HP 5120 SI Series Installation manual
HP 5120 SI Switch Series
Security
Command Reference
Part number: 5998-1814
Software version: Release 1513
Document version: 6W100-20130830
Legal and notice information
© Copyright 2013 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or
use of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained
herein.
i
Contents
AAA configuration commands···································································································································· 1
General AAA configuration commands ·························································································································1
aaa nas-id profile ·····················································································································································1
access-limit enable ···················································································································································1
accounting command···············································································································································2
accounting default····················································································································································3
accounting lan-access ··············································································································································4
accounting login·······················································································································································4
accounting optional ·················································································································································5
accounting portal ·····················································································································································6
authentication default···············································································································································7
authentication lan-access·········································································································································8
authentication login··················································································································································8
authentication portal ················································································································································9
authentication super ·············································································································································· 10
authorization command········································································································································ 11
authorization default ············································································································································· 12
authorization lan-access ······································································································································· 13
authorization login ················································································································································ 14
authorization portal··············································································································································· 15
authorization-attribute user-profile ······················································································································· 15
cut connection························································································································································ 16
display connection ················································································································································ 17
display domain······················································································································································ 20
domain ··································································································································································· 21
domain default enable·········································································································································· 22
idle-cut enable························································································································································ 23
nas-id bind vlan ····················································································································································· 24
self-service-url enable ············································································································································ 24
state········································································································································································· 25
Local user configuration commands····························································································································· 26
access-limit ····························································································································································· 26
authorization-attribute (local user view/user group view) ················································································ 27
bind-attribute ·························································································································································· 28
display local-user··················································································································································· 29
display user-group················································································································································· 31
expiration-date (local user view)·························································································································· 32
group ······································································································································································ 33
local-user ································································································································································ 33
password································································································································································ 34
service-type····························································································································································· 35
state(local user view)············································································································································· 36
user-group ······························································································································································ 37
RADIUS configuration commands ································································································································ 38
accounting-on enable············································································································································ 38
attribute 25 car······················································································································································ 39
data-flow-format (RADIUS scheme view)············································································································· 39
display radius scheme ·········································································································································· 40
display radius statistics ········································································································································· 43
ii
display stop-accounting-buffer······························································································································ 46
key (RADIUS scheme view)··································································································································· 47
nas-ip (RADIUS scheme view) ······························································································································ 48
primary accounting (RADIUS scheme view) ······································································································· 49
primary authentication (RADIUS scheme view)·································································································· 50
radius client···························································································································································· 52
radius nas-ip··························································································································································· 53
radius scheme························································································································································ 54
radius trap······························································································································································ 55
reset radius statistics·············································································································································· 56
reset stop-accounting-buffer·································································································································· 56
retry········································································································································································· 57
retry realtime-accounting ······································································································································ 58
retry stop-accounting (RADIUS scheme view)····································································································· 59
secondary accounting (RADIUS scheme view)··································································································· 59
secondary authentication (RADIUS scheme view) ····························································································· 61
security-policy-server ············································································································································· 63
server-type ······························································································································································ 64
state primary ·························································································································································· 65
state secondary······················································································································································ 65
stop-accounting-buffer enable (RADIUS scheme view) ······················································································ 66
timer quiet (RADIUS scheme view) ······················································································································ 67
timer realtime-accounting (RADIUS scheme view) ····························································································· 68
timer response-timeout (RADIUS scheme view) ·································································································· 69
user-name-format (RADIUS scheme view) ··········································································································· 69
HWTACACS configuration commands ······················································································································· 70
data-flow-format (HWTACACS scheme view)···································································································· 70
display hwtacacs··················································································································································· 71
display stop-accounting-buffer······························································································································ 74
hwtacacs nas-ip ····················································································································································· 74
hwtacacs scheme··················································································································································· 75
key (HWTACACS scheme view)·························································································································· 76
nas-ip (HWTACACS scheme view) ····················································································································· 77
primary accounting (HWTACACS scheme view) ······························································································ 78
primary authentication (HWTACACS scheme view)························································································· 79
primary authorization ··········································································································································· 80
reset hwtacacs statistics ········································································································································ 81
reset stop-accounting-buffer·································································································································· 82
retry stop-accounting (HWTACACS scheme view)···························································································· 82
secondary accounting (HWTACACS scheme view)·························································································· 83
secondary authentication (HWTACACS scheme view)····················································································· 84
secondary authorization······································································································································· 85
stop-accounting-buffer enable (HWTACACS scheme view) ············································································· 87
timer quiet (HWTACACS scheme view) ············································································································· 87
timer realtime-accounting (HWTACACS scheme view)····················································································· 88
timer response-timeout (HWTACACS scheme view) ························································································· 89
user-name-format (HWTACACS scheme view) ·································································································· 89
802.1X configuration commands ·····························································································································91
display dot1x ························································································································································· 91
dot1x······································································································································································· 94
dot1x authentication-method································································································································ 95
dot1x auth-fail vlan················································································································································ 96
dot1x critical vlan·················································································································································· 97
dot1x critical recovery-action······························································································································· 98
iii
dot1x domain-delimiter········································································································································· 99
dot1x guest-vlan ··················································································································································100
dot1x handshake·················································································································································101
dot1x handshake secure·····································································································································102
dot1x mandatory-domain ···································································································································102
dot1x max-user ····················································································································································103
dot1x multicast-trigger·········································································································································105
dot1x port-control ················································································································································105
dot1x port-method ···············································································································································106
dot1x quiet-period···············································································································································107
dot1x re-authenticate ··········································································································································108
dot1x retry····························································································································································109
dot1x timer···························································································································································110
dot1x unicast-trigger ···········································································································································111
reset dot1x statistics ············································································································································112
EAD fast deployment configuration commands···································································································· 113
dot1x free-ip·························································································································································113
dot1x timer ead-timeout······································································································································113
dot1x url ·······························································································································································114
MAC authentication configuration commands ····································································································· 116
display mac-authentication·································································································································116
mac-authentication ··············································································································································118
mac-authentication critical vlan··························································································································119
mac-authentication domain ································································································································120
mac-authentication guest-vlan ····························································································································121
mac-authentication max-user ······························································································································122
mac-authentication timer·····································································································································122
mac-authentication user-name-format ················································································································123
reset mac-authentication statistics ······················································································································124
Portal configuration commands······························································································································ 126
display portal acl·················································································································································126
display portal connection statistics ····················································································································129
display portal free-rule ········································································································································132
display portal interface·······································································································································134
display portal local-server ··································································································································135
display portal server ···········································································································································136
display portal server statistics ····························································································································137
display portal tcp-cheat statistics ·······················································································································139
display portal user···············································································································································141
portal auth-fail vlan ·············································································································································142
portal auth-network··············································································································································143
portal delete-user ·················································································································································144
portal domain ······················································································································································144
portal free-rule······················································································································································145
portal local-server ················································································································································146
portal local-server enable ···································································································································147
portal local-server ip············································································································································148
portal max-user ····················································································································································149
portal move-mode auto·······································································································································149
portal nas-id-profile ·············································································································································150
portal nas-ip ·························································································································································151
portal nas-port-type··············································································································································151
portal offline-detect interval ································································································································152
iv
portal redirect-url ·················································································································································153
portal server ·························································································································································154
portal server banner············································································································································155
portal server method ···········································································································································155
portal server server-detect···································································································································156
portal server user-sync·········································································································································158
portal web-proxy port ·········································································································································159
reset portal connection statistics ························································································································160
reset portal server statistics·································································································································161
reset portal tcp-cheat statistics····························································································································161
Port security configuration commands··················································································································· 162
display port-security ············································································································································162
display port-security mac-address block ···········································································································164
display port-security mac-address security········································································································166
port-security authorization ignore······················································································································168
port-security enable ·············································································································································169
port-security intrusion-mode ································································································································169
port-security mac-address security ·····················································································································170
port-security max-mac-count ·······························································································································171
port-security ntk-mode ·········································································································································172
port-security oui ···················································································································································173
port-security port-mode········································································································································173
port-security timer disableport····························································································································176
port-security trap··················································································································································176
User profile configuration commands···················································································································· 178
display user-profile ··············································································································································178
user-profile enable···············································································································································179
user-profile····························································································································································179
Password control configuration commands··········································································································· 181
display password-control····································································································································181
display password-control blacklist·····················································································································182
password······························································································································································183
password-control aging ······································································································································184
password-control alert-before-expire ·················································································································185
password-control authentication-timeout ···········································································································186
password-control complexity······························································································································186
password-control composition····························································································································187
password-control { aging | composition | history | length } enable····························································188
password-control enable·····································································································································189
password-control expired-user-login··················································································································190
password-control history ·····································································································································190
password-control length······································································································································191
password-control login idle-time ························································································································192
password-control login-attempt ··························································································································192
password-control password update interval·····································································································194
password-control super aging····························································································································194
password-control super composition ·················································································································195
password-control super length ···························································································································196
reset password-control blacklist ·························································································································196
reset password-control history-record················································································································197
HABP configuration commands ····························································································································· 198
display habp························································································································································198
v
display habp table ··············································································································································199
display habp traffic ·············································································································································199
habp client vlan···················································································································································200
habp enable·························································································································································201
habp server vlan··················································································································································201
habp timer····························································································································································202
Public key configuration commands ······················································································································ 203
display public-key local public···························································································································203
display public-key peer·······································································································································205
peer-public-key end ·············································································································································206
public-key-code begin ·········································································································································206
public-key-code end ············································································································································207
public-key local create ········································································································································208
public-key local destroy ······································································································································209
public-key local export dsa ································································································································209
public-key local export rsa ·································································································································211
public-key peer ····················································································································································212
public-key peer import sshkey····························································································································212
PKI configuration commands·································································································································· 214
attribute·································································································································································214
ca identifier ··························································································································································215
certificate request entity ······································································································································215
certificate request from ·······································································································································216
certificate request mode······································································································································217
certificate request polling ···································································································································217
certificate request url···········································································································································218
common-name······················································································································································219
country··································································································································································219
crl check ·······························································································································································220
crl update-period ·················································································································································220
crl url·····································································································································································221
display pki certificate··········································································································································222
display pki certificate access-control-policy······································································································223
display pki certificate attribute-group················································································································224
display pki crl domain ········································································································································225
fqdn·······································································································································································227
ip (PKI entity view)···············································································································································227
ldap-server····························································································································································228
locality ··································································································································································229
organization·························································································································································229
organization-unit··················································································································································230
pki certificate access-control-policy ···················································································································230
pki certificate attribute-group ·····························································································································231
pki delete-certificate ············································································································································231
pki domain ···························································································································································232
pki entity·······························································································································································232
pki import-certificate············································································································································233
pki request-certificate domain ····························································································································234
pki retrieval-certificate·········································································································································235
pki retrieval-crl domain ·······································································································································235
pki validate-certificate ·········································································································································236
root-certificate fingerprint····································································································································236
rule (PKI CERT ACP view) ···································································································································237
vi
state·······································································································································································238
SSH2.0 configuration commands·························································································································· 239
SSH2.0 server configuration commands···················································································································239
display ssh server ················································································································································239
display ssh user-information ·······························································································································240
ssh server authentication-retries ·························································································································241
ssh server authentication-timeout························································································································242
ssh server compatible-ssh1x ·······························································································································243
ssh server enable·················································································································································243
ssh server rekey-interval ······································································································································244
ssh user·································································································································································245
SSH2.0 client configuration commands ····················································································································246
display ssh client source ·····································································································································246
display ssh server-info ·········································································································································247
ssh client authentication server ··························································································································248
ssh client first-time················································································································································248
ssh client ipv6 source··········································································································································249
ssh client source···················································································································································250
ssh2·······································································································································································250
ssh2 ipv6······························································································································································252
SFTP configuration commands ······························································································································· 254
SFTP server configuration commands ························································································································254
sftp server enable ················································································································································254
sftp server idle-timeout·········································································································································254
SFTP client configuration commands··························································································································255
bye ········································································································································································255
cd ··········································································································································································255
cdup······································································································································································256
delete ····································································································································································256
dir··········································································································································································257
display sftp client source·····································································································································258
exit ········································································································································································258
get ·········································································································································································259
help ·······································································································································································259
ls············································································································································································260
mkdir·····································································································································································261
put ·········································································································································································261
pwd·······································································································································································262
quit ········································································································································································262
remove··································································································································································263
rename··································································································································································263
rmdir ·····································································································································································264
sftp·········································································································································································264
sftp client ipv6 source ·········································································································································265
sftp client source ··················································································································································266
sftp ipv6································································································································································267
SCP configuration commands ································································································································ 269
SCP client configuration commands···························································································································269
scp·········································································································································································269
SSL configuration commands ································································································································· 271
ciphersuite ····························································································································································271
client-verify enable ··············································································································································272
vii
close-mode wait···················································································································································272
display ssl client-policy········································································································································273
display ssl server-policy ······································································································································274
handshake timeout ··············································································································································275
pki-domain ···························································································································································276
prefer-cipher·························································································································································277
server-verify enable ·············································································································································277
session ··································································································································································278
ssl client-policy ·····················································································································································279
ssl server-policy····················································································································································279
version ··································································································································································280
TCP attack protection configuration commands ··································································································· 282
display tcp status ·················································································································································282
tcp anti-naptha enable ········································································································································283
tcp state ································································································································································283
tcp syn-cookie enable ·········································································································································284
tcp timer check-state ············································································································································285
IP source guard configuration commands············································································································· 286
display ip check source ······································································································································286
display user-bind ·················································································································································287
ip check source····················································································································································289
ip check source ipv6 ···········································································································································289
ip check source max-entries ·······························································································································290
user-bind·······························································································································································291
user-bind ipv6 ······················································································································································292
ARP attack protection configuration commands ··································································································· 293
ARP packet rate limit configuration commands ········································································································293
arp rate-limit·························································································································································293
Source MAC address based ARP attack detection configuration commands ·······················································293
arp anti-attack source-mac··································································································································293
arp anti-attack source-mac aging-time ··············································································································294
arp anti-attack source-mac exclude-mac ···········································································································295
arp anti-attack source-mac threshold·················································································································295
display arp anti-attack source-mac····················································································································296
ARP packet source MAC address consistency check configuration commands ···················································297
arp anti-attack valid-check enable·····················································································································297
ARP active acknowledgement configuration commands ·························································································297
arp anti-attack active-ack enable·······················································································································297
ARP detection configuration commands ····················································································································298
arp detection enable···········································································································································298
arp detection trust················································································································································299
arp detection validate·········································································································································299
arp restricted-forwarding enable ·······················································································································300
display arp detection ··········································································································································300
display arp detection statistics ···························································································································301
reset arp detection statistics································································································································302
ARP gateway protection configuration commands ··································································································303
arp filter source····················································································································································303
ARP filtering configuration commands·······················································································································303
arp filter binding··················································································································································303
ND attack defense configuration commands········································································································ 305
Source MAC consistency check commands··············································································································305
viii
ipv6 nd mac-check enable ·································································································································305
ND detection configuration commands ·····················································································································305
display ipv6 nd detection···································································································································305
display ipv6 nd detection statistics····················································································································306
ipv6 nd detection enable····································································································································307
ipv6 nd detection trust ········································································································································308
reset ipv6 nd detection statistics ························································································································308
SAVI configuration commands······························································································································· 310
ipv6 savi dad-delay ············································································································································310
ipv6 savi dad-preparedelay·······························································································································310
ipv6 savi down-delay··········································································································································311
ipv6 savi strict······················································································································································311
System-guard configuration commands················································································································· 313
display system-guard···········································································································································313
system-guard aging time·····································································································································314
system-guard control ···········································································································································314
system-guard detect-threshold ····························································································································315
system-guard enable ···········································································································································315
system-guard rate-limit·········································································································································316
FIPS configuration commands ································································································································ 317
fips mode enable·················································································································································317
display fips status ················································································································································317
fips self-test ···························································································································································318
IPsec configuration commands······························································································································· 319
ah authentication-algorithm································································································································319
connection-name··················································································································································319
display ipsec policy ············································································································································320
display ipsec proposal········································································································································323
display ipsec sa···················································································································································324
display ipsec session···········································································································································327
display ipsec statistics·········································································································································328
display ipsec tunnel·············································································································································330
encapsulation-mode ············································································································································331
esp authentication-algorithm ······························································································································332
esp encryption-algorithm ····································································································································332
ike-peer (IPsec policy view) ································································································································333
ipsec anti-replay check ·······································································································································334
ipsec anti-replay window ···································································································································334
ipsec decrypt check·············································································································································335
ipsec policy (interface view)·······························································································································335
ipsec policy (system view) ··································································································································336
ipsec proposal ·····················································································································································337
ipsec sa global-duration ·····································································································································338
ipsec session idle-time·········································································································································338
pfs ·········································································································································································339
policy enable ·······················································································································································340
proposal (IPsec policy view)·······························································································································340
qos pre-classify ····················································································································································341
reset ipsec sa ·······················································································································································342
reset ipsec session ···············································································································································343
reset ipsec statistics ·············································································································································343
sa authentication-hex ··········································································································································344
ix
sa duration ···························································································································································345
sa encryption-hex ················································································································································346
sa spi ····································································································································································347
security acl ···························································································································································347
transform·······························································································································································348
tunnel local···························································································································································349
tunnel remote ·······················································································································································350
IKE configuration commands·································································································································· 351
authentication-algorithm ·····································································································································351
authentication-method·········································································································································351
certificate domain················································································································································352
dh··········································································································································································352
display ike dpd····················································································································································353
display ike peer···················································································································································354
display ike proposal············································································································································355
display ike sa·······················································································································································356
dpd········································································································································································359
encryption-algorithm············································································································································360
exchange-mode ···················································································································································361
id-type···································································································································································361
ike dpd ·································································································································································362
ike local-name······················································································································································362
ike next-payload check disabled ·······················································································································363
ike peer (system view)·········································································································································364
ike proposal ·························································································································································364
ike sa keepalive-timer interval····························································································································365
ike sa keepalive-timer timeout ····························································································································365
ike sa nat-keepalive-timer interval······················································································································366
interval-time ··························································································································································367
local-address ························································································································································367
local-name····························································································································································368
nat traversal ·························································································································································369
peer·······································································································································································369
pre-shared-key······················································································································································370
proposal (IKE peer view) ····································································································································370
remote-address·····················································································································································371
remote-name ························································································································································372
reset ike sa ···························································································································································373
sa duration ···························································································································································374
time-out ·································································································································································374
Support and other resources ·································································································································· 376
Contacting HP ······························································································································································376
Subscription service ············································································································································376
Related information······················································································································································376
Documents····························································································································································376
Websites·······························································································································································376
Conventions ··································································································································································377
Index ········································································································································································ 379
1
AAA configuration commands
The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for features,
commands, and parameters might differ in FIPS mode and non-FIPS mode. For more information about
FIPS mode, see Security Configuration Guide.
General AAA configuration commands
aaa nas-id profile
Syntax
aaa nas-id profile profile-name
undo aaa nas-id profile profile-name
View
System view
Default level
2: System level
Parameters
profile-name: Name of the NAS ID profile, a case-insensitive string of 1 to 16 characters.
Description
Use the aaa nas-id profile command to create a NAS ID profile and enter its view. A NAS ID profile
maintains the bindings between NAS IDs and VLANs.
Use the undo aaa nas-id profile command to remove a NAS ID profile.
Related commands: nas-id bind vlan.
Examples
# Create a NAS ID profile named aaa.
<Sysname> system-view
[Sysname] aaa nas-id profile aaa
[Sysname-nas-id-prof-aaa]
access-limit enable
Syntax
access-limit enable max-user-number
undo access-limit enable
View
ISP domain view
2
Default level
2: System level
Parameters
max-user-number: Maximum number of users, in the range 1 to 2147483646.
Description
Use the access-limit enable command to enable the limit on the number of users in an ISP domain and
set the allowed maximum number. After the number of users reaches the maximum number allowed, no
more users will be accepted.
Use the undo access-limit enable command to restore the default.
By default, there is no limit to the number of users in an ISP domain.
System resources are limited, and user connections may compete for network resources when there are
many users. Setting a proper limit to the number of users helps provide reliable system performance.
Examples
# Set a limit of 500 user connections for ISP domain test.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] access-limit enable 500
accounting command
Syntax
accounting command hwtacacs-scheme hwtacacs-scheme-name
undo accounting command
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, which is a
string of 1 to 32 characters.
Description
Use the accounting command command to specify the command line accounting method.
Use the undo accounting command command to restore the default.
By default, the default accounting method for the ISP domain is used for command line accounting.
The specified HWTACACS scheme must have been configured.
Command line accounting can use only a HWTACACS scheme.
Related commands: accounting default and hwtacacs scheme.
Examples
# Configure ISP domain test to use HWTACACS scheme hwtac for command line accounting.
3
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting command hwtacacs-scheme hwtac
accounting default
Syntax
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme
radius-scheme-name [ local ] }
undo accounting default
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, which is a
string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, which is a string of 1 to 32
characters.
Description
Use the accounting default command to configure the default accounting method for an ISP domain.
Use the undo accounting default command to restore the default.
By default, the default accounting method of an ISP domain is local.
The specified RADIUS or HWTACACS scheme must have been configured.
The default accounting method will be used for all users for whom no specific accounting methods are
configured.
Local accounting is only for monitoring and controlling the number of local user connections; it does not
provide the statistics function that the accounting feature generally provides.
Related commands: hwtacacs scheme and radius scheme.
Examples
# Configure the default accounting method for ISP domain test to use RADIUS accounting scheme rd and
use local accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting default radius-scheme rd local
4
accounting lan-access
Syntax
accounting lan-access { local | none | radius-scheme radius-scheme-name [ local | none ] }
undo accounting lan-access
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, which is a string of 1 to 32
characters.
Description
Use the accounting lan-access command to configure the accounting method for LAN users.
Use the undo accounting lan-access command to restore the default.
By default, the default accounting method for the ISP domain is used for LAN users.
The specified RADIUS scheme must have been configured.
Related commands: local-user, accounting default, and radius scheme.
Examples
# Configure ISP domain test to use local accounting for LAN users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting lan-access local
# Configure ISP domain test to use RADIUS accounting scheme rd for LAN users and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting lan-access radius-scheme rd local
accounting login
Syntax
accounting login { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme
radius-scheme-name [ local ] }
undo accounting login
View
ISP domain view
5
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, which is a
string of 1 to 32 characters.
local: Performs local accounting. It is not used for charging purposes, but for collecting statistics on and
limiting the number of local user connections.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, which is a string of 1 to 32
characters.
Description
Use the accounting login command to configure the accounting method for login users.
Use the undo accounting login command to restore the default.
By default, the default accounting method for the ISP domain is used for login users.
The specified RADIUS or HWTACACS scheme must have been configured.
Accounting is not supported for login users that use FTP.
Related commands: local-user, accounting default, hwtacacs scheme, and radius scheme.
Examples
# Configure ISP domain test to use local accounting for login users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login local
# Configure ISP domain test to use RADIUS accounting scheme rd for login users and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login radius-scheme rd local
accounting optional
Syntax
accounting optional
undo accounting optional
View
ISP domain view
Default level
2: System level
Parameters
None
6
Description
Use the accounting optional command to enable the accounting optional feature.
Use the undo accounting optional command to disable the feature.
By default, the feature is disabled.
After you configure the accounting optional command for a domain, a user that will be disconnected
otherwise can continue to use the network resources when no accounting server is available or the
communication with the current accounting server fails. However, the device will not send real-time
accounting updates for the user anymore. The accounting optional feature applies to scenarios where
accounting is not important.
NOTE:
A
fter you confi
g
ure the accounting optional command, the setting by the access-limit command in local
user view is not effective.
Examples
# Enable the accounting optional feature for users in domain test.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting optional
accounting portal
Syntax
accounting portal {local | none | radius-scheme radius-scheme-name [ local ] }
undo accounting portal
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, which is a string of 1 to 32
characters.
Description
Use the accounting portal command to configure the accounting method for portal users.
Use the undo accounting portal command to restore the default.
By default, the default accounting method for the ISP domain is used for portal users.
The specified RADIUS scheme must have been configured.
Related commands: local-user, accounting default, and radius scheme.
7
Examples
# Configure ISP domain test to use local accounting for portal users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting portal local
# Configure ISP domain test to use RADIUS scheme rd for accounting on portal users and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting portal radius-scheme rd local
authentication default
Syntax
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none |
radius-scheme radius-scheme-name [ local ] }
undo authentication default
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, which is a
string of 1 to 32 characters.
local: Performs local authentication.
none: Does not perform any authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, which is a string of 1 to 32
characters.
Description
Use the authentication default command to configure the default authentication method for an ISP
domain.
Use the undo authentication default command to restore the default.
By default, the default authentication method of an ISP domain is local.
The specified RADIUS or HWTACACS scheme must have been configured.
The default authentication method will be used for all users for whom no specific authentication methods
are configured.
Related commands: local-user, hwtacacs scheme, and radius scheme.
Examples
# Configure the default authentication method for ISP domain test to use RADIUS authentication scheme
rd and use local authentication as the backup.
<Sysname> system-view
8
[Sysname] domain test
[Sysname-isp-test] authentication default radius-scheme rd local
authentication lan-access
Syntax
authentication lan-access { local | none | radius-scheme radius-scheme-name [ local | none ] }
undo authentication lan-access
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local authentication.
none: Does not perform any authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, which is a string of 1 to 32
characters.
Description
Use the authentication lan-access command to configure the authentication method for LAN users.
Use the undo authentication lan-access command to restore the default.
By default, the default authentication method for the ISP domain is used for LAN users.
The specified RADIUS scheme must have been configured.
Related commands: local-user, authentication default, and radius scheme.
Examples
# Configure ISP domain test to use local authentication for LAN users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication lan-access local
# Configure ISP domain test to use RADIUS authentication scheme rd for LAN users and use local
authentication as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication lan-access radius-scheme rd local
authentication login
Syntax
authentication login { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme
radius-scheme-name [ local ] }
undo authentication login
9
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, which is a
string of 1 to 32 characters.
local: Performs local authentication.
none: Does not perform any authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, which is a string of 1 to 32
characters.
Description
Use the authentication login command to configure the authentication method for login users (users
logging in through the console port, Telnet, or FTP).
Use the undo authentication login command to restore the default.
By default, the default authentication method for the ISP domain is used for login users.
The specified RADIUS or HWTACACS scheme must have been configured.
Related commands: local-user, authentication default, hwtacacs scheme, and radius scheme.
Examples
# Configure ISP domain test to use local authentication for login users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication login local
# Configure ISP domain test to use RADIUS authentication scheme rd for login users and use local
authentication as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication login radius-scheme rd local
authentication portal
Syntax
authentication portal {local | none | radius-scheme radius-scheme-name [ local ] }
undo authentication portal
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local authentication.
Other manuals for 5120 SI Series
3
Table of contents
Other HP Switch manuals
HP
HP ProCurve 5400zl Series User manual
HP
HP J3128A AdvanceStack 10Base-T Hub-8E User manual
HP
HP ProCurve 2610-24 User manual
HP
HP A3100-8 v2 EI User manual
HP
HP 6127XLG Blade Series Installation manual
HP
HP AF620A User instructions
HP
HP J3137A Installation and operating manual
HP
HP 316095-B21 - StorageWorks Edge Switch 2/24 Instruction Manual
HP
HP ProCurve 1410-8G User manual
HP
HP 5920 User manual
HP
HP ProCurve 8108fl Assembly instructions
HP
HP 316095-B21 - StorageWorks Edge Switch 2/24 Instruction Manual
HP
HP StorageWorks 2/16 - SAN Switch User manual
HP
HP ProCurve 5300xl Programming manual
HP
HP PROCURVE 2910AL User manual
HP
HP StorageWorks 2/140 - Director Switch User manual
HP
HP V1905-24 User manual
HP
HP STORAGEWORKS ALL-IN-ONE STORAGE SYSTEM User manual
HP
HP A7533A - Brocade 4Gb SAN Switch Base Instruction Manual
HP
HP 5800 Installation manual
Popular Switch manuals by other brands
Endress+Hauser
Endress+Hauser Nivotester FTL 375 N 3 Series manual
Exprezo
Exprezo EZ-108 user manual
AVGear
AVGear AVG-CSK-HD44 user manual
SMC Networks
SMC Networks Tiger Switch 10/100 SMC6704M Specifications
Topgreener
Topgreener TGWF500D installation instructions
Topworx
Topworx DXR-GO Installation, operation & maintenance manual