HP FlexNetwork HSR6600 Installation manual
HP 6600/HSR6600 Routers
Security
Command Reference
Part number: 5998-1514
Software version: A6602-CMW520-R3103
A6600-CMW520-R3102-RPE
A6600-CMW520-R3102-RSE
HSR6602_MCP-CMW520-R3102
Document version: 6PW103-20130628
Legal and notice information
© Copyright 2013 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or use
of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.
i
Contents
AAA configuration commands···································································································································· 1
General AAA configuration commands ·························································································································1
aaa nas-id profile ·····················································································································································1
access-limit enable ···················································································································································1
accounting command···············································································································································2
accounting default····················································································································································3
accounting dvpn·······················································································································································4
accounting lan-access ··············································································································································5
accounting login·······················································································································································6
accounting optional ·················································································································································7
accounting portal ·····················································································································································7
accounting ppp·························································································································································8
accounting ssl-vpn ····················································································································································9
authentication default············································································································································ 10
authentication dvpn··············································································································································· 11
authentication lan-access······································································································································ 12
authentication login··············································································································································· 13
authentication portal ············································································································································· 14
authentication ppp ················································································································································ 15
authentication ssl-vpn ············································································································································ 16
authentication super ·············································································································································· 16
authorization command········································································································································ 17
authorization default ············································································································································· 18
authorization dvpn ················································································································································ 19
authorization lan-access ······································································································································· 20
authorization login ················································································································································ 21
authorization portal··············································································································································· 22
authorization ppp·················································································································································· 23
authorization ssl-vpn·············································································································································· 24
authorization-attribute user-profile ······················································································································· 25
cut connection························································································································································ 26
display connection ················································································································································ 27
display domain······················································································································································ 31
domain ··································································································································································· 33
domain default enable·········································································································································· 34
domain if-unknown················································································································································ 34
idle-cut enable························································································································································ 35
ip pool ···································································································································································· 36
nas device-id·························································································································································· 37
nas-id bind vlan ····················································································································································· 38
self-service-url enable ············································································································································ 39
session-time include-idle-time································································································································ 39
state (ISP domain view)········································································································································· 40
Local user configuration commands····························································································································· 41
access-limit ····························································································································································· 41
authorization-attribute ··········································································································································· 42
bind-attribute ·························································································································································· 43
display local-user··················································································································································· 44
display user-group················································································································································· 48
ii
expiration-date······················································································································································· 49
group ······································································································································································ 50
group-attribute allow-guest ··································································································································· 51
local-user ································································································································································ 51
password································································································································································ 52
service-type····························································································································································· 54
state (local user view)············································································································································ 55
user-group ······························································································································································ 55
validity-date···························································································································································· 56
RADIUS configuration commands ································································································································ 57
accounting-on enable············································································································································ 57
attribute 25 car······················································································································································ 58
data-flow-format (RADIUS scheme view)············································································································· 58
display radius scheme ·········································································································································· 59
display radius statistics ········································································································································· 62
display stop-accounting-buffer (for RADIUS)······································································································· 68
key (RADIUS scheme view)··································································································································· 70
nas-backup-ip························································································································································· 71
nas-ip (RADIUS scheme view) ······························································································································ 72
primary accounting (RADIUS scheme view) ······································································································· 73
primary authentication (RADIUS scheme view)·································································································· 74
radius client···························································································································································· 76
radius nas-backup-ip ············································································································································· 77
radius nas-ip··························································································································································· 78
radius scheme························································································································································ 79
radius trap······························································································································································ 80
reset radius statistics·············································································································································· 81
reset stop-accounting-buffer (for RADIUS) ··········································································································· 81
retry········································································································································································· 82
retry realtime-accounting ······································································································································ 83
retry stop-accounting (RADIUS scheme view)····································································································· 84
secondary accounting (RADIUS scheme view)··································································································· 85
secondary authentication (RADIUS scheme view) ····························································································· 87
security-policy-server ············································································································································· 89
server-type ······························································································································································ 90
state primary ·························································································································································· 91
state secondary······················································································································································ 91
stop-accounting-buffer enable (RADIUS scheme view) ······················································································ 92
timer quiet (RADIUS scheme view) ······················································································································ 93
timer realtime-accounting (RADIUS scheme view) ····························································································· 94
timer response-timeout (RADIUS scheme view) ·································································································· 95
user-name-format (RADIUS scheme view) ··········································································································· 96
vpn-instance (RADIUS scheme view) ··················································································································· 97
HWTACACS configuration commands ······················································································································· 97
data-flow-format (HWTACACS scheme view)···································································································· 97
display hwtacacs··················································································································································· 98
display stop-accounting-buffer (for HWTACACS)····························································································102
hwtacacs nas-ip ···················································································································································103
hwtacacs scheme·················································································································································104
key (HWTACACS scheme view)························································································································104
nas-ip (HWTACACS scheme view) ···················································································································105
primary accounting (HWTACACS scheme view) ····························································································106
primary authentication (HWTACACS scheme view)·······················································································107
primary authorization ·········································································································································108
iii
reset hwtacacs statistics ······································································································································109
reset stop-accounting-buffer (for HWTACACS) ································································································110
retry stop-accounting (HWTACACS scheme view)··························································································111
secondary accounting (HWTACACS scheme view)························································································112
secondary authentication (HWTACACS scheme view)···················································································113
secondary authorization·····································································································································114
stop-accounting-buffer enable (HWTACACS scheme view) ···········································································115
timer quiet (HWTACACS scheme view) ···········································································································115
timer realtime-accounting (HWTACACS scheme view)···················································································116
timer response-timeout (HWTACACS scheme view) ·······················································································117
user-name-format (HWTACACS scheme view) ································································································118
vpn-instance (HWTACACS scheme view) ········································································································118
802.1X commands ················································································································································· 120
display dot1x ·······················································································································································120
dot1x·····································································································································································124
dot1x authentication-method······························································································································125
dot1x auth-fail vlan··············································································································································126
dot1x critical vlan················································································································································127
dot1x critical recovery-action·····························································································································128
dot1x domain-delimiter·······································································································································129
dot1x guest-vlan ··················································································································································130
dot1x handshake·················································································································································131
dot1x handshake secure·····································································································································132
dot1x mandatory-domain ···································································································································132
dot1x max-user ····················································································································································133
dot1x multicast-trigger·········································································································································135
dot1x port-control ················································································································································135
dot1x port-method ···············································································································································136
dot1x quiet-period···············································································································································138
dot1x re-authenticate ··········································································································································138
dot1x retry····························································································································································139
dot1x supp-proxy-check······································································································································140
dot1x timer···························································································································································141
dot1x unicast-trigger ···········································································································································142
reset dot1x statistics ············································································································································143
EAD fast deployment commands ··························································································································· 145
dot1x free-ip·························································································································································145
dot1x timer ead-timeout······································································································································145
dot1x url ·······························································································································································146
MAC authentication configuration commands ····································································································· 148
display mac-authentication·································································································································148
mac-authentication ··············································································································································150
mac-authentication domain ································································································································151
mac-authentication max-user ······························································································································152
mac-authentication timer·····································································································································153
mac-authentication user-name-format ················································································································153
reset mac-authentication statistics ······················································································································155
Portal configuration commands······························································································································ 156
access-user detect················································································································································156
display portal acl·················································································································································157
display portal connection statistics ····················································································································159
display portal free-rule ········································································································································162
iv
display portal interface·······································································································································164
display portal server ···········································································································································165
display portal server statistics ····························································································································166
display portal tcp-cheat statistics ·······················································································································169
display portal user···············································································································································170
portal auth-network··············································································································································172
portal auth-network destination··························································································································173
portal backup-group············································································································································174
portal delete-user ·················································································································································175
portal domain ······················································································································································175
portal free-rule······················································································································································176
portal max-user ····················································································································································177
portal nas-id ·························································································································································178
portal nas-id-profile ·············································································································································179
portal nas-ip ·························································································································································180
portal nas-port-id··················································································································································180
portal nas-port-type··············································································································································181
portal redirect-url ·················································································································································182
portal server ·························································································································································182
portal server method ···········································································································································184
portal server server-detect···································································································································185
portal server user-sync·········································································································································187
reset portal connection statistics ························································································································188
reset portal server statistics·································································································································188
reset portal tcp-cheat statistics····························································································································189
Port security configuration commands··················································································································· 190
display port-security ············································································································································190
display port-security mac-address block ···········································································································193
display port-security mac-address security········································································································195
port-security authorization ignore······················································································································196
port-security enable ·············································································································································197
port-security intrusion-mode ································································································································198
port-security mac-address aging-type inactivity································································································199
port-security mac-address dynamic····················································································································200
port-security mac-address security ·····················································································································200
port-security max-mac-count ·······························································································································202
port-security ntk-mode ·········································································································································203
port-security oui ···················································································································································204
port-security port-mode········································································································································205
port-security timer autolearn aging····················································································································207
port-security timer disableport····························································································································207
port-security trap··················································································································································208
User profile configuration commands···················································································································· 210
display user-profile ··············································································································································210
user-profile enable···············································································································································210
user-profile····························································································································································211
Password control configuration commands··········································································································· 213
display password-control····································································································································213
display password-control blacklist·····················································································································214
password······························································································································································215
password-control { aging | composition | history | length } enable····························································216
password-control aging ······································································································································217
password-control alert-before-expire ·················································································································218
v
password-control authentication-timeout ···········································································································219
password-control complexity······························································································································220
password-control composition····························································································································220
password-control enable·····································································································································222
password-control expired-user-login ··················································································································222
password-control history ·····································································································································223
password-control length······································································································································223
password-control login idle-time ························································································································225
password-control login-attempt ··························································································································225
password-control password update interval·····································································································227
password-control super aging····························································································································227
password-control super composition ·················································································································228
password-control super length ···························································································································229
reset password-control blacklist ·························································································································230
reset password-control history-record················································································································230
RSH configuration commands································································································································ 232
rsh ·········································································································································································232
Public key configuration commands ······················································································································ 234
display public-key local public···························································································································234
display public-key peer·······································································································································235
peer-public-key end ·············································································································································237
public-key-code begin ·········································································································································238
public-key-code end ············································································································································238
public-key local create ········································································································································239
public-key local destroy ······································································································································240
public-key local export dsa ································································································································241
public-key local export rsa ·································································································································242
public-key peer ····················································································································································243
public-key peer import sshkey····························································································································244
PKI configuration commands·································································································································· 246
attribute·································································································································································246
ca identifier ··························································································································································247
certificate request entity ······································································································································247
certificate request from ·······································································································································248
certificate request mode······································································································································249
certificate request polling ···································································································································250
certificate request url···········································································································································250
common-name······················································································································································251
country··································································································································································252
crl check ·······························································································································································252
crl update-period ·················································································································································253
crl url·····································································································································································253
display pki certificate··········································································································································254
display pki certificate access-control-policy······································································································256
display pki certificate attribute-group················································································································257
display pki crl domain ········································································································································258
fqdn·······································································································································································259
ip (PKI entity view)···············································································································································260
ldap-server····························································································································································260
locality ··································································································································································261
organization·························································································································································262
organization-unit··················································································································································262
pki certificate access-control-policy ···················································································································263
vi
pki certificate attribute-group ·····························································································································263
pki delete-certificate ············································································································································264
pki domain ···························································································································································264
pki entity·······························································································································································265
pki import-certificate············································································································································266
pki request-certificate domain ····························································································································266
pki retrieval-certificate·········································································································································267
pki retrieval-crl domain ·······································································································································268
pki validate-certificate ·········································································································································268
root-certificate fingerprint····································································································································269
rule (PKI CERT ACP view) ···································································································································270
state·······································································································································································270
IPsec configuration commands······························································································································· 272
ah authentication-algorithm································································································································272
connection-name··················································································································································273
cryptoengine enable ···········································································································································273
display ipsec policy ············································································································································274
display ipsec policy-template ·····························································································································278
display ipsec profile············································································································································280
display ipsec sa···················································································································································282
display ipsec statistics·········································································································································287
display ipsec transform-set ·································································································································289
display ipsec tunnel·············································································································································290
encapsulation-mode ············································································································································292
esp authentication-algorithm ······························································································································292
esp encryption-algorithm ····································································································································293
ike-peer (IPsec policy view/IPsec policy template view/IPsec profile view) ·················································294
ipsec anti-replay check ·······································································································································295
ipsec anti-replay window ···································································································································295
ipsec decrypt check·············································································································································296
ipsec fragmentation before-encryption··············································································································297
ipsec invalid-spi-recovery enable·······················································································································297
ipsec policy (interface view)·······························································································································298
ipsec policy (system view) ··································································································································299
ipsec policy isakmp template·····························································································································300
ipsec policy-template···········································································································································301
ipsec profile (system view)··································································································································301
ipsec profile (tunnel interface view)···················································································································302
ipsec sa global-duration ·····································································································································303
ipsec transform-set ···············································································································································304
pfs ·········································································································································································305
policy enable ·······················································································································································306
qos pre-classify ····················································································································································306
reset ipsec sa ·······················································································································································307
reset ipsec statistics ·············································································································································308
reverse-route·························································································································································308
reverse-route preference ·····································································································································312
reverse-route tag ··················································································································································313
sa authentication-hex ··········································································································································313
sa duration ···························································································································································315
sa encryption-hex ················································································································································316
sa spi ····································································································································································317
sa string-key ·························································································································································318
security acl ···························································································································································319
vii
transform·······························································································································································321
transform-set ·························································································································································321
tunnel local···························································································································································322
tunnel remote ·······················································································································································323
IKE configuration commands·································································································································· 325
authentication-algorithm ·····································································································································325
authentication-method·········································································································································325
certificate domain················································································································································326
dh··········································································································································································327
display ike dpd····················································································································································327
display ike peer···················································································································································328
display ike proposal············································································································································329
display ike sa·······················································································································································331
dpd········································································································································································334
encryption-algorithm············································································································································335
exchange-mode ···················································································································································336
id-type···································································································································································336
ike dpd ·································································································································································337
ike local-name······················································································································································338
ike next-payload check disabled ·······················································································································339
ike peer (system view)·········································································································································340
ike proposal ·························································································································································340
ike sa keepalive-timer interval····························································································································341
ike sa keepalive-timer timeout ····························································································································342
ike sa nat-keepalive-timer interval······················································································································342
interval-time ··························································································································································343
local ······································································································································································343
local-address ························································································································································344
local-name····························································································································································345
nat traversal ·························································································································································345
peer·······································································································································································346
pre-shared-key······················································································································································347
proposal (IKE peer view) ····································································································································347
remote-address·····················································································································································348
remote-name ························································································································································349
reset ike sa ···························································································································································350
sa duration ···························································································································································351
time-out ·································································································································································351
SSH configuration commands································································································································ 353
SSH server configuration commands ·························································································································353
display ssh server ················································································································································353
display ssh user-information ·······························································································································355
sftp server enable ················································································································································356
sftp server idle-timeout·········································································································································356
ssh server authentication-retries ·························································································································357
ssh server authentication-timeout························································································································358
ssh server compatible-ssh1x enable ··················································································································358
ssh server enable·················································································································································359
ssh server rekey-interval ······································································································································359
ssh user·································································································································································360
SSH client configuration commands ··························································································································362
bye ········································································································································································362
cd ··········································································································································································362
viii
cdup······································································································································································363
delete ····································································································································································363
dir··········································································································································································364
display sftp client source·····································································································································365
display ssh client source ·····································································································································365
display ssh server-info ·········································································································································366
exit ········································································································································································367
get ·········································································································································································367
help ·······································································································································································368
ls············································································································································································368
mkdir·····································································································································································369
put ·········································································································································································370
pwd·······································································································································································370
quit ········································································································································································371
remove··································································································································································371
rename··································································································································································372
rmdir ·····································································································································································372
scp·········································································································································································372
sftp·········································································································································································374
sftp client ipv6 source ·········································································································································376
sftp client source ··················································································································································377
sftp ipv6································································································································································378
ssh client authentication server ··························································································································380
ssh client first-time enable ···································································································································381
ssh client ipv6 source··········································································································································381
ssh client source···················································································································································382
ssh2·······································································································································································383
ssh2 ipv6······························································································································································385
SSL configuration commands ································································································································· 388
ciphersuite ····························································································································································388
client-verify enable ··············································································································································389
client-verify weaken·············································································································································390
close-mode wait···················································································································································391
display ssl client-policy········································································································································391
display ssl server-policy ······································································································································392
handshake timeout ··············································································································································393
pki-domain ···························································································································································394
prefer-cipher·························································································································································395
server-verify enable ·············································································································································396
session ··································································································································································397
ssl client-policy ·····················································································································································397
ssl server-policy····················································································································································398
version ··································································································································································399
SSL VPN configuration commands ························································································································ 400
ssl-vpn enable ······················································································································································400
ssl-vpn server-policy·············································································································································400
Firewall configuration commands·························································································································· 402
Packet-filter firewall configuration commands···········································································································402
display firewall ipv6 statistics ····························································································································402
display firewall-statistics······································································································································403
firewall default ·····················································································································································404
firewall enable·····················································································································································404
firewall ipv6 default ············································································································································405
ix
firewall ipv6 enable ············································································································································406
firewall packet-filter ·············································································································································406
firewall packet-filter ipv6 ····································································································································407
reset firewall ipv6 statistics·································································································································408
reset firewall-statistics ··········································································································································408
ASPF configuration commands···································································································································409
aspf-policy ····························································································································································409
display aspf all ····················································································································································409
display aspf interface··········································································································································410
display aspf policy ··············································································································································411
display port-mapping··········································································································································412
firewall aspf ·························································································································································413
icmp-error drop····················································································································································414
port-mapping ·······················································································································································414
tcp syn-check························································································································································415
ALG configuration commands································································································································ 416
alg·········································································································································································416
Session management commands··························································································································· 418
application aging-time ········································································································································418
display application aging-time ··························································································································419
display session aging-time··································································································································419
display session hardware···································································································································420
display session relation-table ·····························································································································421
display session statistics······································································································································423
display session table ···········································································································································425
reset session ·························································································································································427
reset session statistics ··········································································································································428
session aging-time ···············································································································································429
session checksum·················································································································································430
session early-ageout············································································································································431
session log bytes-active·······································································································································432
session log enable···············································································································································432
session log packets-active···································································································································433
session log time-active ········································································································································434
session max-entries··············································································································································434
session persist acl················································································································································435
Connection limit configuration commands············································································································ 437
connection-limit apply policy······························································································································437
connection-limit policy·········································································································································437
display connection-limit policy ···························································································································438
limit ·······································································································································································439
Web filtering configuration commands················································································································· 441
display firewall http activex-blocking ················································································································441
display firewall http java-blocking·····················································································································442
display firewall http url-filter host ·······················································································································443
display firewall http url-filter parameter ············································································································445
firewall http activex-blocking acl ·······················································································································446
firewall http activex-blocking enable·················································································································447
firewall http activex-blocking suffix····················································································································447
firewall http java-blocking acl····························································································································448
firewall http java-blocking enable ·····················································································································449
firewall http java-blocking suffix ························································································································449
x
firewall http url-filter host acl ······························································································································450
firewall http url-filter host default························································································································451
firewall http url-filter host enable························································································································451
firewall http url-filter host ip-address··················································································································452
firewall http url-filter host url-address ·················································································································453
firewall http url-filter parameter··························································································································454
firewall http url-filter parameter enable·············································································································455
reset firewall http ·················································································································································456
Attack detection and protection configuration commands··················································································· 457
attack-defense apply policy································································································································457
attack-defense logging enable···························································································································457
attack-defense policy···········································································································································458
blacklist enable····················································································································································459
blacklist ip ····························································································································································459
defense icmp-flood action drop-packet ·············································································································460
defense icmp-flood enable ·································································································································461
defense icmp-flood ip··········································································································································461
defense icmp-flood rate-threshold ······················································································································462
defense scan add-to-blacklist······························································································································463
defense scan blacklist-timeout ····························································································································465
defense scan enable ···········································································································································465
defense scan max-rate ········································································································································466
defense syn-flood action ·····································································································································467
defense syn-flood enable····································································································································468
defense syn-flood ip ············································································································································468
defense syn-flood rate-threshold·························································································································469
defense udp-flood action drop-packet···············································································································470
defense udp-flood enable···································································································································471
defense udp-flood ip ···········································································································································471
defense udp-flood rate-threshold························································································································473
display attack-defense policy ·····························································································································474
display attack-defense statistics interface··········································································································477
display blacklist ···················································································································································479
display flow-statistics statistics····························································································································481
display flow-statistics statistics interface············································································································482
display tcp-proxy protected-ip····························································································································484
flow-statistics enable············································································································································485
reset attack-defense statistics interface··············································································································486
signature-detect····················································································································································486
signature-detect action drop-packet···················································································································487
signature-detect large-icmp max-length·············································································································487
tcp-proxy enable··················································································································································488
tcp-proxy mode····················································································································································489
TCP attack protection configuration commands ··································································································· 491
display tcp status ·················································································································································491
tcp anti-naptha enable ········································································································································491
tcp state ································································································································································492
tcp syn-cookie enable ·········································································································································493
tcp timer check-state ············································································································································493
IP source guard configuration commands············································································································· 495
display ip source binding···································································································································495
ip source binding ················································································································································496
ip verify source ····················································································································································497
xi
ip verify source max-entries································································································································498
ARP attack protection configuration commands ··································································································· 500
IP flood protection configuration commands·············································································································500
arp resolving-route enable··································································································································500
arp source-suppression enable ··························································································································500
arp source-suppression limit ·······························································································································501
display arp source-suppression··························································································································501
ARP packet rate limit configuration commands ········································································································502
arp rate-limit·························································································································································502
ARP packet source MAC consistency check configuration commands ··································································503
arp anti-attack valid-ack enable·························································································································503
ARP active acknowledgement configuration commands ·························································································504
arp anti-attack active-ack enable·······················································································································504
Authorized ARP configuration commands·················································································································504
arp authorized enable ········································································································································504
ARP detection configuration commands ····················································································································505
arp detection························································································································································505
arp detection enable···········································································································································506
arp detection trust················································································································································507
arp detection validate·········································································································································507
arp restricted-forwarding enable ·······················································································································508
display arp detection ··········································································································································508
display arp detection statistics ···························································································································509
reset arp detection statistics································································································································510
ARP automatic scanning and fixed ARP configuration commands·········································································510
arp fixup·······························································································································································510
arp scan ·······························································································································································511
ARP gateway protection configuration commands ··································································································512
arp filter source····················································································································································512
ARP filtering configuration commands·······················································································································513
arp filter binding··················································································································································513
ND attack defense configuration commands········································································································ 515
ipv6 nd mac-check enable ·································································································································515
URPF configuration commands ······························································································································ 516
ip urpf ···································································································································································516
FIPS configuration commands ································································································································ 517
display fips status ················································································································································517
fips mode enable·················································································································································517
fips self-test ···························································································································································518
Support and other resources ·································································································································· 520
Contacting HP ······························································································································································520
Subscription service ············································································································································520
Related information······················································································································································520
Documents····························································································································································520
Websites·······························································································································································520
Conventions ··································································································································································521
Index ········································································································································································ 523
1
AAA configuration commands
General AAA configuration commands
aaa nas-id profile
Use aaa nas-id profile to create a NAS ID profile and enter its view. A NAS ID profile maintains the
bindings between NAS IDs and VLANs.
Use undo aaa nas-id profile to remove a NAS ID profile.
Syntax
aaa nas-id profile profile-name
undo aaa nas-id profile profile-name
Views
System view
Default command level
2: System level
Parameters
profile-name: Name of the NAS ID profile, a case-insensitive string of 1 to 16 characters.
Examples
# Create a NAS ID profile named aaa.
<Sysname> system-view
[Sysname] aaa nas-id profile aaa
[Sysname-nas-id-prof-aaa]
Related commands
nas-id bind vlan
access-limit enable
Use access-limit enable to set the maximum number of online users in an ISP domain. After the number
of online users reaches the allowed maximum number, no more users are accepted.
Use undo access-limit enable to restore the default.
Syntax
access-limit enable max-user-number
undo access-limit enable
Default
There is no limit to the number of online users in an ISP domain.
2
Views
ISP domain view
Default command level
2: System level
Parameters
max-user-number: Maximum number of online users that the ISP domain can accommodate, in the range
of 1 to 2147483646.
Usage guidelines
System resources are limited, and user connections may compete for network resources when there are
many users. Setting a proper limit to the number of online users helps provide reliable system
performance.
Examples
# Set a limit of 500 user connections for ISP domain test.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] access-limit enable 500
Related commands
display domain
accounting command
Use accounting command to specify the command line accounting method.
Use undo accounting command to restore the default.
Syntax
accounting command hwtacacs-scheme hwtacacs-scheme-name
undo accounting command
Default
The default accounting method for the ISP domain is used for command line accounting.
Views
ISP domain view
Default command level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
Usage guidelines
The specified HWTACACS scheme must have been configured.
Command line accounting can use only an HWTACACS scheme.
3
Examples
# Configure ISP domain test to use HWTACACS scheme hwtac for command line accounting.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting command hwtacacs-scheme hwtac
Related commands
•accounting default
•hwtacacs scheme
accounting default
Use accounting default to configure the default accounting method for an ISP domain.
Use undo accounting default to restore the default.
Syntax
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme
radius-scheme-name [ local ] }
undo accounting default
Default
The default accounting method of an ISP domain is local.
Views
ISP domain view
Default command level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
The specified RADIUS or HWTACACS scheme must have been configured.
The default accounting method is used for all users who support the specified accounting method and
have no specific accounting method configured.
Local accounting is only used for monitoring and controlling the number of local user connections. It does
not provide the statistics function that the accounting feature generally provides.
Examples
# Configure the default accounting method for ISP domain test to use RADIUS accounting scheme rd and
use local accounting as the backup.
<Sysname> system-view
4
[Sysname] domain test
[Sysname-isp-test] accounting default radius-scheme rd local
Related commands
•local-user
•hwtacacs scheme
•radius scheme
accounting dvpn
Use accounting dvpn to configure the accounting method for DVPN users.
Use undo accounting dvpn to restore the default.
Syntax
accounting dvpn { local | none | radius-scheme radius-scheme-name [ local ] }
undo accounting dvpn
Default
The default accounting method for the ISP domain is used for DVPN users.
Views
ISP domain view
Default command level
2: System level
Parameters
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
The specified RADIUS scheme must have been configured.
Examples
# Configure ISP domain test to use local accounting for DVPN users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting dvpn local
# Configure ISP domain test to use RADIUS accounting scheme rd for DVPN users and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting dvpn radius-scheme rd local
Related commands
•local-user
•accounting default
5
•radius scheme
accounting lan-access
Use accounting lan-access to configure the accounting method for LAN users.
Use undo accounting lan-access to restore the default.
Syntax
accounting lan-access { local | none | radius-scheme radius-scheme-name [ local | none ] }
undo accounting lan-access
Default
The default accounting method for the ISP domain is used for LAN users.
Views
ISP domain view
Default command level
2: System level
Parameters
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
This command is supported only on SAP interface modules that are operating in Layer 2 mode.
The specified RADIUS scheme must have been configured.
Examples
# Configure ISP domain test to use local accounting for LAN users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting lan-access local
# Configure ISP domain test to use RADIUS accounting scheme rd for LAN users and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting lan-access radius-scheme rd local
Related commands
•local-user
•accounting default
•radius scheme
6
accounting login
Use accounting login to configure the accounting method for login users through the console, AUX, or
Asyn port or through Telnet.
Use undo accounting login to restore the default.
Syntax
accounting login { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme
radius-scheme-name [ local ] }
undo accounting login
Default
The default accounting method for the ISP domain is used for login users.
Views
ISP domain view
Default command level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
The specified RADIUS or HWTACACS scheme must have been configured.
Accounting is not supported for login users who use FTP.
Examples
# Configure ISP domain test to use local accounting for login users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login local
# Configure ISP domain test to use RADIUS accounting scheme rd for login users and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login radius-scheme rd local
Related commands
•local-user
•accounting default
•hwtacacs scheme
•radius scheme
7
accounting optional
Use accounting optional to enable the accounting optional feature.
Use undo accounting optional to disable the feature.
Syntax
accounting optional
undo accounting optional
Default
The feature is disabled.
Views
ISP domain view
Default command level
2: System level
Usage guidelines
After you configure the accounting optional command for a domain, a user who would otherwise be
disconnected can continue to use the network resources when no accounting server is available or when
communication with the current accounting server fails. However, the device no longer sends real-time
accounting updates for the user. The accounting optional feature applies to scenarios where accounting
is not important.
After you configure the accounting optional command, the setting configured by the access-limit
command in local user view has no effect.
Examples
# Enable the accounting optional feature for users in domain test.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting optional
accounting portal
Use accounting portal to configure the accounting method for portal users.
Use undo accounting portal to restore the default.
Syntax
accounting portal {local | none | radius-scheme radius-scheme-name [ local ] }
undo accounting portal
Default
The default accounting method for the ISP domain is used for portal users.
Views
ISP domain view
Other manuals for FlexNetwork HSR6600
2
This manual suits for next models
1
Table of contents
Other HP Network Router manuals
HP
HP ProCurve Secure 7102dl User manual
HP
HP A8800 Series Installation manual
HP
HP MSR930 Series User manual
HP
HP A6602 User manual
HP
HP 6125XLG User manual
HP
HP MSR2000 Series User manual
HP
HP 6125XLG User manual
HP
HP FlexFabric 12500E User manual
HP
HP StorageWorks MPX200 User manual
HP
HP MSR93x Series User manual
HP
HP FlexNetwork HSR6800 User manual
HP
HP Officejet Pro 7500 Series Installation manual
HP
HP ProCurve Networking J8454A User manual
HP
HP MSR SERIES User manual
HP
HP ProCurve 2510G Series User manual
HP
HP StorageWorks MPX200 Programming manual
HP
HP FlexNetwork HSR6600 User manual
HP
HP StorageWorks SR2122 User manual
HP
HP HP 830 Series User manual
HP
HP MSR SERIES User manual
