HP 6125G Installation manual
HP 6125 Blade Switch Series
Security
Command Reference
Part number: 5998-3171
Software version: Release 2103
Document version: 6W100-20120907
Legal and notice information
© Copyright 2012 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or
use of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained
herein.
i
Contents
AAA configuration commands···································································································································· 1
General AAA configuration commands ·························································································································1
aaa nas-id profile ·····················································································································································1
access-limit enable ···················································································································································1
accounting command···············································································································································2
accounting default····················································································································································3
accounting lan-access ··············································································································································3
accounting login·······················································································································································4
accounting optional ·················································································································································5
authentication default···············································································································································6
authentication lan-access·········································································································································7
authentication login··················································································································································7
authentication super ·················································································································································8
authorization command···········································································································································9
authorization default ············································································································································· 10
authorization lan-access ······································································································································· 11
authorization login ················································································································································ 12
authorization-attribute user-profile ······················································································································· 13
cut connection························································································································································ 13
display connection ················································································································································ 14
display domain······················································································································································ 17
domain ··································································································································································· 19
domain default enable·········································································································································· 20
idle-cut enable························································································································································ 20
nas-id bind vlan ····················································································································································· 21
self-service-url enable ············································································································································ 22
state (ISP domain view)········································································································································· 22
Local user configuration commands····························································································································· 23
access-limit ····························································································································································· 23
authorization-attribute (local user view/user group view) ················································································ 24
bind-attribute ·························································································································································· 25
display local-user··················································································································································· 26
display user-group················································································································································· 28
expiration-date (local user view)·························································································································· 30
group ······································································································································································ 30
group-attribute allow-guest ··································································································································· 31
local-user ································································································································································ 31
password (local user view)··································································································································· 32
service-type····························································································································································· 33
state (local user view)············································································································································ 34
user-group ······························································································································································ 35
validity-date···························································································································································· 35
RADIUS configuration commands ································································································································ 36
accounting-on enable············································································································································ 36
attribute 25 car······················································································································································ 37
data-flow-format (RADIUS scheme view)············································································································· 37
display radius scheme ·········································································································································· 38
display radius statistics ········································································································································· 41
display stop-accounting-buffer (for RADIUS)······································································································· 44
ii
key (RADIUS scheme view)··································································································································· 45
nas-ip (RADIUS scheme view) ······························································································································ 46
primary accounting (RADIUS scheme view) ······································································································· 47
primary authentication (RADIUS scheme view)·································································································· 49
radius client···························································································································································· 50
radius dscp····························································································································································· 51
radius ipv6 dscp···················································································································································· 52
radius nas-ip··························································································································································· 52
radius scheme························································································································································ 53
radius trap······························································································································································ 54
reset radius statistics·············································································································································· 55
reset stop-accounting-buffer (for RADIUS) ··········································································································· 55
retry········································································································································································· 56
retry realtime-accounting ······································································································································ 57
retry stop-accounting (RADIUS scheme view)····································································································· 58
secondary accounting (RADIUS scheme view)··································································································· 58
secondary authentication (RADIUS scheme view) ····························································································· 60
security-policy-server ············································································································································· 62
server-type ······························································································································································ 63
state primary ·························································································································································· 63
state secondary······················································································································································ 64
stop-accounting-buffer enable (RADIUS scheme view) ······················································································ 65
timer quiet (RADIUS scheme view) ······················································································································ 66
timer realtime-accounting (RADIUS scheme view) ····························································································· 66
timer response-timeout (RADIUS scheme view) ·································································································· 67
user-name-format (RADIUS scheme view) ··········································································································· 68
vpn-instance (RADIUS scheme view) ··················································································································· 69
HWTACACS configuration commands ······················································································································· 70
data-flow-format (HWTACACS scheme view)···································································································· 70
display hwtacacs··················································································································································· 70
display stop-accounting-buffer (for HWTACACS)······························································································ 74
hwtacacs nas-ip ····················································································································································· 74
hwtacacs scheme··················································································································································· 75
key (HWTACACS scheme view)·························································································································· 76
nas-ip (HWTACACS scheme view) ····················································································································· 77
primary accounting (HWTACACS scheme view) ······························································································ 78
primary authentication (HWTACACS scheme view)························································································· 79
primary authorization ··········································································································································· 80
reset hwtacacs statistics ········································································································································ 81
reset stop-accounting-buffer (for HWTACACS) ·································································································· 81
retry stop-accounting (HWTACACS scheme view)···························································································· 82
secondary accounting (HWTACACS scheme view)·························································································· 82
secondary authentication (HWTACACS scheme view)····················································································· 83
secondary authorization······································································································································· 84
stop-accounting-buffer enable (HWTACACS scheme view) ············································································· 85
timer quiet (HWTACACS scheme view) ············································································································· 86
timer realtime-accounting (HWTACACS scheme view)····················································································· 86
timer response-timeout (HWTACACS scheme view) ························································································· 87
user-name-format (HWTACACS scheme view) ·································································································· 88
vpn-instance (HWTACACS scheme view) ·········································································································· 89
802.1X configuration commands ·····························································································································90
display dot1x ························································································································································· 90
dot1x······································································································································································· 93
dot1x authentication-method································································································································ 94
iii
dot1x auth-fail vlan················································································································································ 96
dot1x critical vlan·················································································································································· 96
dot1x critical recovery-action······························································································································· 98
dot1x domain-delimiter········································································································································· 98
dot1x guest-vlan ···················································································································································· 99
dot1x handshake·················································································································································101
dot1x handshake secure·····································································································································101
dot1x mandatory-domain ···································································································································102
dot1x max-user ····················································································································································103
dot1x multicast-trigger·········································································································································104
dot1x port-control ················································································································································105
dot1x port-method ···············································································································································106
dot1x quiet-period···············································································································································107
dot1x re-authenticate ··········································································································································107
dot1x retry····························································································································································108
dot1x timer···························································································································································109
dot1x unicast-trigger ···········································································································································110
reset dot1x statistics ············································································································································111
EAD fast deployment configuration commands···································································································· 112
dot1x free-ip·························································································································································112
dot1x timer ead-timeout······································································································································112
dot1x url ·······························································································································································113
MAC authentication configuration commands ····································································································· 115
display mac-authentication·································································································································115
mac-authentication ··············································································································································117
mac-authentication domain ································································································································118
mac-authentication max-user ······························································································································119
mac-authentication timer·····································································································································120
mac-authentication user-name-format ················································································································120
reset mac-authentication statistics ······················································································································122
Port security configuration commands··················································································································· 123
display port-security ············································································································································123
display port-security mac-address block ···········································································································126
display port-security mac-address security········································································································127
port-security authorization ignore······················································································································129
port-security enable ·············································································································································130
port-security intrusion-mode ································································································································130
port-security mac-address aging-type inactivity································································································131
port-security mac-address dynamic····················································································································132
port-security mac-address security ·····················································································································133
port-security max-mac-count ·······························································································································134
port-security ntk-mode ·········································································································································135
port-security oui ···················································································································································136
port-security port-mode········································································································································137
port-security timer autolearn aging····················································································································139
port-security timer disableport····························································································································139
port-security trap··················································································································································140
User profile configuration commands···················································································································· 142
display user-profile ··············································································································································142
user-profile enable···············································································································································143
user-profile····························································································································································143
iv
Password control configuration commands··········································································································· 145
display password-control····································································································································145
display password-control blacklist·····················································································································146
password······························································································································································147
password-control { aging | composition | history | length } enable ····························································148
password-control aging ······································································································································149
password-control alert-before-expire ·················································································································150
password-control authentication-timeout ···········································································································151
password-control complexity······························································································································151
password-control composition····························································································································152
password-control enable·····································································································································153
password-control expired-user-login··················································································································153
password-control history ·····································································································································154
password-control length······································································································································155
password-control login idle-time ························································································································156
password-control login-attempt ··························································································································156
password-control password update interval·····································································································158
password-control super aging····························································································································158
password-control super composition ·················································································································159
password-control super length ···························································································································159
reset password-control blacklist ·························································································································160
reset password-control history-record················································································································160
Public key configuration commands ······················································································································ 162
display public-key local public···························································································································162
display public-key peer·······································································································································163
peer-public-key end ·············································································································································165
public-key-code begin ·········································································································································165
public-key-code end ············································································································································166
public-key local create ········································································································································167
public-key local destroy ······································································································································168
public-key local export dsa ································································································································169
public-key local export rsa ·································································································································170
public-key peer ····················································································································································171
public-key peer import sshkey····························································································································171
PKI configuration commands·································································································································· 173
attribute·································································································································································173
ca identifier ··························································································································································174
certificate request entity ······································································································································174
certificate request from ·······································································································································175
certificate request mode······································································································································175
certificate request polling ···································································································································176
certificate request url···········································································································································177
common-name······················································································································································178
country··································································································································································178
crl check ·······························································································································································179
crl update-period ·················································································································································179
crl url·····································································································································································180
display pki certificate··········································································································································180
display pki certificate access-control-policy······································································································182
display pki certificate attribute-group················································································································183
display pki crl domain ········································································································································184
fqdn·······································································································································································185
ip (PKI entity view)···············································································································································186
v
ldap-server····························································································································································187
locality ··································································································································································187
organization·························································································································································188
organization-unit··················································································································································188
pki certificate access-control-policy ···················································································································189
pki certificate attribute-group ·····························································································································189
pki delete-certificate ············································································································································190
pki domain ···························································································································································191
pki entity·······························································································································································191
pki import-certificate············································································································································192
pki request-certificate domain ····························································································································192
pki retrieval-certificate·········································································································································193
pki retrieval-crl domain ·······································································································································194
pki validate-certificate ·········································································································································194
root-certificate fingerprint····································································································································195
rule (PKI CERT ACP view) ···································································································································196
state·······································································································································································196
SSH2.0 configuration commands·························································································································· 198
SSH2.0 server configuration commands···················································································································198
display ssh server ················································································································································198
display ssh user-information ·······························································································································199
ssh server authentication-retries ·························································································································200
ssh server authentication-timeout························································································································201
ssh server compatible-ssh1x ·······························································································································202
ssh server dscp·····················································································································································202
ssh server enable·················································································································································203
ssh server ipv6 dscp············································································································································203
ssh server rekey-interval ······································································································································204
ssh user·································································································································································205
SSH2.0 client configuration commands ····················································································································206
display ssh client source ·····································································································································206
display ssh server-info ·········································································································································207
ssh client authentication server ··························································································································208
ssh client dscp······················································································································································208
ssh client first-time················································································································································209
ssh client ipv6 dscp·············································································································································210
ssh client ipv6 source··········································································································································210
ssh client source···················································································································································211
ssh2·······································································································································································212
ssh2 ipv6······························································································································································213
SFTP configuration commands ······························································································································· 215
SFTP server configuration commands ························································································································215
sftp server enable ················································································································································215
sftp server idle-timeout·········································································································································215
SFTP client configuration commands··························································································································216
bye ········································································································································································216
cd ··········································································································································································216
cdup······································································································································································217
delete ····································································································································································217
dir··········································································································································································218
display sftp client source·····································································································································219
exit ········································································································································································219
get ·········································································································································································220
vi
help ·······································································································································································220
ls············································································································································································221
mkdir·····································································································································································222
put ·········································································································································································222
pwd·······································································································································································223
quit ········································································································································································223
remove··································································································································································224
rename··································································································································································224
rmdir ·····································································································································································225
sftp·········································································································································································225
sftp client dscp ·····················································································································································226
sftp client ipv6 dscp ············································································································································227
sftp client ipv6 source ·········································································································································227
sftp client source ··················································································································································228
sftp ipv6································································································································································229
SCP configuration commands ································································································································ 231
SCP client configuration commands···························································································································231
scp·········································································································································································231
SSL configuration commands ································································································································· 233
ciphersuite ····························································································································································233
client-verify enable ··············································································································································234
client-verify weaken·············································································································································234
close-mode wait···················································································································································235
display ssl client-policy········································································································································236
display ssl server-policy ······································································································································237
handshake timeout ··············································································································································238
pki-domain ···························································································································································239
prefer-cipher·························································································································································239
server-verify enable ·············································································································································240
session ··································································································································································241
ssl client-policy ·····················································································································································242
ssl server-policy····················································································································································242
version ··································································································································································243
TCP attack protection configuration commands ··································································································· 244
display tcp status ·················································································································································244
tcp syn-cookie enable ·········································································································································245
IP source guard configuration commands············································································································· 246
display ip source binding···································································································································246
ip source binding ················································································································································247
ip verify source ····················································································································································248
ip verify source max-entries································································································································249
ARP attack protection configuration commands ··································································································· 251
ARP defense against IP packet attacks configuration commands···········································································251
arp resolving-route enable··································································································································251
arp source-suppression enable ··························································································································251
arp source-suppression limit ·······························································································································252
display arp source-suppression··························································································································252
ARP packet rate limit configuration commands ········································································································253
arp rate-limit·························································································································································253
Source MAC address based ARP attack detection configuration commands ·······················································254
arp anti-attack source-mac··································································································································254
arp anti-attack source-mac aging-time ··············································································································255
vii
arp anti-attack source-mac exclude-mac ···········································································································255
arp anti-attack source-mac threshold·················································································································256
display arp anti-attack source-mac····················································································································257
ARP packet source mac address consistency check configuration commands ·····················································258
arp anti-attack valid-check enable·····················································································································258
ARP active acknowledgement configuration commands ·························································································258
arp anti-attack active-ack enable·······················································································································258
ARP detection configuration commands ····················································································································259
arp detection························································································································································259
arp detection enable···········································································································································260
arp detection trust················································································································································261
arp detection validate·········································································································································261
arp restricted-forwarding enable ·······················································································································262
display arp detection ··········································································································································262
display arp detection statistics ···························································································································263
reset arp detection statistics································································································································264
ARP automatic scanning and fixed ARP configuration commands·········································································265
arp fixup·······························································································································································265
arp scan ·······························································································································································265
ARP gateway protection configuration commands ··································································································266
arp filter source····················································································································································266
ARP filtering configuration commands·······················································································································267
arp filter binding··················································································································································267
ND attack defense configuration commands········································································································ 269
ipv6 nd mac-check enable ·································································································································269
URPF configuration commands ······························································································································ 270
ip urpf strict ··························································································································································270
MFF configuration commands································································································································ 271
display mac-forced-forwarding interface ··········································································································271
display mac-forced-forwarding vlan··················································································································271
mac-forced-forwarding········································································································································273
mac-forced-forwarding gateway probe ············································································································273
mac-forced-forwarding network-port ·················································································································274
mac-forced-forwarding server ····························································································································275
Support and other resources ·································································································································· 276
Contacting HP ······························································································································································276
Subscription service ············································································································································276
Related information······················································································································································276
Documents····························································································································································276
Websites·······························································································································································276
Conventions ··································································································································································277
Index ········································································································································································ 279
1
AAA configuration commands
General AAA configuration commands
aaa nas-id profile
Syntax
aaa nas-id profile profile-name
undo aaa nas-id profile profile-name
View
System view
Default level
2: System level
Parameters
profile-name: Name of the NAS ID profile, a case-insensitive string of 1 to 16 characters.
Description
Use aaa nas-id profile to create a NAS ID profile and enter its view. A NAS ID profile maintains the
bindings between NAS IDs and VLANs.
Use undo aaa nas-id profile to remove a NAS ID profile.
Related commands: nas-id bind vlan.
Examples
# Create a NAS ID profile named aaa.
<Sysname> system-view
[Sysname] aaa nas-id profile aaa
[Sysname-nas-id-prof-aaa]
access-limit enable
Syntax
access-limit enable max-user-number
undo access-limit enable
View
ISP domain view
Default level
2: System level
2
Parameters
max-user-number: Maximum number of online users that the ISP domain can accommodate, in the range
of 1 to 2147483646.
Description
Use access-limit enable to set the maximum number of online users in an ISP domain. After the number
of online users reaches the allowed maximum number, no more users are accepted.
Use undo access-limit enable to restore the default.
By default, there is no limit to the number of online users in an ISP domain.
System resources are limited, and user connections may compete for network resources when there are
many users. Setting a proper limit to the number of online users helps provide reliable system
performance.
Related commands: display domain.
Examples
# Set a limit of 500 user connections for ISP domain test.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] access-limit enable 500
accounting command
Syntax
accounting command hwtacacs-scheme hwtacacs-scheme-name
undo accounting command
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
Description
Use accounting command to specify the command line accounting method.
Use undo accounting command to restore the default.
By default, the default accounting method for the ISP domain is used for command line accounting.
The specified HWTACACS scheme must have been configured.
Command line accounting can use only a HWTACACS scheme.
Related commands: accounting default and hwtacacs scheme.
Examples
# Configure ISP domain test to use HWTACACS scheme hwtac for command line accounting.
<Sysname> system-view
3
[Sysname] domain test
[Sysname-isp-test] accounting command hwtacacs-scheme hwtac
accounting default
Syntax
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme
radius-scheme-name [ local ] }
undo accounting default
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use accounting default to configure the default accounting method for an ISP domain.
Use undo accounting default to restore the default.
By default, the default accounting method of an ISP domain is local.
The specified RADIUS or HWTACACS scheme must have been configured.
The default accounting method is used for all users who support the specified accounting method and
have no specific accounting method configured.
Local accounting is only used for monitoring and controlling the number of local user connections. It does
not provide the statistics function that the accounting feature generally provides.
Related commands: local-user, hwtacacs scheme, and radius scheme.
Examples
# Configure the default accounting method for ISP domain test to use RADIUS accounting scheme rd and
use local accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting default radius-scheme rd local
accounting lan-access
Syntax
accounting lan-access { local | none | radius-scheme radius-scheme-name [ local | none ] }
4
undo accounting lan-access
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use accounting lan-access to configure the accounting method for LAN users.
Use undo accounting lan-access to restore the default.
By default, the default accounting method for the ISP domain is used for LAN users.
The specified RADIUS scheme must have been configured.
Related commands: local-user, accounting default, and radius scheme.
Examples
# Configure ISP domain test to use local accounting for LAN users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting lan-access local
# Configure ISP domain test to use RADIUS accounting scheme rd for LAN users and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting lan-access radius-scheme rd local
accounting login
Syntax
accounting login { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme
radius-scheme-name [ local ] }
undo accounting login
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
5
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use accounting login to configure the accounting method for login users through the console port or
through Telnet.
Use undo accounting login to restore the default.
By default, the default accounting method for the ISP domain is used for login users.
The specified RADIUS or HWTACACS scheme must have been configured.
Accounting is not supported for login users who use FTP.
Related commands: local-user, accounting default, hwtacacs scheme, and radius scheme.
Examples
# Configure ISP domain test to use local accounting for login users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login local
# Configure ISP domain test to use RADIUS accounting scheme rd for login users and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login radius-scheme rd local
accounting optional
Syntax
accounting optional
undo accounting optional
View
ISP domain view
Default level
2: System level
Parameters
None
Description
Use accounting optional to enable the accounting optional feature.
Use undo accounting optional to disable the feature.
By default, the feature is disabled.
After you configure the accounting optional command for a domain, a user who would otherwise be
disconnected can continue to use the network resources when no accounting server is available or when
6
communication with the current accounting server fails. However, the switch no longer sends real-time
accounting updates for the user. The accounting optional feature applies to scenarios where accounting
is not important.
After you configure the accounting optional command, the setting configured by the access-limit
command in local user view is not effective.
Examples
# Enable the accounting optional feature for users in domain test.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting optional
authentication default
Syntax
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none |
radius-scheme radius-scheme-name [ local ] }
undo authentication default
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authentication.
none: Does not perform any authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use authentication default to configure the default authentication method for an ISP domain.
Use undo authentication default to restore the default.
By default, the default authentication method of an ISP domain is local.
The specified RADIUS or HWTACACS scheme must have been configured.
The default authentication method is used for all users who support the specified authentication method
and have no specific authentication method configured.
Related commands: local-user, hwtacacs scheme, and radius scheme.
Examples
# Configure the default authentication method for ISP domain test to use RADIUS authentication scheme
rd and use local authentication as the backup.
<Sysname> system-view
[Sysname] domain test
7
[Sysname-isp-test] authentication default radius-scheme rd local
authentication lan-access
Syntax
authentication lan-access { local | none | radius-scheme radius-scheme-name [ local | none ] }
undo authentication lan-access
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local authentication.
none: Does not perform any authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use authentication lan-access to configure the authentication method for LAN users.
Use undo authentication lan-access to restore the default.
By default, the default authentication method for the ISP domain is used for LAN users.
The specified RADIUS scheme must have been configured.
Related commands: local-user, authentication default, and radius scheme.
Examples
# Configure ISP domain test to use local authentication for LAN users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication lan-access local
# Configure ISP domain test to use RADIUS authentication scheme rd for LAN users and use local
authentication as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication lan-access radius-scheme rd local
authentication login
Syntax
authentication login { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none | radius-scheme
radius-scheme-name [ local ] }
undo authentication login
View
ISP domain view
8
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authentication.
none: Does not perform any authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use authentication login to configure the authentication method for login users through the console port,
Telnet, or FTP.
Use undo authentication login to restore the default.
By default, the default authentication method for the ISP domain is used for login users.
The specified RADIUS or HWTACACS scheme must have been configured.
Related commands: local-user, authentication default, hwtacacs scheme, and radius scheme.
Examples
# Configure ISP domain test to use local authentication for login users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication login local
# Configure ISP domain test to use RADIUS authentication scheme rd for login users and use local
authentication as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication login radius-scheme rd local
authentication super
Syntax
authentication super { hwtacacs-scheme hwtacacs-scheme-name | radius-scheme
radius-scheme-name }
undo authentication super
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
9
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use authentication super to configure the authentication method for user privilege level switching.
Use undo authentication super to restore the default.
By default, the default authentication method for the ISP domain is used for user privilege level switching
authentication.
The specified RADIUS or HWTACACS authentication scheme must have been configured.
Related commands: hwtacacs scheme and radius scheme; super authentication-mode (Fundamentals
Command Reference).
Examples
# Configure ISP domain test to use HWTACACS scheme tac for user privilege level switching
authentication.
<Sysname> system-view
[Sysname] super authentication-mode scheme
[Sysname] domain test
[Sysname-domain-test] authentication super hwtacacs-scheme tac
authorization command
Syntax
authorization command { hwtacacs-scheme hwtacacs-scheme-name [ local | none ] | local | none }
undo authorization command
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authorization.
none: Does not perform any authorization exchange. In this case, an authenticated user can access only
commands of Level 0.
Description
Use authorization command to configure the command line authorization method.
Use undo authorization command to restore the default.
By default, the default authorization method for the ISP domain is used for command line authorization.
The specified HWTACACS scheme must have been configured.
With command line authorization configured, a user who has logged in to the switch can execute only
the commands with a level lower than or equal to that of the local user.
10
Related commands: local-user, authorization default, and hwtacacs scheme.
Examples
# Configure ISP domain test to use local command line authorization.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization command local
# Configure ISP domain test to use HWTACACS scheme hwtac for command line authorization and use
local authorization as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization command hwtacacs-scheme hwtac local
authorization default
Syntax
authorization default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none |
radius-scheme radius-scheme-name [ local ] }
undo authorization default
View
ISP domain view
Default level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authorization.
none: Does not perform any authorization exchange. After passing authentication, non-login users can
access the network, FTP users can access the root directory of the switch, and other login users can
access only the commands of Level 0.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use authorization default to configure the default authorization method for an ISP domain.
Use undo authorization default to restore the default.
By default, the default authorization method for the ISP domain of an ISP domain is local.
The specified RADIUS or HWTACACS scheme must have been configured.
The default authorization method is used for all users who support the specified authorization method
and have no specific authorization method are configured.
The RADIUS authorization configuration takes effect only when the authentication method and
authorization method of the ISP domain use the same RADIUS scheme.
Related commands: local-user, hwtacacs scheme, and radius scheme.
11
Examples
# Configure the default authorization method for ISP domain test to use RADIUS authorization scheme rd
and use local authorization as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization default radius-scheme rd local
authorization lan-access
Syntax
authorization lan-access { local | none | radius-scheme radius-scheme-name [ local | none ] }
undo authorization lan-access
View
ISP domain view
Default level
2: System level
Parameters
local: Performs local authorization.
none: Does not perform any authorization exchange. In this case, an authenticated LAN user can access
the network directly.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Description
Use authorization lan-access to configure the authorization method for LAN users.
Use undo authorization lan-access to restore the default.
By default, the default authorization method for the ISP domain is used for LAN users.
The specified RADIUS scheme must have been configured.
The RADIUS authorization configuration takes effect only when the authentication method and
authorization method of the ISP domain use the same RADIUS scheme.
Related commands: local-user, authorization default, and radius scheme.
Examples
# Configure ISP domain test to use local authorization for LAN users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization lan-access local
# Configure ISP domain test to use RADIUS authorization scheme rd for LAN users and use local
authorization as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization lan-access radius-scheme rd local
Other manuals for 6125G
24
This manual suits for next models
1
Table of contents
Other HP Switch manuals
HP
HP Compaq Presario,Presario 1910 User manual
HP
HP 5920 User manual
HP
HP 2530-24 User manual
HP
HP ProCurve 5400zl Series User manual
HP
HP 316095-B21 - StorageWorks Edge Switch 2/24 Instruction Manual
HP
HP 5830 series User manual
HP
HP SN3000B User manual
HP
HP HP 830 Series User manual
HP
HP StorageWorks 2/64 - Core Switch User manual
HP
HP ProCurve 8108fl Assembly instructions
HP
HP 10500 series User manual
HP
HP ProCurve 3500-24 User manual
HP
HP 316095-B21 - StorageWorks Edge Switch 2/24 User manual
HP
HP ProCurve 1400-24G User manual
HP
HP 6125XLG Installation manual
HP
HP 316095-B21 - StorageWorks Edge Switch 2/24 Instruction Manual
HP
HP PROCURVE 2910AL User manual
HP
HP 11757B Use and care manual
HP
HP L10 User manual
HP
HP AdvanceStack 100Base-T Hub-8TXE Installation and operating manual
Popular Switch manuals by other brands
Savant
Savant WPB-S106 Series Quick reference guide
AMAV
AMAV VS81 Installation and operation manual
ZyXEL Communications
ZyXEL Communications Dimension ES-3124PWR release note
Allied Telesis
Allied Telesis Patch 1 AT-S63 release note
Snap One
Snap One B-260-SWTCH-3X1 install guide
Larson Electronics
Larson Electronics EPL-SW Series instruction manual