HP FlexFabric 7900 Series Installation manual
HP FlexFabric 7900 Switch Series
Security
Command Reference
Part number: 5998-4296
Software version: Release 2109
Document version: 6W100-20140122
Legal and notice information
© Copyright 2014 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or
use of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained
herein.
i
Contents
AAA commands ··························································································································································· 1
General AAA commands ·················································································································································1
aaa session-limit ·······················································································································································1
accounting command···············································································································································2
accounting default····················································································································································2
accounting login·······················································································································································4
authentication default···············································································································································5
authentication login··················································································································································6
authentication super ·················································································································································7
authorization command···········································································································································9
authorization default ············································································································································· 10
authorization login ················································································································································ 11
authorization-attribute (ISP domain view) ··········································································································· 12
display domain······················································································································································ 13
domain ··································································································································································· 15
domain default enable·········································································································································· 16
state (ISP domain view)········································································································································· 17
Local user commands····················································································································································· 18
access-limit ····························································································································································· 18
authorization-attribute (local user view/user group view) ················································································ 18
display local-user··················································································································································· 20
display user-group················································································································································· 22
group ······································································································································································ 23
local-user ································································································································································ 24
password································································································································································ 24
service-type····························································································································································· 26
state (local user view)············································································································································ 27
user-group ······························································································································································ 27
RADIUS commands ························································································································································ 28
accounting-on enable············································································································································ 28
data-flow-format (RADIUS scheme view)············································································································· 29
display radius scheme ·········································································································································· 30
display radius statistics ········································································································································· 32
key (RADIUS scheme view)··································································································································· 33
nas-ip (RADIUS scheme view) ······························································································································ 34
primary accounting (RADIUS scheme view) ······································································································· 35
primary authentication (RADIUS scheme view)·································································································· 36
radius nas-ip··························································································································································· 38
radius session-control enable ······························································································································· 38
radius scheme························································································································································ 39
reset radius statistics·············································································································································· 40
retry········································································································································································· 40
retry realtime-accounting ······································································································································ 41
secondary accounting (RADIUS scheme view)··································································································· 42
secondary authentication (RADIUS scheme view) ····························································································· 43
security-policy-server ············································································································································· 45
snmp-agent trap enable radius ···························································································································· 45
state primary ·························································································································································· 47
state secondary······················································································································································ 47
ii
timer quiet (RADIUS scheme view) ······················································································································ 48
timer realtime-accounting (RADIUS scheme view) ····························································································· 49
timer response-timeout (RADIUS scheme view) ·································································································· 50
user-name-format (RADIUS scheme view) ··········································································································· 51
HWTACACS commands ··············································································································································· 52
data-flow-format (HWTACACS scheme view)···································································································· 52
display hwtacacs scheme····································································································································· 53
hwtacacs nas-ip ····················································································································································· 54
hwtacacs scheme··················································································································································· 55
key (HWTACACS scheme view)·························································································································· 56
nas-ip (HWTACACS scheme view) ····················································································································· 57
primary accounting (HWTACACS scheme view) ······························································································ 58
primary authentication (HWTACACS scheme view)························································································· 59
primary authorization ··········································································································································· 61
reset hwtacacs statistics ········································································································································ 62
secondary accounting (HWTACACS scheme view)·························································································· 63
secondary authentication (HWTACACS scheme view)····················································································· 64
secondary authorization······································································································································· 65
timer quiet (HWTACACS scheme view) ············································································································· 67
timer realtime-accounting (HWTACACS scheme view)····················································································· 67
timer response-timeout (HWTACACS scheme view) ························································································· 68
user-name-format (HWTACACS scheme view) ·································································································· 69
Password control commands·····································································································································71
display password-control······································································································································ 71
display password-control blacklist······················································································································· 72
password-control { aging | composition | history | length } enable······························································ 73
password-control aging ········································································································································ 74
password-control alert-before-expire ··················································································································· 76
password-control complexity································································································································ 76
password-control composition······························································································································ 77
password-control enable······································································································································· 79
password-control expired-user-login···················································································································· 80
password-control history ······································································································································· 81
password-control length········································································································································ 82
password-control login idle-time ·························································································································· 83
password-control login-attempt ···························································································································· 84
password-control super aging······························································································································ 86
password-control super composition ··················································································································· 86
password-control super length ····························································································································· 87
password-control update-interval ························································································································· 88
reset password-control blacklist ··························································································································· 89
reset password-control history-record·················································································································· 89
Public key management commands··························································································································91
display public-key local public····························································································································· 91
display public-key peer········································································································································· 95
peer-public-key end ··············································································································································· 96
public-key local create ·········································································································································· 97
public-key local destroy ······································································································································100
public-key local export dsa ································································································································102
public-key local export rsa ·································································································································104
public-key peer ····················································································································································106
public-key peer import sshkey····························································································································106
iii
IPsec commands······················································································································································ 108
ah authentication-algorithm································································································································108
description····························································································································································109
display ipsec policy ············································································································································109
display ipsec sa···················································································································································112
display ipsec statistics·········································································································································115
display ipsec transform-set ·································································································································116
display ipsec tunnel·············································································································································117
encapsulation-mode ············································································································································120
esp authentication-algorithm ······························································································································121
esp encryption-algorithm ····································································································································122
ike-profile······························································································································································123
ipsec anti-replay check ·······································································································································124
ipsec anti-replay window ···································································································································125
ipsec apply policy ···············································································································································125
ipsec decrypt-check enable ································································································································126
ipsec logging packet enable······························································································································127
ipsec df-bit····························································································································································127
ipsec global-df-bit ················································································································································128
ipsec policy ··························································································································································129
ipsec policy local-address ··································································································································130
ipsec sa global-duration ·····································································································································131
ipsec sa idle-time ·················································································································································132
ipsec transform-set ···············································································································································133
local-address ························································································································································133
pfs ·········································································································································································134
protocol ································································································································································135
qos pre-classify ····················································································································································136
remote-address·····················································································································································136
reset ipsec sa ·······················································································································································138
reset ipsec statistics ·············································································································································139
sa duration ···························································································································································139
sa hex-key authentication ···································································································································140
sa hex-key encryption ·········································································································································141
sa idle-time ···························································································································································143
sa spi ····································································································································································143
sa string-key ·························································································································································144
security acl ···························································································································································145
snmp-agent trap enable ipsec····························································································································147
transform-set ·························································································································································148
IKE commands························································································································································· 150
authentication-algorithm ·····································································································································150
authentication-method·········································································································································151
dh··········································································································································································151
display ike proposal············································································································································152
display ike sa·······················································································································································153
dpd········································································································································································156
encryption-algorithm············································································································································157
exchange-mode ···················································································································································158
ike dpd ·································································································································································159
ike identity····························································································································································160
ike invalid-spi-recovery enable···························································································································161
ike keepalive interval ··········································································································································161
ike keepalive timeout ··········································································································································162
iv
ike keychain·························································································································································163
ike limit ·································································································································································163
ike nat-keepalive··················································································································································164
ike profile ·····························································································································································165
ike proposal ·························································································································································165
keychain ·······························································································································································166
local-identity ·························································································································································167
match local address (IKE keychain view)··········································································································168
match local address (IKE profile view)··············································································································169
match remote ·······················································································································································170
pre-shared-key······················································································································································171
priority (IKE keychain view)································································································································172
priority (IKE profile view)····································································································································173
proposal ·······························································································································································173
reset ike sa ···························································································································································174
reset ike statistics ·················································································································································175
sa duration ···························································································································································175
snmp-agent trap enable ike································································································································176
SSH commands ······················································································································································· 178
SSH server commands·················································································································································178
display ssh server ················································································································································178
display ssh user-information ·······························································································································179
sftp server enable ················································································································································180
sftp server idle-timeout·········································································································································181
ssh server acl ·······················································································································································181
ssh server authentication-retries ·························································································································182
ssh server authentication-timeout························································································································183
ssh server compatible-ssh1x enable ··················································································································184
ssh server dscp·····················································································································································184
ssh server enable·················································································································································185
ssh server rekey-interval ······································································································································186
ssh user·································································································································································186
SSH client commands ··················································································································································188
bye ········································································································································································188
cd ··········································································································································································189
cdup······································································································································································189
delete ····································································································································································190
dir··········································································································································································190
display sftp client source·····································································································································191
display ssh client source ·····································································································································192
exit ········································································································································································192
get ·········································································································································································193
help ·······································································································································································193
ls············································································································································································194
mkdir·····································································································································································195
put ·········································································································································································195
pwd·······································································································································································196
quit ········································································································································································196
remove··································································································································································197
rename··································································································································································197
rmdir ·····································································································································································198
scp·········································································································································································198
sftp·········································································································································································200
sftp client source ··················································································································································202
v
ssh client source···················································································································································203
ssh2·······································································································································································204
IP source guard commands ···································································································································· 206
display ip source binding···································································································································206
ip source binding (interface view) ·····················································································································208
ip source binding (system view)·························································································································209
ip verify source ····················································································································································209
ARP attack protection commands ·························································································································· 212
Unresolvable IP attack protection commands ···········································································································212
arp source-suppression enable ··························································································································212
arp source-suppression limit ·······························································································································212
display arp source-suppression··························································································································213
ARP detection commands············································································································································214
arp detection enable···········································································································································214
arp detection trust················································································································································214
arp detection validate·········································································································································215
arp restricted-forwarding enable ·······················································································································215
display arp detection ··········································································································································216
display arp detection statistics ···························································································································216
reset arp detection statistics································································································································217
uRPF commands ······················································································································································ 219
display ip urpf······················································································································································219
ip urpf ···································································································································································220
FIPS commands ······················································································································································· 221
display fips status ················································································································································221
fips mode enable·················································································································································221
fips self-test ···························································································································································223
Support and other resources ·································································································································· 225
Contacting HP ······························································································································································225
Subscription service ············································································································································225
Related information······················································································································································225
Documents····························································································································································225
Websites·······························································································································································225
Conventions ··································································································································································226
Index ········································································································································································ 228
1
AAA commands
The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for features,
commands, and parameters might differ in FIPS mode and non-FIPS mode. For more information about
FIPS mode, see Security Configuration Guide.
General AAA commands
aaa session-limit
Use aaa session-limit to set the maximum number of concurrent users who can log on to the device
through the specified method.
Use undo aaa session-limit to restore the default maximum number of concurrent users for the specified
login method.
Syntax
In non-FIPS mode:
aaa session-limit { ftp | ssh | telnet } max-sessions
undo aaa session-limit { ftp | ssh | telnet }
In FIPS mode:
aaa session-limit ssh max-sessions
undo aaa session-limit ssh
Default
The maximum number of concurrent users is 16 for each user type.
Views
System view
Predefined user roles
network-admin
Parameters
•ftp: FTP users.
•ssh: SSH users.
•telnet: Telnet users.
•max-sessions: Specifies the maximum number of concurrent login users. The value range is 1 to 32.
Usage guidelines
After the maximum number of concurrent login users for a user type exceeds the upper limit, the system
denies the subsequent users of this type.
Examples
# Set the maximum number of concurrent FTP users to 4.
2
<Sysname> system-view
[Sysname] aaa session-limit ftp 4
accounting command
Use accounting command to specify the command line accounting method.
Use undo accounting command to restore the default.
Syntax
accounting command hwtacacs-scheme hwtacacs-scheme-name
undo accounting command
Default
The default accounting method of the ISP domain is used for command line accounting.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
Usage guidelines
The command line accounting function works with the accounting server to record all commands that
have been successfully executed on the device.
Command line accounting can use only a remote HWTACACS server.
Examples
# Configure ISP domain test to use HWTACACS scheme hwtac for command line accounting.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting command hwtacacs-scheme hwtac
Related commands
•accounting default
•command accounting (Fundamentals Command Reference)
•hwtacacs scheme
accounting default
Use accounting default to specify the default accounting method for an ISP domain.
Use undo accounting default to restore the default.
Syntax
In non-FIPS mode:
3
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[local ][none ]|local [none ] | none |radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [ local ] [ none ] }
undo accounting default
In FIPS mode:
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ]
[local ] }
undo accounting default
Default
The default accounting method of an ISP domain is local.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
The default accounting method is used for all users who support this method and do not have a specific
accounting method configured.
Local accounting is only used for monitoring and controlling the number of local user connections. It does
not provide the statistics function that the accounting feature generally provides.
You can specify multiple default accounting methods, one primary and multiple backup methods.
When the primary method is invalid, the device attempts to use the backup methods in sequence. For
example, the accounting default radius-scheme radius-scheme-name local none command specifies the
primary default RADIUS accounting method and two backup accounting methods, local accounting and
no accounting. The device performs RADIUS accounting by default, performs local accounting when the
RADIUS server is invalid, and does not perform accounting when both of the previous methods are
invalid.
Examples
# Configure the default accounting method for ISP domain test to use RADIUS scheme rd and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting default radius-scheme rd local
4
Related commands
•hwtacacs scheme
•local-user
•radius scheme
accounting login
Use accounting login to specify the accounting method for login users.
Use undo accounting login to restore the default.
Syntax
In non-FIPS mode:
accounting login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[local ][none ]|local [none ] | none |radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [ local ] [ none ]}
undo accounting login
In FIPS mode:
accounting login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ]
[local ] }
undo accounting login
Default
The default accounting method of the ISP domain is used for login users.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
Accounting is not supported for login users who use FTP.
You can specify multiple default accounting methods, one primary and multiple backup methods.
When the primary method is invalid, the device attempts to use the backup methods in sequence. For
example, the accounting login radius-scheme radius-scheme-name local none command specifies a
primary default RADIUS accounting method and two backup accounting methods, local accounting and
no accounting. The device performs RADIUS accounting by default, performs local accounting when the
5
RADIUS server is invalid, and does not perform accounting when both of the previous methods are
invalid.
Examples
# Configure ISP domain test to use local accounting for login users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login local
# Configure ISP domain test to use RADIUS scheme rd for login user accounting and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login radius-scheme rd local
Related commands
•accounting default
•hwtacacs scheme
•local-user
•radius scheme
authentication default
Use authentication default to specify the default authentication method for an ISP domain.
Use undo authentication default to restore the default.
Syntax
In non-FIPS mode:
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] [ none ] | local [ none ] | none | radius-scheme radius-scheme-name
[ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }
undo authentication default
In FIPS mode:
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [ local ] }
undo authentication default
Default
The default authentication method of an ISP domain is local.
Views
ISP domain view
Predefined user roles
network-admin
6
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authentication.
none: Does not perform authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
The default authentication method is used for all users who support this method and do not have a
specific authentication method configured.
You can specify multiple default authentication methods, one primary and multiple backup methods.
When the primary method is invalid, the device attempts to use the backup methods in sequence. For
example, the authentication default radius-scheme radius-scheme-name local none command specifies
a primary default RADIUS authentication method and two backup authentication methods, local
authentication and no authentication. The device performs RADIUS authentication by default, performs
local authentication when the RADIUS server is invalid, and does not perform authentication when both
of the previous methods are invalid.
Examples
# Configure the default authentication method for ISP domain test to use RADIUS scheme rd and use
local authentication as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication default radius-scheme rd local
Related commands
•hwtacacs scheme
•local-user
•radius scheme
authentication login
Use authentication login to specify the authentication method for login users.
Use undo authentication login to restore the default.
Syntax
In non-FIPS mode:
authentication login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[ local ] [ none ] | local [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [ local ] [ none ] }
undo authentication login
In FIPS mode:
authentication login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[ local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ]
[ local ] }
7
undo authentication login
Default
The default authentication method of the ISP is used for login users.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authentication.
none: Does not perform authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
You can specify multiple default authentication methods, one primary and multiple backup methods.
When the primary method is invalid, the device attempts to use the backup methods in sequence. For
example, the authentication login radius-scheme radius-scheme-name local none command specifies the
default primary RADIUS authentication method and two backup authentication methods, local
authentication and no authentication. The device performs RADIUS authentication by default, performs
local authentication when the RADIUS server is invalid, and does not perform authentication when both
of the previous methods are invalid.
Examples
# Configure ISP domain test to use local authentication for login users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication login local
# Configure ISP domain test to use RADIUS scheme rd for login users and use local authentication as the
backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication login radius-scheme rd local
Related commands
•authentication default
•hwtacacs scheme
•local-user
•radius scheme
authentication super
Use authentication super to specify a method for user role authentication.
8
Use undo authentication super to restore the default.
Syntax
authentication super { hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name }
*
undo authentication super
Default
The default authentication method of the ISP domain is used for user role authentication.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
You can specify one authentication method and one backup authentication method to use in case that
the previous authentication method is invalid.
If you specify a scheme to provide the method for user role authentication, the method applies only to
users whose user role is in the format of level-n.
•If an HWTACACS scheme is specified, the device uses the entered username for role authentication.
The username must already exist on the HWTACACS server to represent the highest user level that
a user can obtain. For example, to obtain a level-3 user role whose username is test, the device uses
test@domain-name or test for role authentication, depending on whether the domain name is
required.
•If a RADIUS scheme is specified, the device uses the username $enabn$on the RADIUS server for
role authentication of any usernames, where nis the same as that in the target user role. For
example, to obtain a level-3 user role, the device uses $enab3$@domain-name or $enab3$,
depending on whether the domain name is required.
Examples
# Configure ISP domain test to use HWTACACS scheme tac for user role authentication.
<Sysname> system-view
[Sysname] super authentication-mode scheme
[Sysname] domain test
[Sysname-domain-test] authentication super hwtacacs-scheme tac
Related commands
•authentication default
•hwtacacs scheme
•radius scheme
9
authorization command
Use authorization command to specify the command authorization method.
Use undo authorization command to restore the default.
Syntax
In non-FIPS mode:
authorization command { hwtacacs-scheme hwtacacs-scheme-name [ local ] [ none ] | local [ none ] |
none }
undo authorization command
In FIPS mode:
authorization command { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local }
undo authorization command
Default
The default authorization method of the ISP domain is used for command authorization.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authorization.
none: Does not perform authorization. The authorization server does not verify whether the entered
commands are permitted by the user role. The commands are executed successfully if the user role has
permission to the commands.
Usage guidelines
Command authorization restricts login users to execute only authorized commands by employing an
authorization server to verify whether or not each entered command is permitted.
After login, users can access the command lines permitted by their authorized user roles.
You can specify one command authorization method and multiple backup authorization methods.
When the default authorization method is invalid, the device attempts to use the backup authorization
methods in sequence. For example, the authorization command hwtacacs-scheme
hwtacacs-scheme-name local none command specifies the default HWTACACS authorization method
and two backup authorization methods, local authorization and no authorization. The device performs
HWTACACS authorization by default, performs local authorization when the HWTACACS server is
invalid, and does not perform command authorization when both of the previous methods are invalid.
Examples
# Configure ISP domain test to use local command authorization.
<Sysname> system-view
[Sysname] domain test
10
[Sysname-isp-test] authorization command local
# Configure ISP domain test to use HWTACACS scheme hwtac for command authorization and use local
authorization as the backup authorization method.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization command hwtacacs-scheme hwtac local
Related commands
•authorization accounting (Fundamentals Command Reference)
•hwtacacs scheme
•local-user
authorization default
Use authorization default to specify the default authorization method for an ISP domain.
Use undo authorization default to restore the default.
Syntax
In non-FIPS mode:
authorization default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[ local ] [ none ] | local [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [ local ] [ none ] }
undo authorization default
In FIPS mode:
authorization default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[ local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ]
[ local ] }
undo authorization default
Default
The default authorization method of an ISP domain is local.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authorization.
none: Does not perform authorization. After passing authentication, FTP, SFTP and SCP users use the root
directory of the device as the work directory but cannot access to it, and other login users get the default
user role. For more information about the default user role, see Fundamentals Configuration Guide.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
11
Usage guidelines
The default authorization method is used for all users who support this method and do not have a specific
authorization method are configured.
The RADIUS authorization configuration takes effect only when the authentication method and
authorization method of the ISP domain use the same RADIUS scheme.
You can specify one authorization method and multiple backup authorization methods.
When the default authorization method is invalid, the device attempts to use the backup authorization
methods in sequence. For example, the authorization default radius-scheme radius-scheme-name local
none command specifies the default RADIUS authorization method and two backup authorization
methods, local authorization and no authorization. The device performs RADIUS authorization by default,
performs local authorization when the RADIUS server is invalid, and does not perform authorization
when both of the previous methods are invalid.
Examples
# Configure the default authorization method for ISP domain test to use RADIUS scheme rd for user
authorization and use local authorization as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization default radius-scheme rd local
Related commands
•hwtacacs scheme
•local-user
•radius scheme
authorization login
Use authorization login to configure the authorization method for login users.
Use undo authorization login to restore the default.
Syntax
In non-FIPS mode:
authorization login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[local ][none ]|local [none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [ local ] [ none ]}
undo authorization login
In FIPS mode:
authorization login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ]
[local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ]
[local ]}
undo authorization login
Default
The default authorization method of the ISP domain is used for login users.
12
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authorization.
none: Does not perform authorization. After passing authentication, FTP, SFTP, and SCP users use the root
directory of the device as the work directory but cannot access it, and other login users get the default
user role. For more information about the default user role, see Fundamentals Configuration Guide.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of
1 to 32 characters.
Usage guidelines
The RADIUS authorization configuration takes effect only when the authentication method and
authorization method of the ISP domain use the same RADIUS scheme.
You can specify one authorization method and multiple backup authorization methods.
When the default authorization method is invalid, the device attempts to use the backup authorization
methods in sequence. For example, the authorization login radius-scheme radius-scheme-name local
none command specifies the default RADIUS authorization method and two backup authorization
methods, local authorization and no authorization. The device performs RADIUS authorization by default,
performs local authorization when the RADIUS server is invalid, and does not perform authorization
when both of the previous methods are invalid.
Examples
# Configure ISP domain test to use local authorization for login users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization login local
# Configure ISP domain test to use RADIUS scheme rd for login user authorization and use local
authorization as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization login radius-scheme rd local
Related commands
•authorization default
•hwtacacs scheme
•local-user
•radius scheme
authorization-attribute (ISP domain view)
Use authorization-attribute to configure authorization attributes for users in an ISP domain.
13
Use undo authorization-attribute to restore the default of an authorization attribute.
Syntax
authorization-attribute idle-cut minute [ flow ]
undo authorization-attribute idle-cut
Default
No authorization attribute is configured for users in the ISP domain and the idle cut function is disabled.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
idle-cut minute: Sets the idle timeout period in minutes. The value range for the minute argument is 1 to
600.
flow: Specifies the minimum traffic that must be generated in the idle timeout period in bytes, in the range
of 1 to 10240000. The default is 10240 bytes.
Usage guidelines
When the idle cut function is configured, the device periodically detects the traffic of each online user,
and logs out users who do not meet the minimum traffic requirement in the idle timeout period. When the
idle cut function is disabled on the device, the idle cut function of the server takes effect, which requires
at least 10240 bytes to be generated in a configurable idle timeout period.
Examples
# Configure the idle cut function for users in the ISP domain named test, which requires users to generate
at least 10240 bytes in an idle timeout period of 30 minutes.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization-attribute idle-cut 30 10240
Related commands
display domain
display domain
Use display domain to display the ISP domain configuration.
Syntax
display domain [ isp-name ]
Views
Any view
Predefined user roles
network-admin
network-operator
Other manuals for FlexFabric 7900 Series
4
Table of contents
Other HP Switch manuals
HP
HP FlexFabric 12900 series User manual
HP
HP 316095-B21 - StorageWorks Edge Switch 2/24 Instruction Manual
HP
HP 10504 User manual
HP
HP StorageWorks 2/140 - Director Switch User manual
HP
HP 5120 EI Series User manual
HP
HP 6125G Installation manual
HP
HP Aruba 6300F24G 4SFP56 Assembly instructions
HP
HP StorageWorks 16-EL - SAN Switch Instruction Manual
HP
HP 2800 Series User manual
HP
HP ProCurve Switch 2650 Manual
HP
HP StorageWorks 2/140 - Director Switch Instruction Manual
HP
HP AF600A - Server Console Switch User manual
HP
HP ProCurve J4852A User manual
HP
HP ProCurve 8212zl Series User manual
HP
HP aruba 6300M Owner's manual
HP
HP 372284-001 User manual
HP
HP 5500 HI Series Instruction Manual
HP
HP Voltaire InfiniBand Grid Director 4200 QDR Operator's manual
HP
HP 10500 series User manual
HP
HP StorageWorks 2/140 - Director Switch Instruction Manual
