HP 6125XLG Installation manual
HP 6125XLG Blade Switch
Security
Command Reference
Part number: 5998-3738
Software version: Release 2306
Document version: 6W100-20130912
Legal and notice information
© Copyright 2013 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or
use of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained
herein.
i
Contents
AAA commands ··························································································································································· 1
General AAA commands ·················································································································································1
accounting command···············································································································································1
accounting default····················································································································································2
accounting lan-access ··············································································································································3
accounting login·······················································································································································4
authentication default···············································································································································5
authentication lan-access·········································································································································7
authentication login··················································································································································8
authentication super ·················································································································································9
authorization command········································································································································ 10
authorization default ············································································································································· 11
authorization lan-access ······································································································································· 13
authorization login ················································································································································ 14
display domain······················································································································································ 15
domain ··································································································································································· 17
domain default enable·········································································································································· 18
state (ISP domain view)········································································································································· 18
Local user commands····················································································································································· 19
authorization-attribute ··········································································································································· 19
bind-attribute ·························································································································································· 21
display local-user··················································································································································· 22
display user-group················································································································································· 24
group ······································································································································································ 25
local-user ································································································································································ 25
password································································································································································ 27
service-type····························································································································································· 28
state (local user view)············································································································································ 29
user-group ······························································································································································ 30
RADIUS commands ························································································································································ 30
accounting-on enable············································································································································ 30
data-flow-format (RADIUS scheme view)············································································································· 31
display radius scheme ·········································································································································· 32
display radius statistics ········································································································································· 34
key (RADIUS scheme view)··································································································································· 35
nas-ip (RADIUS scheme view) ······························································································································ 37
primary accounting (RADIUS scheme view) ······································································································· 38
primary authentication (RADIUS scheme view)·································································································· 39
radius nas-ip··························································································································································· 41
radius scheme························································································································································ 42
radius session-control enable ······························································································································· 42
reset radius statistics·············································································································································· 43
retry········································································································································································· 43
retry realtime-accounting ······································································································································ 44
secondary accounting (RADIUS scheme view)··································································································· 45
secondary authentication (RADIUS scheme view) ····························································································· 47
security-policy-server ············································································································································· 48
state primary ·························································································································································· 49
state secondary······················································································································································ 50
ii
timer quiet (RADIUS scheme view) ······················································································································ 51
timer realtime-accounting (RADIUS scheme view) ····························································································· 52
timer response-timeout (RADIUS scheme view) ·································································································· 53
user-name-format (RADIUS scheme view) ··········································································································· 54
vpn-instance (RADIUS scheme view) ··················································································································· 55
HWTACACS commands ··············································································································································· 55
data-flow-format (HWTACACS scheme view)···································································································· 55
display hwtacacs scheme····································································································································· 56
hwtacacs nas-ip ····················································································································································· 58
hwtacacs scheme··················································································································································· 59
key (HWTACACS scheme view)·························································································································· 60
nas-ip (HWTACACS scheme view) ····················································································································· 61
primary accounting (HWTACACS scheme view) ······························································································ 62
primary authentication (HWTACACS scheme view)························································································· 63
primary authorization ··········································································································································· 64
reset hwtacacs statistics ········································································································································ 66
secondary accounting (HWTACACS scheme view)·························································································· 66
secondary authentication (HWTACACS scheme view)····················································································· 68
secondary authorization······································································································································· 69
timer quiet (HWTACACS scheme view) ············································································································· 71
timer realtime-accounting (HWTACACS scheme view)····················································································· 72
timer response-timeout (HWTACACS scheme view) ························································································· 73
user-name-format (HWTACACS scheme view) ·································································································· 73
vpn-instance (HWTACACS scheme view) ·········································································································· 74
LDAP commands····························································································································································· 75
authentication-server ············································································································································· 75
display ldap scheme ············································································································································· 76
ip ············································································································································································· 77
ipv6········································································································································································· 78
ldap scheme··························································································································································· 79
ldap server ····························································································································································· 79
login-dn··································································································································································· 80
login-password ······················································································································································ 81
protocol-version ····················································································································································· 82
search-base-dn ······················································································································································· 82
search-scope ·························································································································································· 83
server-timeout ························································································································································· 84
user-parameters ····················································································································································· 84
802.1X commands ····················································································································································86
display dot1x ························································································································································· 86
dot1x······································································································································································· 88
dot1x authentication-method································································································································ 89
dot1x handshake··················································································································································· 90
dot1x mandatory-domain ····································································································································· 91
dot1x max-user ······················································································································································ 91
dot1x multicast-trigger··········································································································································· 92
dot1x port-control ·················································································································································· 93
dot1x port-method ················································································································································· 94
dot1x quiet-period················································································································································· 94
dot1x re-authenticate ············································································································································ 95
dot1x retry······························································································································································ 96
dot1x timer····························································································································································· 97
dot1x unicast-trigger ············································································································································· 98
reset dot1x statistics ·············································································································································· 99
iii
MAC authentication commands····························································································································· 100
display mac-authentication·································································································································100
mac-authentication ··············································································································································102
mac-authentication domain ································································································································102
mac-authentication max-user ······························································································································103
mac-authentication timer·····································································································································104
mac-authentication user-name-format ················································································································105
reset mac-authentication statistics ······················································································································106
Port security commands ·········································································································································· 108
display port-security ············································································································································108
display port-security mac-address block ···········································································································110
display port-security mac-address security········································································································112
port-security authorization ignore······················································································································114
port-security enable ·············································································································································115
port-security intrusion-mode ································································································································115
port-security mac-address security ·····················································································································116
port-security max-mac-count ·······························································································································118
port-security ntk-mode ·········································································································································119
port-security oui ···················································································································································119
port-security port-mode········································································································································120
port-security timer autolearn aging····················································································································123
port-security timer disableport····························································································································123
Password control commands·································································································································· 125
display password-control····································································································································125
display password-control blacklist·····················································································································126
password-control { aging | composition | history | length } enable····························································127
password-control aging ······································································································································128
password-control alert-before-expire ·················································································································129
password-control complexity······························································································································130
password-control composition····························································································································131
password-control enable·····································································································································133
password-control expired-user-login··················································································································133
password-control history ·····································································································································134
password-control length······································································································································135
password-control login idle-time ························································································································136
password-control login-attempt ··························································································································137
password-control super aging····························································································································138
password-control super composition ·················································································································139
password-control super length ···························································································································140
password-control update-interval ·······················································································································141
reset password-control blacklist ·························································································································141
reset password-control history-record················································································································142
Public key management commands······················································································································· 143
display public-key local public···························································································································143
display public-key peer·······································································································································147
peer-public-key end ·············································································································································148
public-key local create ········································································································································149
public-key local destroy ······································································································································152
public-key local export dsa ································································································································154
public-key local export rsa ·································································································································156
public-key peer ····················································································································································158
public-key peer import sshkey····························································································································159
iv
SSH commands ······················································································································································· 160
SSH server commands·················································································································································160
display ssh server ················································································································································160
display ssh user-information ·······························································································································161
sftp server enable ················································································································································162
sftp server idle-timeout·········································································································································163
ssh server acl ·······················································································································································163
ssh server authentication-retries ·························································································································164
ssh server authentication-timeout························································································································165
ssh server compatible-ssh1x enable ··················································································································166
ssh server enable·················································································································································166
ssh server ipv6 acl···············································································································································167
ssh server rekey-interval ······································································································································168
ssh user·································································································································································169
SSH client commands ··················································································································································171
bye ········································································································································································171
cd ··········································································································································································171
cdup······································································································································································172
delete ····································································································································································172
dir··········································································································································································173
display sftp client source·····································································································································174
display ssh client source ·····································································································································174
exit ········································································································································································175
get ·········································································································································································175
help ·······································································································································································175
ls············································································································································································176
mkdir·····································································································································································177
put ·········································································································································································178
pwd·······································································································································································178
quit ········································································································································································179
remove··································································································································································179
rename··································································································································································179
rmdir ·····································································································································································180
scp·········································································································································································180
scp ipv6································································································································································182
sftp·········································································································································································185
sftp client ipv6 source ·········································································································································187
sftp client source ··················································································································································187
sftp ipv6································································································································································188
ssh client ipv6 source··········································································································································190
ssh client source···················································································································································191
ssh2·······································································································································································192
ssh2 ipv6······························································································································································194
IP source guard commands ···································································································································· 197
display ip source binding···································································································································197
display ipv6 source binding static·····················································································································198
ip source binding ················································································································································199
ip verify source ····················································································································································200
ipv6 source binding ············································································································································202
ipv6 verify source ················································································································································203
reset ip source binding ·······································································································································203
reset ipv6 source binding ···································································································································204
v
ARP attack protection commands ·························································································································· 206
Unresolvable IP attack protection commands ···········································································································206
arp resolving-route enable··································································································································206
arp source-suppression enable ··························································································································206
arp source-suppression limit ·······························································································································207
display arp source-suppression··························································································································208
ARP packet rate limit commands ································································································································208
arp rate-limit·························································································································································208
Source MAC-based ARP attack detection commands······························································································209
arp source-mac ····················································································································································209
arp source-mac aging-time ·································································································································210
arp source-mac exclude-mac······························································································································210
arp source-mac threshold ···································································································································211
display arp source-mac·······································································································································211
ARP packet source MAC consistency check commands··························································································212
arp valid-check enable ·······································································································································212
ARP active acknowledgement commands·················································································································213
arp active-ack enable··········································································································································213
ARP detection commands············································································································································214
arp detection enable···········································································································································214
arp detection trust················································································································································214
arp detection validate·········································································································································215
arp restricted-forwarding enable ·······················································································································215
display arp detection ··········································································································································216
display arp detection statistics ···························································································································216
reset arp detection statistics································································································································217
ARP automatic scanning and fixed ARP commands ································································································218
arp fixup·······························································································································································218
arp scan ·······························································································································································219
ARP gateway protection commands ··························································································································220
arp filter source····················································································································································220
ARP filtering commands···············································································································································220
arp filter binding··················································································································································220
uRPF commands ······················································································································································ 222
ip urpf ···································································································································································222
display ip urpf······················································································································································223
FIPS commands ······················································································································································· 224
display fips status ················································································································································224
fips mode enable·················································································································································224
fips self-test ···························································································································································226
IPsec commands······················································································································································ 228
ah authentication-algorithm································································································································228
description····························································································································································229
display ipsec { ipv6-policy | policy }················································································································229
display ipsec { ipv6-policy-template | policy-template } ·················································································233
display ipsec profile············································································································································235
display ipsec sa···················································································································································236
display ipsec statistics·········································································································································240
display ipsec transform-set ·································································································································242
display ipsec tunnel·············································································································································243
encapsulation-mode ············································································································································245
esp authentication-algorithm ······························································································································247
esp encryption-algorithm ····································································································································248
vi
ike-profile······························································································································································249
ipsec anti-replay check ·······································································································································249
ipsec anti-replay window ···································································································································250
ipsec decrypt-check enable ································································································································251
ipsec logging packet enable······························································································································251
ipsec df-bit····························································································································································252
ipsec global-df-bit ················································································································································253
ipsec { ipv6-policy | policy } (interface view) ··································································································254
ipsec { ipv6-policy | policy } (system view)······································································································254
ipsec { ipv6-policy | policy } isakmp template·································································································256
ipsec { ipv6-policy | policy } local-address······································································································257
ipsec { ipv6-policy-template | policy-template } policy-template ····································································258
ipsec profile ·························································································································································259
ipsec sa global-duration ·····································································································································259
ipsec sa idle-time ·················································································································································260
ipsec transform-set ···············································································································································261
local-address ························································································································································262
pfs ·········································································································································································262
protocol ································································································································································263
qos pre-classify ····················································································································································264
remote-address·····················································································································································265
reset ipsec sa ·······················································································································································266
reset ipsec statistics ·············································································································································267
sa duration ···························································································································································268
sa hex-key authentication ···································································································································269
sa hex-key encryption ·········································································································································270
sa idle-time ···························································································································································271
sa spi ····································································································································································272
sa string-key ·························································································································································273
security acl ···························································································································································274
transform-set ·························································································································································275
IKE commands························································································································································· 277
authentication-algorithm ·····································································································································277
authentication-method·········································································································································277
dh··········································································································································································278
display ike proposal············································································································································279
display ike sa·······················································································································································280
dpd········································································································································································283
encryption-algorithm············································································································································284
exchange-mode ···················································································································································285
ike dpd ·································································································································································286
ike identity····························································································································································287
ike invalid-spi-recovery enable···························································································································288
ike keepalive interval ··········································································································································289
ike keepalive timeout ··········································································································································289
ike keychain·························································································································································290
ike limit ·································································································································································291
ike nat-keepalive··················································································································································292
ike profile ·····························································································································································292
ike proposal ·························································································································································293
ike signature-identity from-certificate ·················································································································294
inside-vpn ·····························································································································································295
keychain ·······························································································································································295
local-identity ·························································································································································296
vii
match local address (IKE keychain view)··········································································································297
match local address (IKE profile view)··············································································································298
match remote ·······················································································································································299
pre-shared-key······················································································································································301
priority (IKE keychain view)································································································································302
priority (IKE profile view)····································································································································303
proposal ·······························································································································································303
reset ike sa ···························································································································································304
sa duration ···························································································································································305
Support and other resources ·································································································································· 306
Contacting HP ······························································································································································306
Subscription service ············································································································································306
Related information······················································································································································306
Documents····························································································································································306
Websites·······························································································································································306
Conventions ··································································································································································307
Index ········································································································································································ 309
1
AAA commands
The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for features,
commands, and parameters might differ in FIPS mode and non-FIPS mode. For more information about
FIPS mode, see Security Configuration Guide.
General AAA commands
accounting command
Use accounting command to specify the command line accounting method.
Use undo accounting command to restore the default.
Syntax
accounting command hwtacacs-scheme hwtacacs-scheme-name
undo accounting command
Default
The default accounting method of the ISP domain is used for command line accounting.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
Usage guidelines
The command line accounting function works with the accounting server to record all commands that
have been successfully executed on the device.
Command line accounting can use only a remote HWTACACS server.
Examples
# Configure ISP domain test to use HWTACACS scheme hwtac for command line accounting.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting command hwtacacs-scheme hwtac
Related commands
•accounting default
•command accounting (Fundamentals Command Reference)
•hwtacacs scheme
2
accounting default
Use accounting default to specify the default accounting method for an ISP domain.
Use undo accounting default to restore the default.
Syntax
In non-FIPS mode:
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[local ][none ]|local [none ] | none |radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [ local ] [ none ] }
undo accounting default
In FIPS mode:
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[local ] | local |radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ]
[local ] }
undo accounting default
Default
The default accounting method of an ISP domain is local.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
The default accounting method is used for all users who support this method and do not have a specific
accounting method configured.
Local accounting is only used for monitoring and controlling the number of local user connections, but
does not provide the statistics function that the accounting feature typically provides.
You can specify multiple default accounting methods, one primary and multiple backup methods. When
the primary method is invalid, the device attempts to use the backup methods in sequence. For example,
the accounting default radius-scheme radius-scheme-name local none command specifies the primary
default RADIUS accounting method and two backup accounting methods, local accounting and no
accounting. With this command, the device performs RADIUS accounting by default, performs local
accounting when the RADIUS server is invalid, and does not perform accounting when both of the
previous methods are invalid.
3
Examples
# Configure the default accounting method for ISP domain test to use RADIUS scheme rd and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting default radius-scheme rd local
Related commands
•hwtacacs scheme
•local-user
•radius scheme
accounting lan-access
Use accounting lan-access to configure the accounting method for LAN users.
Use undo accounting lan-access to restore the default.
Syntax
In non-FIPS mode:
accounting lan-access { local [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }
undo accounting lan-access
In FIPS mode:
accounting lan-access { local |radius-scheme radius-scheme-name [ local ] }
undo accounting lan-access
Default
The default accounting method for the ISP domain is used for LAN users.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
local: Performs local accounting.
none: Does not perform accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
You can specify multiple accounting methods, one primary and multiple backup methods. When the
primary method is invalid, the device attempts to use the backup methods in sequence. For example, the
accounting lan-access radius-scheme radius-scheme-name local none command specifies a primary
RADIUS accounting method and two backup accounting methods, local accounting and no accounting.
With this command, the device performs RADIUS accounting by default, performs local accounting
4
when the RADIUS server is invalid, and does not perform accounting when both of the previous methods
are invalid.
Examples
# Configure ISP domain test to use local accounting for LAN users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting lan-access local
# Configure ISP domain test to use RADIUS accounting scheme rd for LAN users and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting lan-access radius-scheme rd local
Related commands
•accounting default
•local-user
•radius scheme
accounting login
Use accounting login to specify the accounting method for login users.
Use undo accounting login to restore the default.
Syntax
In non-FIPS mode:
accounting login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[local ][none ]|local [none ] | none |radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [ local ] [ none ]}
undo accounting login
In FIPS mode:
accounting login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[local ] | local |radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ]
[local ] }
undo accounting login
Default
The default accounting method of the ISP domain is used for login users.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
5
local: Performs local accounting.
none: Does not perform accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
Accounting is not supported for login users who use FTP.
You can specify multiple default accounting methods, one primary and multiple backup methods. When
the primary method is invalid, the device attempts to use the backup methods in sequence. For example,
the accounting login radius-scheme radius-scheme-name local none command specifies a primary
default RADIUS accounting method and two backup accounting methods, local accounting and no
accounting. With this command, the device performs RADIUS accounting by default, performs local
accounting when the RADIUS server is invalid, and does not perform accounting when both of the
previous methods are invalid.
Examples
# Configure ISP domain test to use local accounting for login users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login local
# Configure ISP domain test to use RADIUS scheme rd for login user accounting and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login radius-scheme rd local
Related commands
•accounting default
•hwtacacs scheme
•local-user
•radius scheme
authentication default
Use authentication default to specify the default authentication method for an ISP domain.
Use undo authentication default to restore the default.
Syntax
In non-FIPS mode:
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] [ none ] | ldap-scheme ldap-scheme-name [ local ] [ none ] | local [ none ]
| none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ]
[ none ] }
undo authentication default
In FIPS mode:
6
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] | ldap-scheme ldap-scheme-name [ local ] | local | radius-scheme
radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }
undo authentication default
Default
The default authentication method of an ISP domain is local.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
ldap-scheme ldap-scheme-name: Specifies an LDAP scheme by its name, a case-insensitive string of 1 to
32 characters.
local: Performs local authentication.
none: Does not perform authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
The default authentication method is used for all users who support this method and do not have a
specific authentication method configured.
You can specify multiple default authentication methods, one primary and multiple backup methods.
When the primary method is invalid, the device attempts to use the backup methods in sequence. For
example, the authentication default radius-scheme radius-scheme-name local none command specifies
a primary default RADIUS authentication method and two backup authentication methods, local
authentication and no authentication. With this command, the device performs RADIUS authentication
by default, performs local authentication when the RADIUS server is invalid, and does not perform
authentication when both of the previous methods are invalid.
Examples
# Configure the default authentication method for ISP domain test to use RADIUS scheme rd and use
local authentication as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication default radius-scheme rd local
Related commands
•hwtacacs scheme
•ldap scheme
•local-user
•radius scheme
7
authentication lan-access
Use authentication lan-access to configure the authentication method for LAN users.
Use undo authentication lan-access to restore the default.
Syntax
In non-FIPS mode:
authentication lan-access { local [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }
undo authentication lan-access
In FIPS mode:
authentication lan-access { local | radius-scheme radius-scheme-name [ local ] }
undo authentication lan-access
Default
The default authentication method for the ISP domain is used for LAN users.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
local: Performs local authentication.
none: Does not perform authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
You can specify multiple authentication methods, one primary and multiple backup methods. When the
primary method is invalid, the device attempts to use the backup methods in sequence. For example, the
authentication lan-access radius-scheme radius-scheme-name local none command specifies a primary
RADIUS authentication method and two backup authentication methods, local authentication and no
authentication. With this command, the device performs RADIUS authentication by default, performs
local authentication when the RADIUS server is invalid, and does not perform authentication when both
of the previous methods are invalid.
Examples
# Configure ISP domain test to use local authentication for LAN users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication lan-access local
# Configure ISP domain test to use RADIUS authentication scheme rd for LAN users and use local
authentication as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication lan-access radius-scheme rd local
8
Related commands
•authentication default
•local-user
•radius scheme
authentication login
Use authentication login to specify the authentication method for login users.
Use undo authentication login to restore the default.
Syntax
In non-FIPS mode:
authentication login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[ local ] [ none ] | ldap-scheme ldap-scheme-name [ local ] [ none ] | local [ none ] | none |
radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }
undo authentication login
In FIPS mode:
authentication login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[ local ] | ldap-scheme ldap-scheme-name [ local ] | local | radius-scheme radius-scheme-name
[ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }
undo authentication login
Default
The default authentication method of the ISP is used for login users.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
ldap-scheme ldap-scheme-name: Specifies an LDAP scheme by its name, a case-insensitive string of 1 to
32 characters.
local: Performs local authentication.
none: Does not perform authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
You can specify multiple default authentication methods, one primary and multiple backup methods.
When the primary method is invalid, the device attempts to use the backup methods in sequence. For
example, the authentication login radius-scheme radius-scheme-name local none command specifies the
default primary RADIUS authentication method and two backup authentication methods, local
9
authentication and no authentication. With this command, the device performs RADIUS authentication
by default, performs local authentication when the RADIUS server is invalid, and does not perform
authentication when both of the previous methods are invalid.
Examples
# Configure ISP domain test to use local authentication for login users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication login local
# Configure ISP domain test to use RADIUS scheme rd for login users and use local authentication as the
backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication login radius-scheme rd local
Related commands
•authentication default
•hwtacacs scheme
•ldap scheme
•local-user
•radius scheme
authentication super
Use authentication super to specify a method for user role authentication.
Use undo authentication super to restore the default.
Syntax
authentication super { hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name }
*
undo authentication super
Default
The default authentication method of the ISP domain is used for user role authentication.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
10
Usage guidelines
You can specify one authentication method and one backup authentication method to use in case that
the previous authentication method is invalid.
If you specify a scheme to provide the method for user role authentication, the method applies only to
users whose user role is in the format of level-n.
•If an HWTACACS scheme is specified, the device uses the entered username for role authentication.
The username must already exist on the HWTACACS server to represent the highest user level that
a user can obtain. For example, to obtain a level-3 user role whose username is test, the device uses
test@domain-name or test for role authentication, depending on whether the domain name is
required.
•If a RADIUS scheme is specified, the device uses the username $enabn$on the RADIUS server for
role authentication, where nis the same as that in the target user role. For example, to obtain a
level-3 user role whose username is test, the device uses $enab3$@domain-name or $enab3$ for
any users who request authentication for obtaining the level-3 user role, depending on whether the
domain name is required.
Examples
# Configure ISP domain test to use HWTACACS scheme tac for user role authentication.
<Sysname> system-view
[Sysname] super authentication-mode scheme
[Sysname] domain test
[Sysname-domain-test] authentication super hwtacacs-scheme tac
Related commands
•authentication default
•hwtacacs scheme
•radius scheme
authorization command
Use authorization command to specify the command authorization method.
Use undo authorization command to restore the default.
Syntax
In non-FIPS mode:
authorization command { hwtacacs-scheme hwtacacs-scheme-name [ local ] [ none ] | local [ none ] |
none }
undo authorization command
In FIPS mode:
authorization command { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local }
undo authorization command
Default
The default authorization method of the ISP domain is used for command authorization.
Views
ISP domain view
11
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authorization.
none: Does not perform authorization. The authorization server does not verify whether the entered
commands are permitted by the user role. The commands are executed successfully if the user role has
permission to the commands.
Usage guidelines
Command authorization restricts login users to execute only authorized commands by employing an
authorization server to verify whether or not each entered command is permitted.
After login, users can access the command lines permitted by their authorized user roles.
You can specify one command authorization method and multiple backup authorization methods. When
the default authorization method is invalid, the device attempts to use the backup authorization methods
in sequence. For example, the authorization command hwtacacs-scheme hwtacacs-scheme-name local
none command specifies the default HWTACACS authorization method and two backup authorization
methods, local authorization and no authorization. With this command, the device performs
HWTACACS authorization by default, performs local authorization when the HWTACACS server is
invalid, and does not perform command authorization when both of the previous methods are invalid.
Examples
# Configure ISP domain test to use local command authorization.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization command local
# Configure ISP domain test to use HWTACACS scheme hwtac for command authorization and use local
authorization as the backup authorization method.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization command hwtacacs-scheme hwtac local
Related commands
•authorization accounting (Fundamentals Command Reference)
•hwtacacs scheme
•local-user
authorization default
Use authorization default to specify the default authorization method for an ISP domain.
Use undo authorization default to restore the default.
Syntax
In non-FIPS mode:
Other manuals for 6125XLG
36
Table of contents
Other HP Switch manuals
HP
HP A7503 User manual
HP
HP StorageWorks 2/32 - SAN Switch User manual
HP
HP 6125G Installation manual
HP
HP 438031-B21 - 1:10Gb Ethernet BL-c Switch Instruction Manual
HP
HP PROCURVE 2910AL User manual
HP
HP Compaq Presario,Presario 1910 User manual
HP
HP FlexFabric 5930 Series User manual
HP
HP ProCurve 2520-24-PoE Manual
HP
HP 6400cl User manual
HP
HP ProCurve 6200yl-24G Assembly instructions
HP
HP ProCurve 3500yl-48G-PWR User manual
HP
HP JG303A Installation instructions
HP
HP ProCurve 6120G/XG Programming manual
HP
HP 9500 Series User manual
HP
HP 1810 series User instructions
HP
HP Q.11.XX User manual
HP
HP McDATA 4Gb SAN Switch User manual
HP
HP 6125XLG User manual
HP
HP 438031-B21 - 1:10Gb Ethernet BL-c Switch Operating manual
HP
HP 4800G Series User manual
Popular Switch manuals by other brands
Kessel
Kessel Aqatronic K Installation, operation and maintenance instructions
Power Tec
Power Tec 71442 instruction sheet
LEGRAND
LEGRAND WNRL64 manual
ANTIFERENCE
ANTIFERENCE Clear Switch CF-POE4 user guide
Linksys
Linksys EtherFast EG0801W Specifications
Ubiquiti
Ubiquiti UniFi USW-Industral Quck Start Guide
