HP Enterprise FlexNetwork 10500 Series User manual

HPE FlexNetwork 10500 Switch Series
Fundamentals Configuration Guide
P
art number: 5200-1887a
Software
version: 10500-CMW710-R7557P01
Document version: 6W101-20171020

© Copyright 2017 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® and Acrobat® are trademarks of Adobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
Using the CLI·································································································1
CLI views····························································································································································1
Entering system view from user view·········································································································2
Returning to the upper-level view from any view ·······················································································2
Returning to user view ·······························································································································2
Accessing the CLI online help····························································································································2
Using the undo form of a command···················································································································3
Entering a command··········································································································································4
Editing a command line······························································································································4
Entering a text or string type value for an argument··················································································4
Entering an interface type··························································································································5
Abbreviating commands·····························································································································6
Configuring and using command aliases···································································································6
Configuring and using command hotkeys··································································································7
Enabling redisplaying entered-but-not-submitted commands····································································8
Understanding command-line error messages··································································································9
Using the command history feature ···················································································································9
Command buffering rules·························································································································10
Repeating commands in the command history buffer for a line·······························································10
Controlling the CLI output ································································································································11
Pausing between screens of output·········································································································11
Numbering each output line from a display command·············································································11
Filtering the output from a display command···························································································12
Saving the output from a display command to a file ················································································14
Viewing and managing the output from a display command effectively···················································16
Saving the running configuration ·····················································································································16
Configuring RBAC ·······················································································17
Overview··························································································································································17
Permission assignment····························································································································17
User role assignment·······························································································································20
FIPS compliance··············································································································································20
Configuration task list·······································································································································21
Creating a user role··········································································································································21
Configuring user role rules·······························································································································21
Configuration restrictions and guidelines·································································································22
Configuration procedure···························································································································22
Configuring a feature group ·····························································································································23
Configuring resource access policies···············································································································24
Configuring the user role interface policy·································································································24
Configuring the user role VLAN policy·····································································································24
Configuring the user role VPN instance policy·························································································25
Assigning user roles·········································································································································25
Enabling the default user role feature······································································································25
Assigning user roles to remote AAA authentication users·······································································26
Assigning user roles to local AAA authentication users···········································································26
Assigning user roles to non-AAA authentication users on user lines·······················································27
Configuring temporary user role authorization·································································································28
Configuration restrictions and guidelines·································································································28
Configuring user role authentication ········································································································30
Obtaining temporary user role authorization····························································································30
Displaying and maintaining RBAC settings······································································································30
RBAC configuration examples·························································································································31
RBAC configuration example for local AAA authentication users····························································31
RBAC configuration example for RADIUS authentication users······························································32
RBAC temporary user role authorization configuration example (HWTACACS authentication) )············35
RBAC temporary user role authorization configuration example (RADIUS authentication)·····················39

ii
Troubleshooting RBAC ····································································································································42
Local users have more access permissions than intended······································································42
Login attempts by RADIUS users always fail···························································································42
Login overview·····························································································44
Using the console port for the first device access········································46
Configuring CLI login···················································································47
CLI overview ····················································································································································47
User lines·················································································································································47
Login authentication modes·····················································································································48
User roles·················································································································································48
FIPS compliance··············································································································································48
Configuring console or USB console login·······································································································49
Disabling authentication for console or USB console login······································································49
Configuring password authentication for console or USB console login··················································50
Configuring scheme authentication for console or USB console login·····················································51
Configuring common AUX or console line settings··················································································51
Configuring Telnet login···································································································································53
Configuring the device as a Telnet server································································································53
Using the device to log in to a Telnet server····························································································59
Configuring SSH login······································································································································59
Configuring the device as an SSH server································································································60
Using the device to log in to an SSH server·····························································································61
Displaying and maintaining CLI login···············································································································62
Configuring Web login ·················································································63
FIPS compliance··············································································································································63
Configuring HTTP login····································································································································63
Configuring HTTPS login ·································································································································64
Displaying and maintaining Web login·············································································································66
Web login configuration examples···················································································································67
HTTP login configuration example···········································································································67
HTTPS login configuration example·········································································································67
Accessing the device through SNMP···························································70
Configuring RESTful access········································································71
FIPS compliance··············································································································································71
Configuring RESTful access over HTTP··········································································································71
Configuring RESTful access over HTTPS ·······································································································71
Controlling user access to the device ··························································73
FIPS compliance··············································································································································73
Controlling Telnet and SSH logins···················································································································73
Configuration procedures·························································································································73
Configuration example·····························································································································74
Controlling Web logins·····································································································································74
Configuring source IP-based Web login control·······················································································75
Logging off online Web users···················································································································75
Configuration example·····························································································································75
Controlling SNMP access ································································································································76
Configuration procedure···························································································································76
Configuration example·····························································································································77
Configuring command authorization ················································································································78
Configuration procedure···························································································································78
Configuration example·····························································································································79
Configuring command accounting ···················································································································81
Configuration procedure···························································································································81
Configuration example·····························································································································82

iii
Configuring FTP ··························································································84
FIPS compliance··············································································································································84
Using the device as an FTP server··················································································································84
Configuring basic parameters··················································································································84
Configuring authentication and authorization···························································································85
Manually releasing FTP connections·······································································································86
Displaying and maintaining the FTP server ·····························································································86
FTP server configuration example in standalone mode···········································································86
FTP server configuration example in IRF mode·······················································································88
Using the device as an FTP client ···················································································································89
Establishing an FTP connection···············································································································89
Managing directories on the FTP server··································································································90
Working with files on the FTP server ·······································································································90
Changing to another user account···········································································································91
Maintaining and troubleshooting the FTP connection··············································································92
Terminating the FTP connection··············································································································92
Displaying command help information·····································································································92
Displaying and maintaining the FTP client·······························································································92
FTP client configuration example in standalone mode ············································································93
FTP client configuration example in IRF mode························································································94
Configuring TFTP ························································································96
FIPS compliance··············································································································································96
Configuring the device as an IPv4 TFTP client································································································96
Configuring the device as an IPv6 TFTP client································································································97
Managing file systems·················································································98
Overview··························································································································································98
File systems·············································································································································98
Directories················································································································································99
Files··························································································································································99
Specifying a directory name or file name·······························································································100
FIPS compliance············································································································································100
File system management restrictions and guidelines ····················································································100
Managing storage media and file systems·····································································································101
Partitioning a CF card or a USB disk ·····································································································101
Mounting or unmounting a file system ···································································································102
Formatting a file system·························································································································102
Repairing a file system···························································································································103
Managing directories······································································································································103
Displaying directory information·············································································································103
Displaying the working directory ············································································································103
Changing the working directory··············································································································103
Creating a directory································································································································103
Renaming a directory·····························································································································104
Archiving or extracting directories··········································································································104
Deleting a directory································································································································104
Setting the operation mode for directories·····························································································104
Managing files················································································································································105
Displaying file information······················································································································105
Displaying the contents of a text file·······································································································105
Renaming a file······································································································································105
Copying a file ·········································································································································105
Moving a file···········································································································································106
Compressing or decompressing a file····································································································106
Archiving or extracting files····················································································································106
Deleting or restoring a file······················································································································106
Deleting files from the recycle bin··········································································································107
Calculating the file digest·······················································································································107
Setting the operation mode for files ·······································································································107

iv
Managing configuration files······································································108
Overview························································································································································108
Configuration types································································································································108
Next-startup configuration file redundancy·····························································································109
Configuration file formats·······················································································································109
Startup configuration file selection·········································································································109
Configuration file content organization and format·················································································109
FIPS compliance············································································································································110
Enabling configuration encryption··················································································································110
Comparing configurations for their differences······························································································110
Saving the running configuration ···················································································································111
Using different methods to save the running configuration····································································112
Configuring configuration rollback··················································································································113
Configuration task list·····························································································································113
Setting configuration archive parameters·······························································································114
Enabling automatic configuration archiving····························································································115
Manually archiving the running configuration·························································································115
Rolling back configuration······················································································································115
Configuring configuration commit delay·········································································································116
Specifying a next-startup configuration file ····································································································116
Backing up the main next-startup configuration file to a TFTP server ···························································117
Restoring the main next-startup configuration file from a TFTP server··························································118
Deleting a next-startup configuration file········································································································118
Displaying and maintaining configuration files·······························································································119
Upgrading software····················································································120
Overview························································································································································120
Software types ·······································································································································120
Software file naming conventions ··········································································································120
Comware image redundancy and loading procedure ············································································120
System startup process··························································································································121
Upgrade methods···········································································································································122
Upgrade restrictions and guidelines···············································································································123
Preparing for the upgrade······························································································································123
Upgrade task list ············································································································································123
Preloading the BootWare image to BootWare·······························································································124
Specifying startup images and completing the upgrade (in standalone mode) ·············································124
Specifying startup images and completing the upgrade (in IRF mode) ·························································125
Enabling software synchronization from the active MPU to the standby MPU at startup ······························126
Displaying and maintaining software image settings ·····················································································127
Software upgrade examples ··························································································································127
Software upgrade example (in standalone mode) ·················································································127
Software upgrade example (in IRF mode)·····························································································128
Performing an ISSU···················································································131
Overview························································································································································131
ISSU methods········································································································································131
ISSU commands····································································································································132
Preparing for ISSU·········································································································································132
Verifying the device operating status·····································································································132
Preparing the upgrade images···············································································································133
Identifying the software image signature································································································133
Identifying the ISSU method ··················································································································133
Verifying feature status ··························································································································133
Determining the upgrade procedure ······································································································134
Understanding ISSU guidelines·············································································································134
Logging in to the device through the console port ·················································································135
Saving the running configuration············································································································135
Performing an ISSU by using issu commands·······························································································135
Performing a compatible upgrade··········································································································135
Performing an incompatible upgrade·····································································································136

v
Performing an ISSU by using install commands····························································································136
ISSU task list··········································································································································136
Decompressing an .ipe file·····················································································································137
Installing or upgrading software images·································································································137
Uninstalling feature or patch images······································································································138
Aborting a software activate/deactivate operation ·················································································139
Committing software changes················································································································139
Verifying software images······················································································································139
Deleting inactive software images··········································································································139
Displaying and maintaining ISSU···················································································································140
Standalone mode···································································································································140
IRF mode ···············································································································································140
Troubleshooting ISSU in IRF mode ···············································································································141
Failure to execute the issu load/issu run switchover/issu commit/install activate/install deactivate
command ···············································································································································141
Examples of using issu commands for ISSU on a dual-member IRF fabric ··················································142
Feature upgrade to a compatible version·······························································································142
Feature upgrade to an incompatible version··························································································145
Examples of using issu commands for ISSU on a four-member IRF fabric···················································148
Feature upgrade to a compatible version·······························································································148
Feature upgrade to an incompatible version (upgrading one subordinate member first)·······················154
Feature upgrade to an incompatible version (upgrading multiple subordinate members first)··············159
Examples of using install commands for ISSU on a standalone device ························································164
Feature upgrade example······················································································································164
Examples of using install commands for ISSU on an IRF fabric····································································167
Feature upgrade example······················································································································167
Using the emergency shell·········································································172
Managing the file systems······························································································································172
Obtaining a system image from an FTP/TFTP server····················································································173
Configuring the management Ethernet interface ···················································································173
Checking the connectivity to a server ····································································································174
Accessing the server······························································································································174
Loading the system image·····························································································································175
Rebooting the device ·····································································································································175
Displaying device information in emergency shell mode ···············································································176
Emergency shell usage example···················································································································176
Network requirements····························································································································176
Usage procedure····································································································································176
Using automatic configuration····································································179
Overview························································································································································179
Using server-based automatic configuration··································································································179
Server-based automatic configuration task list ······················································································179
Configuring the file server······················································································································180
Preparing the files for automatic configuration·······················································································180
Configuring the DHCP server·················································································································181
Configuring the DNS server···················································································································183
Configuring the gateway ························································································································183
Preparing the interface used for automatic configuration·······································································183
Starting and completing automatic configuration···················································································183
Server-based automatic configuration examples···························································································184
Automatic configuration using TFTP server···························································································184
Automatic configuration using HTTP server and Tcl script····································································188
Automatic configuration using HTTP server and Python script······························································189
Automatic IRF setup·······························································································································191
Managing the device··················································································194
Device management task list·························································································································194
Configuring the device name ·························································································································194
Configuring the system time···························································································································195
Enabling displaying the copyright statement··································································································196

vi
Configuring banners·······································································································································196
Banner types··········································································································································196
Banner input methods····························································································································196
Configuration procedure·························································································································197
Setting the system operating mode················································································································198
Rebooting the device ·····································································································································198
Configuration guidelines·························································································································199
Rebooting devices immediately at the CLI·····························································································199
Scheduling a device reboot····················································································································199
Scheduling a task···········································································································································199
Configuration guidelines·························································································································199
Configuration procedure·························································································································200
Schedule configuration example············································································································201
Disabling password recovery capability·········································································································204
Setting the port status detection timer ···········································································································206
Monitoring CPU usage···································································································································206
Setting memory alarm thresholds ··················································································································207
Configuring the temperature alarm thresholds·······························································································209
Specifying load sharing modes for a service module·····················································································209
Specifying an operating mode and a proxy mode for a service module ························································210
About operating modes for service modules··························································································210
About proxy modes for service modules································································································216
Configuration restrictions and guidelines·······························································································216
Configuration procedure·························································································································217
Enabling the port down feature globally·········································································································218
Configuring an asset profile for a physical component ··················································································218
Isolating a switching fabric module ················································································································219
Isolation restrictions and guidelines·······································································································219
Isolation procedure·································································································································219
Suppressing switching fabric module removal interrupt signals·····································································220
Configuring hardware failure detection and protection ··················································································220
Specifying the actions to be taken for hardware failures········································································220
Enabling hardware failure protection for interfaces················································································221
Enabling hardware failure protection for aggregation groups ································································221
Enabling data forwarding path failure detection·····························································································222
Verifying and diagnosing transceiver modules ······························································································222
Verifying transceiver modules················································································································222
Diagnosing transceiver modules············································································································223
Disabling alarm traps for transceiver modules·······················································································223
Specifying an ITU channel number for a transceiver module ········································································223
Restoring the factory-default configuration ····································································································224
Displaying and maintaining device management configuration·····································································224
Standalone mode···································································································································224
IRF mode ···············································································································································226
Using Tcl ···································································································229
Using Tcl to configure the device···················································································································229
Executing Comware commands in Tcl configuration view·············································································230
Managing the system with BootWare·························································231
Overview························································································································································231
Restrictions and guidelines····························································································································231
Using the BASIC-BOOTWARE menu on LSU1SUPB0 (JG496A) MPUs······················································232
Modifying serial port parameters············································································································232
Updating the extended BootWare segment···························································································233
Updating the entire BootWare················································································································233
Running the primary extended BootWare segment···············································································234
Running the backup extended BootWare segment················································································234
Using the BASIC-BOOTWARE menu on MPUs except LSU1SUPB0 (JG496A) ··········································235
Modifying serial port parameters············································································································236
Updating the extended BootWare segment···························································································236
Updating the entire BootWare················································································································236

vii
Running the primary extended BootWare segment···············································································237
Running the backup extended BootWare segment················································································237
Using the EXTENDED-BOOTWARE menu on LSU1SUPB0 (JG496A) MPUs·············································238
Running the Comware software·············································································································240
Upgrading Comware software through the console port········································································241
Upgrading Comware software through the management Ethernet port·················································242
Managing files········································································································································245
Restoring the factory-default configuration ····························································································248
Skipping the configuration file at the next startup ··················································································249
Managing the BootWare image··············································································································249
Skipping console login authentication····································································································251
Managing storage media························································································································252
Using the EXTENDED ASSISTANT menu ····························································································253
Using the EXTENDED-BOOTWARE menu on MPUs except LSU1SUPB0 (JG496A) ·································254
Running the Comware software·············································································································257
Upgrading Comware software through the console port········································································257
Upgrading Comware software through the management Ethernet port·················································259
Managing files········································································································································261
Restoring the factory-default configuration ····························································································264
Skipping the configuration file at the next startup ··················································································265
Managing the BootWare image··············································································································266
Skipping console login authentication····································································································268
Managing storage media························································································································269
Using the EXTENDED ASSISTANT menu ····························································································270
BootWare shortcut keys·································································································································271
Comware software upgrade examples ··········································································································272
Using XMODEM to upgrade software through the console port····························································272
Using TFTP to upgrade Comware software through the management Ethernet port····························273
Using FTP to upgrade Comware software through the management Ethernet port······························275
Using Python·····························································································276
Entering the Python shell·······························································································································276
Executing a Python script·······························································································································276
Exiting the Python shell··································································································································276
Python usage example···································································································································276
Comware 7 extended Python API······························································278
Importing and using the Comware 7 extended Python API ···········································································278
Comware 7 extended Python API functions···································································································278
CLI class ················································································································································278
Transfer class·········································································································································280
API get_self_slot····································································································································281
API get_standby_slot·····························································································································281
API get_slot_range·································································································································282
API get_slot_info····································································································································283
Document conventions and icons······························································284
Conventions···················································································································································284
Network topology icons··································································································································285
Support and other resources ·····································································286
Accessing Hewlett Packard Enterprise Support·····························································································286
Accessing updates·········································································································································286
Websites ················································································································································287
Customer self repair·······························································································································287
Remote support······································································································································287
Documentation feedback ·······················································································································287
Index··········································································································289

1
Using the CLI
At the command-line interface (CLI), you can enter text commands to configure, manage, and
monitor the device.
You can use different methods to log in to the CLI, including through the console port, Telnet, and
SSH. For more information about login methods, see "Login overview."
CLI views
Commands are grouped in different views by feature. To use a command, you must enter its view.
CLI views are hierarchically organized, as shown in Figure 1. Each view has a unique prompt, from
which you can identify where you are and what you can do. For example, the prompt
[Sysname-vlan100] shows that you are in VLAN 100 view and can configure attributes for that VLAN.
Figure 1 CLI views
You are placed in user view immediately after you log in to the CLI. The user view prompt is
<Device-name>, where Device-name indicates the device name. The device name is Sysname by
default. You can change it by using the sysname command.
In user view, you can perform the following tasks:
•
Perform basic operations including display, debug, file management, FTP, Telnet, clock setting,
and reboot.
•
Enter system view. The system view prompt is [Device-name].
In system view, you can perform the following tasks:
•
Configure global settings and some features, such as the daylight saving time, banners, and
hotkeys.
•
Enter different feature views.
For example, you can perform the following tasks:
Enter interface view to configure interface parameters.
Enter VLAN view to add ports to the VLAN.
Enter user line view to configure login user attributes.
A feature view might have child views. For example, NQA operation view has the child view HTTP
operation view.
To display all commands available in a view, enter a question mark (?) at the view prompt.
VLAN view
Interface
view
……
System
view
User view User line
view
Local user
view