HP 5920 Installation manual
HP 5920 & 5900 Switch Series
Security
Command Reference
Part number: 5998-2887
Software version: Release2208
Document version: 6W100-20130228
Legal and notice information
© Copyright 2013 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or
use of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained
herein.
Contents
AAA commands ··························································································································································· 1
General AAA commands ·················································································································································1
access-limit enable ···················································································································································1
accounting command···············································································································································2
accounting default····················································································································································2
accounting lan-access ··············································································································································4
accounting login·······················································································································································5
authentication default···············································································································································7
authentication lan-access·········································································································································8
authentication login··················································································································································9
authentication super·············································································································································· 11
authorization command········································································································································ 12
authorization default ············································································································································· 13
authorization lan-access ······································································································································· 15
authorization login ················································································································································ 16
display domain······················································································································································ 18
domain ··································································································································································· 19
domain default enable·········································································································································· 20
state (ISP domain view)········································································································································· 21
Local user commands····················································································································································· 22
authorization-attribute ··········································································································································· 22
bind-attribute ·························································································································································· 23
display local-user··················································································································································· 25
display user-group················································································································································· 26
group ······································································································································································ 27
local-user ································································································································································ 28
password································································································································································ 29
service-type····························································································································································· 31
state (local user view)············································································································································ 32
user-group ······························································································································································ 32
RADIUS commands ························································································································································ 33
accounting-on enable············································································································································ 33
data-flow-format (RADIUS scheme view)············································································································· 34
display radius scheme ·········································································································································· 35
display radius statistics ········································································································································· 37
key (RADIUS scheme view)··································································································································· 39
nas-ip (RADIUS scheme view) ······························································································································ 40
primary accounting (RADIUS scheme view) ······································································································· 41
primary authentication (RADIUS scheme view)·································································································· 42
i
radius nas-ip··························································································································································· 44
radius scheme························································································································································ 45
radius session-control enable ······························································································································· 46
reset radius statistics·············································································································································· 46
retry········································································································································································· 47
retry realtime-accounting ······································································································································ 48
secondary accounting (RADIUS scheme view)··································································································· 49
secondary authentication (RADIUS scheme view) ····························································································· 51
security-policy-server ············································································································································· 53
state primary ·························································································································································· 53
state secondary······················································································································································ 54
timer quiet (RADIUS scheme view) ······················································································································ 56
timer realtime-accounting (RADIUS scheme view) ····························································································· 56
timer response-timeout (RADIUS scheme view) ·································································································· 57
user-name-format (RADIUS scheme view) ··········································································································· 58
vpn-instance (RADIUS scheme view) ··················································································································· 59
HWTACACS commands ··············································································································································· 60
data-flow-format (HWTACACS scheme view)···································································································· 60
display hwtacacs scheme····································································································································· 61
hwtacacs nas-ip ····················································································································································· 63
hwtacacs scheme··················································································································································· 64
key (HWTACACS scheme view)·························································································································· 64
nas-ip (HWTACACS scheme view) ····················································································································· 66
primary accounting (HWTACACS scheme view) ······························································································ 67
primary authentication (HWTACACS scheme view)························································································· 68
primary authorization ··········································································································································· 70
reset hwtacacs statistics ········································································································································ 71
secondary accounting (HWTACACS scheme view)·························································································· 72
secondary authentication (HWTACACS scheme view)····················································································· 73
secondary authorization······································································································································· 75
timer quiet (HWTACACS scheme view) ············································································································· 77
timer realtime-accounting (HWTACACS scheme view)····················································································· 77
timer response-timeout (HWTACACS scheme view) ························································································· 78
user-name-format (HWTACACS scheme view) ·································································································· 79
vpn-instance (HWTACACS scheme view) ·········································································································· 80
LDAP commands····························································································································································· 81
authentication-server ············································································································································· 81
display ldap scheme ············································································································································· 81
ip ············································································································································································· 83
ipv6········································································································································································· 84
ldap scheme··························································································································································· 85
ldap server ····························································································································································· 85
login-dn··································································································································································· 86
ii
login-password ······················································································································································ 87
protocol-version ····················································································································································· 88
search-base-dn······················································································································································· 89
search-scope ·························································································································································· 89
server-timeout ························································································································································· 90
user-parameters ····················································································································································· 91
802.1X commands ····················································································································································93
display dot1x························································································································································· 93
dot1x······································································································································································· 95
dot1x authentication-method································································································································ 96
dot1x handshake··················································································································································· 97
dot1x mandatory-domain ····································································································································· 98
dot1x max-user ······················································································································································ 99
dot1x multicast-trigger·········································································································································100
dot1x port-control ················································································································································100
dot1x port-method ···············································································································································101
dot1x quiet-period···············································································································································102
dot1x re-authenticate ··········································································································································103
dot1x retry····························································································································································103
dot1x timer···························································································································································104
dot1x unicast-trigger ···········································································································································106
reset dot1x statistics ············································································································································107
MAC authentication commands····························································································································· 108
display mac-authentication·································································································································108
mac-authentication ··············································································································································110
mac-authentication domain ································································································································110
mac-authentication max-user ······························································································································111
mac-authentication timer·····································································································································112
mac-authentication user-name-format ················································································································113
reset mac-authentication statistics ······················································································································115
Port security commands ·········································································································································· 116
display port-security ············································································································································116
display port-security mac-address block ···········································································································118
display port-security mac-address security········································································································120
port-security authorization ignore······················································································································122
port-security enable ·············································································································································123
port-security intrusion-mode ································································································································124
port-security mac-address security ·····················································································································125
port-security max-mac-count ·······························································································································127
port-security ntk-mode ·········································································································································127
port-security oui ···················································································································································128
port-security port-mode········································································································································129
iii
port-security timer autolearn aging····················································································································132
port-security timer disableport····························································································································132
Password control commands·································································································································· 134
display password-control····································································································································134
display password-control blacklist·····················································································································135
password-control { aging | composition | history | length } enable ····························································136
password-control aging ······································································································································138
password-control alert-before-expire ·················································································································139
password-control complexity······························································································································139
password-control composition····························································································································140
password-control enable·····································································································································142
password-control expired-user-login··················································································································142
password-control history ·····································································································································143
password-control length······································································································································144
password-control login idle-time ························································································································145
password-control login-attempt ··························································································································146
password-control super aging····························································································································148
password-control super composition ·················································································································148
password-control super length ···························································································································149
password-control update-interval ·······················································································································150
reset password-control blacklist ·························································································································151
reset password-control history-record················································································································152
Public key management commands······················································································································· 153
display public-key local public···························································································································153
display public-key peer·······································································································································157
peer-public-key end ·············································································································································158
public-key local create ········································································································································159
public-key local destroy ······································································································································163
public-key local export dsa ································································································································164
public-key local export rsa ·································································································································166
public-key peer ····················································································································································168
public-key peer import sshkey····························································································································169
PKI commands ························································································································································· 171
attribute·································································································································································171
ca identifier ··························································································································································173
certificate request entity ······································································································································173
certificate request from ·······································································································································174
certificate request mode······································································································································175
certificate request polling ···································································································································176
certificate request url···········································································································································177
common-name······················································································································································178
country··································································································································································179
iv
crl check ·······························································································································································179
crl url·····································································································································································180
display pki certificate access-control-policy······································································································181
display pki certificate attribute-group················································································································182
display pki certificate domain····························································································································184
display pki certificate request-status ··················································································································188
display pki crl ······················································································································································189
fqdn·······································································································································································191
ip ···········································································································································································192
ldap-server····························································································································································192
locality ··································································································································································193
organization·························································································································································194
organization-unit··················································································································································195
pki abort-certificate-request ································································································································195
pki certificate access-control-policy ···················································································································196
pki certificate attribute-group ·····························································································································197
pki delete-certificate ············································································································································198
pki domain ···························································································································································199
pki entity·······························································································································································200
pki export ·····························································································································································200
pki import ·····························································································································································207
pki request-certificate ··········································································································································212
pki retrieve-certificate ··········································································································································213
pki retrieve-crl ······················································································································································214
pki storage ···························································································································································215
pki validate-certificate ·········································································································································216
public-key dsa······················································································································································218
public-key ecdsa··················································································································································219
public-key rsa·······················································································································································220
root-certificate fingerprint····································································································································222
rule ········································································································································································223
source ···································································································································································224
state·······································································································································································225
usage ····································································································································································226
SSH commands ······················································································································································· 228
SSH server configuration commands ·························································································································228
display ssh server ················································································································································228
display ssh user-information ·······························································································································229
sftp server enable ················································································································································230
sftp server idle-timeout·········································································································································231
ssh server acl ·······················································································································································232
ssh server ipv6 acl···············································································································································233
ssh server authentication-retries ·························································································································234
v
ssh server authentication-timeout························································································································234
ssh server compatible-ssh1x enable ··················································································································235
ssh server enable·················································································································································236
ssh server rekey-interval······································································································································236
ssh user·································································································································································237
SSH client configuration commands ··························································································································239
bye ········································································································································································239
cd ··········································································································································································240
cdup······································································································································································240
delete ····································································································································································241
dir··········································································································································································241
display sftp client source·····································································································································243
display ssh client source ·····································································································································243
exit ········································································································································································244
get ·········································································································································································244
help ·······································································································································································245
ls············································································································································································246
mkdir·····································································································································································247
put ·········································································································································································247
pwd·······································································································································································248
quit ········································································································································································248
remove··································································································································································248
rename··································································································································································249
rmdir ·····································································································································································249
scp·········································································································································································250
scp ipv6································································································································································252
sftp·········································································································································································255
sftp client ipv6 source ·········································································································································257
sftp client source ··················································································································································258
sftp ipv6································································································································································259
ssh client ipv6 source··········································································································································261
ssh client source···················································································································································262
ssh2·······································································································································································263
ssh2 ipv6······························································································································································265
SSL commands························································································································································· 268
SSL server policy configuration commands···············································································································268
ciphersuite ····························································································································································268
client-verify enable ··············································································································································270
display ssl server-policy ······································································································································270
pki-domain (SSL server policy view)··················································································································271
session cachesize ················································································································································272
ssl server-policy····················································································································································273
SSL client policy configuration commands ················································································································273
vi
display ssl client-policy········································································································································273
pki-domain (SSL client policy view) ···················································································································274
prefer-cipher·························································································································································275
server-verify enable ·············································································································································277
ssl client-policy ·····················································································································································278
version ··································································································································································278
IP source guard commands ···································································································································· 280
display ip source binding···································································································································280
display ipv6 source binding static·····················································································································281
ip source binding ················································································································································283
ip verify source ····················································································································································284
ipv6 source binding ············································································································································285
ipv6 verify source················································································································································286
reset ip source binding ·······································································································································287
reset ipv6 source binding ···································································································································288
ARP attack protection commands ·························································································································· 290
Unresolvable IP attack protection commands ···········································································································290
arp resolving-route enable··································································································································290
arp source-suppression enable ··························································································································291
arp source-suppression limit ·······························································································································291
display arp source-suppression··························································································································292
ARP packet rate limit commands································································································································293
arp rate-limit·························································································································································293
Source MAC based ARP attack detection commands ·····························································································293
arp source-mac ····················································································································································293
arp source-mac aging-time ·································································································································294
arp source-mac exclude-mac······························································································································295
arp source-mac threshold ···································································································································295
display arp source-mac·······································································································································296
ARP packet source MAC consistency check commands··························································································297
arp valid-check enable ·······································································································································297
ARP active acknowledgement commands ·················································································································298
arp active-ack enable··········································································································································298
ARP detection commands············································································································································298
arp detection enable···········································································································································298
arp detection trust················································································································································299
arp detection validate·········································································································································299
arp restricted-forwarding enable ·······················································································································300
display arp detection ··········································································································································301
display arp detection statistics ···························································································································301
reset arp detection statistics································································································································302
ARP automatic scanning and fixed ARP commands ································································································303
arp fixup·······························································································································································303
vii
arp scan ·······························································································································································303
ARP gateway protection commands ··························································································································304
arp filter source····················································································································································304
ARP filtering commands···············································································································································305
arp filter binding··················································································································································305
uRPF commands ······················································································································································ 307
ip urpf ···································································································································································307
display ip urpf······················································································································································308
FIPS commands ······················································································································································· 309
fips mode enable·················································································································································309
fips self-test ···························································································································································310
display fips status ················································································································································311
IPsec commands······················································································································································ 313
ah authentication-algorithm································································································································313
description····························································································································································314
display ipsec { ipv6-policy | policy } ················································································································315
display ipsec { ipv6-policy-template | policy-template } ·················································································319
display ipsec profile············································································································································321
display ipsec sa···················································································································································322
display ipsec statistics·········································································································································326
display ipsec transform-set ·································································································································328
display ipsec tunnel·············································································································································329
encapsulation-mode ············································································································································331
esp authentication-algorithm ······························································································································333
esp encryption-algorithm ····································································································································334
ike-profile······························································································································································335
ipsec anti-replay check ·······································································································································336
ipsec anti-replay window ···································································································································337
ipsec decrypt-check enable ································································································································337
ipsec logging packet enable······························································································································338
ipsec df-bit····························································································································································339
ipsec global-df-bit ················································································································································340
ipsec { ipv6-policy | policy } (interface view) ··································································································341
ipsec { ipv6-policy | policy } (system view)······································································································341
ipsec { ipv6-policy | policy } isakmp template·································································································343
ipsec { ipv6-policy | policy } local-address······································································································344
ipsec { ipv6-policy-template | policy-template } policy-template ····································································345
ipsec profile ·························································································································································346
ipsec sa global-duration ·····································································································································347
ipsec sa idle-time ·················································································································································348
ipsec transform-set ···············································································································································349
local-address························································································································································349
viii
pfs ·········································································································································································350
protocol ································································································································································351
qos pre-classify ····················································································································································352
remote-address·····················································································································································353
reset ipsec sa ·······················································································································································354
reset ipsec statistics ·············································································································································356
sa duration ···························································································································································356
sa hex-key authentication ···································································································································357
sa hex-key encryption ·········································································································································358
sa idle-time ···························································································································································360
sa spi ····································································································································································360
sa string-key ·························································································································································361
security acl ···························································································································································363
transform-set ·························································································································································364
IKE commands························································································································································· 366
authentication-algorithm ·····································································································································366
authentication-method ·········································································································································367
certificate domain················································································································································368
dh··········································································································································································369
display ike proposal············································································································································370
display ike sa·······················································································································································371
dpd········································································································································································374
encryption-algorithm············································································································································375
exchange-mode ···················································································································································376
ike dpd ·································································································································································377
ike identity····························································································································································378
ike invalid-spi-recovery enable···························································································································379
ike keepalive interval ··········································································································································380
ike keepalive timeout ··········································································································································381
ike keychain·························································································································································381
ike limit ·································································································································································382
ike nat-keepalive··················································································································································383
ike profile ·····························································································································································384
ike proposal ·························································································································································384
ike signature-identity from-certificate ·················································································································386
inside-vpn ·····························································································································································386
keychain ·······························································································································································387
local-identity ·························································································································································388
match local address (IKE keychain view)··········································································································389
match local address (IKE profile view)··············································································································390
match remote ·······················································································································································391
pre-shared-key······················································································································································393
priority (IKE keychain view)································································································································394
ix
x
priority (IKE profile view) ····································································································································395
proposal ·······························································································································································396
reset ike sa ···························································································································································396
sa duration ···························································································································································397
Support and other resources ·································································································································· 399
Contacting HP ······························································································································································399
Subscription service ············································································································································399
Related information······················································································································································399
Documents····························································································································································399
Websites·······························································································································································399
Conventions ··································································································································································400
Index ········································································································································································ 402
AAA commands
The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for features,
commands, and parameters might differ in FIPS mode and non-FIPS mode. For more information about
FIPS mode, see Security Configuration Guide.
General AAA commands
access-limit enable
Use access-limit enable to set the maximum number of online users in an ISP domain. After the number
of online users reaches the allowed maximum number, no more users are accepted.
Use undo access-limit enable to restore the default.
Syntax
access-limit enable max-user-number
undo access-limit enable
Default
There is no limit to the number of online users in an ISP domain.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
max-user-number: Maximum number of online users that the ISP domain can accommodate. The value
range is 1 to 4294967294.
Usage guidelines
System resources are limited, and user connections may compete for network resources when there are
excessive users. Setting a proper limit to the number of online users helps provide reliable system
performance.
Examples
# Set a limit of 500 user connections for ISP domain test.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] access-limit enable 500
1
Related commands
display domain
accounting command
Use accounting command to specify the command line accounting method.
Use undo accounting command to restore the default.
Syntax
accounting command hwtacacs-scheme hwtacacs-scheme-name
undo accounting command
Default
The default accounting method of the ISP domain is used for command line accounting.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
Usage guidelines
The command line accounting function cooperates with the accounting server to record all commands
that have been successfully executed on the device.
Command line accounting can use only a remote HWTACACS server.
Examples
# Configure ISP domain test to use HWTACACS scheme hwtac for command line accounting.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting command hwtacacs-scheme hwtac
Related commands
•accounting default
•command accounting (Fundamentals Command Reference)
•hwtacacs scheme
accounting default
Use accounting default to specify the default accounting method for an ISP domain.
Use undo accounting default to restore the default.
2
Syntax
In non-FIPS mode:
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[local ][none ]|local [none ] | none |radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [ local ] [ none ] }
undo accounting default
In FIPS mode:
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[local ] | local |radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ]
[local ] }
undo accounting default
Default
The default accounting method of an ISP domain is local.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
The default accounting method is used for all users who support this method and do not have a specific
accounting method configured.
Local accounting is only used for monitoring and controlling the number of local user connections, but
does not provide the statistics function that the accounting feature generally provides.
You can specify multiple default accounting methods, one primary and multiple backup methods. When
the primary method is invalid, the device attempts to use the backup methods in sequence. For example,
the accounting default radius-scheme radius-scheme-name local none command specifies the primary
default RADIUS accounting method and two backup accounting methods, local accounting and no
accounting. With this command, the device performs RADIUS accounting by default, performs local
accounting when the RADIUS server is invalid, and does not perform accounting when both of the
previous methods are invalid.
3
Examples
# Configure the default accounting method for ISP domain test to use RADIUS scheme rd and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting default radius-scheme rd local
Related commands
•hwtacacs scheme
•local-user
•radius scheme
accounting lan-access
Use accounting lan-access to configure the accounting method for LAN users.
Use undo accounting lan-access to restore the default.
Syntax
In non-FIPS mode:
accounting lan-access { local [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }
undo accounting lan-access
In FIPS mode:
accounting lan-access { local |radius-scheme radius-scheme-name [ local ] }
undo accounting lan-access
Default
The default accounting method for the ISP domain is used for LAN users.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
local: Performs local accounting.
none: Does not perform accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
You can specify multiple accounting methods, one primary and multiple backup methods. When the
primary method is invalid, the device attempts to use the backup methods in sequence. For example, the
4
accounting lan-access radius-scheme radius-scheme-name local none command specifies a primary
RADIUS accounting method and two backup accounting methods, local accounting and no accounting.
With this command, the device performs RADIUS accounting by default, performs local accounting
when the RADIUS server is invalid, and does not perform accounting when both of the previous methods
are invalid.
Examples
# Configure ISP domain test to use local accounting for LAN users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting lan-access local
# Configure ISP domain test to use RADIUS accounting scheme rd for LAN users and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting lan-access radius-scheme rd local
Related commands
•accounting default
•local-user
•radius scheme
accounting login
Use accounting login to specify the accounting method for login users.
Use undo accounting login to restore the default.
Syntax
In non-FIPS mode:
accounting login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[local ][none ]|local [none ] | none |radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [ local ] [ none ]}
undo accounting login
In FIPS mode:
accounting login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[local ] | local |radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ]
[local ] }
undo accounting login
Default
The default accounting method of the ISP domain is used for login users.
5
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
Accounting is not supported for login users who use FTP.
You can specify multiple default accounting methods, one primary and multiple backup methods. When
the primary method is invalid, the device attempts to use the backup methods in sequence. For example,
the accounting login radius-scheme radius-scheme-name local none command specifies a primary
default RADIUS accounting method and two backup accounting methods, local accounting and no
accounting. With this command, the device performs RADIUS accounting by default, performs local
accounting when the RADIUS server is invalid, and does not perform accounting when both of the
previous methods are invalid.
Examples
# Configure ISP domain test to use local accounting for login users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login local
# Configure ISP domain test to use RADIUS scheme rd for login user accounting and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login radius-scheme rd local
Related commands
•accounting default
•hwtacacs scheme
•local-user
•radius scheme
6
authentication default
Use authentication default to specify the default authentication method for an ISP domain.
Use undo authentication default to restore the default.
Syntax
In non-FIPS mode:
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] [ none ] | ldap-scheme ldap-scheme-name [ local ] [ none ] | local [ none ]
| none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ]
[ none ] }
undo authentication default
In FIPS mode:
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] | ldap-scheme ldap-scheme-name [ local ] | local | radius-scheme
radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }
undo authentication default
Default
The default authentication method of an ISP domain is local.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
ldap-scheme ldap-scheme-name: Specifies an LDAP scheme by its name, a case-insensitive string of 1 to
32 characters.
local: Performs local authentication.
none: Does not perform authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
The default authentication method is used for all users who support this method and do not have a
specific authentication method configured.
You can specify multiple default authentication methods, one primary and multiple backup methods.
When the primary method is invalid, the device attempts to use the backup methods in sequence. For
7
example, the authentication default radius-scheme radius-scheme-name local none command specifies
a primary default RADIUS authentication method and two backup authentication methods, local
authentication and no authentication. With this command, the device performs RADIUS authentication
by default, performs local authentication when the RADIUS server is invalid, and does not perform
authentication when both of the previous methods are invalid.
Examples
# Configure the default authentication method for ISP domain test to use RADIUS scheme rd and use
local authentication as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication default radius-scheme rd local
Related commands
•hwtacacs scheme
•ldap scheme
•local-user
•radius scheme
authentication lan-access
Use authentication lan-access to configure the authentication method for LAN users.
Use undo authentication lan-access to restore the default.
Syntax
In non-FIPS mode:
authentication lan-access { local [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }
undo authentication lan-access
In FIPS mode:
authentication lan-access { local | radius-scheme radius-scheme-name [ local ] }
undo authentication lan-access
Default
The default authentication method for the ISP domain is used for LAN users.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
local: Performs local authentication.
8
Other manuals for 5920
18
This manual suits for next models
3
Table of contents
Other HP Switch manuals
HP
HP 445860-B21 - 10Gb Ethernet BL-c Switch User manual
HP
HP 445860-B21 - 10Gb Ethernet BL-c Switch Operating manual
HP
HP OfficeConnect 1820 8G User manual
HP
HP E5400 zl Series User manual
HP
HP FlexFabric 7900 Series Installation manual
HP
HP ProCurve 3500 User manual
HP
HP 5120-48G-PoE+ EI User instructions
HP
HP J9827A User manual
HP
HP A5830 Series Installation manual
HP
HP 5130 EI Switch Series User manual
HP
HP AA979A - StorageWorks SAN Switch 2/8V Service manual
HP
HP V1810-48G User manual
HP
HP zl User manual
HP
HP 5120 SI Series User manual
HP
HP 3100 v2 Series User manual
HP
HP J4865A User manual
HP
HP ProCurv J8768A Manual
HP
HP Officejet Pro 7500 Series User manual
HP
HP ProCurve 5300xl User manual
HP
HP ProCurve 6200yl-24G Assembly instructions
Popular Switch manuals by other brands
Pfeiffer Vacuum
Pfeiffer Vacuum OHA 200 operating instructions
LDG
LDG DTS-6 manual
Siemens
Siemens SIMATIC NET RUGGEDCOM RSG2300 installation manual
CTC Union
CTC Union ITP-1204GTM-12PHE Quick installation guide
Accton Technology
Accton Technology SwitcHub-2s installation manual
Siemens
Siemens 5SG7234-1 operating instructions