H3C S3100 Series User manual

H3C S3100 Series Ethernet Switches
Operation Manual
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Document Version: 20100908-C-1.00
Product Version: Release 22XX Series

Copyright © 2010, Hangzhou H3C Technologies Co., Ltd. and its licensors
All Rights Reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior
written consent of Hangzhou H3C Technologies Co., Ltd.
Trademarks
H3C, , Aolynk, , H3Care, , TOP G, , IRF, NetPilot, Neocean, NeoVTL,
SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V2G, VnG, PSPT,
XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co.,
Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners.
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.

1
Preface
H3C S3100 Series Ethernet Switches Operation Manual-Release 22XX Series describes the software
features for the H3C S3100 Series Ethernet Switches and guides you through the software
configuration procedures. It also provides configuration examples tohelp you apply software features to
different network scenarios.
This preface includes:
zAudience
zOrganization
zSoftware Version
zConventions
zAbout the H3C S3100 Documentation Set
zObtaining Documentation
zDocumentation Feedback
Audience
This documentation is intended for:
zNetwork planners
zField technical support and servicing engineers
zNetwork administrators working with the S3100 series
Organization
H3C S3100 Series Ethernet Switches Operation Manual-Release 22XX Series is organized as follows:
Part Features
01-CLI Operation zIntroduction to CLI
zCLI configuration
02-Login Operation
zLogging into a switch through the console port
zLogging in through Telnet/SSH
zLogging in using a modem
zLogging in through the web-based network management system
zLogging in through NMS
zUser control
03-Configuration File
Management Operation
zSaving and deleting the configuration file
zErasing the startup configuration file
zSpecifying a configuration file for next startup
04-VLAN Operation
zVLAN overview
zPort-based VLAN
zMAC-based VLAN (applicable only to the S3100-EI series)
zProtocol-based VLAN (applicable only to the S3100-EI series)

2
Part Features
05-Static Route Operation
zIntroduction to static route
zStatic route configuration
zTroubleshooting a static route
06-IP Address-IP Performance
Operation
zConfiguring an IP address for a switch
zConfiguring the TCP attributes for a switch
07-Voice VLAN Operation Voice VLAN (applicable only to the S3100-EI series)
08-GVRP Operation GARP VLAN registration protocol (GVRP)
09-Port Basic Configuration
Operation
zConfiguring port auto-negotiation speed
zLimiting traffic on individual ports
zEnabling flow control on a port
zDuplicating the configuration of a port to other ports
zConfiguring loopback detection for Ethernet port(s)
zEnabling loopback test
zConfiguring a port group
zEnabling the system to test connected cable
zConfiguring the interval to perform statistical analysis on port traffic
zDisabling Up/Down log output on a port
zConfiguring storm control on a port
zSetting the port state change delay
10-Link Aggregation Operation
zLink aggregation control protocol (LACP)
zManual aggregation
zStatic aggregation
11-Port Isolation Operation Port isolation group
12-Port Security-Port Binding
Operation
zConfiguring port security
zConfiguring port binding (applicable only to the S3100-EI series)
13-DLDP Operation Device link detection protocol (DLDP) (applicable only to the S3100-EI
series)
14-MAC Address Table
Management Operation
zManually configuring dynamic, static, and black hole MAC addresses
zSetting the MAC address aging timer
zSetting the maximum number of MAC addresses a port can learn
zDisabling MAC address learning for a VLAN (applicable only to the
S3100-EI series)
zAssigning MAC addresses for Ethernet ports
zConfiguring MAC address replication (applicable only to the S3100-EI
series)
15-MSTP Operation
zSTP/RSTP/MSTP overview and basic configuration
zPerforming mCheck operation
zGuard functions: BPDU Guard, Root Guard, Loop Guard, TC-BPDU
Attack Guard, and BPDU Drop (BPDU Drop is applicable only to the
S3100-EI series)
zDigest snooping
zRapid transition
zVLAN-VPN tunnel (applicable only to the S3100-SI series)
zMSTP maintenance configuration
zSending trap messages conforming to 802.1d standard

3
Part Features
16-Multicast Operation
zInternet group management protocol (IGMP) snooping v2&v3
zMulticast Listener Discovery (MLD) snooping v1&v3 (applicable only
to the S3100-EI series)
zIPv6 multicast VLAN configuration (applicable only to the S3100-EI
series)
zMulticast user control policy configuration (applicable only to the
S3100-EI series)
17-802.1x-System Guard
Operation
zBasic 802.1x configuration
zAdvanced 802.1x configuration
zConfiguring quick EAD deployment
zConfiguring HABP server
zConfiguring HABP client
zConfiguring system guard
18-AAA Operation
zAAA overview
zAAA configuration
zRADIUS configuration
zHWTACACS configuration
zEAD configuration
19-MAC Address Authentication
Operation
zMAC authentication overview
zConfiguring basic MAC authentication functions
zMAC address authentication enhanced function configuration
20-Web Authentication Operation
(Applicable only to the S3100-EI
series)
zIntroduction to web authentication
zWeb authentication configuration
zConfiguring an Auth-Fail VLAN for web authentication
zConfiguring a web authentication-free user
zConfiguring HTTPS access for web authentication
zCustomizing web authentication pages
zConfiguring web authentication transition
zConfiguring a proxy server port for web authentication
21-Triple Authentication Operation
(Applicable only to the S3100-EI
series)
zTriple authentication overview
zTriple authentication configuration
22-ARP Operation
zGratuitous ARP
zManually configuring ARP entries
zARP attack detection (applicable only to the S3100-EI series)
zARP packet rate limit (applicable only to the S3100-EI series)
23-DHCP Operation
zDHCP server (applicable only to the S3100-EI series)
zDHCP snooping
zDHCP packet rate limit (applicable only to the S3100-EI series)
zDHCP/BOOTP client
24-ACL Operation
zBasic/advanced ACLs (Only ACLs defined on S3100-EI series
switches can be applied to hardware directly.)
zLayer 2 ACLs (applicable only to the S3100-EI series)
zIPv6 ACLs (applicable only to the S3100-EI series)
25-QoS-QoS Profile Operation zQuality of Service (QoS)
zQoS profile (applicable only to the S3100-EI series)
26-Mirroring Operation zLocal port mirroring
zRemote port mirroring

4
Part Features
27-Stack-Cluster Operation
zStack
zHuawei Group Management Protocol (HGMP) v2
zNeighbor Discovery Protocol (NDP)
zNeighbor Topology Discovery Protocol (NTDP)
zCluster topology management function
zCluster synchronization function
28-PoE-PoE Profile Operation zPower over Ethernet (PoE)
zPoE profile
29-SNMP-RMON Operation zSimple network management protocol (SNMP)
zRemote monitoring (RMON)
30-NTP Operation zNetwork time protocol (NTP)
31-SSH Operation zConfiguring the SSH server
zConfiguring the SSH client
32-File System Management
Operation
zFile system management
zFile attribute configurable
33-FTP-SFTP-TFTP Operation
zOperating as an FTP server/FTP client
zOperating as an SFTP server/SFTP client
zOperating as a TFTP client
34-Information Center Operation
zSystem logs
zHierarchical alarms
zDebugging information output
35-System Maintenance and
Debugging Operation
zBoot ROM and host software loading
zBasic system configuration and debugging
zNetwork connectivity test
zDevice management
zScheduled task configuration
36-VLAN-VPN Operation
zVLAN-VPN (QinQ)
zConfiguring TPID value (applicable only to the S3100-EI series)
zConfiguring BPDU tunnels (applicable only to the S3100-EI series)
zSelective QinQ (applicable only to the S3100-EI series)
37-VLAN Mapping Operation zOne-to-one VLAN mapping (applicable only to the S3100-EI series)
zMany-to-One VLAN mapping (applicable only to the S3100-EI series)
38-HWPing Operation
zHWPing Server/HWPing client configuration
zNine test types, including ICMP test, DHCP test, FTP test, HTTP test,
DNS test, SNMP test, jitter test, TCP test, and UDP test
39-IPv6 Management Operation
zSupporting IPv6 address
zSupporting static IPv6 route
zSupporting ND snooping (applicable only to the S3100-EI series)
zSupporting ND detection (applicable only to the S3100-EI series)
zSupporting DHCPv6 snooping (applicable only to the S3100-EI series)
zSupporting IPv6 filtering (applicable only to the S3100-EI series)
zSupporting IPv6 DNS
zIPv6-based ping, traceroute, TFTP, and Telnet
40-DNS Operation zStatic domain name resolution
zDynamic domain name resolution
41-Smart Link-Monitor Link
Operation
zSmart Link (applicable only to the S3100-EI series)
zMonitor Link (applicable only to the S3100-EI series)

5
Part Features
42-ARP and IP Attack Defense
Operation
zSupporting ARP packet filtering based on gateway’s address
(applicable only to the S3100-EI series)
zSupporting configuring the maximum number of dynamic ARP entries
a VLAN interface can learn (applicable only to the S3100-EI series)
zSupporting ARP/IP attack defense based on 802.1x (applicable only to
the S3100-EI series)
zSupporting ARP source MAC address consistency check
43-LLDP Operation
zBasic Link Layer Discovery Protocol (LLDP) configuration
zCDP compatibility (applicable only to the S3100-EI series)
zLLDP trapping
44-PKI Operation zPKI overview
zPKI configuration
45-SSL Operation zConfiguring an SSL server policy
zConfiguring an SSL client policy
46-HTTPS Operation zHTTPS overview
zHTTPS configuration
47-Ethernet OAM Operation
(Applicable only to the S3100-EI
series)
zConfiguring basic ethernet OAM functions
zConfiguring the Ethernet OAM connection detection timers
zConfiguring link monitoring
zEnabling OAM remote loopback
48-CFD Operation
(Applicable only to the S3100-EI
series)
zConfiguring basic CFD settings
zConfiguring CC on MEPs
zConfiguring LB on MEPs
zConfiguring LT on MEPs
Software Version
H3C S3100 Series Ethernet Switches Operation Manual-Release 22XX Series and H3C S3100 Series
Ethernet Switches Command Manual-Release 22XX Series are for the software version Release 22XX
Series of the S3100-SI series and S3100-EI series switches.
Comparedwith Release 21XX Series,some new features are addedin Release 22XX Series. For more
information, see Table -1.
Table -1 Added features
Software
version Added features compared with the earlier version Release 2108P04 Part
Configuring MAC address replication (applicable only to
the S3100-EI series) 14-MAC Address Table Management Operation
Setting the offline detect timer for MAC authentication on
the Ethernet port view 19-MAC Address Authentication Operation
Configuring a web authentication-free user on the Ethernet
port view (applicable only to the S3100-EI series)
Configuring web authentication transition (applicable only
to the S3100-EI series)
Release
2211P06
Configuring a proxy server port for web authentication
(applicable only to the S3100-EI series)
20-Web Authentication
Operation

6
Software
version Added features compared with the earlier version Release 2108P04 Part
Limit broadcast traffic in pps 09-Port Basic Configuration
Operation
Multicast user control policy configuration (applicable only
to the S3100-EI series)
Disables the EPON ONU from dropping unknown multicast
packets (applicable only to the S3100-EI series)
16-Multicast Operation
Unicast trigger function of 802.1x (applicable only to the
S3100-EI series) 17-802.1X-System Guard Operation
Triple authentication (applicable only to the S3100-EI
series) 21-Triple Authentication Operation
Cluster synchronization function 27-Stack-Cluster Operation
Many-to-one VLAN mapping (applicable only to the
S3100-EI series) 37-VLAN Mapping Operation
DHCPv6 snooping options 18 and 37 Functions
(applicable only to the S3100-EI series) 39-IPv6 Management Operation
Ethernet OAM configuration (applicable only to the
S3100-EI series) 47-Ethernet OAM Operation
Release
2211P02
CFD configuration (applicable only to the S3100-EI series) 48-CFD Operation
MAC-based VLAN configuration (applicable only to the
S3100-EI series) 04-VLAN Operation
Configuring QoS priority settings for voice traffic on an
interface (applicable only to the S3100-EI series) 07-Voice VLAN Operation
Configuring port auto-negotiation speed
Configuring storm control on a port 09-Port Basic Configuration
Operation
Extended LACP functions 10-Link Aggregation
Operation
Guest VLAN for a Port in macAddressOrUserLoginSecure
mode function
Configuring an aging time for learned security MAC
address entries
IPv6-supported port binding (applicable only to the
S3100-EI series)
12-Port Security-Port Binding
Operation
Suppressing flooding of unknown multicast traffic in a
VLAN
MLD snooping (applicable only to the S3100-EI series)
IPv6 multicast VLAN (applicable only to the S3100-EI
series)
16-Multicast Operation
Mandatory 802.1X authentication domain 17-802.1x-System Guard
Operation
Per user type AAA
Configuring the sending mode of accounting start requests
Multiple secondary RADIUS servers
Release 2209
IPv6-supported RADIUS authentication
18-AAA Operation

7
Software
version Added features compared with the earlier version Release 2108P04 Part
Web authentication 20-Web Authentication
Operation
DHCP Server (applicable only to the S3100-EI series)
Removing DHCP snooping entries
Automatic Configuration
23-DHCP Operation
IPv6 ACL (applicable only to the S3100-EI series) 24-ACL Operation
VLAN marking 25-QoS-QoS Profile
Operation
IPv6-supported SNMP 29-SNMP-RMON Operation
Configuring command alias
Enabling auto power down on the 1000 Mbps uplink port
Scheduled task configuration
35-System Maintenance and
Debugging Operation
New HWPing commands, including: adv-factor, datafill,
description, display hwping statistics, filesize, history
keep-time, history-record enable, hwping-agent clear,
hwping-agent max-requests, sendpacket passroute,
statistics, statistics keep-time, test-time begin, and ttl.
38-HWPing Operation
ND snooping function (applicable only to the S3100-EI
series)
ND detection function (applicable only to the S3100-EI
series)
DHCPv6 snooping function (applicable only to the
S3100-EI series)
IPv6 filtering function (applicable only to the S3100-EI
series)
39-IPv6 Management
Operation
ARP packet filtering based on gateway’s address
(applicable only to the S3100-EI series)
Configuring the maximum number of dynamic ARP entries
a VLAN interface can learn (applicable only to the
S3100-EI series)
ARP/IP attack defense based on 802.1x (applicable only to
the S3100-EI series)
42-ARP and IP Attack
Defense Operation
LLDP 43-LLDP Operation
PKI 44-PKI Operation
SSL 45-SSL Operation
HTTPS 46-HTTPS Operation

8
Conventions
This section describes the conventions used in this documentation set.
Command conventions
Convention Description
Boldface Bold text represents commands and keywords that you enter literally as shown.
italic Italic text represents arguments that you replace with actual values.
[ ] Square brackets enclose syntax choices (keywords or arguments) that are
optional.
{ x | y | ... }
Braces enclose a set of required syntax choices separated by vertical bars,
from which you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices separated by vertical
bars, from which you select one or none.
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax choices separated by
vertical bars, from which you select at least one.
[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntax choices separated by
vertical bars, from which you may select multiple choices or none.
&<1-n> The argument or keyword and argument combination before the ampersand (&)
sign can be entered 1 to n times.
# A line that starts with a pound (#) sign is comments.
GUI conventions
Convention Description
Boldface Window names, button names, field names, and menu items are in Boldface.
For example, the New User window appears; click OK.
> Multi-level menus are separated by angle brackets. For example, File > Create
> Folder.
Symbols
Convention Description
Means reader be extremely careful. Improper operation may cause bodily
injury.
Means reader be careful. Improper operation may cause data loss or damage to
equipment.
Means an action or information that needs special attention to ensure
successful configuration or good performance.
Means a complementary description.
Means techniques helpful for you to make configuration with ease.
About the H3C S3100 Documentation Set
The H3C S3100 documentation set includes:

9
Category Documents Purposes
zS3100-EI series switches
marketing brochure
zS3100-SI series switches
marketing brochure
Describe product specifications and benefits.
H3C Low End Series Ethernet
Switches Pluggable Modules
Manual
Describes the types, appearance, and specifications
of pluggable modules.
RPS user manuals Describe the RPS power supply appearance,
functions, and specifications.
Product
description and
specifications
RPS Ordering Information for H3C
Low-End Ethernet Switches
Describe the switch models that can use RPS power
supply modules and the RPS power cable
specifications.
Compliance and Safety Manual Provides regulatory information and the safety
instructions that must be followed during installation.
Installation guide Provides a complete guide to hardware installation
and hardware specifications.
Hardware
specifications
and installation H3C Pluggable SFP[SFP+][XFP]
Transceiver Modules Installation
Guide
Guides you through installing SFP/SFP+/XFP
transceiver modules.
Operation manuals Describe software features and configuration
procedures.
Command references Provide a quick reference to all available commands.
Software
configuration H3C Low-End Ethernet Switches
Configuration Example
H3C Low-End Ethernet Switches
Configuration Guide
Describe typical network scenarios and provide
configuration examples and instructions.
H3C Series Ethernet Switches
Login Password Recovery Manual Describes the method of recovering or changing the login password if the password is lost.
Operations and
maintenance Release notes
Describe product version information (including
hardware and software compatibility matrix, software
compatibility, feature updates, and technical
information) and software upgrade methods.
Obtaining Documentation
You can access the most up-to-date H3C product documentation on the World Wide Web at
http://www.h3c.com.
Click the links on the top navigation bar to obtain different categories of product documentation:
[Technical Support & Documents > Technical Documents] – Provides hardware installation, software
feature configuration and maintenance documentation.
[Products & Solutions] – Provides information about products and technologies.
[Technical Support & Documents > Software Download] – Provides the documentation released with
the software version.
Documentation Feedback

10
You can e-mail your comments about product documentation to [e-mail].
We appreciate your comments.

i
Table of Contents
1 CLI Configuration ······································································································································1-1
Introduction to the CLI·····························································································································1-1
Command Hierarchy·······························································································································1-1
Command Level and User Privilege Level······················································································1-1
Modifying the Command Level········································································································1-2
Switching User Level·······················································································································1-3
CLI Views················································································································································1-7
CLI Features ·········································································································································1-12
Online Help····································································································································1-12
Terminal Display····························································································································1-13
Command History··························································································································1-13
Error Prompts································································································································1-14
Command Edit·······························································································································1-14

1-1
1 CLI Configuration
Introduction to the CLI
Acommand line interface (CLI) is a user interface to interact with a switch. Through the CLI on a switch,
a user can enter commands to configure the switch and check output information to verify the
configuration. Each S3100 series Ethernet switch provides an easy-to-use CLI and a set of
configuration commands for the convenience of the user to configure and manage the switch.
The CLI on S3100 series Ethernet switches provides the following features, and so has good
manageability and operability.
zHierarchical command protection: After users of different levels log in, they can only use
commands at their own, or lower, levels. This prevents users from using unauthorized commands
to configure switches.
zOnline help: Users can gain online help at any time by entering a question mark (?).
zDebugging: Abundant and detailed debugging information is provided to help users diagnose and
locate network problems.
zCommand history function: This enables users to check the commands that they have lately
executed and re-execute the commands.
zPartial matching of commands: The system will use partially matching method to search for
commands. This allows users to execute a command by entering partially-spelled command
keywords as long as the keywords entered can be uniquely identified by the system.
Command Hierarchy
Command Level and User Privilege Level
To restrict the different users’ access to the device, the system manages the login users and all the
commands by their privilege levels.
All the commands and login users are categorized into four levels, which are visit, monitor, system, and
manage from low to high, and identified respectively by 0 through 3. After users at different privilege
levels log in, they can only use commands at their own, or lower, levels. For example, level 2 users can
only use level 0 through level 2 commands, not level 3 commands.
Command level
Based on user privilege, commands are classified into four levels, which default to:
zVisit level (level 0): Commands at this level are mainly used to diagnose network, and they cannot
be saved in configuration file. For example, ping, tracert and telnet are level 0 commands.
zMonitor level (level 1): Commands at this level are mainly used to maintain the system and
diagnose service faults, and they cannot be saved in configuration file. Such commands include
debugging and terminal.
zSystem level (level 2): Commands at this level are mainly used to configure services. Commands
concerning routing and network layers are at this level. These commands can be used to provide
network services directly.

1-2
zManage level (level 3): Commands at this level are associated with the basic operation modules
and support modules of the system. These commands provide support for services. Commands
concerning file system, FTP/TFTP/XModem downloading, user management, and level setting are
at this level.
By using the command-privilege level command, the administrator can change the level of a
command in a specific view as required. For details, refer to Modifying the Command Level.
User privilege level
Users logged into the switch fall into four user privilege levels, which correspond to the four command
levels respectively. Users at a specific level can only use the commands at the same level or lower
levels.
By default, the Console user (a user who logs into the switch through the Console port) is a level-3 user
and can use commands of level 0 through level 3, while Telnet users are level-0 users and can only use
commands of level 0.
You can use the user privilege levelcommand to set the default user privilege level for users logging in
through a certain user interface. For details, refer to Login Operation.
If a user logs in using AAA authentication, the user privilege level depends on the configuration of the
AAA scheme. For details, refer to AAA Operation.
Modifying the Command Level
Modifying the Command Level
Commands fall into four levels: visit (level 0), monitor (level 1), system (level 2), and manage (level 3).
By using the following command, the administrator can change the level of a command in a specific
view as required.
Table 1-1 Set the level of a command in a specific view
Operation Command Remarks
Enter system view system-view —
Configure the level of a command
in a specific view command-privilege level level view view
command Required

1-3
zIt is recommended not to change the level of a command arbitrarily, for it may cause inconvenience
to maintenance and operation.
zWhen you change the level of a command with multiple keywords or arguments, you should input
the keywords or arguments one by one inthe order they appear in thecommand syntax. Otherwise,
your configuration will not take effect. The values of the arguments should be within the specified
ranges.
zAfter you change the level of a command in a certain view to be lower than the default level, change
the level of the command used to enter the view accordingly.
Configuration example
The network administrator (a level 3 user) wants to change some TFTP commands (such as tftp get)
from level 3 to level 0, so that general Telnet users (level 0 users) are able to download files through
TFTP.
# Change the tftp get command in user view (shell) from level 3 to level 0. (Originally, only level 3 users
can change the level of a command.)
<Sysname> system-view
[Sysname] command-privilege level 0 view shell tftp
[Sysname] command-privilege level 0 view shell tftp 192.168.0.1
[Sysname] command-privilege level 0 view shell tftp 192.168.0.1 get
[Sysname] command-privilege level 0 view shell tftp 192.168.0.1 get bootrom.btm
After the above configuration, general Telnet users can use the tftp get command to download file
bootrom.btm and other files from TFTP server 192.168.0.1 and other TFTP servers.
Switching User Level
Overview
Users can switch their user privilege level temporarily without logging out and disconnecting the current
connection; after the switch, users can continue to configure the device without the need of relogin and
reauthentication, but the commands that they can execute have changed.
For example, if the current user privilege level is 3, the user can configure system parameters; after
switching the user privilegelevel to 0, the user can only execute some simple commands, like ping and
tracert, and only a few display commands.
The switching of user privilege level is temporary, and effective for the current login; after the user relogs
in, the user privilege restores to the original level.
To avoid misoperations, the administrators are recommended to log in to the device by using a lower
privilege level and view device operating parameters, and when they have to maintain the device, they
can switch to a higher level temporarily; when the administrators need to leave for a while or ask
someone else to manage the device temporarily, they can switch to a lower privilege level before they
leave to restrict the operation by others.

1-4
The high-to-low user level switching is unlimited. However, the low-to-high user level switching requires
the corresponding authentication. Generally, two authentication modes are available: the super
password authentication mode and HWTACACS authentication mode.
Complete the following tasks to configure user level switching:
Operation Remarks
Specifying the authentication mode for user level switching Optional
Adopting super password authentication for user level switching Required
The administrator
configures the user
level switching
authentication
policies Adopting HWTACACS authentication for user level switching Required
The user switches
user level after
logging in Switching to a specific user level Required
Specifying the authentication mode for user level switching
The low-to-high user level switching requires the corresponding authentication. The super password
authentication mode and HWTACACS authentication mode are available at the same time to provide
authentication redundancy.
The configuration of authentication mode for user level switching is performed by Level-3 users
(administrators).
Follow these steps to specify the authentication mode for user level switching:
Operation Command Remarks
Enter system view system-view —
Enter user interface view user-interface [ type ]
first-number [ last-number ]—
Super password
authentication super authentication-mode
super-password
HWTACACS
authentication super authentication-mode
scheme
Super password
authentication preferred
(with the HWTACACS
authentication as the
backup authentication
mode)
super authentication-mode
super-password scheme
Specify the
authentication
mode for user
level switching
HWTACACS
authentication preferred
(with the super password
authentication as the
backup authentication
mode)
super authentication-mode
scheme super-password
Optional
These
configurations will
take effect on the
current user
interface only.
By default, super
password
authentication is
adopted for user
level switching.

1-5
When both the super password authentication and the HWTACACS authentication are specified, the
device adopts the preferred authentication mode first. If the preferred authentication mode cannot be
implemented (for example, the super password is not configured or the HWTACACS authentication
server is unreachable), the backup authentication mode is adopted.
Adopting super password authentication for user level switching
With the super password set, you can pass the super password authentication successfully only when
you provide the super password as prompted. If no super password is set, the system prompts
“%Password is not set” when you attempt to switch to a higher user level. In this case, you cannot pass
the super password authentication.
For example, after the administrator configures the super password level 3 simple 123 command,
when users of level 0 through level 2 want to switch to user level 3, they need to input super password
123.
The following table lists the operations to configure super password authentication for user level
switching, which can only be performed by level-3 users (administrators).
Follow these steps to set a password for use level switching:
Operation Command Remarks
Enter system view system-view —
Set the super password for
user level switching super password [level level ] {cipher |simple } password
Required
The configuration will take
effect on all user interfaces.
By default, the super password
is not set.
The super password is for level switching only and is different from the login password..
Adopting HWTACACS authentication for user level switching
To implement HWTACACS authentication for user level switching, a level-3 user must perform the
commands listed in the following table to configure the HWTACACS authentication scheme used for
low-to-high user level switching. With HWTACACS authentication enabled, you can pass the
HWTACACS authentication successfully only after you provide the right user name and the
corresponding password as prompted. Note that if you have passed the HWTACACS authentication
when logging in to the switch, only the password is required.
Follow these steps to set the HWTACACS authentication scheme for user level switching:

1-6
Operation Command Description
Enter system view system-view —
Enter ISP domain view domain domain-name —
Set the HWTACACS
authentication scheme for
user level switching
authentication super
hwtacacs-scheme
hwtacacs-scheme-name
Required
By default, the HWTACACS
authentication scheme for user level
switching is not set.
When setting the HWTACACS authentication scheme for user level switching using the authentication
super hwtacacs-scheme command, make sure the HWTACACS authentication scheme identified by
the hwtacacs-scheme-name argument already exists. Refer to AAA Operation for information about
HWTACACS authentication scheme.
Switching to a specific user level
Follow these steps to switch to a specific user level:
Operation Command Remarks
Switch to a specified user level super [ level ] Required
Execute this command in user view.
zIf no user level is specified in the super password command or the super command, level 3 is
used by default.
zFor security purpose, the password entered is not displayed when you switch to another user level.
You will remain at the original user level if you have tried three times but failed to enter the correct
authentication information.
Configuration example
After a general user telnets to the switch, his/her user level is 0. Now, the network administrator wants to
allow general users to switch to level 3, so that they are able to configure the switch.
1) Super password authentication configuration example
zThe administrator configures the user level switching authentication policies.
# Set the user level switching authentication mode for VTY 0 users to super password authentication.
<Sysname> system-view
[Sysname] user-interface vty 0
[Sysname-ui-vty0] super authentication-mode super-password
[Sysname-ui-vty0] quit

1-7
# Set the password used by the current user to switch to level 3.
[Sysname] super password level 3 simple 123
zA VTY 0 user switches its level to level 3 after logging in.
# A VTY 0 user telnets to the switch, and then uses the set password to switch to user level 3.
<Sysname> super 3
Password:
User privilege level is 3, and only those commands can be used
whose level is equal or less than this.
Privilege note: 0-VISIT, 1-MONITOR, 2-SYSTEM, 3-MANAGE
# After configuring the switch, the general user switches back to user level 0.
<Sysname> super 0
User privilege level is 0, and only those commands can be used
whose level is equal or less than this.
Privilege note: 0-VISIT, 1-MONITOR, 2-SYSTEM, 3-MANAGE
2) HWTACACS authentication configuration example
zThe administrator configures the user level switching authentication policies.
# Configure a HWTACACS authentication scheme named acs, and specify the user name and
password used for user level switching on the HWTACACS server defined in the scheme. Refer to AAA
Operation for detailed configuration procedures.
# Enable HWTACACS authentication for VTY 0 user level switching.
<Sysname> system-view
[Sysname] user-interface vty 0
[Sysname-ui-vty0] super authentication-mode scheme
[Sysname-ui-vty0] quit
# Specify to adopt the HWTACACS authentication scheme named acs for user level switching in the
ISP domain named system.
[Sysname] domain system
[Sysname-isp-system] authentication super hwtacacs-scheme acs
zA VTY 0 user switches its level to level 3 after logging in.
# Switch to user level 3 (assuming that you log into the switch as a VTY 0 user by Telnet).
<Sysname> super 3
Username: user@system
Password:
User privilege level is 3, and only those commands can be used
whose level is equal or less than this.
Privilege note: 0-VISIT, 1-MONITOR, 2-SYSTEM, 3-MANAGE
CLI Views
CLI views are designed for different configuration tasks. They are both correlated and distinguishing.
For example, once a user logs into a switch successfully, the user enters user view, where the user can
perform some simple operations such as checking the operation status and statistics information of the
switch. Afterexecuting the system-view command, the user enters system view, where the user can go
to other views by entering corresponding commands.