HP 3600 v2 Series Installation manual
HP 3600 v2 Switch Series
Security
Command Reference
Part number: 5998-2366
Software version: Release 2101
Document version: 6W101-20130930
Legal and notice information
© Copyright 2013 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or
use of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained
herein.
i
Contents
AAA configuration commands···································································································································· 1
General AAA configuration commands ·························································································································1
aaa nas-id profile ·····················································································································································1
access-limit enable ···················································································································································1
accounting command···············································································································································2
accounting default····················································································································································3
accounting lan-access ··············································································································································3
accounting login·······················································································································································4
accounting optional ·················································································································································5
accounting portal ·····················································································································································6
authentication default···············································································································································7
authentication lan-access·········································································································································7
authentication login··················································································································································8
authentication portal ················································································································································9
authentication super ·············································································································································· 10
authorization command········································································································································ 11
authorization default ············································································································································· 11
authorization lan-access ······································································································································· 12
authorization login ················································································································································ 13
authorization portal··············································································································································· 14
authorization-attribute user-profile ······················································································································· 15
cut connection························································································································································ 16
display connection ················································································································································ 17
display domain······················································································································································ 19
domain ··································································································································································· 21
domain default enable·········································································································································· 22
idle-cut enable························································································································································ 23
nas-id bind vlan ····················································································································································· 24
self-service-url enable ············································································································································ 24
state (ISP domain view)········································································································································· 25
Local user configuration commands····························································································································· 26
access-limit ····························································································································································· 26
authorization-attribute (local user view/user group view) ················································································ 26
bind-attribute ·························································································································································· 28
display local-user··················································································································································· 29
display user-group················································································································································· 31
expiration-date (local user view)·························································································································· 32
group ······································································································································································ 33
group-attribute allow-guest ··································································································································· 33
local-user ································································································································································ 34
local-user password-display-mode ······················································································································· 35
password································································································································································ 35
service-type····························································································································································· 36
state (local user view)············································································································································ 37
user-group ······························································································································································ 38
validity-date (local user view)······························································································································· 39
RADIUS configuration commands ································································································································ 39
accounting-on enable············································································································································ 39
attribute 25 car······················································································································································ 40
ii
data-flow-format (RADIUS scheme view)············································································································· 41
display radius scheme ·········································································································································· 42
display radius statistics ········································································································································· 44
display stop-accounting-buffer (for RADIUS)······································································································· 48
key (RADIUS scheme view)··································································································································· 49
nas device-id·························································································································································· 50
nas-backup-ip························································································································································· 51
nas-ip (RADIUS scheme view) ······························································································································ 52
primary accounting (RADIUS scheme view) ······································································································· 53
primary authentication (RADIUS scheme view)·································································································· 54
radius client···························································································································································· 56
radius nas-backup-ip ············································································································································· 56
radius nas-ip··························································································································································· 57
radius scheme························································································································································ 58
radius trap······························································································································································ 59
reset radius statistics·············································································································································· 60
reset stop-accounting-buffer (for RADIUS) ··········································································································· 60
retry········································································································································································· 61
retry realtime-accounting ······································································································································ 62
retry stop-accounting (RADIUS scheme view)····································································································· 63
secondary accounting (RADIUS scheme view)··································································································· 64
secondary authentication (RADIUS scheme view)······························································································ 66
security-policy-server ············································································································································· 67
server-type ······························································································································································ 68
state primary ·························································································································································· 68
state secondary······················································································································································ 69
stop-accounting-buffer enable (RADIUS scheme view) ······················································································ 70
timer quiet (RADIUS scheme view) ······················································································································ 71
timer realtime-accounting (RADIUS scheme view)······························································································ 72
timer response-timeout (RADIUS scheme view) ·································································································· 73
user-name-format (RADIUS scheme view) ··········································································································· 73
vpn-instance (RADIUS scheme view) ··················································································································· 74
HWTACACS configuration commands ······················································································································· 75
data-flow-format (HWTACACS scheme view)···································································································· 75
display hwtacacs··················································································································································· 75
display stop-accounting-buffer (for HWTACACS)······························································································ 79
hwtacacs nas-ip ····················································································································································· 79
hwtacacs scheme··················································································································································· 80
key (HWTACACS scheme view)·························································································································· 81
nas-ip (HWTACACS scheme view) ····················································································································· 83
primary accounting (HWTACACS scheme view) ······························································································ 83
primary authentication (HWTACACS scheme view)························································································· 84
primary authorization ··········································································································································· 85
reset hwtacacs statistics ········································································································································ 86
reset stop-accounting-buffer (for HWTACACS) ·································································································· 87
retry stop-accounting (HWTACACS scheme view)···························································································· 88
secondary accounting (HWTACACS scheme view)·························································································· 88
secondary authentication (HWTACACS scheme view)····················································································· 89
secondary authorization······································································································································· 90
stop-accounting-buffer enable (HWTACACS scheme view) ············································································· 91
timer quiet (HWTACACS scheme view) ············································································································· 92
timer realtime-accounting (HWTACACS scheme view)····················································································· 92
timer response-timeout (HWTACACS scheme view) ························································································· 93
user-name-format (HWTACACS scheme view) ·································································································· 94
iii
vpn-instance (HWTACACS scheme view) ·········································································································· 95
RADIUS server configuration commands····················································································································· 95
authorization-attribute (RADIUS-server user view)······························································································ 95
description (RADIUS-server user view) ················································································································ 96
expiration-date (RADIUS-server user view) ········································································································· 97
password (RADIUS-server user view)··················································································································· 97
radius-server client-ip············································································································································· 99
radius-server user··················································································································································· 99
802.1X configuration commands ·························································································································· 101
display dot1x ·······················································································································································101
dot1x·····································································································································································104
dot1x authentication-method······························································································································105
dot1x auth-fail vlan··············································································································································106
dot1x domain-delimiter·······································································································································107
dot1x guest-vlan ··················································································································································108
dot1x handshake·················································································································································109
dot1x handshake secure·····································································································································110
dot1x mandatory-domain ···································································································································111
dot1x max-user ····················································································································································112
dot1x multicast-trigger·········································································································································113
dot1x port-control ················································································································································113
dot1x port-method ···············································································································································114
dot1x quiet-period···············································································································································115
dot1x re-authenticate ··········································································································································116
dot1x retry····························································································································································117
dot1x timer···························································································································································118
dot1x unicast-trigger ···········································································································································119
reset dot1x statistics ············································································································································120
EAD fast deployment configuration commands···································································································· 121
dot1x free-ip·························································································································································121
dot1x timer ead-timeout······································································································································121
dot1x url ·······························································································································································122
MAC authentication configuration commands ····································································································· 124
display mac-authentication·································································································································124
mac-authentication ··············································································································································126
mac-authentication domain ································································································································127
mac-authentication guest-vlan ····························································································································128
mac-authentication max-user ······························································································································129
mac-authentication timer·····································································································································129
mac-authentication user-name-format ················································································································130
reset mac-authentication statistics ······················································································································132
Portal configuration commands······························································································································ 133
display portal acl·················································································································································133
display portal connection statistics ····················································································································135
display portal free-rule ········································································································································138
display portal interface·······································································································································139
display portal local-server ··································································································································140
display portal server ···········································································································································141
display portal server statistics ····························································································································142
display portal tcp-cheat statistics ·······················································································································144
display portal user···············································································································································146
portal auth-fail vlan ·············································································································································147
iv
portal auth-network··············································································································································148
portal backup-group············································································································································149
portal delete-user ·················································································································································150
portal domain ······················································································································································150
portal free-rule······················································································································································151
portal local-server ················································································································································152
portal local-server enable ···································································································································153
portal local-server ip············································································································································154
portal max-user ····················································································································································155
portal move-mode auto·······································································································································155
portal nas-id-profile ·············································································································································156
portal nas-ip ·························································································································································157
portal nas-port-type··············································································································································157
portal offline-detect interval ································································································································158
portal redirect-url ·················································································································································159
portal server ·························································································································································160
portal server banner············································································································································161
portal server method ···········································································································································161
portal server server-detect···································································································································162
portal server user-sync·········································································································································164
portal web-proxy port ·········································································································································165
reset portal connection statistics ························································································································166
reset portal server statistics·································································································································167
reset portal tcp-cheat statistics····························································································································167
Port security configuration commands··················································································································· 168
display port-security ············································································································································168
display port-security mac-address block ···········································································································170
display port-security mac-address security········································································································172
port-security authorization ignore······················································································································174
port-security enable ·············································································································································174
port-security intrusion-mode ································································································································175
port-security mac-address aging-type inactivity································································································176
port-security mac-address dynamic····················································································································177
port-security mac-address security ·····················································································································177
port-security max-mac-count ·······························································································································179
port-security ntk-mode ·········································································································································180
port-security oui ···················································································································································180
port-security port-mode········································································································································181
port-security timer autolearn aging····················································································································183
port-security timer disableport····························································································································184
port-security trap··················································································································································185
User profile configuration commands···················································································································· 187
display user-profile ··············································································································································187
user-profile enable···············································································································································188
user-profile····························································································································································188
HABP configuration commands ····························································································································· 190
display habp························································································································································190
display habp table ··············································································································································191
display habp traffic ·············································································································································191
habp client vlan ···················································································································································192
habp enable·························································································································································193
habp server vlan··················································································································································193
habp timer····························································································································································194
v
Public key configuration commands ······················································································································ 195
display public-key local public···························································································································195
display public-key peer·······································································································································196
peer-public-key end ·············································································································································198
public-key-code begin ·········································································································································198
public-key-code end ············································································································································199
public-key local create ········································································································································200
public-key local destroy ······································································································································201
public-key local export dsa ································································································································202
public-key local export rsa ·································································································································203
public-key peer ····················································································································································204
public-key peer import sshkey····························································································································204
PKI configuration commands·································································································································· 206
PKI configuration commands ······································································································································206
attribute·································································································································································206
ca identifier ··························································································································································207
certificate request entity ······································································································································207
certificate request from ·······································································································································208
certificate request mode······································································································································209
certificate request polling ···································································································································209
certificate request url···········································································································································210
common-name······················································································································································211
country··································································································································································211
crl check ·······························································································································································212
crl update-period ·················································································································································212
crl url·····································································································································································213
display pki certificate··········································································································································214
display pki certificate access-control-policy······································································································215
display pki certificate attribute-group················································································································216
display pki crl domain ········································································································································217
fqdn·······································································································································································219
ip (PKI entity view)···············································································································································219
ldap-server····························································································································································220
locality ··································································································································································220
organization·························································································································································221
organization-unit··················································································································································222
pki certificate access-control-policy ···················································································································222
pki certificate attribute-group ·····························································································································223
pki delete-certificate ············································································································································223
pki domain ···························································································································································224
pki entity·······························································································································································224
pki import-certificate············································································································································225
pki request-certificate domain ····························································································································226
pki retrieval-certificate·········································································································································227
pki retrieval-crl domain ·······································································································································227
pki validate-certificate ·········································································································································228
root-certificate fingerprint····································································································································228
rule (PKI CERT ACP view) ···································································································································229
state·······································································································································································230
IPsec configuration commands······························································································································· 231
ah authentication-algorithm································································································································231
display ipsec policy ············································································································································231
display ipsec proposal········································································································································234
vi
display ipsec sa···················································································································································235
display ipsec statistics·········································································································································237
encapsulation-mode ············································································································································238
esp authentication-algorithm ······························································································································239
esp encryption-algorithm ····································································································································240
ipsec policy ··························································································································································240
ipsec proposal ·····················································································································································241
proposal ·······························································································································································242
reset ipsec sa ·······················································································································································243
reset ipsec statistics ·············································································································································243
sa authentication-hex ··········································································································································244
sa encryption-hex ················································································································································245
sa spi ····································································································································································245
sa string-key ·························································································································································246
transform·······························································································································································248
SSH2.0 configuration commands·························································································································· 249
SSH2.0 server configuration commands···················································································································249
display ssh server ················································································································································249
display ssh user-information ·······························································································································250
ssh server authentication-retries ·························································································································251
ssh server authentication-timeout························································································································252
ssh server compatible-ssh1x enable ··················································································································253
ssh server enable·················································································································································253
ssh server rekey-interval ······································································································································254
ssh user·································································································································································254
SSH2.0 client configuration commands ····················································································································256
display ssh client source ·····································································································································256
display ssh server-info ·········································································································································257
ssh client authentication server ··························································································································258
ssh client first-time enable ···································································································································258
ssh client ipv6 source··········································································································································259
ssh client source···················································································································································260
ssh2·······································································································································································260
ssh2 ipv6······························································································································································262
SFTP server configuration commands ························································································································263
sftp server enable ················································································································································263
sftp server idle-timeout·········································································································································263
SFTP client configuration commands··························································································································264
bye ········································································································································································264
cd ··········································································································································································264
cdup······································································································································································265
delete ····································································································································································265
dir··········································································································································································266
display sftp client source·····································································································································267
exit ········································································································································································267
get ·········································································································································································268
help ·······································································································································································268
ls············································································································································································269
mkdir·····································································································································································270
put ·········································································································································································270
pwd·······································································································································································271
quit ········································································································································································271
remove··································································································································································272
rename··································································································································································272
vii
rmdir ·····································································································································································273
sftp·········································································································································································273
sftp client ipv6 source ·········································································································································274
sftp client source ··················································································································································275
sftp ipv6································································································································································275
SSL configuration commands ································································································································· 278
ciphersuite ····························································································································································278
client-verify enable ··············································································································································279
client-verify weaken·············································································································································279
close-mode wait···················································································································································280
display ssl client-policy········································································································································281
display ssl server-policy ······································································································································282
handshake timeout ··············································································································································283
pki-domain ···························································································································································284
prefer-cipher·························································································································································284
server-verify enable ·············································································································································285
session ··································································································································································286
ssl client-policy ·····················································································································································286
ssl server-policy····················································································································································287
version ··································································································································································288
TCP attack protection configuration commands ··································································································· 289
display tcp status ·················································································································································289
tcp syn-cookie enable ·········································································································································290
IP source guard configuration commands············································································································· 291
display ip source binding···································································································································291
display ipv6 source binding·······························································································································292
ip source binding ················································································································································294
ip verify source ····················································································································································295
ip verify source max-entries································································································································295
ipv6 source binding ············································································································································296
ipv6 verify source ················································································································································297
ipv6 verify source max-entries····························································································································298
ARP attack protection configuration commands ··································································································· 299
ARP defense against IP packet attacks configuration commands ···········································································299
arp resolving-route enable··································································································································299
arp source-suppression enable ··························································································································299
arp source-suppression limit ·······························································································································300
display arp source-suppression··························································································································300
ARP packet rate limit configuration commands ········································································································301
arp rate-limit·························································································································································301
arp rate-limit information ····································································································································302
Source MAC address based ARP attack detection configuration commands·······················································303
arp anti-attack source-mac··································································································································303
arp anti-attack source-mac aging-time ··············································································································303
arp anti-attack source-mac exclude-mac ···········································································································304
arp anti-attack source-mac threshold·················································································································305
display arp anti-attack source-mac····················································································································305
ARP packet source mac address consistency check configuration commands ·····················································306
arp anti-attack valid-check enable·····················································································································306
ARP active acknowledgement configuration commands ·························································································307
arp anti-attack active-ack enable·······················································································································307
ARP detection configuration commands ····················································································································307
viii
arp detection enable···········································································································································307
arp detection trust················································································································································308
arp detection validate ·········································································································································309
arp restricted-forwarding enable ·······················································································································309
display arp detection ··········································································································································310
display arp detection statistics ···························································································································311
reset arp detection statistics································································································································312
ARP automatic scanning and fixed ARP configuration commands·········································································312
arp fixup·······························································································································································312
arp scan ·······························································································································································313
ARP gateway protection configuration commands···································································································314
arp filter source····················································································································································314
ARP filtering configuration commands·······················································································································314
arp filter binding··················································································································································314
ND attack defense configuration commands········································································································ 316
Source MAC consistency check commands··············································································································316
ipv6 nd mac-check enable ·································································································································316
ND detection configuration commands ·····················································································································317
display ipv6 nd detection···································································································································317
display ipv6 nd detection statistics····················································································································318
ipv6 nd detection enable····································································································································318
ipv6 nd detection trust ········································································································································319
reset ipv6 nd detection statistics ························································································································320
URPF configuration commands ······························································································································ 321
ip urpf ···································································································································································321
MFF configuration commands································································································································ 322
display mac-forced-forwarding interface ··········································································································322
display mac-forced-forwarding vlan··················································································································322
mac-forced-forwarding········································································································································324
mac-forced-forwarding gateway probe ············································································································324
mac-forced-forwarding network-port ·················································································································325
mac-forced-forwarding server ····························································································································326
SAVI configuration commands······························································································································· 327
ipv6 savi dad-delay ············································································································································327
ipv6 savi dad-preparedelay·······························································································································327
ipv6 savi strict······················································································································································328
Blacklist configuration commands·························································································································· 329
blacklist enable····················································································································································329
blacklist ip ····························································································································································329
display blacklist ···················································································································································330
Support and other resources ·································································································································· 332
Contacting HP ······························································································································································332
Subscription service ············································································································································332
Related information······················································································································································332
Documents····························································································································································332
Websites·······························································································································································332
Conventions ··································································································································································333
Index ········································································································································································ 335
1
AAA configuration commands
General AAA configuration commands
aaa nas-id profile
Syntax
aaa nas-id profile profile-name
undo aaa nas-id profile profile-name
View
System view
Default level
2: System level
Parameters
profile-name: Name of the NAS ID profile, a case-insensitive string of 1 to 16 characters.
Description
Use the aaa nas-id profile command to create a NAS ID profile and enter its view. A NAS ID profile
maintains the bindings between NAS IDs and VLANs.
Use the undo aaa nas-id profile command to remove a NAS ID profile.
Related commands: nas-id bind vlan.
Examples
# Create a NAS ID profile named aaa.
<Sysname> system-view
[Sysname] aaa nas-id profile aaa
[Sysname-nas-id-prof-aaa]
access-limit enable
Syntax
access-limit enable max-user-number
undo access-limit enable
View
ISP domain view
Default level
2: System level
2
Parameters
max-user-number: Maximum number of online users that the ISP domain can accommodate, in the range
of 1 to 2147483646.
Description
Use the access-limit enable command to set the maximum number of online users in an ISP domain. After
the number of online users reaches the allowed maximum number, no more users will be accepted.
Use the undo access-limit enable command to restore the default.
By default, there is no limit to the number of online users in an ISP domain.
System resources are limited, and user connections may compete for network resources when there are
many users. Setting a proper limit to the number of online users helps provide reliable system
performance.
Related commands: display domain.
Examples
# Set a limit of 500 user connections for ISP domain test.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] access-limit enable 500
accounting command
Syntax
accounting command hwtacacs-scheme hwtacacs-scheme-name
undo accounting command
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
Description
Use the accounting command command to specify the command line accounting method.
Use the undo accounting command command to restore the default.
By default, the default accounting method for the ISP domain is used for command line accounting.
The specified HWTACACS scheme must have been configured.
Command line accounting can use only a HWTACACS scheme.
Related commands: accounting default and hwtacacs scheme.
Examples
# Configure ISP domain test to use HWTACACS scheme hwtac for command line accounting.
<Sysname> system-view
3
[Sysname] domain test
[Sysname-isp-test] accounting command hwtacacs-scheme hwtac
accounting default
Syntax
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme
radius-scheme-name [ local ] }
undo accounting default
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use the accounting default command to configure the default accounting method for an ISP domain.
Use the undo accounting default command to restore the default.
By default, the default accounting method of an ISP domain is local.
The specified RADIUS or HWTACACS scheme must have been configured.
The default accounting method will be used for all users who support the specified accounting method
and have no specific accounting method configured.
Local accounting is only used for monitoring and controlling the number of local user connections; it does
not provide the statistics function that the accounting feature generally provides.
Related commands: local-user, hwtacacs scheme, and radius scheme.
Examples
# Configure the default accounting method for ISP domain test to use RADIUS accounting scheme rd and
use local accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting default radius-scheme rd local
accounting lan-access
Syntax
accounting lan-access { local | none | radius-scheme radius-scheme-name [ local | none ] }
4
undo accounting lan-access
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use the accounting lan-access command to configure the accounting method for LAN users.
Use the undo accounting lan-access command to restore the default.
By default, the default accounting method for the ISP domain is used for LAN users.
The specified RADIUS scheme must have been configured.
Related commands: local-user, accounting default, and radius scheme.
Examples
# Configure ISP domain test to use local accounting for LAN users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting lan-access local
# Configure ISP domain test to use RADIUS accounting scheme rd for LAN users and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting lan-access radius-scheme rd local
accounting login
Syntax
accounting login { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme
radius-scheme-name [ local ] }
undo accounting login
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
5
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use the accounting login command to configure the accounting method for login users (users logging in
through the console, AUX, or Asyn port or accessing through Telnet).
Use the undo accounting login command to restore the default.
By default, the default accounting method for the ISP domain is used for login users.
The specified RADIUS or HWTACACS scheme must have been configured.
Accounting is not supported for login users that use FTP.
Related commands: local-user, accounting default, hwtacacs scheme, and radius scheme.
Examples
# Configure ISP domain test to use local accounting for login users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login local
# Configure ISP domain test to use RADIUS accounting scheme rd for login users and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login radius-scheme rd local
accounting optional
Syntax
accounting optional
undo accounting optional
View
ISP domain view
Default level
2: System level
Parameters
None
Description
Use the accounting optional command to enable the accounting optional feature.
Use the undo accounting optional command to disable the feature.
By default, the feature is disabled.
After you configure the accounting optional command for a domain, a user who will be disconnected
otherwise can continue to use the network resources when no accounting server is available or the
6
communication with the current accounting server fails. However, the switch will not send real-time
accounting updates for the user anymore. The accounting optional feature applies to scenarios where
accounting is not important.
NOTE:
A
fter you confi
g
ure the accounting optional command, the setting configured by the access-limit
command in local user view is not effective.
Examples
# Enable the accounting optional feature for users in domain test.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting optional
accounting portal
Syntax
accounting portal {local | none | radius-scheme radius-scheme-name [ local ] }
undo accounting portal
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use the accounting portal command to configure the accounting method for portal users.
Use the undo accounting portal command to restore the default.
By default, the default accounting method for the ISP domain is used for portal users.
The specified RADIUS scheme must have been configured.
Related commands: local-user, accounting default, and radius scheme.
Examples
# Configure ISP domain test to use local accounting for portal users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting portal local
# Configure ISP domain test to use RADIUS scheme rd for accounting on portal users and use local
accounting as the backup.
<Sysname> system-view
7
[Sysname] domain test
[Sysname-isp-test] accounting portal radius-scheme rd local
authentication default
Syntax
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none |
radius-scheme radius-scheme-name [ local ] }
undo authentication default
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authentication.
none: Does not perform any authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use the authentication default command to configure the default authentication method for an ISP
domain.
Use the undo authentication default command to restore the default.
By default, the default authentication method of an ISP domain is local.
The specified RADIUS or HWTACACS scheme must have been configured.
The default authentication method will be used for all users that support the specified authentication
method and have no specific authentication method configured.
Related commands: local-user, hwtacacs scheme, radius scheme.
Examples
# Configure the default authentication method for ISP domain test to use RADIUS authentication scheme
rd and use local authentication as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication default radius-scheme rd local
authentication lan-access
Syntax
authentication lan-access { local | none | radius-scheme radius-scheme-name [ local | none ] }
undo authentication lan-access
8
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local authentication.
none: Does not perform any authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use the authentication lan-access command to configure the authentication method for LAN users.
Use the undo authentication lan-access command to restore the default.
By default, the default authentication method for the ISP domain is used for LAN users.
The specified RADIUS scheme must have been configured.
Related commands: local-user, authentication default, and radius scheme.
Examples
# Configure ISP domain test to use local authentication for LAN users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication lan-access local
# Configure ISP domain test to use RADIUS authentication scheme rd for LAN users and use local
authentication as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication lan-access radius-scheme rd local
authentication login
Syntax
authentication login { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme
radius-scheme-name [ local ] }
undo authentication login
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authentication.
9
none: Does not perform any authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use the authentication login command to configure the authentication method for login users (users
logging in through the console, AUX, or Asyn port or accessing through Telnet or FTP).
Use the undo authentication login command to restore the default.
By default, the default authentication method for the ISP domain is used for login users.
The specified RADIUS or HWTACACS scheme must have been configured.
Related commands: local-user, authentication default, hwtacacs scheme, radius scheme.
Examples
# Configure ISP domain test to use local authentication for login users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication login local
# Configure ISP domain test to use RADIUS authentication scheme rd for login users and use local
authentication as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication login radius-scheme rd local
authentication portal
Syntax
authentication portal {local | none | radius-scheme radius-scheme-name [ local ] }
undo authentication portal
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local authentication.
none: Does not perform any authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use the authentication portal command to configure the authentication method for portal users.
Use the undo authentication portal command to restore the default.
By default, the default authentication method for the ISP domain is used for portal users.
The specified RADIUS scheme must have been configured.
10
Related commands: local-user, authentication default, and radius scheme.
Examples
# Configure ISP domain test to use local authentication for portal users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication portal local
# Configure ISP domain test to use RADIUS scheme rd for authentication of portal users and use local
authentication as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication portal radius-scheme rd local
authentication super
Syntax
authentication super { hwtacacs-scheme hwtacacs-scheme-name | radius-scheme
radius-scheme-name }
undo authentication super
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use the authentication super command to configure the authentication method for user privilege level
switching.
Use the undo authentication super command to restore the default.
By default, the default authentication method for the ISP domain is used for user privilege level switching
authentication.
The specified RADIUS or HWTACACS authentication scheme must have been configured.
Related commands: hwtacacs scheme and radius scheme; super authentication-mode (Fundamentals
Command Reference).
Examples
# Configure ISP domain test to use HWTACACS scheme tac for user privilege level switching
authentication.
<Sysname> system-view
[Sysname] super authentication-mode scheme
[Sysname] domain test
Other manuals for 3600 v2 Series
9
Table of contents
Other HP Switch manuals
HP
HP ProCurve Switch 2650 User manual
HP
HP Aruba CX 10000-48Y6C Installation instructions
HP
HP A7533A - Brocade 4Gb SAN Switch Base Instruction Manual
HP
HP A5120 EI Series User manual
HP
HP 8/20q Installation and operating manual
HP
HP AP775A - Nexus Converged Network Switch 5010 Programming manual
HP
HP 5920 Installation manual
HP
HP 5500 EI series User manual
HP
HP ProCurve 2520-24-PoE Manual
HP
HP 5800 Installation manual
HP
HP 1405-5 User manual
HP
HP 10500 series User manual
HP
HP 6127XLG Blade Series Installation manual
HP
HP A12500 Assembly instructions
HP
HP ProLiant BL p-Class GbE2 User manual
HP
HP StorageWorks Brocade User manual
HP
HP ProCurve 10/100 12 User manual
HP
HP Deskjet 870 Instruction Manual
HP
HP ProCurve 2510-24 User manual
HP
HP ProCurve 1600M User manual
