HP FlexNetwork MSR Series Installation manual

HPE FlexNetwork MSR Router Series
Comware 7 Security Command Reference
Part number: 5200-3000
Software version: MSR-CMW710-R0413
Document version: 6W102-20170101

© Copyright 2017Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® and Acrobat® are trademarks of Adobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
AAA commands···············································································1
General AAA commands···············································································································1
aaa nas-id profile···················································································································1
aaa session-limit ···················································································································1
accounting advpn··················································································································2
accounting command·············································································································3
accounting default ·················································································································4
accounting ipoe·····················································································································5
accounting lan-access············································································································7
accounting login····················································································································8
accounting portal················································································································· 10
accounting ppp ··················································································································· 11
accounting quota-out ··········································································································· 13
accounting start-fail·············································································································· 13
accounting update-fail·········································································································· 14
authentication advpn············································································································ 14
authentication default··········································································································· 16
authentication ike ················································································································ 17
authentication ipoe ·············································································································· 18
authentication lan-access······································································································ 19
authentication login·············································································································· 20
authentication portal ············································································································ 21
authentication ppp··············································································································· 23
authentication super ············································································································ 24
authorization advpn ············································································································· 25
authorization command ········································································································ 26
authorization default ············································································································ 27
authorization ike·················································································································· 29
authorization ipoe················································································································ 29
authorization lan-access······································································································· 30
authorization login ··············································································································· 32
authorization portal·············································································································· 33
authorization ppp················································································································· 34
authorization-attribute (ISP domain view)················································································· 35
display domain···················································································································· 37
domain······························································································································ 41
domain default enable·········································································································· 42
domain if-unknown ·············································································································· 43
ita-policy···························································································································· 44
nas-id bind vlan··················································································································· 45
service-type (ISP domain view)······························································································ 45
session-time include-idle-time································································································ 46
state (ISP domain view)········································································································ 47
user-address-type ··············································································································· 48
Local user commands················································································································· 48
access-limit························································································································ 48
authorization-attribute (local user view/user group view) ····························································· 49
bind-attribute······················································································································ 52
company···························································································································· 53
description ························································································································· 54
display local-guest waiting-approval························································································ 54
display local-user ················································································································ 55
display user-group··············································································································· 59
email································································································································· 61
full-name ··························································································································· 61
group································································································································ 62
local-guest auto-delete enable······························································································· 62

ii
local-guest email format········································································································ 63
local-guest email sender······································································································· 64
local-guest email smtp-server ································································································ 65
local-guest generate ············································································································ 65
local-guest manager-email···································································································· 67
local-guest send-email ········································································································· 68
local-guest timer·················································································································· 68
local-user··························································································································· 69
local-user-export ················································································································· 70
local-user-import ················································································································· 71
password··························································································································· 73
phone ······························································································································· 74
reset local-guest waiting-approval··························································································· 75
service-type (local user view)·································································································75
sponsor-department············································································································· 77
sponsor-email····················································································································· 77
sponsor-full-name················································································································ 78
state (local user view) ·········································································································· 78
user-group ························································································································· 79
validity-datetime·················································································································· 80
RADIUS commands ··················································································································· 81
aaa device-id······················································································································ 81
accounting-on enable··········································································································· 81
accounting-on extended ······································································································· 82
attribute 15 check-mode ······································································································· 83
attribute 25 car···················································································································· 84
attribute remanent-volume ···································································································· 84
client································································································································· 85
data-flow-format (RADIUS scheme view)················································································· 86
display radius scheme·········································································································· 87
display radius statistics········································································································· 90
key (RADIUS scheme view) ·································································································· 91
nas-ip (RADIUS scheme view)······························································································· 92
port··································································································································· 93
primary accounting (RADIUS scheme view) ············································································· 94
primary authentication (RADIUS scheme view)·········································································95
radius dscp ························································································································ 97
radius dynamic-author server ································································································ 97
radius nas-ip ······················································································································ 98
radius scheme···················································································································· 99
radius session-control client ································································································ 100
radius session-control enable ······························································································ 101
radius-server test-profile····································································································· 101
reset radius statistics ········································································································· 102
retry································································································································ 103
retry realtime-accounting ···································································································· 104
secondary accounting (RADIUS scheme view) ······································································· 104
secondary authentication (RADIUS scheme view) ··································································· 106
snmp-agent trap enable radius····························································································· 108
state primary ···················································································································· 109
state secondary ················································································································ 110
timer quiet (RADIUS scheme view)······················································································· 111
timer realtime-accounting (RADIUS scheme view)··································································· 112
timer response-timeout (RADIUS scheme view)······································································ 113
user-name-format (RADIUS scheme view)············································································· 114
vpn-instance (RADIUS scheme view)···················································································· 114
HWTACACS commands ··········································································································· 115
data-flow-format (HWTACACS scheme view) ········································································· 115
display hwtacacs scheme ··································································································· 116
hwtacacs nas-ip················································································································ 118
hwtacacs scheme·············································································································· 119
key (HWTACACS scheme view) ·························································································· 120

iii
nas-ip (HWTACACS scheme view)······················································································· 121
primary accounting (HWTACACS scheme view) ····································································· 122
primary authentication (HWTACACS scheme view)································································· 123
primary authorization ········································································································· 125
reset hwtacacs statistics····································································································· 126
secondary accounting (HWTACACS scheme view)·································································· 127
secondary authentication (HWTACACS scheme view) ····························································· 128
secondary authorization······································································································ 130
timer quiet (HWTACACS scheme view)················································································· 131
timer realtime-accounting (HWTACACS scheme view)····························································· 132
timer response-timeout (HWTACACS scheme view)································································ 133
user-name-format (HWTACACS scheme view)······································································· 133
vpn-instance (HWTACACS scheme view)·············································································· 134
LDAP commands····················································································································· 135
attribute-map···················································································································· 135
authentication-server ········································································································· 136
authorization-server··········································································································· 136
display ldap scheme ·········································································································· 137
ip···································································································································· 139
ipv6 ································································································································ 140
ldap attribute-map ············································································································· 140
ldap scheme····················································································································· 141
ldap server······················································································································· 142
login-dn··························································································································· 142
login-password ················································································································· 143
map································································································································ 144
protocol-version ················································································································ 145
search-base-dn················································································································· 146
search-scope···················································································································· 146
server-timeout ·················································································································· 147
user-parameters················································································································ 147
ITA policy commands················································································································ 148
accounting-level················································································································ 148
accounting-merge enable···································································································· 149
accounting-method············································································································ 150
ita policy·························································································································· 151
traffic-quota-out················································································································· 151
traffic-separate·················································································································· 152
802.1X commands ······································································· 153
display dot1x···················································································································· 153
display dot1x connection····································································································· 158
dot1x ······························································································································ 163
dot1x authentication-method ······························································································· 163
dot1x auth-fail vlan ············································································································ 164
dot1x critical vlan··············································································································· 165
dot1x domain-delimiter······································································································· 166
dot1x ead-assistant enable·································································································· 167
dot1x ead-assistant free-ip·································································································· 168
dot1x ead-assistant url ······································································································· 169
dot1x guest-vlan················································································································ 170
dot1x handshake··············································································································· 170
dot1x handshake reply enable ····························································································· 171
dot1x handshake secure····································································································· 172
dot1x mandatory-domain ···································································································· 173
dot1x max-user················································································································· 173
dot1x multicast-trigger········································································································ 174
dot1x port-control ·············································································································· 175
dot1x port-method ············································································································· 175
dot1x quiet-period·············································································································· 176
dot1x re-authenticate ········································································································· 177
dot1x re-authenticate server-unreachable keep-online······························································ 178

iv
dot1x retry························································································································ 178
dot1x smarton··················································································································· 179
dot1x smarton password····································································································· 180
dot1x smarton retry············································································································ 181
dot1x smarton switchid······································································································· 181
dot1x smarton timer supp-timeout························································································· 182
dot1x timer······················································································································· 183
dot1x unicast-trigger ·········································································································· 185
reset dot1x guest-vlan········································································································ 186
reset dot1x statistics ·········································································································· 186
MAC authentication commands······················································· 188
display mac-authentication·································································································· 188
display mac-authentication connection ·················································································· 191
mac-authentication ············································································································ 196
mac-authentication carry user-ip ·························································································· 196
mac-authentication domain ································································································· 197
mac-authentication host-mode····························································································· 198
mac-authentication max-user······························································································· 198
mac-authentication re-authenticate server-unreachable keep-online ··········································· 199
mac-authentication timer····································································································· 200
mac-authentication timer auth-delay ····················································································· 201
mac-authentication user-name-format ··················································································· 202
reset mac-authentication statistics························································································ 203
Portal commands········································································· 204
aaa-fail nobinding enable···································································································· 204
aging-time························································································································ 205
app-id ····························································································································· 205
app-key··························································································································· 206
authentication-timeout········································································································ 207
auth-url···························································································································· 208
binding-retry····················································································································· 209
captive-bypass enable········································································································ 209
default-logon-page············································································································· 210
display portal···················································································································· 211
display portal extend-auth-server·························································································· 217
display portal local-binding mac-address················································································ 218
display portal mac-trigger-server ·························································································· 219
display portal packet statistics······························································································ 221
display portal redirect statistics ···························································································· 224
display portal rule·············································································································· 225
display portal safe-redirect statistics······················································································ 235
display portal server··········································································································· 238
display portal user ············································································································· 239
display portal web-server···································································································· 248
display web-redirect rule····································································································· 249
exclude-attribute ··············································································································· 252
free-traffic threshold··········································································································· 254
if-match··························································································································· 255
ip (MAC binding server view)······························································································· 257
ip (portal authentication server view)····················································································· 257
ipv6 ································································································································ 258
local-binding aging-time······································································································ 259
local-binding enable··········································································································· 260
logon-page bind················································································································ 261
mail-protocol ···················································································································· 262
nas-port-type···················································································································· 263
port (MAC binding server view)···························································································· 264
port (portal authentication server view) ·················································································· 264
portal { bas-ip | bas-ipv6 } ··································································································· 265
portal { ipv4-max-user | ipv6-max-user }················································································· 266

v
portal apply mac-trigger-server ···························································································· 267
portal apply web-server ······································································································ 268
portal authorization strict-checking························································································ 269
portal client-traffic-report interval ·························································································· 270
portal delete-user ·············································································································· 271
portal device-id ················································································································· 271
portal domain ··················································································································· 272
portal enable ···················································································································· 273
portal extend-auth domain··································································································· 274
portal extend-auth-server···································································································· 275
portal fail-permit server······································································································· 276
portal fail-permit web-server ································································································ 277
portal free-all except destination··························································································· 278
portal free-rule·················································································································· 279
portal free-rule destination··································································································· 281
portal free-rule source········································································································ 282
portal host-check enable····································································································· 283
portal ipv6 free-all except destination ···················································································· 284
portal ipv6 layer3 source····································································································· 284
portal ipv6 user-detect········································································································ 285
portal layer3 source ··········································································································· 287
portal local-web-server······································································································· 287
portal mac-trigger-server····································································································· 289
portal max-user················································································································· 289
portal nas-id profile············································································································ 290
portal nas-port-id format ····································································································· 291
portal nas-port-type············································································································ 292
portal outbound-filter enable································································································ 293
portal pre-auth domain ······································································································· 294
portal packet log enable······································································································ 295
portal pre-auth ip-pool········································································································ 296
portal redirect log enable ···································································································· 296
portal refresh enable·········································································································· 297
portal roaming enable ········································································································ 298
portal safe-redirect enable··································································································· 298
portal safe-redirect forbidden-url··························································································· 299
portal safe-redirect method·································································································· 300
portal safe-redirect user-agent····························································································· 301
portal server····················································································································· 302
portal temp-pass enable ····································································································· 303
portal traffic-accounting disable···························································································· 303
portal user-detect ·············································································································· 304
portal user-dhcp-only ········································································································· 305
portal user-logoff after-client-offline enable············································································· 306
portal user log enable········································································································· 307
portal web-server ·············································································································· 308
redirect-url ······················································································································· 308
reset portal packet statistics ································································································ 309
reset portal redirect statistics······························································································· 310
reset portal safe-redirect statistics ························································································ 311
server-detect (portal authentication server view)······································································ 311
server-detect (portal Web server view) ·················································································· 312
server-type (MAC binding server view)·················································································· 313
server-type(portal server view/portal Web server view)····························································· 314
tcp-port···························································································································· 315
url··································································································································· 315
url-parameter···················································································································· 316
user-sync························································································································· 318
version···························································································································· 319
vpn-instance····················································································································· 320
web-redirect url················································································································· 320

vi
Port security commands ································································ 322
display port-security··········································································································· 322
display port-security mac-address block ················································································ 325
display port-security mac-address security············································································· 328
port-security authorization ignore·························································································· 330
port-security authorization-fail offline····················································································· 331
port-security enable ··········································································································· 331
port-security intrusion-mode ································································································ 332
port-security mac-address aging-type inactivity······································································· 333
port-security mac-address dynamic······················································································· 334
port-security mac-address security ······················································································· 335
port-security mac-move permit····························································································· 336
port-security max-mac-count ······························································································· 337
port-security nas-id-profile··································································································· 338
port-security ntk-mode········································································································ 339
port-security oui ················································································································ 340
port-security port-mode ······································································································ 341
port-security timer autolearn aging························································································ 343
port-security timer disableport······························································································ 344
snmp-agent trap enable port-security ···················································································· 345
User profile commands·································································· 347
display user-profile ············································································································ 347
user-profile······················································································································· 352
Password control commands·························································· 353
display password-control ···································································································· 353
display password-control blacklist························································································· 354
password-control { aging | composition | history | length } enable················································ 355
password-control aging ······································································································ 356
password-control alert-before-expire····················································································· 358
password-control complexity ······························································································· 358
password-control composition······························································································ 359
password-control enable····································································································· 361
password-control expired-user-login······················································································ 362
password-control history····································································································· 363
password-control length······································································································ 364
password-control login idle-time ··························································································· 365
password-control login-attempt ···························································································· 366
password-control super aging······························································································ 368
password-control super composition ····················································································· 368
password-control super length····························································································· 369
password-control update-interval·························································································· 370
reset password-control blacklist ··························································································· 371
reset password-control history-record···················································································· 371
Keychain commands····································································· 373
accept-lifetime utc ············································································································· 373
authentication-algorithm ····································································································· 374
display keychain················································································································ 374
key ································································································································· 376
keychain·························································································································· 376
key-string························································································································· 377
send-lifetime utc················································································································ 378
Public key management commands················································· 380
display public-key local public······························································································ 380
display public-key peer······································································································· 383
peer-public-key end ··········································································································· 385
public-key local create········································································································ 386
public-key local destroy ······································································································ 389

vii
public-key local export dsa·································································································· 391
public-key local export ecdsa······························································································· 393
public-key local export rsa··································································································· 394
public-key peer ················································································································· 396
public-key peer import sshkey······························································································ 397
PKI commands············································································ 398
attribute··························································································································· 398
ca identifier ······················································································································ 399
certificate request entity······································································································ 400
certificate request from······································································································· 401
certificate request mode ····································································································· 401
certificate request polling ···································································································· 403
certificate request url·········································································································· 404
common-name·················································································································· 405
country···························································································································· 405
crl check·························································································································· 406
crl url ······························································································································ 406
display pki certificate access-control-policy············································································· 407
display pki certificate attribute-group ····················································································· 408
display pki certificate domain······························································································· 410
display pki certificate renew-status························································································ 414
display pki certificate request-status······················································································ 416
display pki crl domain········································································································· 417
fqdn································································································································ 419
ip···································································································································· 420
ldap-server······················································································································· 420
locality····························································································································· 421
organization ····················································································································· 422
organization-unit ··············································································································· 422
pki abort-certificate-request································································································· 423
pki certificate access-control-policy······················································································· 424
pki certificate attribute-group ······························································································· 424
pki delete-certificate··········································································································· 425
pki domain ······················································································································· 427
pki entity·························································································································· 427
pki export························································································································· 428
pki import························································································································· 435
pki request-certificate········································································································· 439
pki retrieve-certificate········································································································· 440
pki retrieve-crl··················································································································· 442
pki storage······················································································································· 443
pki validate-certificate········································································································· 444
public-key dsa ·················································································································· 446
public-key ecdsa ··············································································································· 447
public-key rsa··················································································································· 448
root-certificate fingerprint ···································································································· 449
rule································································································································· 451
source····························································································································· 452
state ······························································································································· 453
subject-dn························································································································ 453
usage······························································································································ 454
IPsec commands ········································································· 456
ah authentication-algorithm ································································································· 456
description ······················································································································· 457
display ipsec { ipv6-policy | policy } ······················································································· 457
display ipsec { ipv6-policy-template | policy-template }······························································ 462
display ipsec profile ··········································································································· 464
display ipsec sa ················································································································ 465
display ipsec statistics········································································································ 470
display ipsec transform-set·································································································· 471

viii
display ipsec tunnel ··········································································································· 473
encapsulation-mode ·········································································································· 475
esn enable······················································································································· 476
esp authentication-algorithm································································································ 477
esp encryption-algorithm····································································································· 478
ike-profile························································································································· 480
ikev2-profile ····················································································································· 480
ipsec anti-replay check······································································································· 481
ipsec anti-replay window····································································································· 482
ipsec apply······················································································································· 482
ipsec decrypt-check enable································································································· 483
ipsec df-bit ······················································································································· 484
ipsec fragmentation ··········································································································· 485
ipsec global-df-bit·············································································································· 485
ipsec limit max-tunnel········································································································· 486
ipsec logging negotiation enable ·························································································· 487
ipsec logging packet enable ································································································ 487
ipsec { ipv6-policy | policy }·································································································· 488
ipsec { ipv6-policy | policy } isakmp template··········································································· 489
ipsec { ipv6-policy | policy } local-address··············································································· 490
ipsec { ipv6-policy-template | policy-template } ········································································ 491
ipsec profile······················································································································ 492
ipsec redundancy enable···································································································· 493
ipsec sa global-duration······································································································ 493
ipsec sa idle-time ·············································································································· 494
ipsec transform-set············································································································ 495
local-address···················································································································· 496
pfs·································································································································· 496
protocol··························································································································· 497
qos pre-classify················································································································· 498
redundancy replay-interval·································································································· 499
remote-address················································································································· 500
reset ipsec sa ··················································································································· 501
reset ipsec statistics··········································································································· 502
reverse-route dynamic········································································································ 503
reverse-route preference ···································································································· 504
reverse-route tag··············································································································· 504
sa duration······················································································································· 505
sa hex-key authentication ··································································································· 506
sa hex-key encryption ········································································································ 507
sa idle-time ······················································································································ 508
sa spi······························································································································ 509
sa string-key····················································································································· 510
security acl······················································································································· 512
snmp-agent trap enable ipsec······························································································ 513
tfc enable························································································································· 514
transform-set···················································································································· 515
tunnel protection ipsec ······································································································· 516
IKE commands············································································ 517
aaa authorization··············································································································· 517
authentication-algorithm ····································································································· 518
authentication-method········································································································ 519
certificate domain·············································································································· 519
client-authentication··········································································································· 521
description ······················································································································· 521
dh··································································································································· 522
display ike proposal··········································································································· 523
display ike sa···················································································································· 524
display ike statistics··········································································································· 527
dpd································································································································· 528
encryption-algorithm ·········································································································· 529