3Com E4500-24 User manual

i
Table of Contents
1 CLI Configuration ······································································································································1-1
Introduction to the CLI·····························································································································1-1
Command Hierarchy·······························································································································1-1
Command Level and User Privilege Level······················································································1-1
Modifying the Command Level········································································································1-2
Switching User Level·······················································································································1-3
CLI Views················································································································································1-7
CLI Features ·········································································································································1-11
Online Help····································································································································1-11
Terminal Display····························································································································1-12
Command History··························································································································1-12
Error Prompts································································································································1-13
Command Edit·······························································································································1-13

1-1
1 CLI Configuration
When configuring CLI, go to these sections for information you are interested in:
zIntroduction to the CLI
zCommand Hierarchy
zCLI Views
zCLI Features
Introduction to the CLI
Acommand line interface (CLI) is a user interface to interact with a switch. Through the CLI on a switch,
a user can enter commands to configure the switch and check output information to verify the
configuration. Each 3com switch 4500 provides an easy-to-use CLI and a set of configuration
commands for the convenience of the user to configure and manage the switch.
The CLI on the 3com switch 4500 provides the following features, and so has good manageability and
operability.
zHierarchical command protection: After users of different levels log in, they can only use
commands at their own, or lower, levels. This prevents users from using unauthorized commands
to configure switches.
zOnline help: Users can gain online help at any time by entering a question mark (?).
zDebugging: Abundant and detailed debugging information is provided to help users diagnose and
locate network problems.
zCommand history function: This enables users to check the commands that they have lately
executed and re-execute the commands.
zPartial matching of commands: The system will use partially matching method to search for
commands. This allows users to execute a command by entering partially-spelled command
keywords as long as the keywords entered can be uniquely identified by the system.
Command Hierarchy
Command Level and User Privilege Level
To restrict the different users’ access to the device, the system manages the login users and all the
commands by their privilege levels.
All the commands and login users are categorized into four levels, which are visit, monitor, system, and
manage from low to high, and identified respectively by 0 through 3. After users at different privilege
levels log in, they can only use commands at their own, or lower, levels. For example, level 2 users can
only use level 0 through level 2 commands, not level 3 commands.
Command level
Based on user privilege, commands are classified into four levels, which default to:
zVisit level (level 0): Commands at this level are mainly used to diagnose network, and they cannot
be saved in configuration file. For example, ping, tracert and telnet are level 0 commands.

1-2
zMonitor level (level 1): Commands at this level are mainly used to maintain the system and
diagnose service faults, and they cannot be saved in configuration file. Such commands include
debugging and terminal.
zSystem level (level 2): Commands at this level are mainly used to configure services. Commands
concerning routing and network layers are at this level. These commands can be used to provide
network services directly.
zManage level (level 3): Commands at this level are associated with the basic operation modules
and support modules of the system. These commands provide support for services. Commands
concerning file system, FTP/TFTP/XModem downloading, user management, and level setting are
at this level.
By using the command-privilege level command, the administrator can change the level of a
command in a specific view as required. For details, refer to Modifying the Command Level.
User privilege level
Users logged into the switch fall into four user privilege levels, which correspond to the four command
levels respectively. Users at a specific level can only use the commands at the same level or lower
levels.
By default, the Console user (a user who logs into the switch through the Console port) is a level-3 user
and can use commands of level 0 through level 3, while Telnet users are level-0 users and can only use
commands of level 0.
You can use the user privilege level command to setthe default user privilege level for users logging in
through a certain user interface. For details, refer to Login Operation.
If a user logs in using AAA authentication, the user privilege level depends on the configuration of the
AAA scheme. For details, refer to AAA Operation.
Users can switch their user privilege level temporarily without logging out and disconnecting the current
connection; after the switch, users can continue to configure the device without the need of relogin and
reauthentication, but the commands that they can execute have changed. For details, refer to Switching
User Level.
Modifying the Command Level
Modifying the command level
All the commands in a view are defaulted to different levels, as shown in Command level. The
administrator can modify the command level based on users’ needs to make users of a lower level use
commands with a higher level or improve device security.
Follow these steps to set the level of a command in a specific view:
To do… Use the command… Remarks
Enter system view system-view —

1-3
To do… Use the command… Remarks
Configure the level of a command in
a specific view command-privilege level level view
view command Required
zYou are recommended to use the default command level or modify the command level under the
guidance of professional staff; otherwise, the change of command level may bring inconvenience
to your maintenance and operation, or even potential security problem.
zWhen you change the level of a command with multiple keywords or arguments, you should input
the keywords or arguments one by one inthe order they appear in thecommand syntax. Otherwise,
your configuration will not take effect. The values of the arguments should be within the specified
ranges.
zAfter you change the level of a command in a certain view to be lower than the default level, change
the level of the command used to enter the view accordingly.
Configuration example
The network administrator (a level 3 user) wants to change some TFTP commands (such as tftp get)
from level 3 to level 0, so that general Telnet users (level 0 users) are able to download files through
TFTP.
# Change the tftp get command in user view (shell) from level 3to level 0. (Originally, only level 3 users
can change the level of a command.)
<Sysname> system-view
[Sysname] command-privilege level 0 view shell tftp
[Sysname] command-privilege level 0 view shell tftp 192.168.0.1
[Sysname] command-privilege level 0 view shell tftp 192.168.0.1 get
[Sysname] command-privilege level 0 view shell tftp 192.168.0.1 get bootrom.btm
After the above configuration, general Telnet users can use the tftp get command to download file
bootrom.btm and other files from TFTP server 192.168.0.1 and other TFTP servers.
Switching User Level
Overview
Users can switch their user privilege level temporarily without logging out and disconnecting the current
connection; after the switch, users can continue to configure the device without the need of relogin and
reauthentication, but the commands that they can execute have changed.
For example, if the current user privilege level is 3, the user can configure system parameters; after
switching the user privilegelevel to 0, the user can only execute some simple commands, like ping and
tracert, and only a few display commands.
The switching of user privilege level is temporary, and effective for the current login; after the user relogs
in, the user privilege restores to the original level.
To avoid misoperations, the administrators are recommended to log in to the device by using a lower
privilege level and view device operating parameters, and when they have to maintain the device, they

1-4
can switch to a higher level temporarily; when the administrators need to leave for a while or ask
someone else to manage the device temporarily, they can switch to a lower privilege level before they
leave to restrict the operation by others.
The high-to-low user level switching is unlimited. However, the low-to-high user level switching requires
the corresponding authentication. Generally, two authentication modes are available: the super
password authentication mode and HWTACACS authentication mode.
Complete the following tasks to configure user level switching:
Task Remarks
Specifying the authentication mode for user level
switching Optional
Adopting super password authentication for user
level switching Required
The administrator configures
the user level switching
authentication policies Adopting HWTACACS authentication for user level
switching Required
The user switches user level
after logging in Switching to a specific user level Required
Specifying the authentication mode for user level switching
The low-to-high user level switching requires the corresponding authentication. The super password
authentication mode and HWTACACS authentication mode are available at the same time to provide
authentication redundancy.
The configuration of authentication mode for user level switching is performed by Level-3 users
(administrators).
Follow these steps to specify the authentication mode for user level switching:
To do… Use the command… Remarks
Enter system view system-view —
Enter user interface view user-interface [ type ]
first-number [ last-number ]—
Super password
authentication super authentication-mode
super-password
HWTACACS
authentication super authentication-mode
scheme
Super password
authentication preferred
(with the HWTACACS
authentication as the
backup authentication
mode)
super authentication-mode
super-password scheme
Specify the
authentication
mode for user
level switching
HWTACACS
authentication preferred
(with the super password
authentication as the
backup authentication
mode)
super authentication-mode
scheme super-password
Optional
These
configurations will
take effect on the
current user
interface only.
By default, super
password
authentication is
adopted for user
level switching.

1-5
When both the super password authentication and the HWTACACS authentication are specified, the
device adopts the preferred authentication mode first. If the preferred authentication mode cannot be
implemented (for example, the super password is not configured or the HWTACACS authentication
server is unreachable), the backup authentication mode is adopted.
Adopting super password authentication for user level switching
With the super password set, you can pass the super password authentication successfully only when
you provide the super password as prompted. If no super password is set, the system prompts
“%Password is not set” when you attempt to switch to a higher user level. In this case, you cannot pass
the super password authentication.
For example, after the administrator configures the super password level 3 simple 123 command,
when users of level 0 through level 2 want to switch to user level 3, they need to input super password
123.
The following table lists the operations to configure super password authentication for user level
switching, which can only be performed by level-3 users (administrators).
Follow these steps to set a password for use level switching:
To do… Use the command… Remarks
Enter system view system-view —
Set the super password for
user level switching super password [level level ] {cipher |simple } password
Required
The configuration will take effect
on all user interfaces.
By default, the super password is
not set.
The super password is for level switching only and is different from the login password.
Adopting HWTACACS authentication for user level switching
To implement HWTACACS authentication for user level switching, a level-3 user must perform the
commands listed in the following table to configure the HWTACACS authentication scheme used for
low-to-high user level switching. With HWTACACS authentication enabled, you can pass the
HWTACACS authentication successfully only after you provide the right user name and the
corresponding password as prompted. Note that if you have passed the HWTACACS authentication
when logging in to the switch, only the password is required.
The following table lists the operations to configure HWTACACS authentication for user level switching,
which can only be performed by Level-3 users.
Follow these steps to set the HWTACACS authentication scheme for user level switching:

1-6
To do… Use the command… Remarks
Enter system view system-view —
Enter ISP domain view domain domain-name —
Set the HWTACACS
authentication scheme for
user level switching
authentication super
hwtacacs-scheme
hwtacacs-scheme-name
Required
By default, the HWTACACS
authentication scheme for user level
switching is not set.
When setting the HWTACACS authentication scheme for user level switching using the authentication
super hwtacacs-scheme command, make sure the HWTACACS authentication scheme identified by
the hwtacacs-scheme-name argument already exists. Refer to AAA Operation for information about
HWTACACS authentication scheme.
Switching to a specific user level
Follow these steps to switch to a specific user level:
To do… Use the command… Remarks
Switch to a specified user
level super [ level ] Required
Execute this command in user view.
zIf no user level is specified in the super password command or the super command, level 3 is
used by default.
zFor security purpose, the password entered is not displayed when you switch to another user level.
You will remain at the original user level if you have tried three times but failed to enter the correct
authentication information.
Configuration examples
After a general user telnets to the switch, his/her user level is 0. Now, the network administrator wants to
allow general users to switch to level 3, so that they are able to configure the switch.
1) Super password authentication configuration example
zThe administrator configures the user level switching authentication policies.
# Set the user level switching authentication mode for VTY 0 users to super password authentication.
<Sysname> system-view
[Sysname] user-interface vty 0
[Sysname-ui-vty0] super authentication-mode super-password
[Sysname-ui-vty0] quit

1-7
# Set the password used by the current user to switch to level 3.
[Sysname] super password level 3 simple 123
zA VTY 0 user switches its level to level 3 after logging in.
# A VTY 0 user telnets to the switch, and then uses the set password to switch to user level 3.
<Sysname> super 3
Password:
User privilege level is 3, and only those commands can be used
whose level is equal or less than this.
Privilege note: 0-VISIT, 1-MONITOR, 2-SYSTEM, 3-MANAGE
# After configuring the switch, the general user switches back to user level 0.
<Sysname> super 0
User privilege level is 0, and only those commands can be used
whose level is equal or less than this.
Privilege note: 0-VISIT, 1-MONITOR, 2-SYSTEM, 3-MANAGE
2) HWTACACS authentication configuration example
zThe administrator configures the user level switching authentication policies.
# Configure a HWTACACS authentication scheme named acs, and specify the user name and
password used for user level switching on the HWTACACS server defined in the scheme. Refer to AAA
Operation for detailed configuration procedures.
# Enable HWTACACS authentication for VTY 0 user level switching.
<Sysname> system-view
[Sysname] user-interface vty 0
[Sysname-ui-vty0] super authentication-mode scheme
[Sysname-ui-vty0] quit
# Specify to adopt the HWTACACS authentication scheme named acs for user level switching in the
ISP domain named system.
[Sysname] domain system
[Sysname-isp-system] authentication super hwtacacs-scheme acs
zA VTY 0 user switches its level to level 3 after logging in.
# Switch to user level 3 (assuming that you log into the switch as a VTY 0 user by Telnet).
<Sysname> super 3
Username: user@system
Password:
User privilege level is 3, and only those commands can be used
whose level is equal or less than this.
Privilege note: 0-VISIT, 1-MONITOR, 2-SYSTEM, 3-MANAGE
CLI Views
CLI views are designed for different configuration tasks. They are both correlated and distinguishing.
For example, once a user logs into a switch successfully, the user enters user view, where the user can
perform some simple operations such as checking the operation status and statistics information of the
switch. Afterexecuting the system-view command, the user enterssystem view, where the user can go
to other views by entering corresponding commands.

1-8
Table 1-1 lists the CLI views provided by the 3com switch 4500, operations that can be performed in
different CLI views and the commands used to enter specific CLI views.
Table 1-1 CLI views
View Available
operation Prompt example Enter method Quit method
User view
Display operation
status and
statistical
information of the
switch
<Sysname> Enter user view once logging into
the switch.
Execute the
quit command
to log out of the
switch.
System view Configure system
parameters [Sysname]
Execute the
system-view
command in user
view.
Execute the
quit or return
command to
return to user
view.
100 Mbps Ethernet
port view:
[Sysname-Etherne
t1/0/1]
Execute the
interface ethernet
command in
system view.
Ethernet port
view Configure Ethernet port parameters 1000 Mbps
Ethernet port view:
[Sysname-Gigabit
Ethernet1/0/25]
Execute the
interface
gigabitethernet
command in
system view.
Aux1/0/0 port
(the console
port) view
The 3com switch
4500 does not
support
configuration on
port Aux1/0/0
[Sysname-Aux1/0/
0]
Execute the
interface aux 1/0/0
command in
system view
VLAN view Configure VLAN
parameters [Sysname-vlan1] Execute the vlan
command in
system view.
VLAN
interface view
Configure VLAN
interface
parameters,
including the
management
VLAN parameters
[Sysname-Vlan-int
erface1]
Execute the
interface
Vlan-interface
command in
system view.
Loopback
interface view
Configure loopback
interface
parameters [Sysname-LoopBa
ck0]
Execute the
interface
loopback
command in
system view.
NULL
interface view
Configure NULL
interface
parameters [Sysname-NULL0]
Execute the
interface null
command in
system view.
Local user
view Configure local user parameters [Sysname-luser-us er1]
Execute the
local-user
command in
system view.
Execute the
quit command
to return to
system view.
Execute the
return
command to
return to user
view.

1-9
View Available
operation Prompt example Enter method Quit method
User interface
view
Configure user
interface
parameters [Sysname-ui-aux0]
Execute the
user-interface
command in
system view.
FTP client
view Configure FTP client parameters [ftp] Execute the ftp
command in user
view.
SFTP client
view Configure SFTP client parameters sftp-client> Execute the sftp
command in
system view.
MST region
view Configure MST region parameters [Sysname-mst-regi on]
Execute the stp
region-configurati
on command in
system view.
Cluster view Configure cluster
parameters [Sysname-cluster] Execute the
cluster command
in system view.
Configure the RSA
public key for SSH
users
[Sysname-rsa-publ
ic-key]
Execute the rsa
peer-public-key
command in
system view.
Public key
view Configure the RSA
or DSA public key
for SSH users
[Sysname-peer-pu
blic-key]
Execute the
public-key peer
command in
system view.
Execute the
peer-public-ke
y end
command to
return to system
view.
Edit the RSA public
key for SSH users [Sysname-rsa-key- code]
Public key
editing view Edit the RSA or
DSA public key for
SSH users
[Sysname-peer-ke
y-code]
Execute the
public-key-code
begin command in
public key view.
Execute the
public-key-cod
e end
command to
return to public
key view.
RIP view Configure RIP protocol
parameters [Sysname-rip] Execute the rip
command in
system view.
Routing policy
view Configure routing policy [Sysname-route-p olicy]
Execute the
route-policy
command in
system view.
Basic ACL
view
Define rules for a
basic ACL (with ID
ranging from 2000
to 2999)
[Sysname-acl-
basic-2000]
Execute the acl
number command
in system view.
Advanced
ACL view
Define rules for an
advanced ACL
(with ID ranging
from 3000 to 3999)
[Sysname-acl-adv-
3000]
Execute the acl
number command
in system view.
Layer 2 ACL
view
Define rules for an
layer 2 ACL (with
ID ranging from
4000 to 4999)
[Sysname-acl-ethe
rnetframe-4000]
Execute the acl
number command
in system view.
Execute the
quit command
to return to
system view.
Execute the
return
command to
return to user
view.