname-Ethernet1/2] portal auth-network destination 2.2.2.0 24
portal delete-user
Description
Use portal delete-user to log off users. Related commands: display portal user.
Syntax
portal delete-user { ip-address | all | interface interface-type interface-number }
View
System view
Default level
2: System level
Parameters
ip-address: Logs off the user with the specified IP address. all: Logs off all users. interface interface-type interface-number: Logs off all users on the specified interface.
Examples
# Log out the user whose IP address is 1.1.1.1.
<Sysname> system-view [Sysname] portal delete-user 1.1.1.1
287
portal domain
Description
Use portal domain to specify an authentication domain for an interface. Then, the device uses the specified authentication domain for AAA of the portal users on the interface. Use undo portal domain to restore the default. By default, no authentication domain is specified for an interface. Related commands: display portal interface.
Syntax
portal domain domain-name undo portal domain
View
Interface view
Default level
2: System level
Parameters
domain-name: ISP domain name, a case-insensitive string of 1 to 24 characters. The domain specified by this argument must already exist.
Examples
# Configure the authentication domain to be used for portal users on Ethernet 1/1 as my-domain.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] portal domain my-domain
portal free-rule
Description
Use portal free-rule to configure a portal-free rule and specify the source filtering condition, destination filtering condition, or both. Use undo portal free-rule to remove a specific portal-free rule or all portal-free rules. If you specify both the source IP address and source MAC address, the IP address must be a host address with a 32-bit mask. Otherwise, the specified MAC address does not take effect. If you specify both a VLAN and an interface in a portal-free rule, the interface must belong to the VLAN. Otherwise, the rule does not take effect. You cannot configure a portal-free rule to have the same filtering criteria as that of an existing one. When attempted, the system prompts that the rule already exists. No matter whether portal authentication is enabled on an interface, you can only add or remove a portal-free rule, rather than modifying it. A Layer 2 interface in an aggregation group cannot be specified as the source interface of a portal-free rule, and the source interface of a portal-free rule cannot be added to an aggregation group.
288
For Layer 2 portal authentication, you can configure only portal-free rules that are from any source address to any or a specific destination address. With such a portal-free rule configured, users can access the specified address without portal authentication. Related commands: display portal free-rule.
Syntax
portal free-rule rule-number { destination { any | ip { ip-address mask { mask-length | netmask } | any } } | source { any | [ interface interface-type interface-number | ip { ip-address mask { mask-length | netmask } | any } | mac mac-address | vlan vlan-id ] * } } * undo portal free-rule { rule-number | all }
View
System view
Default level
2: System level
Parameters
rule-number: Number for the portal-free rule, in the range of 0 to 255. any: Imposes no limitation on the previous keyword. ip ip-address: Specifies an IP address. mask { mask-length | netmask }: Specifies the mask of the IP address, which can be in dotted decimal notation or an integer in the range of 0 to 32. interface interface-type interface-number: Specifies a source interface. mac mac-address: Specifies a source MAC address in the format H-H-H. vlan vlan-id: Specifies a source VLAN ID. all: Specifies all portal-free rules.
Examples
# Configure a portal-free rule, allowing any packet whose source IP address is 10.10.10.1/24 and source interface is Ethernet 1/1 to bypass portal authentication.
<Sysname> system-view [Sysname] portal free-rule destination ip any 15 source ip 10.10.10.1 mask 24 interface ethernet 1/1
portal local-server
Description
Use portal local-server to configure the protocol type to be supported by the local portal server and load the default authentication page file. Use undo portal local-server to cancel the configuration. By default, the local portal server does not support any protocol type. When executing this command, the local portal server loads the default authentication page file, which is supposed to be saved in the root directory of the device. To make sure that the local portal server uses the user-defined default authentication pages, edit and save them properly before executing this command. Otherwise, the system default authentication pages are used.
289
If you specify HTTP in this command, the redirection URL for HTTP packets is in the format of http://IP address of the device/portal/logon.htm, and clients and the portal server exchange authentication information through HTTP. If an online portal user exists on the device, you cannot remove the configured protocol type. Related commands: display portal local-server.
Syntax
portal local-server http undo portal local-server http
View
System view
Default level
2: System level
Parameters
http: Specifies that the local portal server use HTTP to exchange authentication packets with clients.
Examples
# Configure the local portal server to support HTTP.
<Sysname> system-view [Sysname] portal local-server http
portal local-server enable

Description
Use portal local-server enable to enable Layer 2 portal authentication on the current port. Use undo portal to restore the default. By default, portal authentication is not enabled on a Layer 2 port. For normal operation of portal authentication on a Layer 2 port, you must disable portal authentication on all Layer 3 interfaces and HP recommends disabling port security, guest VLAN of 802.1X, and EAD fast deployment of 802.1X on the port. For information about port security and 802.1X features, see Security Configuration Guide. Before enabling portal authentication on a Layer 2 port, be sure to specify the listening IP address of the local portal server. Related command: portal local-server ip. The following table shows the command and router compatibility: Command
portal localserver enable
MSR900
No
MSR20-1X
No
MSR20
No
MSR30
Supported on MIM-FSW modules, MSR30-11E, and MSR30-11F
MSR50
No
Syntax
portal local-server enable undo portal
290
View
Layer 2 Ethernet interface view
Default level
2: System level
Parameters
None
Examples
# Enable Layer 2 portal authentication on Ethernet 1/1.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] portal local-server enable
portal local-server ip
Description
Use portal local-server ip to specify the listening IP address of the local portal server for Layer 2 portal authentication. With a listening IP address specified, the device will redirect Web requests from portal clients to the authentication page at the listening IP address. Use undo portal local-server ip to restore the default. By default, no listening IP address is specified for the local portal server. HP recommends you to configure a loopback interfaces address as the listening IP address because: The status of a loopback interface is stable. This can avoid authentication page access failures caused by interface failures. A loopback interface does not forward received packets. This can avoid impacting system performance when there are many network access requests. Command
portal localserver ip
The following table shows the command and router compatibility: MSR900
No
MSR20-1X
No
MSR20
No
MSR30
MSR50
No
Syntax
portal local-server ip ip-address undo portal local-server ip
View
System view
Default level
2: System level
Parameters
ip-address: Listening IP address of the local portal server. This IP address is that of a Layer 3 interface on the access device and is routable to from the portal client.
291
Examples
# Specify 1.1.1.1 as the listening IP address of the local portal server for Layer 2 portal authentication.
<Sysname> system-view [Sysname] interface loopback 1 [Sysname-LoopBack1] ip address 1.1.1.1 32 [Sysname-LoopBack1] quit [Sysname] portal local-server ip 1.1.1.1
portal max-user
Description
Use portal max-user to set the maximum number of online portal users allowed in the system. Use undo portal max-user to restore the default. If the maximum number of portal users specified in the command is less than that of the current online portal users, the command can be executed successfully and does not impact the online portal users, but the system does not allow new portal users to log in until the number drops down below the limit. All MSR routers support the command, but they have different value ranges and default values: MSR900
Value range: 1 to 512 Default: 512
MSR20-1X
MSR20
MSR30
MSR50
MPUF: 1 to 512, 512 by default MPU-G2: 1 to 4096, 4096 by default
Syntax
portal max-user max-number undo portal max-user
View
System view
Default level
2: System level
Parameters
max-number: Maximum number of online portal users allowed in the system. For the value range and default value for your router, see the value settings for this command.
Examples
# Set the maximum number of portal users allowed in the system to 100.
<Sysname> system-view [Sysname] portal max-user 100
292
portal move-mode auto

Description
Use portal move-mode auto to enable support for portal user moving. Then, if an authenticated user moves from a port of the device to another port of the device without logging off, the user can continue to access the network (without re-authentication) if the following conditions are satisfied: The new port is up. The original port and the new port belong to the same VLAN. The authorization information of the user, if any, is assigned to the new port successfully.
If any condition is not satisfied, the device re-authenticates the user on the new port. Use undo portal move-mode to disable support for portal user moving. By default, support for portal user moving is disabled, and if an authenticated user moves from a port of the device to another port of the device without logging off, the user cannot get online when the original port is still up, because the original port is still maintaining the authentication information of the user. If the original port goes down after a user moves from the port to another port, the authentication information of the user is lost and the user has to be re-authenticated. Support for portal user moving applies to scenarios where hubs, Layer 2 switches, or APs exist between users and the access devices. The following table shows the command and router compatibility: Command
portal movemode auto
MSR900
No
MSR20-1X
No
MSR20
No
MSR30
MSR50
No
Syntax
portal move-mode auto undo portal move-mode
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable support for portal user moving.
<Sysname> system-view [Sysname] portal move-mode auto
293
portal nas-id-profile
Description
Use portal nas-id-profile to specify a NAS ID profile for the interface. Use undo portal nas-id-profile to cancel the configuration. By default, an interface is not specified with any NAS ID profile. If an interface is specified with a NAS ID profile, the interface prefers to use the binding defined in the profile.
Syntax
portal nas-id-profile profile-name undo portal nas-id-profile
View
Interface view
Default level
2: System level
Parameters
profile-name: Name of the profile that defines the binding relationship between VLANs and NAS IDs, a case-insensitive string of 1 to 16 characters. The profile can be configured by using the aaa nas-id profile command. For more information about this command, see the chapter AAA configuration commands.
Examples
# Specify NAS ID profile aaa for VLAN-interface 2.
<Sysname> system-view [Sysname] interface vlan-interface 2 [Sysname-Vlan-interface2] portal nas-id-profile aaa
portal nas-ip
Description
Use portal nas-ip to configure the source IP address for the interface to use for portal packets to be sent. Use undo portal nas-ip to restore the default. By default, no source IP address is specified, and the IP address of the user access interface is used as the source IP address of the portal packets.
Syntax
portal nas-ip ip-address undo portal nas-ip
View
Interface view
Default level
2: System level
294
Parameters
ip-address: Source IP address to be specified for portal packets. This IP address must be a local IP address, and cannot be 0.0.0.0, 255.255.255.255, a class D address, a class E address, or a loopback address.
Examples
# Configure the source IP address for portal packets to be sent on Ethernet 1/1 as 2.2.2.2.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] portal nas-ip 2.2.2.2
portal nas-port-type
Description
Use portal nas-port-type to specify the access port type (indicated by the NAS-Port-Type value) on the current interface. The specified NAS-Port-Type value will be carried in the RADIUS requests sent from the device to the RADIUS server. Use undo portal nas-port-type to restore the default. By default, the access port type of an interface is not specified, and the NAS-Port-Type value carried in RADIUS requests is the user access port type obtained by the access device.
Syntax
portal nas-port-type { ethernet | wireless } undo portal nas-port-type
View
Interface view
Default level
2: System level
Parameters
ethernet: Specifies the access port type as Ethernet, which corresponds to code 15. wireless: Specifies the access port type as IEEE 802.1 standard wireless interface, which corresponds to 1 code 19. This keyword is usually specified on an interface for wireless portal users, making sure that the NAS-Port-Type value delivered by the access device to the RADIUS server is wireless.
Examples
# Specify the NAS-Port-Type value of Ethernet 1/1 as IEEE 802.1 standard wireless interface. 1
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] portal nas-port-type wireless
portal offline-detect interval

Description
Use portal offline-detect interval to set the online Layer 2 portal user detection interval. Then, after a Layer 2 portal user gets online, the device starts a detection timer for the user, and checks whether the
295
user has sent any packet to the device at this interval. If the device receives no packets from the user during two detection intervals or finds that the users MAC address entry has been aged out, the device considers that the user has gone offline and clears the authentication information of the user. Use undo portal offline-detect interval to restore the default. By default, the online Layer 2 portal user detection interval is 300 seconds. This detection interval must be equal to or less than the MAC address entry aging time. Otherwise, many portal users will be considered offline due to aged MAC address entries.
Syntax
portal offline-detect interval offline-detect-interval undo portal offline-detect interval
View
Layer 2 Ethernet interface view
Default level
2: System level
Parameters
offline-detect-value: Online Layer 2 portal user detection interval, in the range of 60 to 65535.
Examples
# Set the online Layer 2 portal user detection interval to 3600 seconds on port Ethernet 1/1.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-ethernet1/1] portal offline-detect interval 3600
portal redirect-url
Description
Use portal redirect-url to specify the auto redirection URL for authenticated portal users. Use undo portal redirect-url to restore the default. By default, a user authenticated is redirected to the URL the user typed in the address bar before portal authentication. With Layer 3 remote portal authentication, this feature requires the cooperation of the IMC server and the IMC must support the page auto-redirection function. The wait-time period option is effective to only local portal authentication. If a Layer 2 portal user is to be assigned a VLAN after passing portal authentication, the user may need to update the IP address after getting online. In this case, the redirection wait time must be longer than the user IP address update time. Otherwise, the user may not be able to open the URL because the expected IP address update is not complete yet.
Syntax
portal redirect-url url-string [ wait-time period ] undo portal redirect-url
296
View
System view
Default level
2: System level
Parameters
url-string: Auto redirection URL for authenticated portal users, a string of 1 to 127 characters. It must start with http:// and must be a fully qualified URL. period: Time that the device must wait before redirecting a user passing portal authentication to the auto redirection URL. It ranges from 1 to 90 and defaults to 5, in seconds.
Examples
# Configure the device to redirect a portal user to http://www.testpt.cn 3 seconds after the user passes portal authentication.
<Sysname> system-view [Sysname] portal redirect-url http://www.testpt.cn wait-time 3
portal server
Description
Use portal server to configure a portal server for Layer 3 portal authentication. Use undo portal server to remove a portal server, restore the default destination port and default URL address, or delete the shared key or the VPN instance configuration. By default, no portal server is configured for Layer 3 portal authentication. If the specified portal server exists and no user is on the interfaces referencing the portal server, using the undo portal server server-name command removes the specified portal server, and if keyword port or url is also provided, the command restores the destination port number or URL address to the default. The configured portal server and its parameters can be removed or modified only when the portal server is not referenced by an interface. To remove or modify the settings of a portal server that has been referenced by an interface, you must first remove the portal configuration on the interface by using the undo portal command. For local portal server configuration, the keywords key, port, and url are usually not required and, if configured, do not take effect. Related commands: display portal server.
Syntax
portal server server-name ip ip-address [ key key-string | port port-id | url url-string | vpn-instance vpninstance-name ] * undo portal server server-name [ key | port | url | vpn-instance ]
View
System view
Default level
2: System level
297
Parameters
server-name: Name of the portal server, a case-sensitive string of 1 to 32 characters. ip-address: IP address of the portal server. If you specify the local portal server, the IP address specified must be that of a Layer 3 interface on the device and must be reachable from the portal clients. key-string: Shared key for communication with the portal server, a case-sensitive string of 1 to 16 characters. Portal packets exchanged between the access device and the portal server carry an authenticator, which is generated with the shared key. The receiver uses the authenticator to check the correctness of the received portal packets. port-id: Destination port number used when the device sends an unsolicited message to the portal server, in the range of 1 to 65534. The default is 50100. url-string: URL to which HTTP packets are to be redirected. The default URL is in the http://ip-address format, where ip-address is the IP address of the portal server. You can also specify the domain name of the portal server, in which case you must use the portal free-rule command to configure the IP address of the DNS server as a portal authentication-free destination IP address. vpn-instance vpn-instance-name: Specifies the MPLS L3VPN to which the portal server belongs. vpninstance-name is a case-sensitive string of 1 to 31 characters. If the portal server is on the public network, do not specify this option.
Examples
# Configure portal server pts, setting the IP address to 192.168.0.1 1, the key to portal, and the redirection 1 URL to http://192.168.0.1 1/portal. 1
<Sysname> system-view [Sysname] portal server pts ip 192.168.0.111 key portal url http://192.168.0.111/portal
portal server banner

Description
Use portal server banner to configure the welcome banner of the default web page provided by the local portal server. Use undo portal server banner to restore the default. By default, no web page welcome banner is configured. The configured welcome banner is applied to only the default authentication pages, rather than the customized authentication pages.
Syntax
portal server banner banner-string undo portal server banner
View
System view
Default level
2: System level
298
Parameters
banner-string: Welcome banner for the web page, a case-sensitive string of 1 to 50 characters. It cannot contain the less-than sign (<) or the and sign (&). If multiple continuous spaces exist in the string, the browser recognizes them as one.
Examples
# Configure the welcome banner of the default web page provided by the local portal server as Welcome to Portal Authentication.
<Sysname> system-view [Sysname] portal server banner Welcome to Portal Authentication
portal server method

Description
Use portal server method to enable Layer 3 portal authentication on an interface, and specify the portal server and the authentication mode to be used. Use undo portal to disable Layer 3 portal authentication on an interface. By default, Layer 3 portal authentication is disabled on an interface. The specified portal server must exist. For the local portal server, the re-DHCP authentication mode can be configured but does not take effect. Related commands: display portal server.
Syntax
portal server server-name method { direct | layer3 | redhcp } undo portal
View
Interface view
Default level
2: System level
Parameters
server-name: Name of the portal server, a case-sensitive string of 1 to 32 characters. method: Specifies the authentication mode to be used. direct: Direct authentication. layer3: Cross-subnet authentication. redhcp: Re-DHCP authentication.
Examples
# Enable Layer 3 portal authentication on interface Ethernet 1/1, referencing portal server pts and setting the authentication mode to direct.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] portal server pts method direct
299
portal server server-detect

Description
Use portal server server-detect to configure portal server detection, including the detection method, action, probe interval, and maximum number of probe attempts. With this function configured, the device checks the status of the specified server periodically and takes the specified actions when the server status changes. Use undo portal server server-detect to cancel the detection of the specified portal server. By default, the portal server detection function is not configured. You can specify one or more detection methods and the actions to be taken. If both detection methods are specified, a portal server is regarded as unreachable as long as one detection method fails, and an unreachable portal server is regarded as recovered only when both detection methods succeed. If multiple actions are specified, the system executes all the specified actions when the status of a portal server changes. Deleting a portal server on the device will delete the detection function for the portal server. If you configure the detection function for a portal server for multiple times, the last configuration takes effect. If you do not specify an optional parameter, the default setting of the parameter is used. The portal server detection function takes effect only when the portal server is referenced on an interface. Authentication-related packets from a portal server, such as logon requests and logoff requests, have the same effect as the portal heartbeat packets for the portal server detection function. Related command: display portal server.
Syntax
portal server server-name server-detect method { http | portal-heartbeat } * action { log | permit-all | trap } * [ interval interval ] [ retry retries ] undo portal server server-name server-detect
View
System view
Default level
2: System level
Parameters
server-name: Name of a portal server, a case-sensitive string of 1 to 32 characters. The specified portal server must have existed. server-detect method { http | portal-heartbeat }: Specifies the portal server detection method. Two detection methods are available: http: Probes HTTP connections. In this method, the access device periodically sends TCP connection requests to the HTTP service port of the portal servers enabled on its interfaces. If the TCP connection with a portal server can be established, the access device considers that the HTTP service of the portal server is open and the portal server is reachablethe detection succeeds. If the TCP connection cannot be established, the access device considers that the detection failsthe portal server is unreachable. If a portal server does not support the portal server heartbeat function, you
300
can configure the device to use the HTTP probe method to detect the reachability of the portal server. portal-heartbeat: Probes portal heartbeat packets. Portal servers periodically send portal heartbeat packets to the access devices. If the access device receives a portal heartbeat packet from a portal server within the specified interval, the access device considers that the probe succeeds and the portal server is reachable; otherwise, it considers that the probe fails and the portal server is unreachable. This method is effective to only portal servers that support the portal heartbeat function. Currently, only the IMC portal server supports this function. To implement detection with this method, you also need to configure the portal server heartbeat function on the IMC portal server and make sure that the server heartbeat interval configured on the portal server is shorter than or equal to the probe interval configured on the device.
action { log | permit-all | trap }: Specifies the actions to be taken when the status of a portal server changes. The following actions are available: log: Specifies the action as sending a log message. When the status (reachable/unreachable) of a portal server changes, the access device sends a log message. The log message contains the portal server name and the current state and original state of the portal server. permit-all: Specifies the action as disabling portal authenticationenabling portal authentication bypass. When the device detects that a portal server is unreachable, it disables portal authentication on the interface referencing the portal server, allowing all portal users on this interface to access network resources. When the access device receives the portal server heartbeat packets or authentication packets (such as login requests and logout requests), it re-enables the portal authentication function. trap: Specifies the action as sending a trap message. When the status (reachable/unreachable) of a portal server changes, the access device sends a trap message to the NMS. Trap message contains the portal server name and the current state of the portal server.
interval interval: Interval at which probe attempts are made. The interval argument ranges from 20 to 600 and defaults to 20, in seconds. retry retries: Maximum number of probe attempts. The retries argument ranges from 1 to 5 and defaults to 3. If the number of consecutive, failed probes reaches this value, the access device considers that the portal server is unreachable.
Examples
# Configure the device to detect portal server pts: Specifying both the HTTP probe and portal heartbeat probe methods Setting the probe interval to 600 seconds Specifying the device to send a server unreachable trap message, send a log message and disable portal authentication to permit unauthenticated portal users, if two consecutive probes fail.
<Sysname> system-view [Sysname] portal server pts server-detect method http portal-heartbeat action log permitall trap interval 600 retry 2
portal server user-sync

Description
Use portal server user-sync to configure portal user information synchronization with a specific portal server. With this function configured, the device periodically checks and responds to the user
301
synchronization packet received from the specified portal server, so as to keep the consistency of the online user information on the device and the portal server. Use undo portal server user-sync to cancel the portal user information synchronization configuration with the specified portal server. By default, the portal user synchronization function is not configured. The user information synchronization function requires that a portal server supports the portal user heartbeat function (currently only the IMC portal server supports portal user heartbeat). To implement the portal user synchronization function, you also need to configure the user heartbeat function on the portal server and make sure that the user heartbeat interval configured on the portal server is shorter than or equal to the synchronization probe interval configured on the device. Deleting a portal server on the device will delete the portal user synchronization configuration with the portal server. If you configure the user synchronization function for a portal server for multiple times, the last configuration takes effect. If you do not specify an optional parameter, the default setting of the parameter is used. For redundant user information on the deviceinformation of the users considered as nonexistent on the portal server, the device deletes the information during the (N+1)th probe interval, where N equals to the value of retries configured in the portal server user-sync command.
Syntax
portal server server-name user-sync [ interval interval ] [ retry retries ] undo portal server server-name user-sync
View
System view
Default level
2: System level
Parameters
server-name: Name of a portal server, a case-sensitive string of 1 to 32 characters. The specified portal server must have existed. user-sync: Enables the portal user synchronization function. interval interval: Specifies the interval at which the device checks the user synchronization packets. The interval argument ranges from 60 to 3600 and defaults to 300, in seconds. retry retries: Specifies the maximum number of consecutive failed checks. The retries argument ranges from 1 to 5 and defaults to 4. If the access device finds that one of its users does not exist in the user synchronization packets from the portal server within N consecutive probe intervals (N = retries), it considers that the user does not exist on the portal server and logs the user off.
Examples
# Configure the device to synchronize portal user information with portal server pts: Setting the synchronization probe interval to 600 seconds Specifying the device to log off users if information of the users does not exist in the user synchronization packets sent from the server in two consecutive probe intervals.
<Sysname> system-view [Sysname] portal server pts user-sync interval 600 retry 2
302
portal web-proxy port

Description
Use portal web-proxy port to add a web proxy server port number so that HTTP requests destined for this port number trigger portal authentication. Use undo portal web-proxy port to delete one or all web proxy server port numbers. By default, no web proxy server port number is configured, and the device redirects only HTTP requests destined for port 80. Up to four web proxy server port numbers can be added. If the port number of a web proxy server is 80, you do not need to configure the port number of the server on the device. If a users browser uses the WPAD protocol to discover web proxy servers, you must add the port numbers of the web proxy servers on the device, and configure portal-free rules to allow user packets destined for the IP address of the WPAD server to pass without authentication. For Layer 2 portal authentication, you need to add the port numbers of the web proxy servers on the device, and users need to make sure that their browsers that use a web proxy server do not use the proxy server for the listening IP address of the local portal server. Thus, HTTP packets that the portal user sends to the local portal server are not sent to the web proxy server. The following table shows the command and router compatibility: Command
portal webproxy port
MSR900
No
MSR20-1X
No
MSR20
No
MSR30
Yes
MSR50
No
Syntax
portal web-proxy port port-number undo portal web-proxy port { port-number | all }
View
System view
Default level
2: System level
Parameters
port-number: Web proxy server port number, in the range of 1 to 65535. all: Specifies all web proxy server port numbers.
Examples
# Add web proxy server port number 8080 on the device, so that users using a web proxy server with the port number can be redirected to the portal authentication page.
<Sysname> system-view [Sysname] portal web-proxy port 8080
303
reset portal connection statistics

Description
Use reset portal connection statistics to clear portal connection statistics on a specific interface or all interfaces.
Syntax
reset portal connection statistics { all | interface interface-type interface-number }
View
User view
Default level
1: Monitor level
Parameters
all: Specifies all interfaces. interface interface-type interface-number: Specifies an interface by its type and number.
Examples
# Clear portal connection statistics on interface Ethernet 1/1.
<Sysname> reset portal connection statistics interface ethernet 1/1
reset portal server statistics

Description
Use reset portal server statistics to clear portal server statistics on a specific interface or all interfaces.
Syntax
reset portal server statistics { all | interface interface-type interface-number }
View
User view
Default level
1: Monitor level
Parameters
all: Specifies all interfaces. interface interface-type interface-number: Specifies an interface by its type and number.
Examples
# Clear portal server statistics on interface Ethernet 1/1.
<Sysname> reset portal server statistics interface ethernet 1/1
reset portal tcp-cheat statistics

Description
Use reset portal tcp-cheat statistics to clear TCP spoofing statistics.
304
Syntax
reset portal tcp-cheat statistics
View
User view
Default level
1: Monitor level
Parameters
None
Examples
# Clear TCP spoofing statistics.
<Sysname> reset portal tcp-cheat statistics
web-redirect
Description
Use web-redirect to configure the mandatory Web page pushing function on an interface. After you configure this function on an interface and set the redirection interval, a user on the interface will be forced to access a specific Web page when the user accesses network resources through Web for the first time. After a specific period of time, namely, the redirection interval, if the user sends a Web access request again, the system will push the specified Web page to the user again. Use undo web-redirect to restore the default. By default, this function is not configured on an interface. You cannot configure both the portal function and the mandatory Web page pushing function on an interface. If you do so, the function configured later will not take effect. If you execute this command repeatedly, the last configuration takes effect.
Syntax
web-redirect url url-string [ interval interval ] undo web-redirect
View
Interface view
Default level
2: System level
Parameters
url-string: URL address to which a Web access request is to be redirected. Interval: Redirection interval in seconds, in the range of 60 to 86400. The default is 86400.
Examples
# Configure the mandatory Web page pushing function on Ethernet 1/1, setting the redirection URL address to http://192.0.0.1 and the interval to 3600 seconds.
<Sysname> system-view [Sysname] interface ethernet 1/1
305
[Sysname-Ethernet1/1] web-redirect url http://192.0.0.1 interval 3600
306
Firewall configuration commands

Packet-filter firewall configuration commands
display firewall ethernet-frame-filter
Description
Use display firewall ethernet-frame-filter to view the Ethernet frame filtering statistics.
Syntax
display firewall ethernet-frame-filter { all | dlsw | interface interface-type interface-number } [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameter
all: Displays the Ethernet frame filtering statistics of all interfaces. dlsw: Displays the Ethernet frame filtering statistics when data streams pass the DLSw module. interface interface-type interface-number: Displays the Ethernet frame filtering statistics of the specified interface. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Example
# Display the Ethernet frame filtering statistics on Ethernet 1/1.
<Sysname> display firewall ethernet-frame-filter interface ethernet 1/1 Interface: Ethernet1/1 In-bound Policy: acl 4000 From 2005-06-07 14:46:59 to 2005-06-07 16:16:23 0 packets, 0 bytes, 0% permitted, 0 packets, 0 bytes, 0% denied, 0 packets, 0 bytes, 0% permitted default, 0 packets, 0 bytes, 0% denied default, Totally 0 packets, 0 bytes, 0% permitted, Totally 0 packets, 0 bytes, 0% denied.
307
Out-bound Policy: acl 4000 From 2005-06-07 15:59:23 to 2005-06-07 16:16:23 0 packets, 0 bytes, 0% permitted, 0 packets, 0 bytes, 0% denied, 0 packets, 0 bytes, 0% permitted default, 0 packets, 0 bytes, 0% denied default, Totally 0 packets, 0 bytes, 0% permitted, Totally 0 packets, 0 bytes, 0% denied.

Interface In-bound Policy Out-bound Policy
Description
Interface configured with Ethernet frame filtering Indicates an inbound ACL rule has been configured on the interface Indicates an outbound ACL rule has been configured on the interface.
display firewall ipv6 statistics

Description
Use display firewall ipv6 statistics to view the packet filtering statistics of the IPv6 firewall.
Syntax
display firewall ipv6 statistics { all | interface interface-type interface-number } [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
all: Displays the packet filtering statistics of all interfaces of the IPv6 firewall. interface interface-type interface-number: Displays the packet filtering statistics of the specified interface of the IPv6 firewall. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display the packet filtering statistics of the IPv6 firewall.
<Sysname> display firewall ipv6 statistics interface ethernet 1/1
308
Interface: ethernet1/1 In-bound Policy: acl6 2000 From 2008-06-04 10:25:21 to 2008-06-04 10:35:57 0 packets, 0 bytes, 0% permitted 0 packets, 0 bytes, 0% denied 0 packets, 0 bytes, 0% permitted default 0 packets, 0 bytes, 0% denied default Totally 0 packets, 0 bytes, 0% permitted Totally 0 packets, 0 bytes, 0% denied

Interface In-bound Policy Out-bound Policy acl6 0 packets, 0 bytes, 0% permitted
Description
Interface configured with the IPv6 packet filtering function Indicates that an IPv6 ACL is configured in the inbound direction of the interface Indicates that an IPv6 ACL is configured in the outbound direction of the interface IPv6 ACL number Indicates the packets permitted by IPv6 ACL rules: the number of packets and bytes, and the percentage of the permitted to the total. Indicates the packets denied by IPv6 ACL rules: the number of packets and bytes, and the percentage of the denied to the total. Indicates the packets that matched no IPv6 ACL rule and were permitted according to the default filtering rule: number of packets and bytes, and the percentage of the permitted to the total. Indicates the packets that matched no IPv6 ACL rule and were denied according to the default filtering rule: number of packets and bytes, and the percentage of the denied to the total. Indicates all permitted packets: the number of packets and bytes, and the percentage of all the permitted to the total. Indicates all denied packets: the number of packets and bytes, and the percentage of all the denied to the total.
0 packets, 0 bytes, 0% denied
0 packets, 0 bytes, 0% permitted default
0 packets, 0 bytes, 0% denied default
Totally 0 packets, 0 bytes, 0% permitted
Totally 0 packets, 0 bytes, 0% denied
display firewall-statistics
Description
Use display firewall-statistics to view the packet filtering statistics of the IPv4 firewall. Related commands: firewall fragments-inspect.
309
NOTE: At most 50 fragments with the same 16-bit identifier in IP header can be recorded.
Syntax
display firewall-statistics { all | fragments-inspect | interface interface-type interface-number } [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
all: Displays the packet filtering statistics of all interfaces of the IPv4 firewall. fragments-inspect: Displays the fragments inspection statistics of the IPv4 firewall. interface interface-type interface-number: Displays the packet filtering statistics of the specified interface of the IPv4 firewall. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display statistics information about fragments inspection.
<Sysname> display firewall-statistics fragments-inspect Fragments inspection is enabled. The high-watermark for clamping is 2000. The low-watermark for clamping is 1500. Current records for fragments inspection is 0.

Fragments inspection is enabled The high-watermark for clamping The low-watermark for clamping Current records for fragments inspection
Description
The fragments inspection function of the firewall is enabled High threshold of the number of fragment status records Low threshold of the number of fragment status records The current number of records for fragments inspection
310
firewall default
Description
Use firewall default to specify the default firewall filtering action of the IPv4 firewall. By default, the default filtering action of the IPv4 firewall is permitting packets to pass (permit).
Syntax
firewall default { deny | permit }
View
System view
Default level
2: System level
Parameters
deny: Specifies the filtering action as denying packets to pass the firewall. permit: Specifies the filtering action as permitting packets to pass the firewall.
Examples
# Specify the default filtering action of the IPv4 firewall as denying packets to pass.
<Sysname> system-view [Sysname] firewall default deny
firewall enable
Description
Use firewall enable to enable the IPv4 firewall function. Use undo firewall enable to disable the IPv4 firewall function. By default, the IPv4 firewall function is disabled.
Syntax
firewall enable undo firewall enable
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable the IPv4 firewall function.
<Sysname> system-view [Sysname] firewall enable
311
firewall ethernet-frame-filter
Description
Use firewall ethernet-frame-filter to configure Ethernet frame filtering. Use undo firewall ethernet-frame-filter to remove the Ethernet frame filtering. Ethernet frame filtering is not performed by default. The Ethernet frame filtering function is effective only when the interface works in bridge group. You can apply only one ACL in one direction of an interface to filter Ethernet frames. The following table shows the command and router compatibility: Command
firewall ethernetframe-filter
MSR900
No
MSR20-1X
No
MSR20
Yes
MSR30
Yes
MSR50
Yes
Syntax
firewall ethernet-frame-filter { acl-number | name acl-name } { inbound | outbound } undo firewall ethernet-frame-filter [ { acl-number | name acl-name } ] { inbound | outbound }
View
Interface view
Default level
2: System level
Parameters
acl-number: Ethernet frame header ACL number, in the range of 4000 to 4999. name acl-name: Specifies the Ethernet frame header ACL name; a case-insensitive string of 1 to 63 characters that must start with an English letter a to z or A to Z. To avoid confusion, the word all cannot be used as the ACL name. inbound: Filters packets received by the interface. outbound: Filters packets forwarded from the interface.
Examples
# Configure Ethernet frame filtering rules in the inbound direction of Ethernet 1/1.
<Sysname> system-view [Sysname] bridge enable [Sysname] bridge 1 enable [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] bridge-set 1 [Sysname-Ethernet1/1] firewall ethernet-frame-filter 4001 inbound
firewall fragments-inspect
Description
Use firewall fragments-inspect to enable fragments inspection.
312
Use undo firewall fragments-inspect to disable fragments inspection. Be default, fragments inspection is disabled. Related commands: display firewall-statistics fragments-inspect and firewall packet-filter.
Syntax
firewall fragments-inspect undo firewall fragments-inspect
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable fragments inspection.
<Sysname> system-view [Sysname] firewall fragments-inspect
firewall fragments-inspect { high | low }

Description
Use firewall fragments-inspect { high | low } to set the high and low threshold values for fragments inspection. Use undo firewall fragments-inspect { high | low } to restore the defaults. By default, the high threshold is 2000 and low threshold is 1500. The low threshold must be smaller than or equal to the high threshold. Related commands: display firewall-statistics fragments-inspect and firewall packet-filter.
Syntax
firewall fragments-inspect { high | low } { number | default } undo firewall fragments-inspect { high | low }
View
System view
Default level
2: System level
Parameters
high: Specifies the high threshold of the number of fragment status records. low: Specifies the low threshold of the number of fragment status records. number: Number of fragment status records.
313
default: Specifies the default number of fragment status records. With this keyword specified, the specified threshold is restored to the default.
Examples
# Set the high threshold for fragment inspection to 3000 and restore the low threshold to the default.
<Sysname> system-view [Sysname] firewall fragments-inspect high 3000 [Sysname] firewall fragments-inspect low default
firewall ipv6 default

Description
Use firewall ipv6 default to specify the default firewall filtering action of the IPv6 firewall. By default, the default filtering action of IPv6 firewall is permitting packets to pass (permit).
Syntax
firewall ipv6 default { deny | permit }
View
System view
Default level
2: System level
Parameters
deny: Specifies the filtering action as denying packets to pass the firewall. permit: Specifies the filtering action as permitting packets to pass the firewall.
Examples
# Specify the default filtering action of the IPv6 firewall as denying packets to pass.
<Sysname> system-view [Sysname] firewall ipv6 default deny
firewall ipv6 enable

Description
Use firewall ipv6 enable to enable the IPv6 firewall function. Use undo firewall ipv6 enable to disable the IPv6 firewall function. By default, the IPv6 firewall function is disabled.
Syntax
firewall ipv6 enable undo firewall ipv6 enable
View
System view
Default level
2: System level
314
Parameters
None
Examples
# Enable the IPv6 firewall function.
<Sysname> system-view [Sysname] firewall ipv6 enable
firewall ipv6 fragments-inspect

Description
Use firewall ipv6 fragments-inspect to enable IPv6 fragments inspection. Use undo firewall ipv6 fragments-inspect to disable IPv6 fragments inspection. By default, IPv6 fragments inspection is disabled.
Syntax
firewall ipv6 fragments-inspect undo firewall ipv6 fragments-inspect
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable IPv6 fragments inspection.
<Sysname> system-view [Sysname] firewall ipv6 fragments-inspect
firewall packet-filter
Description
Use firewall packet-filter to configure IPv4 packet filtering on the interface. Use undo firewall packet-filter to cancel the configuration. Packets are not filtered on an interface by default. You can apply only one IPv4 ACL in one direction of an interface to filter packets. Related commands: firewall fragments-inspect. The following table shows the command and router compatibility: Command
firewall packetfilter
MSR900
No
MSR20-1X
No
MSR20
Yes
MSR30
Yes
MSR50
Yes
315
Syntax
firewall packet-filter { acl-number | name acl-name } { inbound | outbound } [ match-fragments { exactly | normally } ] undo firewall packet-filter { acl-number | name acl-name } { inbound | outbound }
View
Interface view
Default level
2: System level
Parameters
acl-number: Basic ACL number, in the range of 2000 to 2999; advanced ACL number, in the range of 3000 to 3999. name acl-name: Specifies the name of a basic or advanced IPv4 ACL; a case-insensitive string of 1 to 63 characters that must start with an English letter a to z or A to Z. To avoid confusion, the word all cannot be used as the ACL name. inbound: Filters packets received by the interface. outbound: Filters packets forwarded from the interface. match-fragments { exactly | normally }: Specifies the fragment match mode (for advanced ACLs only). The default match mode is normally. exactly: Specifies the exact match mode. normally: Specifies the normal match mode.
Examples
# Apply ACL 2001 to interface Serial 2/0 to filter outbound packets.
<Sysname> system-view [Sysname] interface serial 2/0 [Sysname-Serial2/0] firewall packet-filter 2001 outbound
firewall packet-filter ipv6

Description
Use firewall packet-filter ipv6 to configure IPv6 packet filtering on the interface. Use undo firewall packet-filter ipv6 to remove the IPv6 packet filtering setting on the interface. By default, IPv6 packets are not filtered on the interface. You can apply only one IPv6 ACLs in one direction of an interface to filter packets. The following table shows the command and router compatibility: Command
firewall packet-filter ipv6
MSR900
No
MSR20-1X
No
MSR20
Yes
MSR30
Yes
MSR50
Yes
Syntax
firewall packet-filter ipv6 { acl6-number | name acl6-name } { inbound | outbound } undo firewall packet-filter ipv6 [ { acl6-number | name acl6-name } ] { inbound | outbound }
316
View
Interface view
Default level
2: System level
Parameters
acl-number: Basic ACL number, in the range of 2000 to 2999; advanced ACL number, in the range of 3000 to 3999. name acl6-name: Specifies the name of a basic or advanced IPv6 ACL; a case-insensitive string of 1 to 63 characters that must start with an English letter a to z or A to Z. To avoid confusion, the word all cannot be used as the ACL name. inbound: Specifies to filter packets received by the interface. outbound: Specifies to filter packets forwarded by the interface.
Examples
# Apply IPv6 ACL 2500 to interface Ethernet 1/1 to filter outbound packets.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] firewall packet-filter ipv6 2500 outbound
reset firewall ethernet-frame-filter

Description
Use reset firewall ethernet-frame-filter to clear the Ethernet frame filtering statistics.
Syntax
reset firewall ethernet-frame-filter { all | dlsw | interface interface-type interface-number }
View
User view
Default level
1: Monitor level
Parameters
all: Clears all Ethernet frame filtering statistics. dlsw: Clears the Ethernet frame filtering statistics of the DLSw module. interface interface-type interface-number: Clears the Ethernet frame filtering statistics on the specified interface.
Examples
# Clear all the firewall statistic information.
<Sysname> reset firewall ethernet-frame-filter all
317
reset firewall ipv6 statistics

Description
Use reset firewall ipv6 statistics to clear the packet filtering statistics of the IPv6 firewall. Related commands: display firewall ipv6 statistics.
Syntax
reset firewall ipv6 statistics { all | interface interface-type interface-number }
View
User view
Default level
1: Monitor level
Parameters
all: Clears the packet filtering statistics on all interfaces of the IPv6 firewall. interface interface-type interface-number: Clears the packet filtering statistics on the specified interface of the IPv6 firewall.
Examples
# Clear the packet filtering statistics on Ethernet 1/1 of the IPv6 firewall.
<Sysname> reset firewall ipv6 statistics interface ethernet 1/1
reset firewall-statistics
Description
Use reset firewall-statistics to clear the packet filtering statistics of the IPv4 firewall.
Syntax
reset firewall-statistics { all | interface interface-type interface-number }
View
User view
Default level
1: Monitor level
Parameters
all: Clears the packet filtering statistics on all interfaces of the IPv4 firewall. interface interface-type interface-number: Clears the packet filtering statistics on the specified interface of the IPv4 firewall.
Examples
# Clear the packet filtering statistics of IPv4 firewall on Ethernet 1/1.
<Sysname> reset firewall-statistics interface ethernet 1/1
318
ASPF configuration commands

aging-time
Description
Use aging-time to set the TCP session termination delay time, TCP session hold time, TCP session idle timeout period, and UDP session idle timeout period. Use undo aging-time to restore the defaults. By default, the TCP session termination delay time, TCP session hold time, TCP session idle timeout period, and UDP session idle timeout period are 5, 30, 3600 and 30 seconds respectively. Within the timeout period, the system maintains the session. Related commands: display aspf all, display aspf interface, display aspf policy, and display aspf session.
Syntax
aging-time { fin | syn | tcp | udp } seconds undo aging-time { fin | syn | tcp | udp }
View
ASPF policy view
Default level
2: System level
Parameters
fin: Specifies the TCP session termination delay time after a FIN packet is detected. If the session still exists after this period of time, it will be torn down. syn: Specifies the TCP session hold time after a SYN is detected. If the session fails to reach the established state within this period of time, it will be torn down. tcp: Specifies the TCP session idle timeout period. udp: Specifies the UDP session idle timeout period. seconds: Timeout period, in seconds. The value range is 5 to 43200.
Examples
# Create an ASPF policy with the policy number 1, and enter ASPF policy view.
<Sysname> system-view [Sysname] aspf-policy 1
# Set the TCP session termination delay time of the TCP session to 10 seconds.
[Sysname-aspf-policy-1] aging-time fin 10
# Set the TCP session hold time of the TCP session to 20 seconds.
[Sysname-aspf-policy-1] aging-time syn 20
# Set the TCP session idle timeout period to 3000 seconds.

[Sysname-aspf-policy-1] aging-time tcp 3000
# Set the UDP session idle timeout period to 1 seconds. 10

[Sysname-aspf-policy-1] aging-time udp 110
319
aspf-policy
Description
Use aspf-policy to create an ASPF policy and enter its view. Use undo aspf-policy to remove an ASPF policy. A defined ASPF policy can be applied through its policy number.
Syntax
aspf-policy aspf-policy-number undo aspf-policy aspf-policy-number
View
System view
Default level
2: System level
Parameters
aspf-policy-number: ASPF policy number, in the range of 1 to 99
Examples
# Create an ASPF policy and enter the corresponding ASPF policy view.
<Sysname> system-view [Sysname] aspf-policy 1 [Sysname-aspf-policy-1]
detect
Description
Use detect to configure ASPF detection for the application layer protocol or transport layer protocol. Use undo detect to restore the default. By default, the timeout period for an application layer protocol is 3600 seconds, the TCP-based timeout period is 3600 seconds, and the UDP-based timeout period is 30 seconds. If the protocol type is HTTP, Java blocking is allowed. If application layer protocol detection and general TCP/UDP detection are both enabled, application layer protocol detection is given priority over general TCP/UDP detection. ASPF uses timeouts to manage the session status information of a protocol so as to determine when to terminate the status information management of a session or when to delete a session that cannot be normally established. As a global configuration, the setting of a timeout applies to all sessions to protect system resources from being maliciously seized. A protocol idle timeout setting specified using the detect command has priority over a timeout setting specified using the aging-time command. Related commands: display aspf all, display aspf interface, display aspf policy, and display aspf session.
Syntax
detect protocol [ java-blocking acl-number ] [ aging-time seconds ]
320
undo detect protocol
View
ASPF policy view
Default level
2: System level
Parameters
protocol: Name of a protocol supported by the ASPF. Application layer protocols include FTP, HTTP, H323, SMTP, and RTSP, and transport layer protocols include TCP and UDP. java-blocking acl-number: Blocks the Java Applets of packets to the specified network segment, applicable to HTTP only. The acl-number argument refers to a basic IPv4 ACL number, in the range of 2000 to 2999. aging-time seconds: Configures the idle timeout period for the application layer protocol, in seconds. The value range is 5 to 43200.
Examples
# Specify ASPF policy 1 for the HTTP protocol, enable Java blocking, and configure ACL 2000 so that the ASPF policy can filter Java applets from the server 10.1.1.1.
<Sysname> system-view [Sysname] acl number 2000 [Sysname-acl-basic-2000] rule permit source 10.1.1.1 0 [Sysname-acl-basic-2000] rule deny source any [Sysname-acl-basic-2000] quit [Sysname] aspf-policy 1 [Sysname-aspf-policy-1] detect http java-blocking 2000
display aspf all

Description
Use display aspf all to view the information of all the ASPF policies and sessions.
Syntax
display aspf all [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
321
Examples
# Display the information of all the ASPF policies and sessions.
<Sysname> display aspf all [ASPF Policy Configuration] Policy Number 1: Log: SYN timeout: FIN timeout: TCP timeout: UDP timeout: Detect Protocols: ftp tcp timeout 3600 s timeout 3600 s disable 30 5 3600 30 s s s s
[Interface Configuration] Interface Ethernet1/1 [Established Sessions] Session Initiator 73A4844 1.1.1.50:1025 Responder 2.2.2.1:21 Application ftp Status FTP_CONXN_UP -------------------------------------------------------------------------InboundPolicy none OutboundPolicy 1 ---------------------------------------------------------------

[ASPF Policy Configuration] Policy Number SYN timeout FIN timeout TCP timeout UDP timeout Detect Protocols [Interface Configuration] Interface InboundPolicy OutboundPolicy Detect Protocols Session Initiator Responder Application 322
Description
ASPF policy configuration information ASPF policy number SYN timeout value of the TCP session FIN timeout of the TCP session Idle timeout of the TCP session Idle timeout of the UDP session Detect protocols ASPF policy application information of the interface Type and number of the Interface Inbound ASPF policy Outbound ASPF policy Detected protocols Session ID IP address and port number of the Initiator of the session IP address and port number of the responder of the session Application protocol
Field
Status
Description
Session status
display aspf interface

Description
Use display aspf interface to view the ASPF policy configuration applied on interfaces.
Syntax
display aspf interface [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
Examples
# Display the ASPF policies on interface.
<Sysname> display aspf interface [Interface Configuration] Interface Serial2/1 1 InboundPolicy OutboundPolicy none ---------------------------------------------------------------

InboundPolicy OutboundPolicy
Description
Inbound ASPF policy Outbound ASPF policy
display aspf policy

Description
Use display aspf policy to view the information of an ASPF policy.
Syntax
display aspf policy aspf-policy-number [ | { begin | exclude | include } regular-expression ]
323
View
Any view
Default level
1: Monitor level
Parameters
aspf-policy-number: ASPF policy number, in the range of 1 to 99 |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display the configuration information of ASPF policy 1.
<Sysname> display aspf policy 1 [ASPF Policy Configuration] Policy Number 1: Log: SYN timeout: FIN timeout: TCP timeout: UDP timeout: Detect Protocols ftp tcp timeout 120 s timeout 3600 s disable 30 5 3600 30 s s s s

[ASPF Policy Configuration] Policy Number SYN timeout FIN timeout TCP timeout UDP timeout Detect Protocols
Description
ASPF policy configuration information ASPF policy number TCP connection SYN status timeout time TCP session FIN status timeout time TCP session idle status timeout time UDP session idle status timeout time Detection protocol
display aspf session

Description
Use display aspf session to view the information of the current ASPF session.
324
Syntax
display aspf session [ verbose ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
verbose: Displays the detailed information of the current session. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display the related information of the current ASPF session.
<Sysname> display aspf session [Established Sessions] Session Initiator 212BA84 169.254.1.121:1427 7148124 100.1.1.1:1027 Responder 169.254.1.52:0 200.1.1.2:21 Application ftp-data ftp Status TCP_DOWN FTP_CONXN_UP
# Display the detailed information of the current ASPF session.

<Sysname> display aspf session verbose [Session 0x7148124] Initiator: 100.1.1.1:1027 Application protocol: ftp Transport protocol: 6 Child: 0x0 Interface: Ethernet1/1 Timeout 01:00:00 Responder: 200.1.1.2:21 Status: FTP_CONXN_UP Port: 21 Parent: 0x0 Direction: outbound Time left 01:00:00
Initiator Bytes/Packets sent: 350/8 Responder Bytes/Packets sent: 324/6 Initiator tcp SeqNumber/AckNumber: 141385146/134665684 Responder tcp SeqNumber/AckNumber: 134665683/141385146

Initiator Responder Application protocol 325
Description
IP address and port number of the initiator of the session IP address and port number of the responder of the session Application protocol
Field
Status Transport protocol Port Child Parent Interface: Ethernet1/1 Direction: outbound Timeout Time left Initiator Bytes/Packets sent Responder Bytes/Packets sent Initiator tcp SeqNumber/AckNumber Responder tcp SeqNumber/AckNumber
Description
Status of the session Protocol number of the transport layer Port number of the application layer protocol Child session Parent session The ASPF policy is applied to the inbound direction of Ethernet 1/1 Timeout set for the protocol Remaining timeout period Number of initiator bytes/packets sent Number of responder bytes/packets sent TCP sequence number/acknowledgment number of the initiator TCP sequence number/acknowledgment number of the responder
display port-mapping
Description
Use display port-mapping to view port mapping information. Related commands: port-mapping.
Syntax
display port-mapping [ application-name | port port-number ] [ | { begin | exclude | include } regularexpression ]
View
Any view
Default level
1: Monitor level
Parameters
application-name: Name of the application to be used for port mapping. Available applications include FTP, GTP-C, GTP-U, GTP-V0, H323, HTTP, RTSP, SCCP, SIP, SMTP, and SQLNET. port port-number: Specifies to display port mapping information on the specified port. The port number is in the range of 0 to 65535. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression.
326
Examples
# Display all the information about port mapping.
<Sysname> display port-mapping SERVICE ftp gtp-c gtp-u gtp-v0 h323 http rtsp sccp sip smtp sqlnet PORT 21 2123 2152 3386 1720 80 554 2000 5060 25 1521 ACL TYPE system defined system defined system defined system defined system defined system defined system defined system defined system defined system defined system defined -------------------------------------------------

SERVICE PORT ACL TYPE
Description
Application layer protocol that is mapped to a port Number of the port for the application layer protocol Number of the ACL specifying the host range Port mapping type, system predefined or user customized
firewall aspf
Description
Use firewall aspf to apply the specified ASPF policy to the specified direction on the current interface. Use undo firewall aspf to remove the specified ASPF policy on the current interface. By default, no ASPF policy is applied on the interface. The following table shows the command and router compatibility: Command
firewall aspf
MSR900
No
MSR20-1X
No
MSR20
Yes
MSR30
Yes
MSR50
Yes
Syntax
firewall aspf aspf-policy-number { inbound | outbound } undo firewall aspf aspf-policy-number { inbound | outbound }
View
Interface view
327
Default level
2: System level
Parameters
aspf-policy-number: Number of the ASPF policy, in the range of 1 to 99. inbound: Applies ASPF policy to inbound packets. outbound: Applies ASPF policy to outbound packets.
Examples
# Apply ASPF policy 1 to the outbound direction of Ethernet 1/1.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] firewall aspf 1 outbound
log enable
Description
Use log enable to enable the ASPF session logging function. Use undo log enable to disable the ASPF session logging function. By default, the ASPF session logging function is disabled. Related commands: display aspf all, display aspf interface, display aspf policy, and display aspf session.
Syntax
log enable undo log enable
View
ASPF policy view
Default level
2: System level
Parameters
None
Examples
# Enable the ASPF session logging function.
<Sysname> system-view [Sysname] aspf-policy 1 [Sysname-aspf-policy-1] log enable
port-mapping
Description
Use port-mapping to map a port to an application layer protocol. Use undo port-mapping to remove a port mapping entry. By default, there is no mapping between the port and the application layer.
328
Related commands: display port-mapping.
Syntax
port-mapping application-name port port-number [ acl acl-number ] undo port-mapping [ application-name port port-number [ acl acl-number ] ]
View
System view
Default level
2: System level
Parameters
application-name: Name of the application for port mapping. Available applications include FTP, GTP-C, GTP-U, GTP-V0, H323, HTTP, RTSP, SCCP, SIP, SMTP, and SQLNET. port port-number: Specifies the port that the application layer protocol is mapped to. The port number is in the range of 0 to 65535. acl acl-number: Specifies the IPv4 ACL for indicating the host range. The ACL number is in the range of 2000 to 2999.
Examples
# Map port 3456 to the FTP protocol.
<Sysname> system-view [Sysname] port-mapping ftp port 3456
reset aspf session

Description
Use reset aspf session command clear ASPF sessions.
Syntax
reset aspf session
View
User view
Default level
2: System level
Parameters
None
Examples
# Clear ASPF sessions.
<Sysname> reset aspf session
329
SSH2.0 configuration commands

SSH2.0 server configuration commands
display ssh server
Description
Use display ssh server command on an SSH server to display SSH server status information or session information. Related commands: ssh server authentication-retries, ssh server authentication-timeout, ssh server compatible-ssh1x enable, ssh server enable, and ssh server rekey-interval. NOTE: This command is also available on an SFTP server.
Syntax
display ssh server { session | status } [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
session: Displays the session information of the SSH server. status: Displays the status information of the SSH server. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display the SSH server status information.
<Sysname> display ssh server status SSH Server: Disable SSH version : 1.99 SSH authentication-timeout : 60 second(s) SSH server key generating interval : 0 hour(s)
330
SSH Authentication retries : 3 time(s) SFTP Server: Disable SFTP Server Idle-Timeout: 10 minute(s)

SSH Server SSH version SSH authentication-timeout SSH server key generating interval SSH Authentication retries SFTP Server SFTP Server Idle-Timeout
Description
Whether the SSH server function is enabled SSH protocol version When the SSH supports SSH1, the protocol version is 1.99. Otherwise, the protocol version is 2.0. Authentication timeout period SSH server key pair update interval Maximum number of SSH authentication attempts Whether the SFTP server function is enabled SFTP connection idle timeout period
# Display the SSH server session information.

<Sysname> display ssh server session Conn VTY 0 Ver 2.0 Encry DES State Established Retry 0 SerType SFTP Username client001

Conn Ver Encry State Retry SerType Username
Description
Connected VTY channel SSH server protocol version Encryption algorithm Status of the session, including: Init, Ver-exchange, Keysexchange, Auth-request, Serv-request, Established, Disconnected Number of authentication attempts Service type (SFTP, Stelnet) Name of a user for login
display ssh user-information

Description
Use display ssh user-information command on an SSH server to display information about one or all SSH users. This command displays only information about SSH users configured through the ssh user command on the SSH server. Without the username argument, the command displays information about all SSH users.
331
Related commands: ssh user. NOTE: This command is also available on an SFTP server.
Syntax
display ssh user-information [ username ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
username: SSH username, a string of 1 to 80 characters. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display information about all SSH users.
<Sysname> display ssh user-information Total ssh users : 2 Username yemx test Authentication-type password publickey User-public-key-name null pubkey Service-type stelnet|sftp sftp

Username Authentication-type User-public-key-name Service-type
Description
Name of the user Authentication method. If this field has a value of password, the next field will have a value of null. Public key of the user Service type
ssh server authentication-retries

Description
Use ssh server authentication-retries to set the maximum number of SSH connection authentication attempts.
332
Use undo ssh server authentication-retries to restore the default. By default, the maximum number of SSH connection authentication attempts is 3. This configuration takes effect only for the users trying to log in after the configuration. Authentication will fail if the number of authentication attempts (including both publickey and password authentication) exceeds that specified in the ssh server authentication-retries command. If the authentication method of SSH users is password-publickey, the maximum number of SSH connection authentication attempts must be at least 2. This is because SSH2.0 users must pass both password and publickey authentication. Related commands: display ssh server.
Syntax
ssh server authentication-retries times undo ssh server authentication-retries
View
System view
Default level
3: Manage level
Parameters
times: Maximum number of authentication attempts, in the range of 1 to 5.
Examples
# Set the maximum number of SSH connection authentication attempts to 4.
<Sysname> system-view [Sysname] ssh server authentication-retries 4
ssh server authentication-timeout

Description
Use ssh server authentication-timeout to set the SSH user authentication timeout period on the SSH server. Use undo ssh server authentication-timeout to restore the default. By default, the authentication timeout period is 60 seconds. Related commands: display ssh server.
Syntax
ssh server authentication-timeout time-out-value undo ssh server authentication-timeout
View
System view
Default level
3: Manage level
333
Parameters
time-out-value: Authentication timeout period in seconds, in the range of 1 to 120.
Examples
# Set the SSH user authentication timeout period to 10 seconds.
<Sysname> system-view [Sysname] ssh server authentication-timeout 10
ssh server compatible-ssh1x enable

Description
Use ssh server compatible-ssh1x to enable the SSH server to support SSH1 clients. Use undo ssh server compatible-ssh1x to disable the SSH server from supporting SSH1 clients. By default, the SSH server supports SSH1 clients. The configuration takes effect only for clients that log in after the configuration Related commands: display ssh server.
Syntax
ssh server compatible-ssh1x enable undo ssh server compatible-ssh1x
View
System view
Default level
3: Manage level
Parameters
None
Examples
# Enable the SSH server to support SSH1 clients.
<Sysname> system-view [Sysname] ssh server compatible-ssh1x enable
ssh server enable

Description
Use ssh server enable to enable the SSH server function. Use undo ssh server enable to disable the SSH server function. By default, SSH server is disabled.
Syntax
ssh server enable undo ssh server enable
334
View
System view
Default level
3: Manage level
Parameters
None
Examples
# Enable SSH server.
<Sysname> system-view [Sysname] ssh server enable
ssh server rekey-interval

Description
CAUTION: This command is only available to SSH users using SSH1 client software. The system does not update any DSA key pair periodically. Use ssh server rekey-interval to set the interval for updating the RSA server key. Use undo ssh server rekey-interval to restore the default. By default, the update interval of the RSA server key is 0. That is, the RSA server key is not updated. Related commands: display ssh server.
Syntax
ssh server rekey-interval hours undo ssh server rekey-interval
View
System view
Default level
3: Manage level
Parameters
hours: Server key pair update interval in hours, in the range of 1 to 24.
Examples
# Set the RSA server key pair update interval to 3 hours.
<Sysname> system-view [Sysname] ssh server rekey-interval 3
335
ssh user
Description
Use ssh user to create an SSH user and specify the service type and authentication method. Use undo ssh user to delete an SSH user. For a publickey authentication user, you must configure the username and the public key on the device. For a password authentication user, you can configure the account information on either the device or the remote authentication server such as a RADIUS server. If you use the ssh user to configure a public key for a user who has already had a public key, the new one overwrites the old one. You can change the authentication method and public key of an SSH user when the user is communicating with the SSH server. However, your changes take effect only after the user logs out and logs in again. If an SFTP user has been assigned a public key, it is necessary to set a working folder for the user. The working folder of an SFTP user depends on the user authentication method. For a user using only password authentication, the working folder is the AAA authorized one. For a user using only publickey authentication or using both publickey authentication and password authentication, the working folder is the one set by using the ssh user command. Related commands: display ssh user-information.
Syntax
ssh user username service-type stelnet authentication-type { password | { any | password-publickey | publickey } assign publickey keyname } ssh user username service-type { all | sftp } authentication-type { password | { any | passwordpublickey | publickey } assign publickey keyname work-directory directory-name } undo ssh user username
View
System view
Default level
3: Manage level
Parameters
username: SSH username, a case-sensitive string of 1 to 80 characters. service-type: Specifies the service type of an SSH user, which can be one of the following: all: Specifies both secure Telnet and secure FTP. sftp: Specifies the service type as secure FTP. stelnet: Specifies the service type of secure Telnet. password: Performs password authentication. This authentication method features easy and fast encryption, but it is vulnerable. It can work with AAA to implement user authentication, authorization, and accounting.
authentication-type: Specifies the authentication method of an SSH user, which can be one the following:
336
any: Performs either password authentication or publickey authentication. password-publickey: Performs both password authentication and publickey authentication (featuring higher security) if the client runs SSH2, and performs either type of authentication if the client runs SSH1. publickey: Performs publickey authentication. This authentication method has the downside of complicated and slow encryption, but it provides strong authentication that can defend against brute-force attacks. This authentication method is easy to use. Once it is configured, the authentication process completes automatically without the need of remembering or entering any password.
assign publickey keyname: Assigns an existing public key to an SSH user. keyname indicates the name of the client public key and is a string of 1 to 64 characters. work-directory directory-name: Specifies the working directory for an SFTP user. directory-name indicates the name of the working directory and is a string of 1 to 135 characters.
Examples
# Create an SSH user named user1, setting the service type as sftp, the authentication method as publickey, the working directory of the SFTP server as flash:, and assigning a public key named key1 to the user.
<Sysname> system-view [Sysname] ssh user user1 service-type sftp authentication-type publickey assign publickey key1 work-directory flash:
SSH2.0 client configuration commands

display ssh client source
Description
Use display ssh client source to display the source IP address or source interface information on an SSH client. If neither source IP address nor source interface is specified for the SSH client, the system will display the message Neither source IP address nor source interface was specified for the STelnet client. Related commands: ssh client source.
Syntax
display ssh client source [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow.
337
exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display the source IP address or source interface of the SSH client.
<Sysname> display ssh client source The source IP address you specified is 192.168.0.1
display ssh server-info

Description
Use display ssh server-info command on a client to display mappings between SSH servers and their host public keys on an SSH client. When an SSH client needs to authenticate the SSH server, it uses the locally saved public key of the server for the authentication. If the authentication fails, you can use this command to check the public key of the server saved on the client. Related commands: ssh client authentication server. NOTE: This command is also available on an SFTP client.
Syntax
display ssh server-info [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
Examples
# Display the mappings between host public keys and SSH servers saved on the client.
<Sysname> display ssh server-info Server Name(IP) 192.168.0.1 Server public key name abc_key01 ______________________________________________________
338
192.168.0.2
abc_key02

Server Name(IP) Server public key name
Description
Name or IP address of the server Name of the host public key of the server
ssh client authentication server

Description
Use ssh client authentication server command on a client to configure the host public key of a specified server so that the client can determine whether the server is trustworthy. Use undo ssh authentication server to remove the configuration. By default, the host public key of the server is not configured, and when logging into the server, the client uses the IP address or host name used for login as the public key name. If the client does not support first-time authentication, it will reject unauthenticated servers. In this case, you need to configure the public keys of the servers and specify the mappings between public keys and servers on the client, so that the client uses the correct public key of a server to authenticate the server. The specified host public key of the server must already exist. Related commands: ssh client first-time enable.
Syntax
ssh client authentication server server assign publickey keyname undo ssh client authentication server server assign publickey
View
System view
Default level
2: System level
Parameters
server: IP address or name of the server, a string of 1 to 80 characters. assign publickey keyname: Specifies the name of the host public key of the server, a string of 1 to 64 characters.
Examples
# Configure the public key of the server with the IP address of 192.168.0.1 to be key1.
<Sysname> system-view [Sysname] ssh client authentication server 192.168.0.1 assign publickey key1
339
ssh client first-time enable

Description
Use ssh client first-time enable to enable the first-time authentication function. Use undo ssh client first-time to disable the function. By default, the function is enabled. With first-time authentication, when an SSH client not configured with the server host public key accesses the server for the first time, the user can continue accessing the server, and save the host public key on the client. When accessing the server again, the client will use the saved server host public key to authenticate the server. Without first-time authentication, a client not configured with the server host public key will refuse to access the server. To access the server, a user must configure in advance the server host public key locally and specify the public key name for authentication. Because the server might update its key pairs periodically, clients must obtain the most recent public keys of the server for successful authentication of the server.
Syntax
ssh client first-time enable undo ssh client first-time
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable the first-time authentication function.
<Sysname> system-view [Sysname] ssh client first-time enable
ssh client ipv6 source

Description
Use ssh client ipv6 source to specify the source IPv6 address or source interface for the SSH client. Use undo ssh client ipv6 source to remove the configuration. By default, an SSH client uses the IPv6 address of the interface specified by the route of the device to access the SSH server. Related commands: display ssh client source.
Syntax
ssh client ipv6 source { ipv6 ipv6-address | interface interface-type interface-number }
340
undo ssh client ipv6 source
View
System view
Default level
3: Manage level
Parameters
ipv6 ipv6-address: Specifies a source IPv6 address. interface interface-type interface-number: Specifies a source interface by its type and number.
Examples
# Specify the source IPv6 address as 2:2::2:2 for the SSH client.
<Sysname> system-view [Sysname] ssh client ipv6 source ipv6 2:2::2:2
ssh client source

Description
Use ssh client source to specify the source IPv4 address or source interface of the SSH client. Use undo ssh client source to remove the configuration. By default, an SSH client uses the IP address of the interface specified by the route of the device to access the SSH server. Related commands: display ssh client source.
Syntax
ssh client source { ip ip-address | interface interface-type interface-number } undo ssh client source
View
System view
Default level
3: Manage level
Parameters
ip ip-address: Specifies a source IPv4 address. interface interface-type interface-number: Specifies a source interface by its type and number.
Examples
# Specify the source IPv4 address of the SSH client as 192.168.0.1.
<Sysname> system-view [Sysname] ssh client source ip 192.168.0.1
341
ssh2
Description
Use ssh2 to establish a connection to an IPv4 SSH server and specify the public key algorithm, the preferred key exchange algorithm, and the preferred encryption algorithms and preferred HMAC algorithms between the client and server. When the clients authentication method is publickey, the client needs to get the local private key for validation. As the publickey authentication includes RSA and DSA algorithms, you must specify an algorithm (by using the identity-key keyword) in order to get the correct data for the local private key. By default, the encryption algorithm is DSA.
Syntax
ssh2 server [ port-number ] [ vpn-instance vpn-instance-name ] [ identity-key { dsa | rsa } | prefer-ctoscipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | preferstoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] *
View
User view
Default level
0: Visit level
Parameters
server: IPv4 address or host name of the server, a case-insensitive string of 1 to 20 characters. port-number: Port number of the server, in the range of 0 to 65535. The default is 22. vpn-instance vpn-instance-name: Specifies the MPLS L3VPN that the server belongs to, where vpninstance-name is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option. identity-key: Specifies the algorithm for publickey authentication, either dsa or rsa. The default is dsa. prefer-ctos-cipher: Preferred encryption algorithm from client to server, defaulted to aes128. 3des: Encryption algorithm 3des-cbc. aes128: Encryption algorithm aes128-cbc. des: Encryption algorithm des-cbc. md5: HMAC algorithm hmac-md5. md5-96: HMAC algorithm hmac-md5-96. sha1: HMAC algorithm hmac-sha1. sha1-96: HMAC algorithm hmac-sha1-96. dh-group-exchange: Key exchange algorithm diffie-hellman-group-exchange-sha1. dh-group1: Key exchange algorithm diffie-hellman-group1-sha1. dh-group14: Key exchange algorithm diffie-hellman-group14-sha1.
prefer-ctos-hmac: Preferred HMAC algorithm from client to server, defaulted to sha1-96.
prefer-kex: Preferred key exchange algorithm, defaulted to dh-group-exchange.
342
prefer-stoc-cipher: Preferred encryption algorithm from server to client, defaulted to aes128. prefer-stoc-hmac: Preferred HMAC algorithm from server to client, defaulted to sha1-96.
Examples
# Log in to remote SSH2.0 server 10.214.50.51, using the following algorithms: Preferred key exchange algorithm: DH-group1 Preferred encryption algorithm from server to client: AES128 Preferred HMAC algorithm from client to server: MD5 Preferred HMAC algorithm from server to client: SHA1-96
<Sysname> ssh2 10.214.50.51 prefer-kex dh-group1 prefer-stoc-cipher aes128 prefer-ctoshmac md5 prefer-stoc-hmac sha1-96
ssh2 ipv6
Description
Use ssh2 ipv6 to establish a connection to an IPv6 SSH server and specify public key algorithm, the preferred key exchange algorithm, and the preferred encryption algorithms and preferred HMAC algorithms between the client and server. When the clients authentication method is publickey, the client needs to get the local private key for validation. As the publickey authentication includes RSA and DSA algorithms, you must specify an algorithm (by using the identity-key keyword) in order to get the correct data for the local private key. By default, the encryption algorithm is DSA.
Syntax
ssh2 ipv6 server [ port-number ] [ vpn-instance vpn-instance-name ] [ identity-key { dsa | rsa } | preferctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | preferstoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] *
View
User view
Default level
0: Visit level
Parameters
server: IPv6 address or host name of the server, a case-insensitive string of 1 to 46 characters. port-number: Port number of the server, in the range of 0 to 65535. The default is 22. vpn-instance vpn-instance-name: Specifies the MPLS L3VPN that the server belongs to, where vpninstance-name is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option. identity-key: Specifies the algorithm for publickey authentication, either dsa or rsa. The default is dsa. prefer-ctos-cipher: Preferred encryption algorithm from client to server, defaulted to aes128. 3des: Encryption algorithm 3des-cbc. aes128: Encryption algorithm aes128-cbc.
343
des: Encryption algorithm des-cbc. md5: HMAC algorithm hmac-md5. md5-96: HMAC algorithm hmac-md5-96. sha1: HMAC algorithm hmac-sha1. sha1-96: HMAC algorithm hmac-sha1-96. dh-group-exchange: Key exchange algorithm diffie-hellman-group-exchange-sha1. dh-group1: Key exchange algorithm diffie-hellman-group1-sha1. dh-group14: Key exchange algorithm diffie-hellman-group14-sha1.
prefer-kex: Preferred key exchange algorithm, default to dh-group-exchange.
Examples
# Log in to remote SSH2.0 server 2000::1, setting the algorithms as follows: Preferred key exchange algorithm: DH-group1 Preferred encryption algorithm from server to client: AES128 Preferred HMAC algorithm from client to server: MD5 Preferred HMAC algorithm from server to client: SHA1-96
<Sysname> ssh2 ipv6 2000::1 prefer-kex dh-group1 prefer-stoc-cipher aes128 prefer-ctoshmac md5 prefer-stoc-hmac sha1-96
SFTP server configuration commands

sftp server enable
Description
Use sftp server enable to enable SFTP server. Use undo sftp server enable to disable SFTP server. By default, SFTP server is disabled. Related commands: display ssh server.
Syntax
sftp server enable undo sftp server enable
View
System view
Default level
3: Manage level
344
Parameters
None
Examples
# Enable SFTP server.
<Sysname> system-view [Sysname] sftp server enable
sftp server idle-timeout

Description
Use sftp server idle-timeout to set the idle timeout period for SFTP user connections. Use undo sftp server idle-timeout to restore the default. By default, the idle timeout period is 10 minutes. Related commands: display ssh server.
Syntax
sftp server idle-timeout time-out-value undo sftp server idle-timeout
View
System view
Default level
3: Manage level
Parameters
time-out-value: Timeout period in minutes. It ranges from 1 to 35,791.
Examples
# Set the idle timeout period for SFTP user connections to 500 minutes.
<Sysname> system-view [Sysname] sftp server idle-timeout 500
SFTP client configuration commands

bye
Description
Use bye to terminate the connection with a remote SFTP server and return to user view. This command functions as the exit and quit commands.
Syntax
bye
345
View
SFTP client view
Default level
3: Manage level
Parameters
None
Examples
# Terminate the connection with the remote SFTP server.
sftp-client> bye Bye Connection closed. <Sysname>
cd
Description
Use cd to change the working path on a remote SFTP server. With the argument not specified, the command displays the current working path. NOTE: You can use the cd .. command to return to the upper-level directory. You can use the cd / command to return to the root directory of the system.
Syntax
cd [ remote-path ]
View
SFTP client view
Default level
3: Manage level
Parameters
remote-path: Name of a path on the server.
Examples
# Change the working path to new1.
sftp-client> cd new1 Current Directory is: /new1
cdup
Description
Use cdup to return to the upper-level directory.
346
Syntax
cdup
View
SFTP client view
Default level
3: Manage level
Parameters
None
Examples
# From the current working directory /new1, return to the upper-level directory.
sftp-client> cdup Current Directory is: /
delete
Description
Use delete to delete files from a server. This command functions as the remove command.
Syntax
delete remote-file&<1-10>
View
SFTP client view
Default level
3: Manage level
Parameters
remote-file&<1-10>: Names of files on the server. &<1-10> means that you can provide up to 10 filenames, which are separated by space.
Examples
# Delete file temp.c from the server.
sftp-client> delete temp.c The following files will be deleted: /temp.c Are you sure to delete it? [Y/N]:y This operation might take a long time. Please wait... File successfully Removed
347
dir
Description
Use dir to display information about the files and sub-directories under a specified directory. With the a and l keyword not specified, the command displays detailed information of the files and sub-directories under the specified directory in the form of a list. With the remote-path not specified, the command displays information about the files and sub-directories of the current working directory. This command functions as the ls command.
Syntax
dir [ -a | -l ] [ remote-path ]
View
SFTP client view
Default level
3: Manage level
Parameters
-a: Displays the names of the files and sub-directories under the specified directory. -l: Displays the detailed information of the files and sub-directories under the specified directory in the form of a list. remote-path: Name of the directory to be queried.
Examples
# Display detailed information about the files and sub-directories under the current working directory in the form of a list.
sftp-client> dir -rwxrwxrwx -rwxrwxrwx -rwxrwxrwx -rwxrwxrwx drwxrwxrwx drwxrwxrwx -rwxrwxrwx 1 noone 1 noone 1 noone 1 noone 1 noone 1 noone 1 noone nogroup nogroup nogroup nogroup nogroup nogroup nogroup 1759 Aug 23 06:52 config.cfg 225 Aug 24 08:01 pubkey2 283 Aug 24 07:39 pubkey1 225 Sep 28 08:28 pub1 0 Sep 28 08:24 new1 0 Sep 28 08:18 new2 225 Sep 28 08:30 pub2
display sftp client source

Description
Use display sftp client source to display the source IP address or source interface currently set for the SFTP client. If neither source IP address nor source interface is specified for the SFTP client, the system will display the message Neither source IP address nor source interface was specified for the SFTP client. Related commands: sftp client source.
348
Syntax
display sftp client source [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
Examples
# Display the source IP address of the SFTP client.
<Sysname> display sftp client source The source IP address you specified is 192.168.0.1
exit
Description
Use exit to terminate the connection with a remote SFTP server and return to user view. This command functions as the bye and quit commands.
Syntax
exit
View
SFTP client view
Default level
3: Manage level
Parameters
None
Examples
sftp-client> exit Bye Connection closed. <Sysname>
349
get
Description
Use get to download a file from a remote SFTP server and save it locally. If you do not specify the local-file argument, the file will be saved locally with the same name as that on the remote SFTP server.
Syntax
get remote-file [ local-file ]
View
SFTP client view
Default level
3: Manage level
Parameters
remote-file: Name of a file on the remote SFTP server. local-file: Name for the local file.
Examples
# Download file temp1.c and save it as temp.c locally.
sftp-client> get temp1.c temp.c Remote file:/temp1.c ---> Local file: temp.c Downloading file successfully ended
help
Description
Use help to display a list of all commands or the help information of an SFTP client command. With neither the argument nor the keyword specified, the command displays a list of all commands.
Syntax
help [ all | command-name ]
View
SFTP client view
Default level
3: Manage level
Parameters
all: Displays a list of all commands. command-name: Name of a command.
Examples
# Display the help information of the get command.
sftp-client> help get
350
get remote-path [local-path]
Download file.Default local-path is the same as remote-path
ls
Description
Use ls to display file and folder information under a specified directory. With the a and l keyword not specified, the command displays detailed information of files and folders under the specified directory in a list form. With the remote-path not specified, the command displays the file and folder information of the current working directory. This command functions as the dir command.
Syntax
ls [ -a | -l ] [ remote-path ]
View
SFTP client view
Default level
3: Manage level
Parameters
-a: Displays the filenames and the folder names of the specified directory. -l: Displays in a list form detailed information of the files and folders of the specified directory. remote-path: Name of the directory to be queried.
Examples
# Display in a list form detailed file and folder information under the current working directory.
sftp-client> ls -rwxrwxrwx -rwxrwxrwx -rwxrwxrwx -rwxrwxrwx drwxrwxrwx drwxrwxrwx -rwxrwxrwx 1 noone 1 noone 1 noone 1 noone 1 noone 1 noone 1 noone nogroup nogroup nogroup nogroup nogroup nogroup nogroup 1759 Aug 23 06:52 config.cfg 225 Aug 24 08:01 pubkey2 283 Aug 24 07:39 pubkey1 225 Sep 28 08:28 pub1 0 Sep 28 08:24 new1 0 Sep 28 08:18 new2 225 Sep 28 08:30 pub2
mkdir
Description
Use mkdir to create a directory on a remote SFTP server.
Syntax
mkdir remote-path
351
View
SFTP client view
Default level
3: Manage level
Parameters
remote-path: Name for the directory on a remote SFTP server.
Examples
# Create a directory named test on the remote SFTP server.
sftp-client> mkdir test New directory created
put
Description
Use put to upload a local file to a remote SFTP server. If you do not specify the remote-file argument, the file will be saved remotely with the same name as the local one.
Syntax
put local-file [ remote-file ]
View
SFTP client view
Default level
3: Manage level
Parameters
local-file: Name of a local file. remote-file: Name for the file on a remote SFTP server.
Examples
# Upload local file temp.c to the remote SFTP server and save it as temp1.c.
sftp-client> put temp.c temp1.c Local file:temp.c ---> Remote file: /temp1.c Uploading file successfully ended
pwd
Description
Use pwd to display the current working directory of a remote SFTP server.
Syntax
pwd
352
View
SFTP client view
Default level
3: Manage level
Parameters
None
Examples
# Display the current working directory of the remote SFTP server.
sftp-client> pwd /
quit
Description
Use quit to terminate the connection with a remote SFTP server and return to user view. This command functions as the bye and exit commands.
Syntax
quit
View
SFTP client view
Default level
3: Manage level
Parameters
None
Examples
sftp-client> quit Bye Connection closed. <Sysname>
remove
Description
Use remove to delete files from a remote server. This command functions as the delete command.
Syntax
remove remote-file&<1-10>
353
View
SFTP client view
Default level
3: Manage level
Parameters
remote-file&<1-10>: Names of files on an SFTP server. &<1-10> means that you can provide up to 10 filenames, which are separated by space.
Examples
# Delete file temp.c from the server.
sftp-client> remove temp.c The following files will be deleted: /temp.c Are you sure to delete it? [Y/N]:y This operation might take a long time.Please wait... File successfully Removed
rename
Description
Use rename to change the name of a specified file or directory on an SFTP server.
Syntax
rename oldname newname
View
SFTP client view
Default level
3: Manage level
Parameters
oldname: Name of an existing file or directory. newname: New name for the file or directory.
Examples
# Change the name of a file on the SFTP server from temp1.c to temp2.c.
sftp-client> rename temp1.c temp2.c File successfully renamed
rmdir
Description
Use rmdir to delete the specified directories from an SFTP server.
354
Syntax
rmdir remote-path&<1-10>
View
SFTP client view
Default level
3: Manage level
Parameters
remote-path&<1-10>: Names of directories on the remote SFTP server. &<1-10> means that you can provide up to 10 directory names that are separated by space.
Examples
# On the SFTP server, delete directory temp1 in the current directory.
sftp-client> rmdir temp1 Directory successfully removed
sftp
Description
Use sftp to establish a connection to a remote IPv4 SFTP server and enter SFTP client view. When the clients authentication method is publickey, the client needs to get the local private key for validation. As the publickey authentication includes RSA and DSA algorithms, you must specify an algorithm (by using the identity-key keyword) in order to get the correct data for the local private key. By default, the encryption algorithm is DSA.
Syntax
sftp server [ port-number ] [ vpn-instance vpn-instance-name ] [ identity-key { dsa | rsa } | prefer-ctoscipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | preferstoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] *
View
User view
Default level
3: Manage level
Parameters
server: IPv4 address or host name of the server, a case-insensitive string of 1 to 20 characters. port-number: Port number of the server, in the range of 0 to 65535. The default is 22. vpn-instance vpn-instance-name: Specifies the MPLS L3VPN that the server belongs to, where vpninstance-name is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option. identity-key: Specifies the algorithm for publickey authentication, either dsa or rsa. The default is dsa. prefer-ctos-cipher: Preferred encryption algorithm from client to server, defaulted to aes128.
355
3des: Encryption algorithm 3des-cbc. aes128: Encryption algorithm aes128-cbc. des: Encryption algorithm des-cbc. md5: HMAC algorithm hmac-md5. md5-96: HMAC algorithm hmac-md5-96. sha1: HMAC algorithm hmac-sha1. sha1-96: HMAC algorithm hmac-sha1-96. dh-group-exchange: Key exchange algorithm diffie-hellman-group-exchange-sha1. dh-group1: Key exchange algorithm diffie-hellman-group1-sha1. dh-group14: Key exchange algorithm diffie-hellman-group14-sha1.
Examples
# Connect to SFTP server 10.1.1.2, using the following algorithms: Preferred key exchange algorithm: dh-group1. Preferred encryption algorithm from server to client: aes128. Preferred HMAC algorithm from client to server: md5. Preferred HMAC algorithm from server to client: sha1-96.
<Sysname> sftp 10.1.1.2 prefer-kex dh-group1 prefer-stoc-cipher aes128 prefer-ctos-hmac md5 prefer-stoc-hmac sha1-96 Input Username:
sftp client ipv6 source

Description
Use sftp client ipv6 source to specify the source IPv6 address or source interface for an SFTP client. Use undo sftp client ipv6 source to remove the configuration. By default, an SFTP client uses the IPv6 address of the interface specified by the route of the device to access the SFTP server. Related commands: display sftp client source.
Syntax
sftp client ipv6 source { ipv6 ipv6-address | interface interface-type interface-number } undo sftp client ipv6 source
View
System view
356
Default level
3: Manage level
Parameters
ipv6 ipv6-address: Specifies a source IPv6 address. interface interface-type interface-number: Specifies a source interface by its type and number.
Examples
# Specify the source IPv6 address of the SFTP client as 2:2::2:2.
<Sysname> system-view [Sysname] sftp client ipv6 source ipv6 2:2::2:2
sftp client source

Description
Use sftp client source to specify the source IPv4 address or interface of an SFTP client. Use undo sftp source-interface to remove the configuration. By default, an SFTP client uses the IP address of the interface specified by the route of the device to access the SFTP server. Related commands: display sftp client source.
Syntax
sftp client source { ip ip-address | interface interface-type interface-number } undo sftp client source
View
System view
Default level
3: Manage level
Parameters
ip ip-address: Specifies a source IPv4 address. interface interface-type interface-number: Specifies a source interface by its type and number.
Examples
# Specify the source IP address of the SFTP client as 192.168.0.1.
<Sysname> system-view [Sysname] sftp client source ip 192.168.0.1
sftp ipv6
Description
Use sftp ipv6 to establish a connection to a remote IPv6 SFTP server and enter SFTP client view. When the clients authentication method is publickey, the client needs to get the local private key for validation. As the publickey authentication includes RSA and DSA algorithms, you must specify an
357
algorithm (by using the identity-key keyword) in order to get the correct data for the local private key. By default, the encryption algorithm is DSA.
Syntax
sftp ipv6 server [ port-number ] [ vpn-instance vpn-instance-name ] [ identity-key { dsa | rsa } | preferctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | preferstoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] *
View
User view
Default level
3: Manage level
Parameters
server: IPv6 address or host name of the server, a case-insensitive string of 1 to 46 characters. port-number: Port number of the server, in the range of 0 to 65535. The default is 22. vpn-instance vpn-instance-name: Specifies the MPLS L3VPN that the server belongs to, where vpninstance-name is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option. identity-key: Specifies the algorithm for publickey authentication, either dsa or rsa. The default is dsa. prefer-ctos-cipher: Preferred encryption algorithm from client to server, defaulted to aes128. 3des: Encryption algorithm 3des-cbc. aes128: Encryption algorithm aes128-cbc. des: Encryption algorithm des-cbc. md5: HMAC algorithm hmac-md5. md5-96: HMAC algorithm hmac-md5-96. sha1: HMAC algorithm hmac-sha1. sha1-96: HMAC algorithm hmac-sha1-96. dh-group-exchange: Key exchange algorithm diffie-hellman-group-exchange-sha1. dh-group1: Key exchange algorithm diffie-hellman-group1-sha1. dh-group14: Key exchange algorithm diffie-hellman-group14-sha1.
Examples
# Connect to server 2:5::8:9, using the following algorithms: Preferred key exchange algorithm: dh-group1. Preferred encryption algorithm from server to client: aes128. Preferred HMAC algorithm from client to server: md5.
358
Preferred HMAC algorithm from server to client: sha1-96.
<Sysname> sftp ipv6 2:5::8:9 prefer-kex dh-group1 prefer-stoc-cipher aes128 prefer-ctoshmac md5 prefer-stoc-hmac sha1-96 Input Username:
359
SSL configuration commands

SSL uses an encryption engine for encryption. The HP MSR900, and MSR20-1X do not support encryption engines.
ciphersuite
Description
Use ciphersuite to specify the cipher suites for an SSL server policy to support. By default, an SSL server policy supports all cipher suites. With no keyword specified, the command configures an SSL server policy to support all cipher suites. If you execute the command repeatedly, the last one takes effect. Related commands: display ssl server-policy.
Syntax
ciphersuite [ rsa_3des_ede_cbc_sha | rsa_aes_128_cbc_sha | rsa_aes_256_cbc_sha | rsa_des_cbc_sha | rsa_rc4_128_md5 | rsa_rc4_128_sha ] *
View
SSL server policy view
Default level
2: System level
Parameters
rsa_3des_ede_cbc_sha: Specifies the key exchange algorithm of RSA, the data encryption algorithm of 3DES_EDE_CBC, and the MAC algorithm of SHA. rsa_aes_128_cbc_sha: Specifies the key exchange algorithm of RSA, the data encryption algorithm of 128-bit AES_CBC, and the MAC algorithm of SHA. rsa_aes_256_cbc_sha: Specifies the key exchange algorithm of RSA, the data encryption algorithm of 256-bit AES_CBC, and the MAC algorithm of SHA. rsa_des_cbc_sha: Specifies the key exchange algorithm of RSA, the data encryption algorithm of DES_CBC, and the MAC algorithm of SHA. rsa_rc4_128_md5: Specifies the key exchange algorithm of RSA, the data encryption algorithm of 128-bit RC4, and the MAC algorithm of MD5. rsa_rc4_128_sha: Specifies the key exchange algorithm of RSA, the data encryption algorithm of 128-bit RC4, and the MAC algorithm of SHA.
Examples
# Configure SSL server policy policy1 to support cipher suites rsa_rc4_128_md5 and rsa_rc4_128_sha.
<Sysname> system-view [Sysname] ssl server-policy policy1 [Sysname-ssl-server-policy-policy1] ciphersuite rsa_rc4_128_md5 rsa_rc4_128_sha
360
client-verify enable
Description
Use client-verify enable to configure the SSL server to require the client to pass certificate-based authentication. Use undo client-verify enable to restore the default. By default, the SSL server does not require certificate-based SSL client authentication. If you configure the client-verify enable command and enable the SSL client weak authentication function, whether the client must be authenticated is up to the client. If the client chooses to be authenticated, the client must pass authentication before accessing the SSL server; otherwise, the client can access the SSL server without authentication. If you configure the client-verify enable command but disable the SSL client weak authentication function, the SSL client must pass authentication before accessing the SSL server. Related commands: client-verify weaken and display ssl server-policy.
Syntax
client-verify enable undo client-verify enable
View
Default level
2: System level
Parameters
None
Examples
# Configure the SSL server to require certificate-based SSL client authentication.
<Sysname> system-view [Sysname] ssl server-policy policy1 [Sysname-ssl-server-policy-policy1] client-verify enable
client-verify weaken
Description
Use client-verify weaken to enable SSL client weak authentication. Use undo client-verify weaken to restore the default. By default, SSL client weak authentication is disabled. If the SSL server requires certificate-based client authentication and the SSL client weak authentication function is enabled, whether the client must be authenticated is up to the client. If the client chooses to be authenticated, the client must pass authentication before accessing the SSL server; otherwise, the client can access the SSL server without authentication. If the SSL server requires certificate-based client authentication and SSL client weak authentication is disabled, the SSL client must pass authentication before accessing the SSL server.
361
NOTE: The client-verify weaken command takes effect only when the SSL server requires certificate-based client authentication. Related commands: client-verify enable and display ssl server-policy.
Syntax
client-verify weaken undo client-verify weaken
View
Default level
2: System level
Parameters
None
Examples
# Enable SSL client weak authentication.
<Sysname> system-view [Sysname] ssl server-policy policy1 [Sysname-ssl-server-policy-policy1] client-verify enable [Sysname-ssl-server-policy-policy1] client-verify weaken
close-mode wait
Description
Use close-mode wait to set the SSL connection close mode to wait mode. In this mode, after sending a close-notify alert message to a client, the server does not close the connection until it receives a closenotify alert message from the client. Use undo close-mode wait to restore the default. By default, an SSL server sends a close-notify alert message to the client and closes the connection without waiting for the close-notify alert message from the client. Related commands: display ssl server-policy.
Syntax
close-mode wait undo close-mode wait
View
Default level
2: System level
362
Parameters
None
Examples
# Set the SSL connection close mode to wait.
<Sysname> system-view [Sysname] ssl server-policy policy1 [Sysname-ssl-server-policy-policy1] close-mode wait
display ssl client-policy

Description
Use display ssl client-policy to view information about a specified SSL client policy or all SSL client policies.
Syntax
display ssl client-policy { policy-name | all } [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
policy-name: SSL client policy name, a case-insensitive string of 1 to 16 characters. all: Displays information about all SSL client policies. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display information about SSL client policy policy1.
<Sysname> display ssl client-policy policy1 SSL Client Policy: policy1 SSL Version: SSL 3.0 PKI Domain: 1 Prefer Ciphersuite: RSA_RC4_128_MD5 Server-verify: enabled

SSL Client Policy 363
Description
SSL client policy name
Field
SSL Version PKI Domain Prefer Ciphersuite Server-verify
Description
Version of the protocol used by the SSL client policy, SSL 3.0 or TLS 1.0 PKI domain of the SSL client policy Preferred cipher suite of the SSL client policy Whether server authentication is enabled for the SSL client policy
display ssl server-policy

Description
Use display ssl server-policy to view information about a specified SSL server policy or all SSL server policies.
Syntax
display ssl server-policy { policy-name | all } [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
policy-name: SSL server policy name, a case-insensitive string of 1 to 16 characters. all: Displays information about all SSL server policies. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display information about SSL server policy policy1.
<Sysname> display ssl server-policy policy1 SSL Server Policy: policy1 PKI Domain: domain1 Ciphersuite: RSA_RC4_128_MD5 RSA_RC4_128_SHA RSA_DES_CBC_SHA RSA_3DES_EDE_CBC_SHA RSA_AES_128_CBC_SHA RSA_AES_256_CBC_SHA
364
Handshake Timeout: 3600 Close-mode: wait disabled Session Timeout: 3600 Session Cachesize: 500 Client-verify: disabled Client-verify weaken: disabled

SSL Server Policy PKI Domain Ciphersuite Handshake Timeout
Description
SSL server policy name. PKI domain used by the SSL server policy. Cipher suites supported by the SSL server policy. Handshake timeout time of the SSL server policy, in seconds. Close mode of the SSL server policy, which can be:
wait disabled: In this mode, the server sends a

close-notify alert message to the client and then closes the connection immediately without waiting for the close-notify alert message of the client.
Close-mode
wait enabled: In this mode, the server sends a

close-notify alert message to the client and then waits for the close-notify alert message of the client. Only after receiving the expected message, does the server close the connection. Session Timeout Session Cachesize Client-verify Session timeout time of the SSL server policy, in seconds. Maximum number of buffered sessions of the SSL server policy. Whether the SSL server policy requires the client to be authenticated.
handshake timeout
Description
Use handshake timeout to set the handshake timeout time for an SSL server policy. Use undo handshake timeout to restore the default. By default, the handshake timeout time is 3600 seconds. If the SSL server does not receive any packet from the SSL client before the handshake timeout time expires, the SSL server will terminate the handshake process. Related commands: display ssl server-policy.
Syntax
handshake timeout time undo handshake timeout
365
View
Default level
2: System level
Parameters
time: Handshake timeout time in seconds, in the range of 180 to 7200.
Examples
# Set the handshake timeout time of SSL server policy policy1 to 3000 seconds.
<Sysname> system-view [Sysname] ssl server-policy policy1 [Sysname-ssl-server-policy-policy1] handshake timeout 3000
pki-domain
Description
Use pki-domain to specify a PKI domain for an SSL server policy or SSL client policy. Use undo pki-domain to restore the default. By default, no PKI domain is configured for an SSL server policy or SSL client policy. Related commands: display ssl server-policy and display ssl client-policy.
Syntax
pki-domain domain-name undo pki-domain
View
SSL server policy view, SSL client policy view
Default level
2: System level
Parameters
domain-name: Name of a PKI domain, a case-insensitive string of 1 to 15 characters.
Examples
# Configure SSL server policy policy1 to use PKI domain server-domain.
<Sysname> system-view [Sysname] ssl server-policy policy1 [Sysname-ssl-server-policy-policy1] pki-domain server-domain
# Configure SSL client policy policy1 to use PKI domain client-domain.

<Sysname> system-view [Sysname] ssl client-policy policy1 [Sysname-ssl-client-policy-policy1] pki-domain client-domain
366
prefer-cipher
Description
Use prefer-cipher to specify the preferred cipher suite for an SSL client policy. Use undo prefer-cipher to restore the default. By default, the preferred cipher suite for an SSL client policy is rsa_rc4_128_md5. Related commands: display ssl client-policy.
Syntax
prefer-cipher { rsa_3des_ede_cbc_sha | rsa_aes_128_cbc_sha rsa_des_cbc_sha | rsa_rc4_128_md5 | rsa_rc4_128_sha } undo prefer-cipher | rsa_aes_256_cbc_sha |
View
SSL client policy view
Default level
2: System level
Parameters
rsa_3des_ede_cbc_sha: Specifies the key exchange algorithm of RSA, the data encryption algorithm of 3DES_EDE_CBC, and the MAC algorithm of SHA. rsa_aes_128_cbc_sha: Specifies the key exchange algorithm of RSA, the data encryption algorithm of 128-bit AES_CBC, and the MAC algorithm of SHA. rsa_aes_256_cbc_sha: Specifies the key exchange algorithm of RSA, the data encryption algorithm of 256-bit AES_CBC, and the MAC algorithm of SHA. rsa_des_cbc_sha: Specifies the key exchange algorithm of RSA, the data encryption algorithm of DES_CBC, and the MAC algorithm of SHA. rsa_rc4_128_md5: Specifies the key exchange algorithm of RSA, the data encryption algorithm of 128-bit RC4, and the MAC algorithm of MD5. rsa_rc4_128_sha: Specifies the key exchange algorithm of RSA, the data encryption algorithm of 128-bit RC4, and the MAC algorithm of SHA.
Examples
# Set the preferred cipher suite for SSL client policy policy1 to rsa_aes_128_cbc_sha.
<Sysname> system-view [Sysname] ssl client-policy policy1 [Sysname-ssl-client-policy-policy1] prefer-cipher rsa_aes_128_cbc_sha
server-verify enable
Description
Use server-verify enable to enable certificate-based SSL server authentication so that the SSL client authenticates the server by the servers certificate during the SSL handshake process. Use undo server-verify enable to disable certificate-based SSL server authentication. When certificatebased SSL server authentication is disabled, it is assumed that the SSL server is valid.
367
By default, certificate-based SSL server authentication is enabled. Related commands: display ssl client-policy.
Syntax
server-verify enable undo server-verify enable
View
Default level
2: System level
Parameters
None
Examples
# Enable certificate-based SSL server authentication.
<Sysname> system-view [Sysname] ssl client-policy policy1 [Sysname-ssl-client-policy-policy1] server-verify enable
session
Description
Use session to set the maximum number of cached sessions and the caching timeout time. Use undo session to restore the default. By default, the maximum number of cached sessions is 500 and the caching timeout time is 3600 seconds. It is a complicated process to use the SSL handshake protocol to negotiate session parameters and establish sessions. To simplify the process, SSL allows reusing negotiated session parameters to establish sessions. This feature requires that the SSL server maintain information about existing sessions. The number of cached sessions and the session information caching time are limited: If the number of sessions in the cache reaches the maximum, SSL rejects to cache new sessions. If a session has been cached for a period equal to the caching timeout time, SSL will remove the information of the session.
Related commands: display ssl server-policy.
Syntax
session { cachesize size | timeout time } * undo session { cachesize | timeout } *
View
Default level
2: System level
368
Parameters
cachesize size: Specifies the maximum number of cached sessions, in the range of 100 to 1000. timeout time: Specifies the caching timeout time in seconds, in the range of 1800 to 72000.
Examples
# Set the caching timeout time to 4000 seconds and the maximum number of cached sessions to 600.
<Sysname> system-view [Sysname] ssl server-policy policy1 [Sysname-ssl-server-policy-policy1] session timeout 4000 cachesize 600
ssl client-policy
Description
Use ssl client-policy to create an SSL policy and enter its view. Use undo ssl client-policy to delete a specified SSL client policy or all SSL client policies. Related commands: display ssl client-policy.
Syntax
ssl client-policy policy-name undo ssl client-policy { policy-name | all }
View
System view
Default level
2: System level
Parameters
policy-name: SSL client policy name, a case-insensitive string of 1 to 16 characters, which cannot be a, al, or all. all: Specifies all SSL client policies.
Examples
# Create SSL client policy policy1 and enter its view.
<Sysname> system-view [Sysname] ssl client-policy policy1 [Sysname-ssl-client-policy-policy1]
ssl server-policy
Description
Use ssl server-policy to create an SSL server policy and enter its view. Use undo ssl server-policy to delete a specified SSL server policy or all SSL server policies. You cannot delete an SSL server policy that has been associated with one or more application layer protocols. Related commands: display ssl server-policy.
369
Syntax
ssl server-policy policy-name undo ssl server-policy { policy-name | all }
View
System view
Default level
2: System level
Parameters
policy-name: SSL server policy name, a case-insensitive string of 1 to 16 characters, which cannot be a, al, or all. all: Specifies all SSL server policies.
Examples
# Create SSL server policy policy1 and enter its view.
<Sysname> system-view [Sysname] ssl server-policy policy1 [Sysname-ssl-server-policy-policy1]
version
Description
Use version to specify the SSL protocol version for an SSL client policy. Use undo version to restore the default. By default, the SSL protocol version for an SSL client policy is TLS 1.0. Related commands: display ssl client-policy.
Syntax
version { ssl3.0 | tls1.0 } undo version
View
Default level
2: System level
Parameters
ssl3.0: Specifies SSL 3.0. tls1.0: Specifies TLS 1.0.
Examples
# Specify the SSL protocol version for SSL client policy policy1 as SSL 3.0.
<Sysname> system-view [Sysname] ssl client-policy policy1 [Sysname-ssl-client-policy-policy1] version ssl3.0
370
User profile configuration commands

display user-profile
Description
Use display user-profile to display information about all user profiles that have been created.
Syntax
display user-profile [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
2: System level
Parameters
Examples
# Display information about all user profiles that have been created.
<Sysname> display user-profile Status enabled User profile a123 ----Total user profiles: ----Enabled user profiles: 1------1-------

Status
Description
Status of the user profile: enabled disabled
User profile Total user profiles Enabled user profiles
User profile name Total number of user profiles that have been created Total number of user profiles that have been enabled
371
user-profile enable
Description
Use user-profile enable to enable a user profile that has been created. If the user profile does not exist, the command fails. Only enabled user profiles can be applied to authenticated users. Use undo user-profile enable to disable the specified user profile. Disabling a user profile logs out users that are using the user profile. To edit or remove the configurations in a user profile, disable the user profile first. By default, a created user profile is disabled.
Syntax
user-profile profile-name enable undo user-profile profile-name enable
View
System view
Default level
2: System level
Parameters
profile-name: Specifies the name of a user profile that has been created. The name takes a case-sensitive string of 1 to 31 characters. It can only contain English letters, digits, and underlines, and it must start with an English letter.
Examples
# Enable user profile a123.
<Sysname> system-view [Sysname] user-profile a123 enable
user-profile
Description
Use user-profile to create a user profile and enter the user profile view. If the specified user profile has been created, you enter the user profile view directly. Use undo user-profile to remove an existing disabled user profile. You cannot remove a user profile that is enabled. By default, no user profiles exist on the device. Related commands: user-profile enable.
Syntax
user-profile profile-name undo user-profile profile-name
View
System view
372
Default level
2: System level
Parameters
profile-name: Assigns a name to the user profile. The name is a case-sensitive string of 1 to 31 characters. It can only contain English letters, digits, and underlines, and it must start with an English letter. A user profile name must be globally unique.
Examples
# Create user profile a123.
<Sysname> system-view [Sysname] user-profile a123 [Sysname-user-profile-a123]
# Enter the user profile view of a123.

<Sysname> system-view [Sysname] user-profile a123 [Sysname-user-profile-a123]
373
ARP attack protection configuration commands

ARP defense against IP packet attacks configuration commands
arp source-suppression enable
Description
Use arp source-suppression enable to enable the ARP source suppression function. Use undo arp source-suppression enable to disable the function. By default, the ARP source suppression function is disabled. Related commands: display arp source-suppression.
Syntax
arp source-suppression enable undo arp source-suppression enable
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable the ARP source suppression function.
<Sysname> system-view [Sysname] arp source-suppression enable
arp source-suppression limit

Description
Use arp source-suppression limit to set the maximum number of packets with the same source IP address but unresolvable destination IP addresses that the device can receive in five seconds. Use undo arp source-suppression limit to restore the default value, which is 10. With this feature configured, whenever the number of packets with unresolvable destination IP addresses from a host within five seconds exceeds the specified threshold, the device suppresses the sending host from triggering any ARP requests within the following five seconds.
374
Related commands: display arp source-suppression.
Syntax
arp source-suppression limit limit-value undo arp source-suppression limit
View
System view
Default level
2: System level
Parameters
limit-value: Specifies the maximum number of packets with the same source IP address but unresolvable destination IP addresses that the device can receive in five seconds. It ranges from 2 to 1024.
Examples
# Set the maximum number of packets with the same source address but unresolvable destination IP addresses that the device can receive in five seconds to 100.
<Sysname> system-view [Sysname] arp source-suppression limit 100
display arp source-suppression

Description
Use display arp source-suppression to display information about the current ARP source suppression configuration.
Syntax
display arp source-suppression [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
2: System level
Parameters
Examples
# Display information about the current ARP source suppression configuration.
375
<Sysname> display arp source-suppression ARP source suppression is enabled Current suppression limit: 100 Current cache length: 16

ARP source suppression is enabled Current suppression limit Current cache length
Description
The ARP source suppression function is enabled. Maximum number of packets with the same source IP address but unresolvable destination IP addresses that the device can receive in five seconds Size of cache used to record source suppression information
Source MAC address based ARP attack detection configuration commands

arp anti-attack source-mac
Description
Use arp anti-attack source-mac to enable source MAC address based ARP attack detection and specify the detection mode. Use undo arp anti-attack source-mac to restore the default. By default, source MAC address based ARP attack detection is disabled. After you enable this feature, the device checks the source MAC address of ARP packets received from the VLAN. If the number of ARP packets received from a source MAC address within five seconds exceeds the specified threshold: In filter detection mode, the device displays a log message and filters out the ARP packets from the MAC address. In monitor detection mode, the device only displays a log message.
If no detection mode is specified in the undo arp anti-attack source-mac command, both detection modes are disabled.
Syntax
arp anti-attack source-mac { filter | monitor } undo arp anti-attack source-mac [ filter | monitor ]
View
System view
376
Default level
2: System level
Parameters
filter: Specifies the filter mode. monitor: Specifies the monitor mode.
Examples
# Enable filter-mode source MAC address based ARP attack detection
<Sysname> system-view [Sysname] arp anti-attack source-mac filter
arp anti-attack source-mac aging-time

Description
Use arp anti-attack source-mac aging-time to configure the age timer for protected MAC addresses. Use undo arp anti-attack source-mac aging-time to restore the default. By default, the age timer for protected MAC addresses is 300 seconds (five minutes).
Syntax
arp anti-attack source-mac aging-time time undo arp anti-attack source-mac aging-time
View
System view
Default level
2: System level
Parameters
time: Age timer for protected MAC addresses, in the range of 60 to 6000 seconds.
Examples
# Configure the age timer for protected MAC addresses as 60 seconds.
<Sysname> system-view [Sysname] arp anti-attack source-mac aging-time 60
arp anti-attack source-mac exclude-mac

Description
Use arp anti-attack source-mac exclude-mac to configure protected MAC addresses which will be excluded from ARP packet detection. Use undo arp anti-attack source-mac exclude-mac to remove the configured protected MAC addresses. By default, no protected MAC address is configured.
377
If no MAC address is specified in the undo arp anti-attack source-mac exclude-mac command, all the configured protected MAC addresses are removed.
Syntax
arp anti-attack source-mac exclude-mac mac-address&<1-n> undo arp anti-attack source-mac exclude-mac [ mac-address&<1-n> ]
View
System view
Default level
2: System level
Parameters
mac-address&<1-n>: MAC address list. The mac-address argument indicates a protected MAC address in the format H-H-H. &<1-n> indicates the number of protected MAC addresses that you can configure. The value of the n argument ranges from 1 to 64.
Examples
# Configure a protected MAC address.
<Sysname> system-view [Sysname] arp anti-attack source-mac exclude-mac 2-2-2
arp anti-attack source-mac threshold

Description
Use arp anti-attack source-mac threshold to configure the threshold for source MAC address based ARP attack detection. If the number of ARP packets sent from a MAC address within five seconds exceeds this threshold, the device considers this an attack. Use undo arp anti-attack source-mac threshold to restore the default. By default, the threshold for source MAC address based ARP attack detection is 50.
Syntax
arp anti-attack source-mac threshold threshold-value undo arp anti-attack source-mac threshold
View
System view
Default level
2: System level
Parameters
threshold-value: Threshold for source MAC address based ARP attack detection, in the range of 10 to 100.
Examples
# Configure the threshold for source MAC address based ARP attack detection as 30.
378
<Sysname> system-view [Sysname] arp anti-attack source-mac threshold 30
display arp anti-attack source-mac

Description
Use display arp anti-attack source-mac to display attacking MAC addresses detected by source MAC address based ARP attack detection. If no interface is specified, the display arp anti-attack source-mac command displays attacking MAC addresses detected on all the interfaces.
Syntax
display arp anti-attack source-mac [ interface interface-type interface-number ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
interface interface-type interface-number: Displays attacking MAC addresses detected on the interface. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display the attacking MAC addresses detected by source MAC address based ARP attack detection.
<Sysname> display arp anti-attack source-mac Source-MAC 23f3-1122-3344 23f3-1122-3355 23f3-1122-33ff 23f3-1122-33ad 23f3-1122-33ce VLAN ID 4094 4094 4094 4094 4094 Interface GE1/1 GE1/2 GE1/3 GE1/4 GE1/5 Aging-time 10 30 25 30 2
379
ARP packet source MAC address consistency check configuration commands

arp anti-attack valid-ack enable
Description
Use arp anti-attack valid-check enable to enable ARP packet source MAC address consistency check on the gateway. After you execute this command, the gateway device can filter out ARP packets with the source MAC address in the Ethernet header different from the sender MAC address in the ARP message. Use undo arp anti-attack valid-check enable to restore the default. By default, ARP packet source MAC address consistency check is disabled.
Syntax
arp anti-attack valid-check enable undo arp anti-attack valid-check enable
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable ARP packet source MAC address consistency check.
<Sysname> system-view [Sysname] arp anti-attack valid-check enable
ARP active acknowledgement configuration commands

arp anti-attack active-ack enable
Description
Use arp anti-attack active-ack enable to enable the ARP active acknowledgement function. Use undo arp anti-attack active-ack enable to restore the default. By default, the ARP active acknowledgement function is disabled. This feature is configured on gateway devices to identify invalid ARP packets.
380
Syntax
arp anti-attack active-ack enable undo arp anti-attack active-ack enable
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable the ARP active acknowledgement function.
<Sysname> system-view [Sysname] arp anti-attack active-ack enable
ARP automatic scanning and fixed ARP configuration commands

arp fixup
Description
Use arp fixup to change the existing dynamic ARP entries into static ARP entries. You can use this command again to change the dynamic ARP entries learned later into static. Note the following: The static ARP entries changed from dynamic ARP entries have the same attributes as the manually configured static ARP entries. The number of static ARP entries changed from dynamic ARP entries is restricted by the number of static ARP entries that the device supports. As a result, the device may fail to change all dynamic ARP entries into static ARP entries. Suppose that the number of dynamic ARP entries is D and that of the existing static ARP entries is S. When the dynamic ARP entries are changed into static, new dynamic ARP entries may be created (suppose the number is M) and some of the dynamic ARP entries may be aged out (suppose the number is N). After the process is complete, the number of static ARP entries is D + S + M N. To delete a specific static ARP entry changed from a dynamic one, use the undo arp ip-address [ vpn-instance-name ] command. To delete all such static ARP entries, use the reset arp all or reset arp static command.
Syntax
arp fixup
381
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable Fixed ARP.
<Sysname> system-view [Sysname] arp fixup
arp scan
Description
Use arp scan to enable ARP automatic scanning in the specified address range for neighbors. Note the following: If the start IP and end IP addresses are specified, the device scans the specific address range for neighbors and learns their ARP entries, so that the scanning time is reduced. If the specified address range contains multiple network segments, the sender IP address in the ARP request is the interface address on the smallest network segment. If no address range is specified, the device only scans the network where the primary IP address of the interface resides for neighbors. The sender IP address in the ARP requests is the primary IP address of the interface. The start IP address and end IP address must be on the same network as the primary IP address or manually configured secondary IP addresses of the interface. IP addresses already exist in ARP entries are not scanned. ARP automatic scanning may take some time. To stop an ongoing scan, press Ctrl + C. Dynamic ARP entries are created based on ARP replies received before the scan is terminated.
Syntax
arp scan [ start-ip-address to end-ip-address ]
View
Layer 3 Ethernet interface view, Layer 3 Ethernet subinterface view, VLAN interface view
Default level
2: System level
Parameters
start-ip-address: Start IP address of the scanning range. end-ip-address: End IP address of the scanning range. The end IP address must be higher than or equal to the start IP address.
382
Examples
# Configure the device to scan the network where the primary IP address of Ethernet 1/1 resides for neighbors.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] arp scan
# Configure the device to scan the specific address range for neighbors.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] arp scan 1.1.1.1 to 1.1.1.20
383
IP source guard configuration commands

display ip check source
Description
Use display ip check source to display dynamic IP source guard binding entries. With no parameters specified, the command displays the dynamic IPv4 IP source guard binding entries of all interfaces. Related commands: ip check source. The following table shows the command and router compatibility: Command MSR900 MSR20-1X MSR20 MSR30
Installed with MIM-FSW or DMIM-FSW modules, the MSR30 routers support binding IP addresses, MAC addresses, and VLANs. MSR30-11E Layer 2 fixed Ethernet ports support binding IP addresses, MAC addresses, and VLANs. MSR30-11F Layer 2 fixed Ethernet ports support binding only IP and MAC addresses.
MSR50
display ip check source
No
No
No
Installed with FICFSW or DFIC-FSW modules, MSR50 routers support binding IP addresses, MAC addresses, and VLANs.
Syntax
display ip check source [ interface interface-type interface-number | ip-address ip-address | mac-address mac-address ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
interface interface-type interface-number: Displays the dynamic IP source guard binding entries of the interface specified by its type and number. ip-address ip-address: Displays the dynamic IP source guard binding entries of an IP address.
384
mac-address mac-address: Displays the dynamic IP source guard binding entries of an MAC address (in the format H-H-H). |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display all dynamic IPv4 source guard binding entries.
<Sysname> display ip check source Total entries found: 3 MAC Address 040a-0000-4000 040a-0000-3000 040a-0000-2000 IP Address 10.1.0.9 10.1.0.8 10.1.0.7 VLAN 2 2 2 Interface Eth1/1 Eth1/1 Eth1/1 Type DHCP-SNP DHCP-SNP DHCP-SNP

Total entries found MAC Address IP Address VLAN Interface Type
Description
Total number of found entries MAC address of the dynamic IP source guard binding entry. N/A means that no MAC address is bound in the entry. IP address of the dynamic IP source guard binding entry. N/A means that no IP address is bound in the entry. VLAN bound to the IP source guard binding entry. N/A means that no VLAN information exists in the entry. Interface of the dynamic IP source guard binding entry Type of the dynamic IP source guard binding entry, including:
DHCP-SNPentry generated based on DHCP snooping entry.
display user-bind
Description
Use display user-bind to display static IP source guard binding entries. With no parameters specified, the command displays static IPv4 source guard binding entries of all interfaces. Related commands: user-bind. The following table shows the command and router compatibility:
385
Command
MSR900
MSR20-1X
MSR20
MSR30
Installed with XMIMFSW modules, the MSR30-10 and MSR3011 routers support binding MAC addresses only. Installed with MIM-FSW or DMIM-FSW modules, the MSR30 routers support binding IP addresses, MAC addresses, and VLANs. MSR30-11E Layer 2 fixed Ethernet ports support binding IP addresses, MAC addresses, and VLANs. MSR30-11F Layer 2 fixed Ethernet ports support binding only IP and MAC addresses.
MSR50
Yes display userbind Layer 2 fixed Ethernet ports support binding MAC addresses only. No No
Syntax
display user-bind [ interface interface-type interface-number | ip-address ip-address | mac-address macaddress ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
interface interface-type interface-number: Displays the static IP source guard binding entries of the interface specified by its type and number. ip-address ip-address: Displays the static IP source guard binding entries of an IP address. mac-address mac-address: Displays the static IP source guard binding entries of an MAC address (in the format H-H-H). |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression.
386
regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display all static IPv4 source guard binding entries.
<Sysname> display user-bind Total entries found: 4 MAC Address N/A 0001-0001-0001 0003-0003-0003 0004-0004-0004 IP Address 1.1.1.1 2.2.2.2 N/A 4.4.4.4 VLAN N/A 200 N/A N/A Interface Eth1/1 Eth1/1 Eth1/1 Eth1/1 Type Static Static Static Static

Total entries found MAC Address IP Address VLAN Interface Type
Description
Total number of found entries MAC address of the binding. N/A means that no MAC address is bound in the entry. IP address of the binding. N/A means that no IP address is bound in the entry. VLAN of the binding. N/A means that no VLAN is bound in the entry. Interface of the binding Type of the binding:
StaticStatic IPv4 binding entry.
ip check source
Description
Use ip check source to configure the dynamic IP source guard binding function on a port. Use undo ip check source to restore the default. By default, the dynamic IP source guard binding function is disabled. You cannot configure the dynamic IP source guard binding function on a port that is in an aggregation group or a service loopback group. Related commands: display ip check source. The following table shows the command and router compatibility:
387
Command
MSR900
MSR20-1X
MSR20
MSR30
Installed with MIM-FSW or DMIM-FSW modules, the MSR30 routers support binding IP addresses, MAC addresses, and VLANs. MSR30-11E Layer 2 fixed Ethernet ports support binding IP addresses, MAC addresses, and VLANs. MSR30-11F Layer 2 fixed Ethernet ports support binding only IP and MAC addresses.
MSR50
ip check source
No
No
No
Syntax
ip check source { ip-address | ip-address mac-address | mac-address } undo ip check source
View
Ethernet interface view, VLAN interface view
Default level
2: System level
Parameters
ip-address: Binds source IP addresses to the port. ip-address mac-address: Binds source IP addresses and MAC addresses to the port. mac-address: Binds source MAC addresses to the port.
Examples
# Configure dynamic IPv4 binding of packet source IP address and MAC address on Layer 2 Ethernet port Ethernet 1/1 to filter packets based on the dynamically generated DHCP snooping entries.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] ip check source ip-address mac-address
# Configure dynamic IPv4 binding of packet source IP address and MAC address on VLAN-interface 100 to filter packets based on the dynamically generated DHCP relay entries.
<Sysname> system-view [Sysname] interface vlan-interface 100 [Sysname-Vlan-interface100] ip check source ip-address mac-address
388
user-bind
Description
Use user-bind to configure a static binding. Use undo user-bind to delete a static binding. By default, no static binding exists on a port. You cannot configure the same static binding entry on one port for multiple times, but you can configure the same static entry on different ports. You cannot configure a static binding on a port that is in an aggregation group or a service loopback group. Related commands: display user-bind. The following table shows the command and router compatibility: Command MSR900 MSR20-1X MSR20 MSR30
Installed with XMIMFSW modules, the MSR30-10 and MSR3011 routers support binding MAC addresses only. Installed with MIM-FSW or DMIM-FSW modules, the MSR30 routers support binding IP addresses, MAC addresses, and VLANs. MSR30-11E Layer 2 fixed Ethernet ports support binding IP addresses, MAC addresses, and VLANs. MSR30-11F Layer 2 fixed Ethernet ports support binding only IP and MAC addresses.
MSR50
Yes Layer 2 fixed Ethernet ports support binding MAC addresses only.
user-bind
No
No
Installed with FICFSW and DFICFSW modules, MSR50 routers support binding IP addresses, MAC addresses, and VLANs.
The following table shows the maximum number of binding entries allowed on the MSR routers: MSR900
Maximum number of binding entries allowed 8
MSR20-1X
MSR20
MSR30
256 on an XMIM-FSW module 8 on a MIM/DMIMFSW module
MSR50
8 on an FIC-FSW or DFIC-FSW module
389
Syntax
user-bind { ip-address ip-address | ip-address ip-address mac-address mac-address | mac-address macaddress } [ vlan vlan-id ] undo user-bind { ip-address ip-address | ip-address ip-address mac-address mac-address | mac-address mac-address } [ vlan vlan-id ]
View
Layer 2 Ethernet port view
Default level
2: System level
Parameters
ip-address ip-address: Specifies the IP address for the static binding. The IPv4 address can only be a Class A, Class B, or Class C address and can be neither 127.x.x.x nor 0.0.0.0. mac-address mac-address: Specifies the MAC address for the static binding in the format H-H-H. The MAC address cannot be all 0s, all Fs (a broadcast address), or a multicast address. vlan vlan-id: Specifies the VLAN for the static binding. vlan-id is the ID of the VLAN to be bound, in the range of 1 to 4094.
Examples
# Configure a static IPv4 source guard binding on port Ethernet 1/1.
<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] user-bind ip-address 192.168.0.1 mac-address 0001-0001-0001
390
Attack detection and protection configuration commands

attack-defense apply policy
Description
Use attack-defense apply policy to apply an attack protection policy to an interface. Use undo attack-defense apply policy to restore the default. By default, no attack protection policy is applied to an interface. NOTE:
The attack protection policy to be applied to an interface must already be created by using the attack-defense policy command. One interface can be configured with only one attack protection policy. If you apply multiple policies to an interface, only the last one will take effect. However, one policy can be applied to multiple interfaces.
Related commands: attack-defense policy and display attack-defense policy.
Syntax
attack-defense apply policy policy-number undo attack-defense apply policy
View
Interface view
Default level
2: System level
Parameters
policy-number: Sequence number of an attack protection policy, in the range of 1 to 128.
Examples
# Apply attack protection policy 1 to interface GigabitEthernet 1/1.
<Sysname> system-view [Sysname] interface gigabitethernet 1/1 [Sysname-GigabitEthernet1/1] attack-defense apply policy 1
attack-defense policy
Description
Use attack-defense policy to create an attack protection policy and enter attack protection policy view. Use undo attack-defense policy to delete an attack protection policy.
391
By default, no attack protection policy is created. Related commands: display attack-defense policy.
Syntax
attack-defense policy policy-number [ interface interface-type interface-number ] undo attack-defense policy policy-number [ interface interface-type interface-number ]
View
System view
Default level
2: System level
Parameters
policy-number: Sequence number of an attack protection policy, in the range of 1 to 128. interface interface-type interface-number: Specifies the interface that will use the policy exclusively. If you specify an interface, the policy will be applied to only the interface. Otherwise, the policy will be applied to multiple interfaces.
Examples
# Create attack protection policy 1.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1]
blacklist enable
Description
Use blacklist enable to enable the blacklist function. Use undo blacklist enable to restore the default. By default, the blacklist function is disabled. After the blacklist function is enabled, you can add blacklist entries manually, or configure the device to add blacklist entries automatically. The auto-blacklist function must cooperate with the scanning attack protection function or the user login authentication function. For configuration information about scanning attack protection, see the defense scan add-to-blacklist command. Related commands: defense scan and display attack-defense policy.
Syntax
blacklist enable undo blacklist enable
View
System view
Default level
2: System level
392
Parameters
None
Examples
# Enable the blacklist function.
<Sysname> system-view [Sysname] blacklist enable
blacklist ip
Description
Use blacklist ip to add a blacklist entry. After an IP address is added to the blacklist, the device will filter all packets from it. Use undo blacklist to delete one or all blacklist entries, or cancel the aging time configuration of a blacklist entry. You can use the undo blacklist ip source-ip-address timeout command to cancel the aging time specified for a manually added blacklist entry. After the configuration, this blacklist entry will never get aged. All blacklist entries can take effect only when the blacklist function is enabled. You can modify the aging time of an existing blacklist entry, and the modification will take effect immediately. Related commands: blacklist enable and display blacklist.
Syntax
blacklist ip source-ip-address [ timeout minutes ] undo blacklist { all | ip source-ip-address [ timeout ] }
View
System view
Default level
2: System level
Parameters
source-ip-address: IP address to be added to the blacklist, used to match the source IP address of packets. This IP address cannot be a broadcast address, 127.0.0.0/8, a class D address, or a class E address. all: Specifies all blacklist entries. timeout minutes: Specifies an aging time for the blacklist entry. minutes indicates the aging time and ranges from 1 to 1000, in minutes. If you do not specify the aging time, the blacklist entry will never get aged and thus always exist unless you delete it manually.
Examples
# Add IP address 192.168.1.2 to the blacklist and configure its aging time as 20 minutes.
<Sysname> system-view [Sysname] blacklist ip 192.168.1.2 timeout 20
393
defense icmp-flood action drop-packet

Description
Use defense icmp-flood action drop-packet to configure the device to drop ICMP flood attack packets. Use undo defense icmp-flood action to restore the default. By default, the device only outputs alarm logs if detecting an ICMP flood attack. Related commands: defense icmp-flood enable, defense icmp-flood ip, defense icmp-flood ratethreshold, and display attack-defense policy.
Syntax
defense icmp-flood action drop-packet undo defense icmp-flood action
View
Attack protection policy view
Default level
2: System level
Parameters
None
Examples
# Configure attack protection policy 1 to drop ICMP flood attack packets.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] defense icmp-flood action drop-packet
defense icmp-flood enable

Description
Use defense icmp-flood enable to enable ICMP flood attack protection. Use undo defense icmp-flood enable to restore the default. By default, ICMP flood attack protection is disabled. Related commands: defense icmp-flood action drop-packet, defense icmp-flood ip, defense icmp-flood rate-threshold, and display attack-defense policy.
Syntax
defense icmp-flood enable undo defense icmp-flood enable
View
Default level
2: System level
394
Parameters
None
Examples
# Enable ICMP flood attack protection in attack protection policy 1.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] defense icmp-flood enable
defense icmp-flood ip
Description
Use defense icmp-flood ip to configure the action and silence thresholds for ICMP flood attack protection of a specific IP address. Use undo defense icmp-flood ip to remove the configuration. By default, no ICMP flood attack protection thresholds are configured for an IP address. You can configure ICMP flood attack protection thresholds for up to 32 IP addresses in an attack protection policy. Related commands: defense icmp-flood action drop-packet, defense icmp-flood enable, and display attack-defense policy.
Syntax
defense icmp-flood ip ip-address rate-threshold high rate-number [ low rate-number ] undo defense icmp-flood ip ip-address [ rate-threshold ]
View
Default level
2: System level
Parameters
ip-address: IP address to be protected. This IP address cannot be a broadcast address, 127.0.0.0/8, a class D address, or a class E address. high rate-number: Sets the action threshold for ICMP flood attack protection of the specified IP address. rate-number indicates the number of ICMP packets sent to the specified IP address per second, and is in the range of from 1 to 65535. With the ICMP flood attack protection enabled, the device enters the attack detection state. When the device detects that the sending rate of ICMP packets destined for the specified IP address constantly reaches or exceeds the specified action threshold, the device considers the IP address is under attack, enters the attack protection state, and takes protection actions as configured. low rate-number: Sets the silence threshold for ICMP flood attack protection of the specified IP address. rate-number indicates the number of ICMP packets sent to the specified IP address per second, and is in the range of from 1 to 65535. The default value of the silence threshold is 3/4 of the action threshold. If the device, when in the attack protection state, detects that the sending rate of ICMP packets destined for the specified IP address drops below the silence threshold, it considers that the attack is over, returns to the attack detection state, and stops the protection actions.
395
Examples
# Enable ICMP flood attack protection for IP address 192.168.1.2, and set the action threshold to 2000 packets per second and the silence threshold to 1000 packets per second.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] defense icmp-flood ip 192.168.1.2 rate-threshold high 2000 low 1000
defense icmp-flood rate-threshold

Description
Use defense icmp-flood rate-threshold to configure the global action and silence thresholds for ICMP flood attack protection. The device uses the global attack protection thresholds to protect IP addresses for which you do not configure attack protection parameters specifically. Use undo defense icmp-flood rate-threshold to restore the default. By default, the global action threshold is 1000 packet per second and the global silence threshold is 750 packets per second. Adjust the thresholds according to the actual network conditions. Usually, ICMP traffic is smaller than TCP traffic and UDP traffic. You can set a smaller action threshold for ICMP flood protection. If the link bandwidth of the protected network is small, set a smaller silence threshold to help release the traffic pressure. Related commands: defense icmp-flood action drop-packet, defense icmp-flood enable, and display attack-defense policy.
Syntax
defense icmp-flood rate-threshold high rate-number [ low rate-number ] undo defense icmp-flood rate-threshold
View
Default level
2: System level
Parameters
high rate-number: Sets the global action threshold for ICMP flood attack protection. rate-number indicates the number of ICMP packets sent to an IP address per second, and is in the range of from 1 to 65535. With ICMP flood attack enabled, the device enters the attack detection state. When the device detects that the sending rate of ICMP packets destined for an IP address constantly reaches or exceeds the specified action threshold, the device considers the IP address is under attack, enters the attack protection state, and takes protection actions as configured. low rate-number: Sets the global silence threshold for ICMP flood attack protection. rate-number indicates the number of ICMP packets sent to an IP address per second, and is in the range of from 1 to 65535. If the device, when in the attack protection state, detects that the sending rate of ICMP packets destined for an IP address drops below the silence threshold, it considers that the attack to the IP address is over, returns to the attack detection state, and stops the protection actions.
396
Examples
# Set the global action threshold to 3000 packets per second and the global silence threshold to 1000 packets per second for ICMP flood attack.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] defense icmp-flood rate-threshold high 3000 low 1000
defense scan add-to-blacklist

Description
Use defense scan add-to-blacklist to enable the blacklist function for scanning attack protection. Use undo defense scan add-to-blacklist to restore the default. By default, the blacklist function for scanning attack protection is not enabled. With scanning attack protection enabled, a device will check the connection rate by IP address. If the connection rate of an IP address reaches or exceeds the threshold (set by the defense scan max-rate command), the device considers the IP address a scanning attack source and drops subsequent packets from the IP address until it finds that the rate is less than the threshold. At the same time, if the blacklist function for scanning attack protection is also enabled, the device will add the source IP address to the blacklist, which then filters packets until the blacklist entry is aged out (the aging time is set by the defense scan blacklist-timeout command). The blacklist entries added by the scanning attack protection function take effect only after you enable the blacklist function for the device by using the blacklist enable command. If you delete an entry blacklisted by scanning attack protection short after the entry is added (within 1 second, currently), the system will not add the entry again. This is because the system considers the subsequent packets matching the entry the packets of the same attack. Related commands: blacklist enable, defense scan blacklist-timeout, defense scan enable, and defense scan max-rate.
Syntax
defense scan add-to-blacklist undo defense scan add-to-blacklist
View
Default level
2: System level
Parameters
None
Examples
# Enable scanning attack protection.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] defense scan enable
397
# Set the connection rate threshold for triggering scanning attack protection to 2000 connections per second.
[Sysname-attack-defense-policy-1] defense scan max-rate 2000
# Enable the blacklist function for scanning attack protection, and specify the blacklist entry aging time as 20 minutes.
[Sysname-attack-defense-policy-1] defense scan add-to-blacklist [Sysname-attack-defense-policy-1] defense scan blacklist-timeout 20 [Sysname-attack-defense-policy-1] quit
# Enable the blacklist function globally to make the blacklist function for scanning attack protection take effect.
[Sysname] blacklist enable
defense scan blacklist-timeout

Description
Use defense scan blacklist-timeout to specify the aging time for entries blacklisted by scanning attack protection. Use undo defense scan blacklist-timeout to restore the default, which is 10 minutes. Related commands: blacklist enable, defense scan add-to-blacklist, defense scan enable, and defense scan max-rate.
Syntax
defense scan blacklist-timeout minutes undo defense scan blacklist-timeout
View
Default level
2: System level
Parameters
minutes: Aging time of blacklist entries, in the range of 1 to 1000, in minutes.
Examples
# Set the aging time for entries blacklisted by the scanning attack protection function to 20 minutes.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] defense scan blacklist-timeout 20
defense scan enable

Description
Use defense scan enable to enable scanning attack protection. Use undo defense scan enable to restore the default. By default, scanning attack protection is disabled.
398
With scanning attack protection enabled, a device will check the connection rate by IP address. If the connection rate of an IP address reaches or exceeds the threshold (set by the defense scan max-rate command), the device considers the IP address a scanning attack source and drops subsequent packets from the IP address until it finds that the rate is less than the threshold. Related commands: blacklist enable, defense scan add-to-blacklist, defense scan blacklist-timeout, and defense scan max-rate.
Syntax
defense scan enable undo defense scan enable
View
Default level
2: System level
Parameters
None
Examples
defense scan max-rate

Description
Use defense scan max-rate to specify the threshold of connection establishment rate that triggers scanning attack prevention. Use undo defense scan max-rate to restore the default, which is 4000 connections per second. With scanning attack protection enabled, a device will check the connection rate by IP address. If the connection rate of an IP address reaches or exceeds the threshold, the device considers the IP address a scanning attack source and drops subsequent packets from the IP address until it finds that the rate is less than the threshold. Related commands: blacklist enable, defense scan add-to-blacklist, defense scan blacklist-timeout, and defense scan enable.
Syntax
defense scan max-rate rate-number undo defense scan max-rate
View
Default level
2: System level
399
Parameters
rate-number: Threshold of the connection establishment rate (number of connections established in a second) that triggers scanning attack protection, in the range of 1 to 10000.
Examples
# Set the connection rate threshold for triggering scanning attack protection to 2000 connections per second.
[Sysname-attack-defense-policy-1] defense scan max-rate 2000
defense syn-flood action

Description
Use defense syn-flood action to configure the device to drop SYN flood attack packets. When the device detects an SYN flood attack, the device drops all subsequent connection requests to the attacked IP address. Use undo defense syn-flood action to restore the default. By default, the device only outputs alarm logs when detecting an attack. Related commands: defense syn-flood enable and display attack-defense policy.
Syntax
defense syn-flood action drop-packet undo defense syn-flood action
View
Default level
2: System level
Parameters
drop-packet: Drops SYN flood attack packets.
Examples
# Configure the SYN flood protection policy to drop SYN flood attack packets.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] defense syn-flood action drop-packet
defense syn-flood enable

Description
Use defense syn-flood enable to enable SYN flood attack protection.
400
Use undo defense syn-flood enable to restore the default. By default, SYN flood attack protection is disabled. Related commands: defense syn-flood and display attack-defense policy.
Syntax
defense syn-flood enable undo defense syn-flood enable
View
Default level
2: System level
Parameters
None
Examples
# Enable SYN flood attack protection in attack protection policy 1.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] defense syn-flood enable
defense syn-flood ip
Description
Use defense syn-flood ip to configure the action and silence thresholds for SYN flood attack protection of a specific IP address. Use undo defense syn-flood ip to remove the configuration. By default, no SYN flood attack protection thresholds are configured for an IP address. You can specify multiple protected IP addresses in each attack protection policy. Related commands: defense syn-flood action, defense syn-flood enable, and display attack-defense policy.
Syntax
defense syn-flood ip ip-address rate-threshold high rate-number [ low rate-number ] undo defense syn-flood ip ip-address [ rate-threshold ]
View
Default level
2: System level
Parameters
ip-address: IP address to be protected. This IP address cannot be a broadcast address, 127.0.0.0/8, a class D address, or a class E address.
401
high rate-number: Sets the action threshold for SYN flood attack protection of the specified IP address. rate-number indicates the number of SYN packets sent to the specified IP address per second, and is in the range of 1 to 65535. With SYN flood attack protection enabled, the device enters the attack detection state. When the device detects that the sending rate of SYN packets destined for the specified IP address constantly reaches or exceeds the specified action threshold, the device considers the IP address is under attack, enters the attack protection state, and takes protection actions as configured. low rate-number: Sets the silence threshold for SYN flood attack protection of the specified IP address. rate-number indicates the number of SYN packets sent to the specified IP address per second, and is in the range of 1 to 65535. The default value of the silence threshold is 3/4 of the action threshold. If the device, when in the attack protection state, detects that the sending rate of SYN packets destined for the specified IP address drops below the silence threshold, it considers that the attack is over, returns to the attack detection state and stops taking the protection measures.
Examples
# Configure SYN flood attack protection for IP address 192.168.1.2, and set the action threshold to 2000 packets per second and the silence threshold to 1000 packets per second.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] defense syn-flood ip 192.168.1.2 rate-threshold high 2000 low 1000
defense syn-flood rate-threshold

Description
Use defense syn-flood rate-threshold to configure the global action and silence thresholds for SYN flood attack protection. The device uses the global attack protection thresholds to protect the IP addresses for which you do not configure attack protection parameters specifically. Use undo defense syn-flood rate-threshold to restore the default. By default, the global action threshold is 1000 packets per second and the global silence threshold is 750 packets per second. Adjust the thresholds according to your actual network conditions. For the protected objects that have big SYN traffic in normal case, for example, HTTP server or FTP server, set a bigger action threshold to avoid impaction on normal services. For poor network conditions, or attack-sensitive networks, you can set a smaller action threshold. If the link bandwidth of the protected network is small, you can set a smaller silence threshold to help release the network traffic pressure. Related commands: defense syn-flood enable and display attack-defense policy.
Syntax
defense syn-flood rate-threshold high rate-number [ low rate-number ] undo defense syn-flood rate-threshold
View
Default level
2: System level
402
Parameters
high rate-number: Sets the global action threshold for SYN flood attack protection. rate-number indicates the number of SYN packets sent to an IP address per second, and is in the range of 1 to 64000. With the SYN flood attack protection enabled, the device enters the attack detection state. When the device detects that the sending rate of SYN packets destined for an IP address constantly reaches or exceeds the specified action threshold, the device considers the IP address is under attack, enters the attack protection state, and takes protection actions as configured. low rate-number: Sets the global silence threshold for SYN flood attack protection. rate-number indicates the number of SYN packets sent to an IP address per second, and is in the range of 1 to 64000. If the device, when in the attack protection state, detects that the sending rate of SYN packets destined for an IP address drops below the silence threshold, it considers that the attack to the IP address is over, returns to the attack detection state and stops the protection actions.
Examples
# Configure SYN flood attack protection, set the global action threshold to 3000 packets per second and the global silence threshold to 1000 packets per second.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] defense syn-flood rate-threshold high 3000 low 1000
defense udp-flood action drop-packet

Description
Use defense udp-flood action drop-packet to configure the device to drop UDP flood attack packets. Use undo defense udp-flood action to restore the default. By default, the device only outputs alarm logs if it detects a UDP flood attack. Related commands: defense udp-flood enable, defense udp-flood ip, defense udp-flood rate-threshold, and display attack-defense policy.
Syntax
defense udp-flood action drop-packet undo defense udp-flood action
View
Default level
2: System level
Parameters
None
Examples
# Configure attack protection policy 1 to drop UDP flood packets.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] defense udp-flood action drop-packet
403
defense udp-flood enable

Description
Use defense udp-flood enable to enable UDP flood attack protection. Use undo defense udp-flood enable to restore the default. By default, UDP flood attack protection is disabled. Related commands: defense udp-flood action drop-packet, defense udp-flood rate-threshold, defense udp-flood ip, and display attack-defense policy.
Syntax
defense udp-flood enable undo defense udp-flood enable
View
Default level
2: System level
Parameters
None
Examples
# Enable UDP flood attack protection in attack protection policy 1.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] defense udp-flood enable
defense udp-flood ip
Description
Use defense udp-flood ip to configure the action and silence thresholds for UDP flood attack protection of a specific IP address. Use undo defense udp-flood ip to remove the configuration. By default, no UDP flood attack protection thresholds are configured for an IP address. You can configure UDP flood attack protection thresholds for up to 32 IP addresses in each attack protection policy. Related commands: defense udp-flood action drop-packet, defense udp-flood enable, and display attack-defense policy.
Syntax
defense udp-flood ip ip-address rate-threshold high rate-number [ low rate-number ] undo defense udp-flood ip ip-address [ rate-threshold ]
404
View
Default level
2: System level
Parameters
ip-address: IP address to be protected. This IP address cannot be a broadcast address, 127.0.0.0/8, a class D address, or a class E address. high rate-number: Sets the action threshold for UDP flood attack protection of the specified IP address. rate-number indicates the number of UDP packets sent to the specified IP address per second, and is in the range of 1 to 65535. With the UDP flood attack protection enabled, the device enters the attack detection state. When the device detects that the sending rate of UDP packets destined for the specified IP address constantly reaches or exceeds the specified action threshold, the device considers the IP address is under attack, enters the attack protection state, and takes protection actions as configured. low rate-number: Sets the silence threshold for UDP flood attack protection of the specified IP address. rate-number indicates the number of UDP packets sent to the specified IP address per second, and is in the range of 1 to 65535. The default value of the silence threshold is 3/4 of the action threshold. If the device, when in the attack protection state, detects that the sending rate of UDP packets destined for the specified IP address drops below the silence threshold, it considers that the attack is over, returns to the attack detection state, and stops the protection measures.
Examples
# Configure UDP flood attack protection for IP address 192.168.1.2, and set the action threshold to 2000 packets per second and the silence threshold to 1000 packets per second.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] defense udp-flood ip 192.168.1.2 rate-threshold high 2000 low 1000
defense udp-flood rate-threshold

Description
Use defense udp-flood rate-threshold to configure the global action and silence thresholds for UDP flood attack protection. The device uses the global attack protection thresholds to protect the IP addresses for which you do not configure attack protection parameters specifically. Use undo defense udp-flood rate-threshold to restore the default. By default, the global action threshold is 1000 packets per second and the global silence threshold is 750 packets per second. Adjust the thresholds according to your actual network conditions. For the protected objects that have big UDP traffic in normal case, set a bigger action threshold to avoid impaction on normal services. For poor network conditions, or attack-sensitive networks, you can set a smaller action threshold. If the link bandwidth of the protected network is small, you can set a smaller silence threshold to help release the network traffic pressure. Related commands: defense udp-flood action drop-packet, defense udp-flood enable, and display attack-defense policy.
405
Syntax
defense udp-flood rate-threshold high rate-number [ low rate-number ] undo defense udp-flood rate-threshold
View
Default level
2: System level
Parameters
high rate-number: Sets the global action threshold for UDP flood attack protection. rate-number indicates the number of UDP packets sent to an IP address per second, and is in the range of 1 to 65535. With the UDP flood attack protection enabled, the device enters the attack detection state. When the device detects that the sending rate of UDP packets destined for an IP address constantly reaches or exceeds the specified action threshold, the device considers the IP address is under attack, enters the attack protection state, and takes protection actions as configured. low rate-number: Sets the global silence threshold for UDP flood attack protection. rate-number indicates the number of UDP packets sent to an IP address per second, and is in the range of 1 to 65535. If the device, when in the attack protection state, detects that the sending rate of UDP packets destined for an IP address drops below the silence threshold, it considers that the attack to the IP address is over, returns to the attack detection state, and stops the protection actions.
Examples
# Configure UDP flood attack protection, set the global action threshold to 3000 packets per second and the global silence threshold to 1000 packets per second.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] defense udp-flood rate-threshold high 3000 low 1000
display attack-defense policy

Description
Use display attack-defense policy to display the configuration information of one or all attack protection policies. If you do not specify the policy-number argument, the command displays the summary information of all attack protection policies. Related commands: attack-defense policy.
Syntax
display attack-defense policy [ policy-number ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
406
Parameters
policy-number: Sequence number of an attack protection policy, in the range of 1 to 128. |: Filters command output by specifying a regular expression. For more information about regular expressions, see the Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display the configuration information of attack protection policy 1.
<Sysname> display attack-defense policy 1 Attack-defense Policy Information -----------------------------------------------------------Policy number Bound interfaces Smurf attack-defense ICMP redirect attack-defense ICMP unreachable attack-defense Large ICMP attack-defense Max-length TCP flag attack-defense Tracert attack-defense Fraggle attack-defense WinNuke attack-defense LAND attack-defense Source route attack-defense Route record attack-defense Scan attack-defense Add to blacklist Blacklist timeout Max-rate Signature-detect action ICMP flood attack-defense ICMP flood action ICMP flood high-rate ICMP flood low-rate IP 192.168.1.1 192.168.2.1 : 1 : GigabitEthernet1/1 : Enabled : Disabled : Disabled : Enabled : 250 bytes : Enabled : Enabled : Enabled : Enabled : Enabled : Enabled : Enabled : Enabled : Enabled : 10 minutes : 1000 connections/s : Drop-packet : Enabled : Syslog : 2000 packets/s : 750 packets/s High-rate(packets/s) 1000 2000 Low-rate(packets/s) 500 1000 : Enabled
407
------------------------------------------------------------
--------------------------------------------------------------------------
ICMP flood attack-defense for specific IP addresses:
-------------------------------------------------------------------------UDP flood attack-defense
UDP flood action UDP flood high-rate UDP flood low-rate IP 192.168.1.1 192.168.2.1
: Drop-packet : 2000 packets/s : 750 packets/s High-rate(packets/s) 1000 2000 Low-rate(packets/s) 500 500 : Enabled : Reset-session : 2000 packets/s : 750 packets/s High-rate(packets/s) 1000 2000 Low-rate(packets/s) 750 1000
UDP Flood attack-defense for specific IP addresses:
-------------------------------------------------------------------------SYN flood attack-defense SYN flood action SYN flood high-rate SYN flood low-rate IP 192.168.1.1 192.168.2.1
SYN Flood attack-defense for specific IP addresses:
Table 66 Output description Filed

Policy number Bound interfaces Smurf attack-defense ICMP redirect attack-defense ICMP unreachable attack-defense Large ICMP attack-defense Max-length TCP flag attack-defense Tracert attack-defense Fraggle attack-defense WinNuke attack-defense LAND attack-defense Source route attack-defense Route record attack-defense
Description
Sequence number of the attack protection policy Interfaces to which the attack protection policy is applied Indicates whether Smurf attack protection is enabled Indicates whether ICMP redirect attack protection is enabled Indicates whether ICMP unreachable attack protection is enabled Indicates whether large ICMP attack protection is enabled Maximum length allowed for an ICMP packet Indicates whether TCP flag attack protection is enabled Indicates whether tracert attack protection is enabled Indicates whether Fraggle attack protection is enabled Indicates whether WinNuke attack protection is enabled Indicates whether Land attack protection is enabled Indicates whether Source Route attack protection is enabled Indicates whether Route Record attack protection is enabled
408
Filed
Scan attack-defense Add to blacklist Blacklist timeout Max-rate
Description
Indicates whether scanning attack protection is enabled Indicates whether the blacklist function is enabled for scanning attack protection Aging time of the blacklist entries Threshold for the connection establishment rate Action to be taken when a single-packet attack is detected. It can be Drop-packet (dropping subsequent packets) or Syslog (outputting an alarm log). Indicates whether ICMP flood attack protection is enabled Action to be taken when an ICMP flood attack is detected. It can be Drop-packet (dropping subsequent packets) or Syslog (outputting an alarm log). Global action threshold for ICMP flood attack protection Global silence threshold for ICMP flood attack protection ICMP flood attack protection settings for specific IP addresses Indicates whether UDP flood attack is enabled Action to be taken when a UDP flood attack is detected. It can be Drop-packet (dropping subsequent packets) or Syslog (outputting an alarm log). Global action threshold for UDP flood attack protection Global silence threshold for UDP flood attack protection UDP flood attack protection settings for specific IP addresses Indicates whether SYN flood attack is enabled Action to be taken when a SYN flood attack is detected. It can be Drop-packet (dropping subsequent packets) or Syslog (outputting an alarm log). Global action threshold for SYN flood attack protection Global silence threshold for SYN flood attack protection
Signature-detect action
ICMP flood attack-defense
ICMP flood action
ICMP flood high-rate ICMP flood low-rate ICMP flood attack-defense for specific IP addresses UDP flood attack-defense
UDP flood action
UDP flood high-rate UDP flood low-rate UDP flood attack on IP SYN flood attack-defense
SYN flood action
SYN flood high-rate SYN flood low-rate
409
Filed
SYN flood attack on IP
Description
SYN flood attack protection settings for specific IP addresses
# Display the summary configuration information of all attack protection policies.

<Sysname> display attack-defense policy Attack-defense Policy Brief Information -------------------------------------------------------------------------Policy Number 1 50 128 Bound Interface GigabitEthernet1/1 None GigabitEthernet1/2
display attack-defense statistics interface

Description
Use display attack-defense statistics interface to display the attack protection statistics of an interface. Related commands: attack-defense apply policy and attack-defense policy.
Syntax
display attack-defense statistics interface interface-type interface-number [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
interface-type interface-number: Specifies an interface by its type and number. |: Filters command output by specifying a regular expression. For more information about regular expressions, see the Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display the attack protection statistics of interface GigabitEthernet 1/1.
<Sysname> display attack-defense statistics interface gigabitethernet 1/1 Attack-defense Statistics Information -----------------------------------------------------------Interface Attack policy number : GigabitEthernet1/1 : 1
410
------------------------------------------------------------
Fraggle attacks Fraggle packets dropped ICMP redirect attacks ICMP redirect packets dropped ICMP unreachable attacks ICMP unreachable packets dropped LAND attacks LAND attack packets dropped Large ICMP attacks Large ICMP packets dropped Route record attacks Route record packets dropped Source route attacks Source route packets dropped Smurf attacks Smurf packets dropped TCP flag attacks TCP flag packets dropped Tracert attacks Tracert packets dropped WinNuke attacks WinNuke packets dropped Scan attacks Scan attack packets dropped SYN flood attacks SYN flood packets dropped ICMP flood attacks ICMP flood packets dropped UDP flood attacks UDP flood packets dropped
: 1 : 100 : 1 : 100 : 1 : 100 : 1 : 100 : 1 : 100 : 1 : 100 : 1 : 100 : 1 : 100 : 1 : 100 : 1 : 100 : 1 : 100 : 1 : 100 : 1 : 100 : 1 : 100 : 1 : 100

Attack policy number Fraggle attacks Fraggle packets dropped ICMP redirect attacks ICMP redirect packets dropped ICMP unreachable attacks ICMP unreachable packets dropped LAND attacks LAND attack packets dropped
Description
Sequence number of the attack protection policy applied to the interface Number of detected Fraggle attacks Number of Fraggle packets dropped Number of detected ICMP redirect attacks Number of ICMP redirect packets dropped Number of detected ICMP unreachable attacks Number of ICMP unreachable packets dropped Number of detected Land attacks Number of Land packets dropped
411
Field
Large ICMP attacks Large ICMP packets dropped Route record attacks Route record packets dropped Source route attacks Source route packets dropped Smurf attacks Smurf attack packets dropped TCP flag attacks TCP flag packets dropped Tracert attacks Tracert packets dropped WinNuke attacks WinNuke packets dropped Scan attacks Scan attack packets dropped SYN flood attacks SYN flood attack packets dropped ICMP flood attacks ICMP flood attack packets dropped UDP flood attacks UDP flood attack packets dropped
Description
Number of detected large ICMP attacks Number of large ICMP packets dropped Number of detected Route Record attacks Number of Route Record attack packets dropped Number of detected Source Route attacks Number of Source Route attack packets dropped Number of detected Smurf attacks Number of Smurf attack packets dropped Number of detected TCP flag attacks Number of TCP flag packets dropped Number of detected Tracert attacks Number of Tracert packets dropped Number of detected WinNuke attacks Number of WinNuke packets dropped Number of detected scanning attacks Number of scanning attack packets dropped Number of detected SYN flood attacks Number of SYN flood attack packets dropped Number of detected ICMP flood attacks Number of ICMP flood attack packets dropped Number of detected UDP flood attacks Number of UDP flood attack packets dropped
display blacklist
Description
Use display blacklist to display information about one or all blacklist entries. Related commands: blacklist enable and blacklist ip.
Syntax
display blacklist { all | ip source-ip-address } [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
412
Parameters
all: Displays information about all blacklist entries. ip source-ip-address: Displays information about the blacklist entry for an IP address. source-ip-address indicates the IP address, which cannot be a broadcast address, 127.0.0.0/8, a class D address, or a class E address. |: Filters command output by specifying a regular expression. For more information about regular expressions, see the Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display information about all blacklist entries.
<Sysname> display blacklist all Blacklist information -----------------------------------------------------------------------------Blacklist Blacklist items IP 2.2.1.2 1.1.1.2 1.1.1.3 Type Aging started : enabled : 1 Aging finished Dropped packets 0
-----------------------------------------------------------------------------YYYY/MM/DD hh:mm:ss YYYY/MM/DD hh:mm:ss manual 2008/08/27 19:15:39 Never auto 2008/09/01 18:26:31 2008/09/01 18:36:31 4294967295
manual 2008/09/02 06:13:20 2008/09/02 07:54:47 4294967295
--------------------------------------------------------------------------

Blacklist Blacklist items IP
Description
Indicates whether the blacklist function is enabled Number of blacklist entries IP address of the blacklist entry Type of the blacklist entry, which can be:
Type
manual The entry was added manually. auto The entry was added automatically by the
scanning attack protection function. Time when the blacklist entry is added Aging time of the blacklist entry. Never means that the entry will never get aged. Number of packets from the IP address that have been dropped
Aging started Aging finished Dropped packets
413
display flow-statistics statistics

Description
Use display flow-statistics statistics to display traffic statistics on interfaces based on IP addresses.
Syntax
display flow-statistics statistics { destination-ip dest-ip-address | source-ip src-ip-address } [ vpn-instance vpn-instance-name ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
destination-ip dest-ip-address: Displays statistics of the traffic destined for the specified destination IP address. dest-ip-address indicates the destination IP address, which cannot be a broadcast address, 127.0.0.0, a class D address, or a class E address source-ip src-ip-address: Displays statistics of the traffic that is from the specified source IP address. src-ipaddress indicates the source IP address, which cannot be a broadcast address, 127.0.0.0, a class D address, or a class E address. vpn-instance vpn-instance-name: Displays statistics of the traffic that belongs to the specified VPN. vpninstance-name indicates the VPN instance name of an MPLS L3VPN, a case-sensitive string of 1 to 31 characters. If the object to be displayed belongs to the public network, do not specify this option. |: Filters command output by specifying a regular expression. For more information about regular expressions, see the Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display the traffic statistics of source IP address 192.168.1.2.
<Sysname> display flow-statistics statistics source-ip 192.168.1.2 Flow Statistics Information ----------------------------------------------------------IP Address Total number of existing sessions Session establishment rate TCP sessions Half-open TCP sessions Half-close TCP sessions TCP session establishment rate UDP sessions : : : : : : : :
414
192.168.1.2 70 10/s 10 10 10 10/s 10
-----------------------------------------------------------
UDP session establishment rate ICMP sessions ICMP session establishment rate RAWIP sessions RAWIP session establishment rate
: : : : :
10/s 10 10/s 10 10/s

IP Address Total number of existing sessions Session establishment rate TCP sessions Half-open TCP sessions Half-close TCP sessions TCP session establishment rate UDP sessions UDP session establishment rate ICMP sessions ICMP session establishment rate RAWIP sessions RAWIP session establishment rate
Description
Source IP address Total number of connections Connection establishment rate Number of TCP connections Number of half-open connections Number of half-close connections TCP connection establishment rate Number of UDP connections UDP connection establishment rate Number of ICMP connections ICMP connection establishment rate Number of RAWIP connections RAWIP connection establishment rate
display flow-statistics statistics interface

Description
Use display flow-statistics statistics interface to display the traffic statistics of an interface.
Syntax
display flow-statistics statistics interface interface-type interface-number { inbound | outbound } [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
interface-type interface-number: Specifies an interface by its type and number. inbound: Displays traffic statistics in the inbound direction of an interface. outbound: Displays traffic statistics in the outbound direction of an interface.
415
|: Filters command output by specifying a regular expression. For more information about regular expressions, see the Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display the inbound traffic statistics of interface GigabitEthernet 1/1.
<Sysname> display flow-statistics statistics interface gigabitethernet 1/1 inbound Flow Statistics Information -----------------------------------------------------------Interface Total number of existing sessions Session establishment rate TCP sessions Half-open TCP sessions Half-close TCP sessions TCP session establishment rate UDP sessions UDP session establishment rate ICMP sessions ICMP session establishment rate RAWIP sessions RAWIP session establishment rate : GigabitEthernet1/1 : : : : : : : : : : : : 70 10/s 10 10 10 10/s 10 10/s 10 10/s 10 10/s ------------------------------------------------------------

Total number of existing sessions Session establishment rate TCP sessions Half-open TCP sessions Half-close TCP sessions TCP session establishment rate UDP sessions UDP session establishment rate ICMP sessions ICMP session establishment rate RAWIP sessions RAWIP session establishment rate
Description
Total number of connections Connection establishment rate Number of TCP connections Number of half-open connections Number of half-close connections TCP connection establishment rate Number of UDP connections UDP connection establishment rate Number of ICMP connections ICMP connection establishment rate Number of RAWIP connections RAWIP connection establishment rate
416
flow-statistics enable
Description
Use flow-statistics enable to enable traffic statistics on an interface. Use undo flow-statistics enable to restore the default. By default, traffic statistics is disabled on an interface. You can enable multiple types of traffic statistics on an interface, and then use related display commands to view the statistics results of each type. Related commands: display flow-statistics statistics.
Syntax
flow-statistics enable { destination-ip | inbound | outbound | source-ip } undo flow-statistics enable { destination-ip | inbound | outbound | source-ip }
View
Interface view
Default level
2: System level
Parameters
destination-ip: Collects statistics on packets sent out of the current interface by destination IP address. inbound: Collects statistics on packets received on the interface. outbound: Collects statistics on packets sent out of the interface. source-ip: Collects statistics on packets received on the current interface by source IP address.
Examples
# On interface GigabitEthernet 1/1, enable traffic statistics by destination IP address.
<Sysname> system-view [Sysname] interface gigabitethernet 1/1 [Sysname-GigabitEthernet1/1] flow-statistics enable destination-ip
# You can use the following to view statistics on packets sent out of the interface with the destination IP address being 2.2.2.2 (you can specify the destination IP address as needed).
[Sysname-GigabitEthernet1/1] display flow-statistics statistics destination-ip 2.2.2.2
reset attack-defense statistics interface

Description
Use reset attack-defense statistics interface to clear the attack protection statistics of an interface. Related commands: display attack-defense statistics interface.
Syntax
reset attack-defense statistics interface interface-type interface-number
417
View
User view
Default level
1: Monitor level
Parameters
interface-type interface-number: Specifies an interface by its type and number.
Examples
# Clear the attack protection statistics of interface GigabitEthernet 1/1.
<Sysname> reset attack-defense statistics interface gigabitethernet 1/1
signature-detect
Description
Use signature-detect to enable signature detection of a single-packet attack. Use undo signature-detect to disable signature detection of a single-packet attack. By default, signature detection of all type of attacks is disabled. Related commands: display attack-defense policy.
Syntax
signature-detect { fraggle | icmp-redirect | icmp-unreachable | land | large-icmp | route-record | smurf | source-route | tcp-flag | tracert | winnuke } enable undo signature-detect { fraggle | icmp-redirect | icmp-unreachable | land | large-icmp | route-record | smurf | source-route | tcp-flag | tracert | winnuke } enable
View
Default level
2: System level
Parameters
fraggle: Specifies the Fraggle packet attack. icmp-redirect: Specifies the ICMP redirect packet attack. icmp-unreachable: Specifies the ICMP unreachable packet attack. land: Specifies the Land packet attack. large-icmp: Specifies the large ICMP packet attack. route-record: Specifies the route record packet attack. smurf: Specifies the Smurf packet attack. source-route: Specifies the source route packet attack. tcp-flag: Specifies the TCP flag packet attack. tracert: Specifies the Tracert packet attack.
418
winnuke: Specifies the Winnuke packet attack.
Examples
# Enable signature detection of Fraggle attack in attack protection policy 1.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] signature-detect fraggle enable
signature-detect action drop-packet

Description
Use signature-detect action drop-packet to configure the device to drop single-packet attack packets. Use undo signature-detect action to restore the default. By default, the device only outputs alarm logs if it detects a single-packet attack. Related commands: display attack-defense policy.
Syntax
signature-detect action drop-packet undo signature-detect action
View
Default level
2: System level
Parameters
None
Examples
# Configure attack protection policy 1 to drop single-packet attack packets.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] signature-detect action drop-packet
signature-detect large-icmp max-length

Description
Use signature-detect large-icmp max-length to specify the ICMP packet length threshold that triggers large ICMP attack protection. Use undo signature-detect large-icmp max-length to restore the default. By default, an ICMP packet length of 4000 bytes will trigger large ICMP attack protection. With signature detection of large ICMP attack enabled, a device considers all ICMP packets longer than the specified maximum length as large ICMP attack packets. This command is effective only when signature detection of large ICMP attack is enabled.
419
Related commands: display attack-defense policy and signature-detect large-icmp enable.
Syntax
signature-detect large-icmp max-length length undo signature-detect large-icmp max-length
View
Default level
2: System level
Parameters
length: Maximum length of an ICMP packet, in the range of 28 to 65534 bytes.
Examples
# Enable signature detection of large ICMP attack, set the ICMP packet length threshold that triggers large ICMP attack protection to 5000 bytes, and configure the device to drop ICMP packets longer than the specified maximum length.
<Sysname> system-view [Sysname] attack-defense policy 1 [Sysname-attack-defense-policy-1] signature-detect large-icmp enable [Sysname-attack-defense-policy-1] signature-detect large-icmp max-length 5000 [Sysname-attack-defense-policy-1] signature-detect action drop-packet
420
TCP attack protection configuration commands

display tcp status
Description
Use display tcp status to display status of all TCP connections for monitoring TCP connections.
Syntax
display tcp status [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
Examples
# Display status of all TCP connections.
<Sysname> display tcp status *: TCP MD5 Connection TCPCB 03e37dc4 04217174 Local Add:port 0.0.0.0:4001 100.0.0.204:23 Foreign Add:port 0.0.0.0:0 100.0.0.253:65508 Established State Listening

*: TCP MD5 Connection TCPCB Local Add:port Foreign Add:port State
Description
If the status information of a TCP connection contains *, the TCP adopts the MD5 algorithm for authentication. TCP control block Local IP address and port number Remote IP address and port number State of the TCP connection
421
tcp anti-naptha enable

Description
Use tcp anti-naptha enable to enable the protection against Naptha attack. Use undo tcp anti-naptha enable to disable the protection against Naptha attack. By default, the protection against Naptha attack is disabled. The configurations made by using the tcp state and tcp timer check-state commands will be removed after the protection against Naptha attack is disabled.
Syntax
tcp anti-naptha enable undo tcp anti-naptha enable
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable the protection against Naptha attack.
<Sysname> system-view [Sysname] tcp anti-naptha enable
tcp state
Description
Use tcp state to configure the maximum number of TCP connections in a state. When this number is exceeded, the aging of TCP connections in this state will be accelerated. Use undo tcp state to restore the default. By default, the maximum number of TCP connections in each state is 5. Note the following points: You need to enable the protection against Naptha attack before executing this command. Otherwise, an error will be prompted. You can respectively configure the maximum number of TCP connections in each state. If the maximum number of TCP connections in a state is 0, the aging of TCP connections in this state will not be accelerated.
Related commands: tcp anti-naptha enable.
Syntax
tcp state { closing | established | fin-wait-1 | fin-wait-2 | last-ack | syn-received } connection-number number
422
undo tcp state { closing | established | fin-wait-1 | fin-wait-2 | last-ack | syn-received } connectionnumber
View
System view
Default level
2: System level
Parameters
closing: CLOSING state of a TCP connection. established: ESTABLISHED state of a TCP connection. fin-wait-1: FIN_WAIT_1 state of a TCP connection. fin-wait-2: FIN_WAIT_2 state of a TCP connection. last-ack: LAST_ACK state of a TCP connection. syn-received: SYN_RECEIVED state of a TCP connection. connection-number number: Maximum number of TCP connections in a certain state. The argument number is in the range of 0 to 500.
Examples
# Set the maximum number of TCP connections in ESTABLISHED state to 100.
<Sysname> system-view [Sysname] tcp anti-naptha enable [Sysname] tcp state established connection-number 100
tcp syn-cookie enable

Description
Use tcp syn-cookie enable to enable the SYN Cookie feature to protect the device against SYN Flood attacks. Use undo tcp syn-cookie enable to disable the SYN Cookie feature. By default, the SYN Cookie feature is enabled.
Syntax
tcp syn-cookie enable undo tcp syn-cookie enable
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable the SYN Cookie feature.
423
<Sysname> system-view [Sysname] tcp syn-cookie enable
tcp timer check-state

Description
Use tcp timer check-state to configure the TCP connection state check interval. Use undo tcp timer check-state to restore the default. By default, the TCP connection state check interval is 30 seconds. The device periodically checks the number of TCP connections in each state. If it detects that the number of TCP connections in a state exceeds the maximum number, it will accelerate the aging of TCP connections in such a state. You need to enable the protection against Naptha attack before executing this command. Otherwise, an error will be prompted. Related commands: tcp anti-naptha enable.
Syntax
tcp timer check-state time-value undo tcp timer check-state
View
System view
Default level
2: System level
Parameters
time-value: TCP connection state check interval in seconds, in the range of 1 to 60.
Example
# Set the TCP connection state check interval to 40 seconds.
<Sysname> system-view [Sysname] tcp anti-naptha enable [Sysname] tcp timer check-state 40
424
Connection limit configuration commands

connection-limit default action
Description
Use connection-limit default action to specify the default connection limit action, that is, to specify whether to limit connections that do not match the connection limit rule in the policy. Use undo connection-limit default action to restore the default. By default, the device does not limit connections that do not match the connection limit rules in the policy.
Syntax
connection-limit default action { deny | permit } undo connection-limit default action [ permit ]
View
Connection limit policy view
Default level
2: System level
Parameters
deny: Does not limit connections that do not match the connection limit rules in the policy. permit: Uses the default connection limit settings to limit connections that do not match the connection limit rules in the policy.
Examples
# Configure the default connection limit action as permit.
<Sysname> system-view [Sysname] connection-limit policy 1 [Sysname-connection-limit-policy-1] connection-limit default action permit
connection-limit default amount

Description
Use connection-limit default amount to set the default connection limit parameters. Use undo connection-limit default amount to restore the defaults. By default, the upper limit is 50, and the lower limit is 20.
Syntax
connection-limit default amount upper-limit max-amount lower-limit min-amount undo connection-limit default amount [ upper-limit max-amount lower-limit min-amount ]
425
View
Default level
2: System level
Parameters
upper-limit max-amount: Specifies the upper connection limit. The value is in the range of 1 to 4294967295. lower-limit min-amount: Specifies the lower connection limit. The value is n the range of 0 to 4294967294. min-amount must be less than max-amount.
Examples
# Set the default upper connection limit to 200 and the lower connection limit to 50.
<Sysname> system-view [Sysname] connection-limit policy 1 [Sysname-connection-limit-policy-1] lower-limit 50 connection-limit default amount upper-limit 200
connection-limit policy
Description
Use connection-limit policy to create a connection limit policy and enter connection limit policy view. Use undo connection-limit policy to delete the specified or all connection limit policies. A connection limit policy contains a set of rules for limiting the number of connections of a specific user. By default, a connection limit policy uses the default connection limit settings. A policy number uniquely identifies a connection limit policy. Policies are matched by number in descending order. After applying a connection limit policy to a NAT module, you cannot modify the connection limit rules in the policy, but can add and remove connection limit rules.
Syntax
connection-limit policy policy-number undo connection-limit policy { policy-number | all }
View
System view
Default level
2: System level
Parameters
policy-number: Specifies the number of a connection limit policy. The value is in the range of 0 to 19. all: Specifies all connection limit policies.
426
Examples
# Create a connection limit policy numbered 1 and enter its view.
<Sysname> system-view [Sysname] connection-limit policy 1 [Sysname-connection-limit-policy-1]
display connection-limit policy

Description
Use display connection-limit policy to display information about a specific or all connection limit policies. Related commands: limit acl.
Syntax
display connection-limit policy { policy-number | all } [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
policy-number: Connection limit policy number. The value is in the range of 0 to 19. all: Displays all connection limit policies. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display information about all connection limit policies.
<Sysname> display connection-limit policy all There is 1 policy: Connection-limit policy 1, refcount 0 ,3 limits limit 1 acl 2000 per-source amount 1111 10 limit 2 acl 2001 per-destination amount 300 20 limit 3 acl 2002 per-service amount 400 50

<Sysname> display connection-limit policy all There are 2 policies: Connection-limit policy 0, refcount 1, 2 limits
427
limit 0 source any amount dns 100 http 200 tcp 300 other 400 rate 100 shared limit 1 source 1.1.1.0 24 amount tcp 100 bandwidth 200 shared Connection-limit policy 1, refcount 0, 1 limit limit 4500 source 2.2.0.0 16 amount dns 200

<Sysname> display connection-limit policy all There are 1 policies: Connection-limit policy 0, refcount 0, 1 limit limit 0 source ip 3.3.3.0 24 source-vpn vpn1 destination ip any protocol tcp maxconnections 200 per-source

Connection-limit policy refcount 1, 2 limits limit xxx
Description
Number of the connection limit policy Number of times that the policy is applied and number of rules in the policy. Rule in the policy. For more information, see the limit acl command.
display connection-limit statistics

Description
Use display connection-limit statistics to display connection limit statistics.
Syntax
display connection-limit statistics [ source src-address { mask-length | mask } ] [ destination dst-address { mask-length | mask } ] [ destination-port { eq | gt | lt | neq | range } port-number ] [ vpn-instance vpninstance-name ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
source src-address: Specifies the source IP address of the connections. destination dst-address: Specifies the destination IP address of the connections. mask-length: Mask length, in the range of 1 to 32. mask: Network mask. destination-port: Specifies destination ports of connections. { eq | gt | lt | neq | range }: Specifies the Specifies an operator for matching destination ports. eq: Equal to the specified port number.
428
gt: Greater than the specified port number. lt: Less than the specified port number. neq: Not equal to the specified port number. range: Specifies a port range.
port-number: Port number, in the range of 0 to 65535. When the range keyword is specified, set a port range in the format start-port end-port, where the start-port must be less than or equal to the end-port. vpn-instance vpn-instance-name: Specifies the MPLS L3VPN to which the connections belong, where the vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the connections are in the public network, do not specify this option. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display connection limit statistics.
<Sysname> display connection-limit statistics source-ip 192.168.0.210 NAT amount 2 dest-ip --upper-limit 200 dest-port --lower-limit 100 vpn-instance --limit-flag 0
--------------------------------------------------------------------------

source-ip dest-ip dest-port vpn-instance NAT amount upper-limit lower-limit limit-flag
Description
Source IP address. "---" means no such information is available. Destination IP address. "---" means no such information is available. Destination port number. "---" means no such information is available. MPLS L3VPN instance. "---" means that the connection belongs to the public network. The NAT module to which the connection limit policy applies. Number of connections established Upper limit on the number of connections Lower limit on the number of connections Whether new connections are allowed, 0 means yes, 1 means no.
429
display nat connection-limit

Description
Use display nat connection-limit to display NAT connection limit statistics.
Syntax
display nat connection-limit [ source src-address { mask-length | mask } ] [ destination dst-address { masklength | mask } ] [ destination-port { eq | gt | lt | neq | range } port-number ] [ vpn-instance vpninstance-name ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
source src-address: Specifies the source IP address of the connections. destination dst-address: Specifies the destination IP address of the connections. mask-length: The length of network mask, in the range of 1 to 32. mask: Network mask. destination-port: Specifies destination ports of connections. { eq | gt | lt | neq | range }: Specifies an operator for matching destination ports. eq: Equal to the specified port number. gt: Greater than the specified port number. lt: Less than the specified port number. neq: Not equal to the specified port number. range: Specifies a port range.
port-number: Port number, in the range of 0 to 65,535. When the range keyword is specified, set a port range in the format start-port end-port, where the start-port must be less than or equal to the end-port. vpn-instance vpn-instance-name: Specifies the MPLS L3VPN to which the connections belong, where the vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the connections are in the public network, do not specify this option. |: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
430
Examples
# Display NAT connection limit statistics.
<Sysname> display nat connection-limit source-ip 192.168.0.210 NAT amount 2 dest-ip --upper-limit 50 dest-port --lower-limit 20 vpn-instance --limit-flag 0
--------------------------------------------------------------------------

source-ip dest-ip dest-port vpn-instance NAT amount upper-limit lower-limit limit-flag
Description
Source IP address of the connection. "---" means that no such information is not available. Destination IP address of the connection. "---" means that no such information is not available. Destination port of the connection. "---" means that no such information is not available. MPLS L3VPN that the connection belongs to. "---" means that the connection belongs to a public network. Indicates that the connection is created through NAT. Number of active connections Upper limit on the number of connections Lower limit on the number of connections Whether new connections are allowed to establish: 0 means yes, 1 means no.
limit acl
Description
Use limit acl to configure an ACL-based connection limit rule. Use undo limit to remove a connection limit rule. If you do not specify any optional parameters, the device uses the default connection limit settings (upper and lower limits) to limit connections by source IP address. For more information about default connection limit parameters, see the connection-limit default amount command. If multiple keywords among per-destination, per-service, and per-source are specified, the specified keywords take effect in combination. For example, with both per-destination and per-service limit types specified, the limit rule collects statistics on and limits the connections of the same service that are destined to the same destination IP address. Related commands: connection-limit policy, display connection-limit policy, and display nat connectionlimit.
431
Syntax
limit limit-id acl acl-number [ { per-destination | per-service | per-source } * amount max-amount minamount ] undo limit limit-id [ acl acl-number [ { per-destination | per-service | per-source } * amount max-amount min-amount ] ]
View
Default level
2: System level
Parameters
limit-id: ID of a rule in the connection limit policy. The value range depends on the device model. acl-number: Number of an ACL, in the range of 2000 to 3999. Connections matching this ACL are to be limited. per-destination: Limits connections by destination IP address. per-service: Limits connections by service type or application. per-source: Limits connections by source IP address. amount: Limits the number of connections. max-amount: Upper connection limit. The value range depends on the device model. min-amount: Lower connection limit, which must be smaller than the upper limit. The value range depends on the device model.
Examples
# Configure a rule for connection limit policy 1 to limit connections initiated from 192.168.0.0/24 by destination IP address, setting the upper and lower connection limits to 200 and 100 respectively.
<Sysname> system-view [Sysname] acl number 2001 [Sysname-acl-basic-2001] rule permit source 192.168.0.0 0.0.0.255 [Sysname-acl-basic-2001] quit [Sysname] connection-limit policy 1 [Sysname-connection-limit-policy-1] limit 1 acl 2001 per-destination amount 200 100
nat connection-limit-policy
Description
Use nat connection-limit-policy to apply a connection limit policy to the NAT module. Use undo nat connection-limit-policy to remove the application. To modify a connection limit rule in the policy that is already applied to the NAT module, use the undo nat connection-limit policy to remove the application first.
432
Syntax
nat connection-limit-policy policy-number undo nat connection-limit-policy policy-number
View
System view
Default level
2: System level
Parameters
policy-number: Number of an existing connection limit policy. The value is in the range of 0 to 19.
Examples
# Apply connection limit policy 1 to the NAT module.
<Sysname> system-view [Sysname] nat connection-limit-policy 1
# Remove the application of connection limit policy 1 from the NAT module.
<Sysname> system-view [Sysname] undo nat connection-limit-policy 1
433
Password control configuration commands

display password-control
Description
Use display password-control to display password control configuration information.
Syntax
display password-control [ super ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
2: System level
Parameters
super: Displays the password control information of the super passwords. Without this keyword, the command displays the password control information for all passwords. |: Filters command output by specifying a regular expression. For more information about regular expressions, see the Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display the global password control configuration information.
<Sysname> display password-control Global password control configurations: Password control: Password aging: Password length: Password composition: Password history: User authentication timeout: Maximum failed login attempts: Login attempt-failed action: Minimum password update time: User account idle-time: Login with aged password: Password complexity: Disabled Enabled (90 days) Enabled (10 characters) Enabled (1 types, 1 characters per type) Enabled (max history records:4) 60 seconds 3 times Lock for 1 minutes 24 hours 90 days 3 times in 30 days Disabled (username checking) Disabled (repeated characters checking)
Early notice on password expiration: 7 days
434
# Display the password control configuration information for super passwords.

<Sysname> display password-control super Super password control configurations: Password aging: Password length: Password composition: Enabled (90 days) Enabled (10 characters) Enabled (1 types, 1 characters per type)

Password control Password aging Password length Password composition Password history Early notice on password expiration User authentication timeout Maximum failed login attempts Login attempt-failed action Minimum password update time User account idle-time Login with aged password
Description
Whether the password control feature is enabled Whether password aging is enabled and, if enabled, the aging time Whether the minimum password length restriction function is enabled and, if enabled, the setting Whether the password composition restriction function is enabled and, if enabled, the settings Whether the password history function is enabled and, if enabled, the setting Number of days during which the user is warned of the pending password expiration Password authentication timeout time Allowed maximum number of consecutive failed login attempts for FTP and VTY users Action to be taken after a user fails to login for the specified number of attempts Minimum password update interval Maximum account idle time Number of times and maximum number of days a user can log in using an expired password Whether to check the password complexity, including:
Checking whether a password contains the

Password complexity username or the reverse of the username.
Checking whether a password contains any

character that is repeated consecutively three or more times
display password-control blacklist

Description
Use display password-control blacklist to display information about users blacklisted due to authentication failure. With no arguments provided, this command displays information about all users in the blacklist.
435
Syntax
display password-control blacklist [ user-name name | ip ipv4-address | ipv6 ipv6-address ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
2: System level
Parameters
user-name name: Specifies a user by the name, a string of 1 to 80 characters. ipv4-address: IPv4 address of a user. ipv6-address: IPv6 address of a user. |: Filters command output by specifying a regular expression. For more information about regular expressions, see the Fundamentals Configuration Guide. begin: Displays the first line that matches the specified regular expression and all lines that follow. exclude: Displays all lines that do not match the specified regular expression. include: Displays all lines that match the specified regular expression. regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Examples
# Display information about users blacklisted due to authentication failure.
<Sysname> display password-control blacklist Username: test IP: 192.168.44.1 Login failed times: 1 Lock flag: unlock
Total 1 blacklist item(s) matched. 1 listed.

Username IP Login failed times
Description
Username of the user IP address of the user Number of login failures Whether the user is prohibited from logging in:
Lock flag
unlockNot prohibited lockProhibited temporarily or permanently, depending on the

password-control login-attempt command
password
Description
Use password to set a password for a local user in interactive mode. Use undo password to remove the password for a local user.
436
Valid characters for a local user password include uppercase letters A to Z, lowercase letters a to z, numbers 0 to 9, blank space, and these 31 symbols: ~`!@#$%^&*()_+-={}|[]\:;<>,./. A local user password configured in interactive mode must satisfy the password control requirement. For example, if the minimum password length is set to 8, the password must contain at least eight characters.
Syntax
Password undo password
View
Local user view
Default level
2: System level
Parameters
None
Examples
# Set a password for local user test in interactive mode.
<Sysname> system-view [Sysname] local-user test [Sysname-luser-test] password Password:********** Confirm :********** Updating user(s) information, please wait....
password-control { aging | composition | history | length } enable

Description
Use password-control { aging | composition | history | length } enable to enable the password aging, composition restriction, history, or minimum password length restriction function. Use undo password-control { aging | composition | history | length } enable to disable the specified function. By default, the four password control functions are all enabled. NOTE:
For these four functions to take effect, the password control feature must be enabled globally. You must enable a function for its relevant configurations to take effect. For example, if the minimum password length restriction function is not enabled, the setting by the password-control length command does not take effect. The system stops recording history passwords after you execute the undo password-control history enable command, but the prior records still exist.
Related commands: password-control enable and display password-control.
437
Syntax
password-control { aging | composition | history | length } enable undo password-control { aging | composition | history | length } enable
View
System view
Default level
2: System level
Parameters
aging: Enables the password aging function. composition: Enables the password composition restriction function. history: Enables the password history function. length: Enables the minimum password length restriction function.
Examples
# Enable the password control feature globally.
<Sysname> system-view [Sysname] password-control enable
# Enable the password composition restriction function.

[Sysname] password-control composition enable
# Enable the password aging function.

[Sysname] password-control aging enable
# Enable the minimum password length restriction function.

[Sysname] password-control length enable
# Enable the password history function.

[Sysname] password-control history enable
password-control aging
Description
Use password-control aging to set the password aging time. Use undo password-control aging to restore the default. By default, the global password aging time is 90 days, the password aging time of a user group equals the global setting, and the password aging time of a local user equals that of the user group to which the local user belongs. The setting in system view has global significance and applies to all user groups, the setting in user group view applies to all local users in the user group, and the setting in local user view applies to only the local user. A password aging time setting with a smaller application range has a higher priority. That is, the system prefers the setting for a local user. If there is no setting for the local user, the system will use the setting for the user group. If there is no setting for the user group, the system will use the global setting. Related commands: display password-control, local-user, and user-group.
438
Syntax
password-control aging aging-time undo password-control aging
View
System view, user group view, local user view
Default level
2: System level
Parameters
aging-time: Password aging time in days, in the range of 1 to 365.
Examples
# Set the global password aging time to 80 days.
<Sysname> system-view [Sysname] password-control aging 80
# Set the password aging time for user group test to 90 days.
[Sysname] user-group test [Sysname-ugroup-test] password-control aging 90 [Sysname-ugroup-test] quit
# Set the password aging time for local user abc to 100 days.
[Sysname] local-user abc [Sysname-luser-abc] password-control aging 100
password-control alert-before-expire
Description
Use password-control alert-before-expire to set the number of days before a users password expires during which the user is warned of the pending password expiration. Use undo password-control alert-before-expire to restore the default. By default, a user is warned of pending password expiration 7 days before the users password expires.
Syntax
password-control alert-before-expire alert-time undo password-control alert-before-expire
View
System view
Default level
2: System level
Parameters
alert-time: Number of days before a users password expires during which the user is warned of the pending password expiration, in the range of 1 to 30.
439
Examples
# Configure the device to warn a user about pending password expiration 10 days before the users password expires.
<Sysname> system-view [Sysname] password-control alert-before-expire 10
password-control authentication-timeout
Description
Use password-control authentication-timeout to set the user authentication timeout time. Use undo password-control authentication-timeout to restore the default. By default, the user authentication timeout time is 60 seconds.
Syntax
password-control authentication-timeout authentication-timeout undo password-control authentication-timeout
View
System view
Default level
2: System level
Parameters
authentication-timeout: User authentication timeout time in seconds, in the range of 30 to 120.
Examples
# Set the user authentication timeout time to 40 seconds.
<Sysname> system-view [Sysname] password-control authentication-timeout 40
password-control complexity
Description
Use password-control complexity to configure the password complexity checking policy. Unqualified passwords will be refused. Use undo password-control complexity check to remove a password complexity checking item. By default, no user password complexity checking is performed, and a password can contain the username, the reverse of the username, or a character repeated three or more times consecutively. Related commands: display password-control.
Syntax
password-control complexity { same-character | user-name } check undo password-control complexity { same-character | user-name } check
View
System view
440
Default level
2: System level
Parameters
same-character: Refuses a password that contains any character repeated consecutively three or more times. user-name: Refuses a password that contains the username or the reverse of the username.
Examples
# Configure the password complexity checking policy, refusing any password that contains the username or the reverse of the username.
<Sysname> system-view [Sysname] password-control complexity user-name check
password-control composition
Description
Use password-control composition to configure the password composition policy. Use undo password-control composition to restore the default. By default, the global password composition policy is as follows: the minimum number of password composition types is 1 and the minimum number of characters of a password composition type is also 1. The default password composition policy of a user group is the same as the global policy, and the default password composition policy of a local user is the same as that of the user group to which the local user belongs. The settings in system view have global significance and apply to all user groups, the settings in user group view apply to all local users in the user group, and the settings in local user view apply to only the local user. A password composition policy with a smaller application range has a higher priority. That is, the system prefers the settings for a local user. If there is no setting for the local user, the system will use the settings for the user group. If there is no setting for the user group, the system will use the global settings. Related commands: display password-control, local-user, and user-group.
Syntax
password-control composition type-number type-number [ type-length type-length ] undo password-control composition
View
Default level
2: System level
Parameters
type-number type-number: Specifies the minimum number of password composition types, in the range of 1 to 4. type-length type-length: Specifies the minimum number of characters of each password composition type, in the range of 1 to 63.
441
Examples
# Set the minimum number of password composition types to 3 and the minimum number of characters of each password composition type to 5 for all passwords.
<Sysname> system-view [Sysname] password-control composition type-number 3 type-length 5
# Set the minimum number of password composition types to 3 and the minimum number of characters of each password composition type to 5 for user group test.
[Sysname] user-group test [Sysname-ugroup-test] password-control composition type-number 3 type-length 5 [Sysname-ugroup-test] quit
# Set the minimum number of password composition types to 3 and the minimum number of characters of each password composition type to 5 for local user abc.
[Sysname] local-user abc [Sysname-luser-abc] password-control composition type-number 3 type-length 5
password-control enable
Description
Use password-control enable to enable the password control feature globally. Use undo password-control enable to disable the password control feature globally. By default, the password control feature is disabled globally. Only after the password control feature is enabled globally, do the password control functions take effect. Related commands: display password-control.
Syntax
password-control enable undo password-control enable
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable the password control feature globally.
<Sysname> system-view [Sysname] password-control enable
password-control expired-user-login
Description
Use password-control expired-user-login to set the maximum number of days and maximum number of times that a user can log in after the password expires.
442
Use undo password-control expired-user-login to restore the defaults. By default, a user can log in three times within 30 days after the password expires. Related commands: display password-control.
Syntax
password-control expired-user-login delay delay times times undo password-control expired-user-login
View
System view
Default level
2: System level
Parameters
delay: Maximum number of days during which a user can log in using an expired password. It must be in the range of 1 to 90. times: Maximum number of times a user can log in after the password expires, in the range of 0 to 10. 0 means that a user cannot log in after the password expires.
Examples
# Specify that a user can log in five times within 60 days after the password expires.
<Sysname> system-view [Sysname] password-control expired-user-login delay 60 times 5
password-control history
Description
Use password-control history to set the maximum number of history password records for each user. Use undo password-control history to restore the default. By default, the maximum number of history password records for each user is 4.
Syntax
password-control history max-record-num undo password-control history
View
System view
Default level
2: System level
Parameters
max-record-num: Maximum number of history password records for each user, in the range of 2 to 15.
Examples
# Set the maximum number of history password records for each user to 10.
<Sysname> system-view [Sysname] password-control history 10
443
password-control length
Description
Use password-control length to set the minimum password length. Use undo password-control length to restore the default. By default, the global minimum password length is 10 characters, the minimum password length of a user group equals the global setting, and the minimum password length of a local user equals that of the user group to which the local user belongs. The setting in system view has global significance and applies to all user groups, the setting in user group view applies to all local users in the user group, and the setting in local user view applies to only the local user. A minimum password length setting with a smaller application range has a higher priority. That is, the system prefers the setting for a local user. If there is no setting for the local user, the system will use the setting for the user group. If there is no setting for the user group, the system will use the global setting. Related commands: display password-control, local-user, and user-group.
Syntax
password-control length length undo password-control length
View
Default level
2: System level
Parameters
length: Minimum password length in characters, in the range of 4 to 32.
Examples
# Set the global minimum password length to 9 characters.
<Sysname> system-view [Sysname] password-control length 9
# Set the minimum password length to 9 characters for user group test.
[Sysname] user-group test [Sysname-ugroup-test] password-control length 9 [Sysname-ugroup-test] quit
# Set the minimum password length to 9 characters for local user abc.
[Sysname] local-user abc [Sysname-luser-abc] password-control length 9
password-control login idle-time

Description
Use password-control login idle-time to set the maximum account idle time. If a user account is idle for this period of time, it becomes invalid.
444
Use undo password-control login idle-time to restore the default. By default, the maximum account idle time is 90 days. Related commands: display password-control.
Syntax
password-control login idle-time idle-time undo password-control login idle-time
View
System view
Default level
2: System level
Parameters
idle-time: Maximum account idle time, in the range of 0 to 365, in days. 0 means no restriction for account idle time.
Examples
# Set the maximum account idle time to 30 days.
<Sysname> system-view [Sysname] password-control login idle-time 30
password-control login-attempt
Description
Use password-control login-attempt to specify the maximum number of consecutive failed login attempts and the action to be taken when a user fails to log in after the specified number of attempts. Use undo password-control to restore the default. By default, the maximum number of consecutive failed login attempts is three and a user failing to log in after the specified number of attempts must wait for one minute before trying again. If prohibited permanently, a user can log in only after you remove the user from the blacklist. If prohibited temporarily, a user can log in again after the lock time elapses or an administrator removes the user from the blacklist. If not prohibited to log in, a user is removed from the blacklist as long as the user logs in successfully or after the blacklist aging time (one minute) elapses. Related commands: display password-control, display password-control blacklist, and reset passwordcontrol blacklist.
Syntax
password-control login-attempt login-times [ exceed { lock | lock-time time | unlock } ] undo password-control login-attempt
View
System view
445
Default level
2: System level
Parameters
login-times: Maximum number of consecutive failed login attempts, in the range of 2 to 10. exceed: Specifies the action to be taken when a user fails to log in after the specified number of attempts. lock: Permanently prohibits a user who fails to log in after the specified number of attempts from logging in. lock-time time: Forces a user who fails to log in after the specified number of attempts to wait for a period of time before trying again. The time argument is in minutes and in the range of 1 to 360. unlock: Allows a user who fails to log in after the specified number of attempts to continue trying to log in.
Examples
# Set the maximum number of login attempts to four and permanently prohibit a user failing to log in after four attempts from logging in.
<Sysname> system-view [Sysname] password-control login-attempt 4 exceed lock
Later, if a user tries to log in but fails four times, you can find it in the blacklist, with its status changed from unlock to lock:
[Sysname] display password-control blacklist Username: test IP: 192.168.44.1 Login failed times: 4 Lock flag: lock
The user can no longer log in. # Set the maximum number of login attempts to two and prohibit a user failing to log in after two attempts from logging in within three minutes.
<Sysname> system-view [Sysname] password-control login-attempt 2 exceed lock-time 3
Later, if a user tries to log in but fails two times, you can find it in the blacklist, with its status changed from unlock to lock:
[Sysname] display password-control blacklist Username: test IP: 192.168.44.1 Login failed times: 2 Lock flag: lock
After three minutes, the user is removed from the blacklist and can log in again.
password-control password update interval

Description
Use password-control password update interval to set the minimum password update interval, that is, the minimum interval at which users can change their passwords. Use undo password-control password update interval to restore the default.
446
By default, the minimum password update interval is 24 hours. This function is not effective in the case that a user is prompted to change the password when the user logs in for the first time or after the password is aged out. Related commands: display password-control.
Syntax
password-control password update interval interval undo password-control password update interval
View
System view
Default level
2: System level
Parameters
interval: Minimum password update interval, in the range of 0 to 168, in hours. 0 means no requirements for password update interval.
Examples
# Set the minimum password update interval to 36 hours.
<Sysname> system-view [Sysname] password-control password update interval 36
password-control super aging

Description
Use password-control super aging to set the aging time for super passwords. Use undo password-control super aging to restore the default. By default, the aging time for super passwords is 90 days. The setting for super passwords, if present, overrides that for all passwords. Related commands: password-control aging.
Syntax
password-control super aging aging-time undo password-control super aging
View
System view
Default level
2: System level
Parameters
aging-time: Super password aging time in days, in the range of 1 to 365.
Examples
# Set the aging time for super passwords to 10 days.
447
<Sysname> system-view [Sysname] password-control super aging 10
password-control super composition

Description
Use password-control super composition to configure the composition policy for super passwords. Use undo password-control super composition to restore the default. By default, both the minimum number of composition types and the minimum number of characters of composition type are 1 for super passwords. The settings for super passwords, if present, override those configured for all passwords. Related commands: password-control composition.
Syntax
password-control super composition type-number type-number [ type-length type-length ] undo password-control super composition
View
System view
Default level
2: System level
Parameters
type-number type-number: Specifies the minimum number of composition types for super passwords, in the range of 1 to 4. type-length type-length: Specifies the minimum number of characters of each composition type for super passwords, in the range of 1 to 16.
Examples
# Set the minimum number of composition types to 3 and the minimum number of characters of each composition type to 5 for super passwords.
<Sysname> system-view [Sysname] password-control super composition type-number 3 type-length 5
password-control super length

Description
Use password-control super length to set the minimum length for super passwords. Use undo password-control super length to restore the default. By default, the minimum super password length is 10 characters. The setting for super passwords, if present, overrides that for all passwords. Related commands: password-control length.
Syntax
password-control super length length
448
undo password-control super length
View
System view
Default level
2: System level
Parameters
length: Minimum length for super passwords in characters, in the range of 4 to 16.
Examples
# Set the minimum length for super passwords to 10 characters.
<Sysname> system-view [Sysname] password-control super length 10
reset password-control blacklist

Description
Use reset password-control blacklist to remove all or one user from the blacklist. Related commands: display password-control blacklist.
Syntax
reset password-control blacklist [ user-name name ]
View
User view
Default level
3: Manage level
Parameters
user-name name: Specifies the username of the user to be removed from the blacklist. name is a casesensitive string of 1 to 80 characters.
Examples
# Delete the user named test from the blacklist.
<Sysname> reset password-control blacklist user-name test Are you sure to delete the specified user in blacklist? [Y/N]:
reset password-control history-record

Description
Use reset password-control history-record to delete history password records. NOTE:
With no arguments or keywords specified, this command deletes the history password records of all local users. With the super keyword specified but the level argument not specified, this command deletes the history records of all super passwords.
449
Syntax
reset password-control history-record [ user-name name | super [ level level ] ]
View
User view
Default level
3: Manage level
Parameters
user-name name: Specifies the username of the user whose password records are to be deleted. name is a case-sensitive string of 1 to 80 characters. super: Deletes the history records of the super password specified by the level level option or the history records of all super passwords. level level: Specifies a user level, in the range of 1 to 3.
Examples
# Clear the history password records of all local users (enter Y to confirm).
<Sysname> reset password-control history-record Are you sure to delete all local user's history records? [Y/N]:
450
HABP configuration commands

display habp
Description
Use display habp to display HABP configuration information. If the HABP function is not enabled on the device, this command does not display the HABP configuration but only the running status of the HABP function.
Syntax
display habp [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
Examples
# Display HABP configuration information.
<Sysname> display habp Global HABP information: HABP Mode: Server Sending HABP request packets every 20 seconds Bypass VLAN: 2

HABP Mode Sending HABP request packets every 20 seconds Bypass VLAN
Description
HABP mode of the current device, server or client The HABP server sends HABP request packets at an interval of 20 seconds. ID of the VLAN in which HABP packets are transmitted
451
display habp table

Description
Use display habp table to display HABP MAC address table entries. This command is only applicable on an HABP server to display the MAC address entries collected by the HABP server.
Syntax
display habp table [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
Examples
# On the HABP server, display HABP MAC address table entries.
<Sysname> display habp table MAC 001f-3c00-0030 Holdtime 53 Receive Port Ethernet1/1

MAC
Description
MAC address Lifetime of an entry in seconds. The initial value is three times the interval to send HABP request packets. An entry will age out if it is not updated during the period. Port that learned the MAC address
Holdtime
Receive Port
display habp traffic

Description
Use display habp traffic to display HABP packet statistics.
Syntax
display habp traffic [ | { begin | exclude | include } regular-expression ]
452
View
Any view
Default level
1: Monitor level
Parameters
Examples
# Display HABP packet statistics.
<Sysname> display habp traffic HABP counters : Packets output: 48, Input: 36 ID error: 0, Type error: 0, Version error: 0 Sent failed: 0

Packets output Input ID error Type error Version error Sent failed
Description
Number of HABP packets sent Number of HABP packets received Number of packets with an incorrect ID Number of packets with an incorrect type Number of packets with an incorrect version number Number of packets that failed to be sent
habp client vlan

Description
Use habp client vlan to specify the VLAN to which the HABP client belongs. HABP packets are to be transmitted in this VLAN. Use undo habp client to restore the default. By default, an HABP client belongs to VLAN 1.
Syntax
habp client vlan vlan-id undo habp client
453
View
System view
Default level
2: System level
Parameters
vlan-id: ID of the VLAN in which HABP packets are to be transmitted, in the range of from 1 to 4094.
Examples
# Specify the HABP client to belong to VLAN 2.
<Sysname> system-view [Sysname] habp client vlan 2
habp enable
Description
Use habp enable to enable HABP. Use undo habp enable to disable HABP. By default, HABP is enabled.
Syntax
habp enable undo habp enable
View
System view
Default level
2: System level
Parameters
None
Examples
# Enable HABP.
<Sysname> system-view [Sysname] habp enable
habp server vlan

Description
Use habp server vlan to configure HABP to work in server mode and specify the VLAN in which HABP packets are to be transmitted. Use undo habp server to configure HABP to work in the default mode. By default, HABP works in client mode. In a cluster, if a member device with 802.1X authentication or MAC authentication enabled is attached with some other member devices of the cluster, you also need to configure HABP server on this device.
454
Otherwise, the cluster management device will not be able to manage the devices attached to this member device. For information about the cluster function, see the Network Management and Monitoring Configuration Guide.
Syntax
habp server vlan vlan-id undo habp server
View
System view
Default level
2: System level
Parameters
vlan-id: ID of the VLAN in which HABP packets are to be transmitted, in the range of 1 to 4094.
Examples
# Configure HABP to work in server mode and specify the VLAN for HABP packets as VLAN 2.
<Sysname> system-view [Sysname] habp server vlan 2
habp timer
Description
Use habp timer to set the interval at which the switch sends HABP request packets. Use undo habp timer to restore the default. The default interval is 20 seconds. This command is required only on the HABP server.
Syntax
habp timer interval undo habp timer
View
System view
Default level
2: System level
Parameters
interval: Interval (in seconds) at which the switch sends HABP request packets, in the range of 5 to 600.
Examples
# Set the interval at which the switch sends HABP request packets to 50 seconds.
<Sysname> system-view [Sysname] habp timer 50
455
URPF configuration commands

ip urpf
Description
Use ip urpf to enable URPF check on the interface. Use undo ip urpf to disable URPF check. By default, URPF check is disabled. Configuring URPF in interface view takes effect on the interface only. You can use the display ip interface to view statistics of packets discarded by URPF.
Syntax
ip urpf { loose | strict } [ allow-default-route ] [ acl acl-number ] undo ip urpf
View
Interface view
Default level
2: System level
Parameters
loose: Specifies the loose URPF check. strict: Specifies the strict URPF check. allow-default-route: Allows use of the default route for URPF check. acl acl-number: ACL number, in the range of 2000 to 3999. For a basic ACL, the value ranges from 2000 to 2999. For an advanced ACL, the value ranges from 3000 to 3999.
Examples
# Enable strict URPF check, allow use of the default route, and reference ACL 2999 on Ethernet 1/2.
<Sysname> system-view [Sysname] interface ethernet 1/2 [Sysname-Ethernet1/2] ip urpf strict allow-default-route acl 2999
# Enable loose URPF check on Ethernet 1/1.

<Sysname> system-view [Sysname] interface ethernet 1/1 [Sysname-Ethernet1/1] ip urpf loose
456
Support and other resources

Contacting HP
For worldwide technical support information, see the HP support website: http://www.hp.com/support Before contacting HP, collect the following information: Product model names and numbers Technical support registration number (if applicable) Product serial numbers Error messages Operating system type and revision level Detailed questions
Subscription service
HP recommends that you register your product at the Subscriber's Choice for Business website: http://www.hp.com/go/wwalerts After registering, you will receive email notification of product enhancements, new driver versions, firmware updates, and other product resources.
Related information
Documents
To find related documents, browse to the Manuals page of the HP Business Support Center website: http://www.hp.com/support/manuals For related documentation, navigate to the Networking section, and select a networking category. For a complete list of acronyms and their definitions, see HP A-Series Acronyms.
Websites
HP.com http://www.hp.com HP Networking http://www.hp.com/go/networking HP manuals http://www.hp.com/support/manuals HP download drivers and software http://www.hp.com/support/downloads HP software depot http://www.software.hp.com HP Education http://www.hp.com/learn
457
Conventions
This section describes the conventions used in this documentation set.
Command conventions
Convention
Boldface Italic [] { x | y | ... } [ x | y | ... ] { x | y | ... } * [ x | y | ... ] * &<1-n> #
Description
Bold text represents commands and keywords that you enter literally as shown. Italic text represents arguments that you replace with actual values. Square brackets enclose syntax choices (keywords or arguments) that are optional. Braces enclose a set of required syntax choices separated by vertical bars, from which you select one. Square brackets enclose a set of optional syntax choices separated by vertical bars, from which you select one or none. Asterisk-marked braces enclose a set of required syntax choices separated by vertical bars, from which you select at least one. Asterisk-marked square brackets enclose optional syntax choices separated by vertical bars, from which you select one choice, multiple choices, or none. The argument or keyword and argument combination before the ampersand (&) sign can be entered 1 to n times. A line that starts with a pound (#) sign is comments.
GUI conventions
Convention
Boldface >
Description
Window names, button names, field names, and menu items are in bold text. For example, the New User window appears; click OK. Multi-level menus are separated by angle brackets. For example, File > Create > Folder.
Symbols
Convention
WARNING CAUTION IMPORTANT NOTE TIP
Description
An alert that calls attention to important information that if not understood or followed can result in personal injury. An alert that calls attention to important information that if not understood or followed can result in data loss, data corruption, or damage to hardware or software. An alert that calls attention to essential information. An alert that contains additional or supplementary information. An alert that provides helpful information.
458
Network topology icons

Represents a generic network device, such as a router, switch, or firewall. Represents a routing-capable device, such as a router or Layer 3 switch. Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports Layer 2 forwarding and other Layer 2 features.
Port numbering in examples

The port numbers in this document are for illustration only and might be unavailable on your device.
459
Index
ABCDEFGHIKLMNOPQRSTUVW
A aaa nas-id profile,1 access-limit,33 access-limit enable,1 access-user detect,270 accounting command,2 accounting default,3 accounting dvpn,3 accounting lan-access,4 accounting login,5 accounting optional,6 accounting portal,7 accounting ppp,7 accounting ssl-vpn,8 accounting voip,9 accounting-on enable,46 aging-time,319 ah authentication-algorithm,157 ARP active acknowledgement configuration commands,380 arp anti-attack active-ack enable,380 arp anti-attack source-mac,376 arp anti-attack source-mac aging-time,377 arp anti-attack source-mac exclude-mac,377 arp anti-attack source-mac threshold,378 arp anti-attack valid-ack enable,380 ARP automatic scanning and fixed ARP configuration commands,381 ARP defense against IP packet attacks configuration commands,374 arp fixup,381 ARP packet source MAC address consistency check configuration commands,380 arp scan,382 arp source-suppression enable,374 arp source-suppression limit,374 ASPF configuration commands,319 aspf-policy,320
460
attack-defense apply policy,391 attack-defense policy,391 attribute,232 attribute 25 car,47 authentication default,10 authentication dvpn,10 authentication lan-access,1 1 authentication login,12 authentication portal,13 authentication ppp,14 authentication super,15 authentication voip,14 authentication-algorithm,206 authentication-method,206 authorization command,16 authorization default,17 authorization dvpn,18 authorization lan-access,18 authorization login,19 authorization portal,20 authorization ppp,21 authorization voip,22 authorization-attribute (local user view/user group view),34 authorization-attribute (RADIUS-server user view),97 authorization-attribute user-profile,23 B bind-attribute,35 blacklist enable,392 blacklist ip,393 bye,345 C ca identifier,233 cd,346 cdup,346 certificate domain,207 certificate request entity,233
certificate request from,234 certificate request mode,235 certificate request polling,235 certificate request url,236 ciphersuite,360 client-verify enable,361 client-verify weaken,361 close-mode wait,362 common-name,237 connection-limit default action,425 connection-limit default amount,425 connection-limit policy,426 connection-name,157 country,237 crl check,238 crl update-period,238 crl url,239 cryptoengine enable,158 cut connection,23 D data-flow-format (HWTACACS scheme view),78 data-flow-format (RADIUS scheme view),48 defense icmp-flood action drop-packet,394 defense icmp-flood enable,394 defense icmp-flood ip,395 defense icmp-flood rate-threshold,396 defense scan add-to-blacklist,397 defense scan blacklist-timeout,398 defense scan enable,398 defense scan max-rate,399 defense syn-flood action,400 defense syn-flood enable,400 defense syn-flood ip,401 defense syn-flood rate-threshold,402 defense udp-flood action drop-packet,403 defense udp-flood enable,404 defense udp-flood ip,404 defense udp-flood rate-threshold,405 delete,347 description (RADIUS-server user view),98 detect,320 dh,207 dir,348 display arp anti-attack source-mac,379
461
display arp source-suppression,375 display aspf all,321 display aspf interface,323 display aspf policy,323 display aspf session,324 display attack-defense policy,406 display attack-defense statistics interface,410 display blacklist,412 display connection,24 display connection-limit policy,427 display connection-limit statistics,428 display domain,26 display dot1x,103 display firewall ethernet-frame-filter,307 display firewall ipv6 statistics,308 display firewall-statistics,309 display flow-statistics statistics,414 display flow-statistics statistics interface,415 display habp,451 display habp table,452 display habp traffic,452 display hwtacacs,78 display ike dpd,208 display ike peer,209 display ike proposal,210 display ike sa,21 1 display ip check source,384 display ipsec policy,158 display ipsec policy-template,162 display ipsec profile,164 display ipsec proposal,166 display ipsec sa,167 display ipsec session,168 display ipsec statistics,170 display ipsec tunnel,171 display local-user,36 display mac-authentication,127 display nat connection-limit,430 display password-control,434 display password-control blacklist,435 display pki certificate,240 display pki certificate access-control-policy,241 display pki certificate attribute-group,242 display pki crl domain,243
display portal acl,270 display portal connection statistics,273 display portal free-rule,276 display portal interface,277 display portal local-server,278 display portal server,279 display portal server statistics,280 display portal tcp-cheat statistics,282 display portal user,284 display port-mapping,326 display port-security,136 display port-security mac-address block,138 display port-security mac-address security,140 display port-security preshared-key user,141 display public-key local public,257 display public-key peer,258 display radius scheme,48 display radius statistics,51 display sftp client source,348 display ssh client source,337 display ssh server,330 display ssh server-info,338 display ssh user-information,331 display ssl client-policy,363 display ssl server-policy,364 display stop-accounting-buffer (for HWTACACS),82 display stop-accounting-buffer (for RADIUS),54 display tcp status,421 display user-bind,385 display user-group,38 display user-profile,371 domain,28 domain default enable,29 dot1x,106 dot1x authentication-method,107 dot1x auth-fail vlan,108 dot1x domain-delimiter,109 dot1x free-ip,124 dot1x guest-vlan,1 10 dot1x handshake,1 1 1 dot1x handshake secure,1 12 dot1x mandatory-domain,1 13 dot1x max-user,1 14 dot1x multicast-trigger,1 15
462
dot1x port-control,1 15 dot1x port-method,1 16 dot1x quiet-period,1 17 dot1x re-authenticate,1 18 dot1x retry,1 19 dot1x supp-proxy-check,1 19 dot1x timer,121 dot1x timer ead-timeout,125 dot1x unicast-trigger,122 dot1x url,125 dpd,215 E encapsulation-mode,173 encryption-algorithm,215 esp authentication-algorithm,174 esp encryption-algorithm,175 exchange-mode,216 exit,349 expiration-date (local user view),39 expiration-date (RADIUS-server user view),99 F firewall aspf,327 firewall default,31 1 firewall enable,31 1 firewall ethernet-frame-filter,312 firewall fragments-inspect,312 firewall fragments-inspect { high | low },313 firewall ipv6 default,314 firewall ipv6 enable,314 firewall ipv6 fragments-inspect,315 firewall packet-filter,315 firewall packet-filter ipv6,316 flow-statistics enable,417 fqdn,245 G General AAA configuration commands,1 get,350 group,40 H habp client vlan,453 habp enable,454 habp server vlan,454
habp timer,455 handshake timeout,365 help,350 HWTACACS configuration commands,78 hwtacacs nas-ip,82 hwtacacs scheme,83 I idle-cut enable,29 id-type,217 ike dpd,217 ike local-name,218 ike next-payload check disabled,219 ike peer (system view),219 ike proposal,220 ike sa keepalive-timer interval,221 ike sa keepalive-timer timeout,221 ike sa nat-keepalive-timer interval,222 ike-peer (IPsec policy view, IPsec policy template view, IPsec profile view),176 interval-time,222 ip (PKI entity view),245 ip check source,387 ip pool,30 ip urpf,456 ipsec anti-replay check,176 ipsec anti-replay window,177 ipsec binding policy,177 ipsec cpu-backup enable,179 ipsec decrypt check,179 ipsec invalid-spi-recovery enable,180 ipsec policy (interface view),181 ipsec policy (system view),181 ipsec policy isakmp template,182 ipsec policy local-address,183 ipsec policy-template,184 ipsec profile (system view),184 ipsec profile (tunnel interface view),185 ipsec proposal,186 ipsec sa global-duration,186 ipsec session idle-time,187 K key (HWTACACS scheme view),84 key (RADIUS scheme view),55
463
L ldap-server,246 limit acl,431 local,223 Local user configuration commands,33 local-address,224 locality,246 local-name,224 local-user,41 local-user password-display-mode,42 log enable,328 ls,351 M mac-authentication,129 mac-authentication domain,130 mac-authentication max-user,131 mac-authentication timer,132 mac-authentication user-name-format,132 mkdir,351 N nas-id bind vlan,31 nas-ip (HWTACACS scheme view),85 nas-ip (RADIUS scheme view),56 nat connection-limit-policy,432 nat traversal,225 O organization,247 organization-unit,248 P Packet-filter firewall configuration commands,307 password,42 password,436 password (RADIUS-server user view),99 password-control { aging | composition | history | length } enable,437 password-control aging,438 password-control alert-before-expire,439 password-control authentication-timeout,440 password-control complexity,440 password-control composition,441 password-control enable,442 password-control expired-user-login,442
password-control history,443 password-control length,444 password-control login idle-time,444 password-control login-attempt,445 password-control password update interval,446 password-control super aging,447 password-control super composition,448 password-control super length,448 peer,226 peer-public-key end,260 pfs,188 pki certificate access-control-policy,248 pki certificate attribute-group,249 pki delete-certificate,249 pki domain,250 pki entity,250 pki import-certificate,251 pki request-certificate domain,252 pki retrieval-certificate,252 pki retrieval-crl domain,253 pki validate-certificate,253 pki-domain,366 policy enable,189 portal auth-network,285 portal auth-network destination,286 portal delete-user,287 portal domain,288 portal free-rule,288 portal local-server,289 portal local-server enable,290 portal local-server ip,291 portal max-user,292 portal move-mode auto,293 portal nas-id-profile,294 portal nas-ip,294 portal nas-port-type,295 portal offline-detect interval,295 portal redirect-url,296 portal server,297 portal server banner,298 portal server method,299 portal server server-detect,300 portal server user-sync,301 portal web-proxy port,303
464
port-mapping,328 port-security authorization ignore,142 port-security enable,143 port-security intrusion-mode,144 port-security mac-address security,144 port-security max-mac-count,146 port-security ntk-mode,147 port-security oui,148 port-security port-mode,148 port-security preshared-key,152 port-security timer autolearn aging,152 port-security timer disableport,154 port-security trap,154 port-security tx-key-type 1 1key,155 prefer-cipher,367 pre-shared-key,226 primary accounting (HWTACACS scheme view),86 primary accounting (RADIUS scheme view),57 primary authentication (HWTACACS scheme view),87 primary authentication (RADIUS scheme view),59 primary authorization,88 proposal (IKE peer view),227 proposal (IPsec policy view/IPsec policy template view/IPsec profile view),189 public-key local create,262 public-key local destroy,263 public-key local export dsa,264 public-key local export rsa,265 public-key peer,266 public-key peer import sshkey,267 public-key-code begin,260 public-key-code end,261 put,352 pwd,352 Q qos pre-classify,190 quit,353 R radius client,60 RADIUS configuration commands,46 radius nas-ip,61 radius scheme,62 RADIUS server configuration commands,97
radius trap,62 radius-server client-ip,101 radius-server user,101 remote-address,228 remote-name,229 remove,353 rename,354 reset aspf session,329 reset attack-defense statistics interface,417 reset dot1x statistics,123 reset firewall ethernet-frame-filter,317 reset firewall ipv6 statistics,318 reset firewall-statistics,318 reset hwtacacs statistics,89 reset ike sa,229 reset ipsec sa,191 reset ipsec session,192 reset ipsec statistics,192 reset mac-authentication statistics,134 reset password-control blacklist,449 reset password-control history-record,449 reset portal connection statistics,304 reset portal server statistics,304 reset portal tcp-cheat statistics,304 reset radius statistics,63 reset stop-accounting-buffer (for HWTACACS),89 reset stop-accounting-buffer (for RADIUS),64 retry,64 retry realtime-accounting,65 retry stop-accounting (HWTACACS scheme view),90 retry stop-accounting (RADIUS scheme view),66 reverse-route,193 reverse-route preference,196 reverse-route tag,197 rmdir,354 root-certificate fingerprint,254 rsh,268 rule (PKI CERT ACP view),255 S sa authentication-hex,197 sa duration,230 sa duration,198 sa encryption-hex,199 sa spi,200
465
sa string-key,201 secondary accounting (HWTACACS scheme view),90 secondary accounting (RADIUS scheme view),67 secondary authentication (HWTACACS scheme view),91 secondary authentication (RADIUS scheme view),68 secondary authorization,92 security acl,202 security-policy-server,70 self-service-url enable,32 server-type,71 server-verify enable,367 service-type,43 session,368 sftp,355 SFTP client configuration commands,345 sftp client ipv6 source,356 sftp client source,357 sftp ipv6,357 SFTP server configuration commands,344 sftp server enable,344 sftp server idle-timeout,345 signature-detect,418 signature-detect action drop-packet,419 signature-detect large-icmp max-length,419 Source MAC address based ARP attack detection configuration commands,376 ssh client authentication server,339 ssh client first-time enable,340 ssh client ipv6 source,340 ssh client source,341 ssh server authentication-retries,332 ssh server authentication-timeout,333 ssh server compatible-ssh1x enable,334 ssh server enable,334 ssh server rekey-interval,335 ssh user,336 ssh2,342 ssh2 ipv6,343 SSH2.0 client configuration commands,337 SSH2.0 server configuration commands,330 ssl client-policy,369 ssl server-policy,369 state,256 state (ISP domain view),32
state (local user view),44 state primary,71 state secondary,72 stop-accounting-buffer enable (HWTACACS scheme view),93 stop-accounting-buffer enable (RADIUS scheme view),73 T tcp anti-naptha enable,422 tcp state,422 tcp syn-cookie enable,423 tcp timer check-state,424 time-out,231 timer quiet (HWTACACS scheme view),94 timer quiet (RADIUS scheme view),74 timer realtime-accounting (HWTACACS scheme view),94 timer realtime-accounting (RADIUS scheme view),74 timer response-timeout (HWTACACS scheme view),95 timer response-timeout (RADIUS scheme view),75 transform,203 tunnel local,204 tunnel remote,205 U user-bind,389 user-group,45 user-name-format (HWTACACS scheme view),96 user-name-format (RADIUS scheme view),76 user-profile,372 user-profile enable,372 V validity-date (local user view),45 version,370 vpn-instance (HWTACACS scheme view),97 vpn-instance (RADIUS scheme view),77 W web-redirect,305
466

HP a-MSR Router Series High Security Command Reference

Uploaded by

Copyright:

Available Formats

HP a-MSR Router Series High Security Command Reference

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

HP a-MSR Router Series High Security Command Reference

Uploaded by

Copyright:

Available Formats

HP MSR Router Series Security Command Reference

Legal and notice information

habp server vlan 454 habp timer 455

AAA configuration commands

[Sysname] domain test [Sysname-isp-test] authentication login local

undo authorization login

[Sysname] domain test [Sysname-isp-test] authorization voip radius-scheme rd

IP=10.0.0.1 Total 1 connection(s) matched.

Table 2 Output description Field

Default authentication scheme Default authorization scheme Default accounting scheme

<Sysname> system-view [Sysname] domain test [Sysname-isp-test]

domain default enable

nas-id bind vlan

state (ISP domain view)

Local user configuration commands

authorization-attribute (local user view/user group view)

# Configure the authorized VLAN of user group abc as VLAN 3.

Total 1 local user(s) matched.

Table 3 Output description Field

Total 1 user group(s) matched.

expiration-date (local user view)

state (local user view)

validity-date (local user view)

RADIUS configuration commands

data-flow-format (RADIUS scheme view)

display radius scheme

: without-domain : Byte : one

Table 4 Output description Field

display radius statistics

RADIUS sent messages statistic:

No-response-acct-stop packet = 1 Discarded No-response-acct-stop packet for buffer overflow = 0

Table 5 Output description Field

display stop-accounting-buffer (for RADIUS)

Total 2 record(s) Matched

key (RADIUS scheme view)

nas-ip (RADIUS scheme view)

primary accounting (RADIUS scheme view)

primary authentication (RADIUS scheme view)

reset radius statistics

reset stop-accounting-buffer (for RADIUS)

Related commands: radius scheme and timer response-timeout.

retry stop-accounting (RADIUS scheme view)

secondary accounting (RADIUS scheme view)

secondary authentication (RADIUS scheme view)

[Sysname] radius scheme radius1 [Sysname-radius-radius1] security-policy-server 10.110.1.2

Related commands: display radius scheme and state secondary.

stop-accounting-buffer enable (RADIUS scheme view)

timer quiet (RADIUS scheme view)

timer realtime-accounting (RADIUS scheme view)

Real-time accounting interval (minute)

Related commands: retry realtime-accounting.

timer response-timeout (RADIUS scheme view)

user-name-format (RADIUS scheme view)

vpn-instance (RADIUS scheme view)

HWTACACS configuration commands

: : 5 : 5 : 100 : with-domain : B : one-packet

Table 7 Output description Field

display stop-accounting-buffer (for HWTACACS)

key (HWTACACS scheme view)

nas-ip (HWTACACS scheme view)