HP FlexNetwork 7500 Series Installation manual

HPE FlexNetwork 7500 Switch Series
Security Command Reference
P
art number: 5200-1951a
Software
version: 7500-CMW710-R7557P01
Document version: 6W101-20171020

© Copyright 2017 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® and Acrobat® are trademarks of Adobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
AAA commands·····························································································1
General AAA commands····································································································································1
aaa nas-id profile········································································································································1
aaa session-limit ········································································································································2
accounting command·································································································································2
accounting default······································································································································3
accounting dual-stack ································································································································4
accounting lan-access································································································································5
accounting login·········································································································································7
accounting portal········································································································································8
accounting quota-out··································································································································9
accounting start-fail··································································································································10
accounting update-fail······························································································································11
authentication default·······························································································································11
authentication lan-access·························································································································13
authentication login··································································································································14
authentication onu····································································································································15
authentication portal·································································································································16
authentication super·································································································································17
authorization command····························································································································18
authorization default·································································································································20
authorization lan-access ··························································································································21
authorization login····································································································································22
authorization portal···································································································································24
authorization-attribute (ISP domain view)································································································25
display domain·········································································································································26
domain ·····················································································································································30
domain default enable······························································································································31
domain if-unknown···································································································································32
nas-id bind vlan········································································································································33
service-type (ISP domain view)················································································································33
session-time include-idle-time··················································································································34
state (ISP domain view)···························································································································35
user-address-type····································································································································36
Local user commands······································································································································37
access-limit ··············································································································································37
authorization-attribute (local user view/user group view)·········································································38
bind-attribute············································································································································40
company···················································································································································41
description················································································································································42
display local-user ·····································································································································42
display user-group····································································································································46
email·························································································································································47
full-name ··················································································································································48
group························································································································································48
local-guest email format···························································································································49
local-guest email sender··························································································································50
local-guest email smtp-server··················································································································51
local-guest generate·································································································································51
local-guest send-email·····························································································································53
local-user··················································································································································53
local-user auto-delete enable···················································································································55
local-user-export ······································································································································55
local-user-import ······································································································································56
password (device management user view)······························································································58
password (network access user view) ·····································································································59
phone·······················································································································································60

ii
service-type (local user view)···················································································································61
sponsor-department·································································································································62
sponsor-email···········································································································································62
sponsor-full-name ····································································································································63
state (local user view) ······························································································································64
user-group················································································································································64
validity-datetime·······································································································································65
RADIUS commands·········································································································································66
aaa device-id············································································································································66
accounting-on enable·······························································································································67
accounting-on extended···························································································································68
attribute 15 check-mode···························································································································69
attribute 25 car·········································································································································69
attribute 31 mac-format····························································································································70
attribute convert (RADIUS DAS view)······································································································71
attribute convert (RADIUS scheme view)·································································································72
attribute reject (RADIUS DAS view)·········································································································73
attribute reject (RADIUS scheme view)····································································································74
attribute remanent-volume·······················································································································75
attribute translate ·····································································································································76
client·························································································································································76
data-flow-format (RADIUS scheme view) ································································································78
display radius scheme······························································································································79
display radius statistics ····························································································································82
display stop-accounting-buffer (for RADIUS)···························································································83
key (RADIUS scheme view)·····················································································································84
nas-ip (RADIUS scheme view)·················································································································85
port···························································································································································86
primary accounting (RADIUS scheme view)····························································································87
primary authentication (RADIUS scheme view)·······················································································89
radius attribute extended··························································································································90
radius dscp···············································································································································92
radius dynamic-author server···················································································································92
radius nas-ip·············································································································································93
radius scheme··········································································································································94
radius session-control client·····················································································································95
radius session-control enable ··················································································································96
radius-server test-profile ··························································································································97
reset radius statistics································································································································98
reset stop-accounting-buffer (for RADIUS)······························································································98
retry··························································································································································99
retry realtime-accounting························································································································100
retry stop-accounting (RADIUS scheme view)·······················································································101
secondary accounting (RADIUS scheme view) ·····················································································102
secondary authentication (RADIUS scheme view) ················································································104
server-load-sharing enable ····················································································································106
snmp-agent trap enable radius ··············································································································107
state primary ··········································································································································108
state secondary······································································································································109
stop-accounting-buffer enable (RADIUS scheme view)·········································································110
timer quiet (RADIUS scheme view)········································································································111
timer realtime-accounting (RADIUS scheme view)················································································112
timer response-timeout (RADIUS scheme view)····················································································113
user-name-format (RADIUS scheme view)····························································································114
vpn-instance (RADIUS scheme view)····································································································115
HWTACACS commands································································································································115
data-flow-format (HWTACACS scheme view) ·······················································································115
display hwtacacs scheme ······················································································································116
display stop-accounting-buffer (for HWTACACS)··················································································121
hwtacacs nas-ip ·····································································································································122
hwtacacs scheme···································································································································123
key (HWTACACS scheme view)············································································································124

iii
nas-ip (HWTACACS scheme view)········································································································125
primary accounting (HWTACACS scheme view)···················································································126
primary authentication (HWTACACS scheme view)··············································································127
primary authorization······························································································································129
reset hwtacacs statistics ························································································································130
reset stop-accounting-buffer (for HWTACACS)·····················································································131
retry stop-accounting (HWTACACS scheme view)················································································131
secondary accounting (HWTACACS scheme view) ··············································································132
secondary authentication (HWTACACS scheme view) ·········································································134
secondary authorization·························································································································135
stop-accounting-buffer enable (HWTACACS scheme view)··································································137
timer quiet (HWTACACS scheme view)·································································································138
timer realtime-accounting (HWTACACS scheme view)·········································································138
timer response-timeout (HWTACACS scheme view)·············································································139
user-name-format (HWTACACS scheme view)·····················································································140
vpn-instance (HWTACACS scheme view)·····························································································141
LDAP commands···········································································································································141
attribute-map··········································································································································141
authentication-server······························································································································142
authorization-server ·······························································································································143
display ldap scheme·······························································································································144
ip ····························································································································································145
ipv6·························································································································································146
ldap attribute-map··································································································································147
ldap scheme···········································································································································148
ldap server ·············································································································································149
login-dn ··················································································································································149
login-password·······································································································································150
map························································································································································151
protocol-version······································································································································152
search-base-dn······································································································································152
search-scope··········································································································································153
server-timeout········································································································································154
user-parameters·····································································································································154
RADIUS server commands····························································································································155
display radius-server active-client··········································································································155
display radius-server active-user ···········································································································156
radius-server activate·····························································································································157
radius-server client·································································································································158
802.1X commands·····················································································160
display dot1x··········································································································································160
display dot1x connection························································································································164
display dot1x mac-address ····················································································································167
dot1x ······················································································································································168
dot1x access-user log enable ················································································································169
dot1x after-mac-auth max-attempt·········································································································170
dot1x authentication-method··················································································································171
dot1x auth-fail vlan·································································································································172
dot1x auth-fail vsi···································································································································173
dot1x critical eapol ·································································································································174
dot1x critical vlan····································································································································174
dot1x critical vsi······································································································································175
dot1x critical-voice-vlan··························································································································176
dot1x domain-delimiter···························································································································177
dot1x ead-assistant enable····················································································································178
dot1x ead-assistant free-ip·····················································································································179
dot1x ead-assistant url···························································································································179
dot1x eapol untag···································································································································180
dot1x guest-vlan·····································································································································181
dot1x guest-vlan-delay···························································································································182
dot1x guest-vsi·······································································································································183

iv
dot1x guest-vsi-delay·····························································································································184
dot1x handshake····································································································································185
dot1x handshake reply enable···············································································································186
dot1x handshake secure························································································································186
dot1x mac-binding··································································································································187
dot1x mac-binding enable······················································································································188
dot1x mandatory-domain ·······················································································································189
dot1x max-user ······································································································································190
dot1x multicast-trigger····························································································································190
dot1x port-control···································································································································191
dot1x port-method··································································································································192
dot1x quiet-period ··································································································································193
dot1x re-authenticate ·····························································································································193
dot1x re-authenticate manual·················································································································194
dot1x re-authenticate server-unreachable keep-online··········································································195
dot1x retry··············································································································································195
dot1x timer ·············································································································································196
dot1x timer reauth-period·······················································································································198
dot1x unicast-trigger·······························································································································199
dot1x user-ip freeze ·······························································································································200
reset dot1x guest-vlan····························································································································200
reset dot1x guest-vsi······························································································································201
reset dot1x statistics·······························································································································201
MAC authentication commands·································································203
display mac-authentication·····················································································································203
display mac-authentication connection··································································································206
display mac-authentication mac-address·······························································································208
mac-authentication·································································································································210
mac-authentication access-user log enable···························································································211
mac-authentication carry user-ip············································································································211
mac-authentication critical vlan··············································································································212
mac-authentication critical vsi················································································································213
mac-authentication critical-voice-vlan····································································································214
mac-authentication domain····················································································································215
mac-authentication guest-vlan···············································································································216
mac-authentication guest-vlan auth-period····························································································217
mac-authentication guest-vsi ·················································································································218
mac-authentication guest-vsi auth-period······························································································219
mac-authentication host-mode···············································································································219
mac-authentication max-user·················································································································220
mac-authentication offline-detect enable ·······························································································221
mac-authentication parallel-with-dot1x···································································································222
mac-authentication re-authenticate········································································································223
mac-authentication re-authenticate server-unreachable keep-online····················································223
mac-authentication timer (interface view) ······························································································224
mac-authentication timer (system view)·································································································225
mac-authentication user-name-format···································································································227
reset mac-authentication critical vlan·····································································································228
reset mac-authentication critical vsi·······································································································228
reset mac-authentication critical-voice-vlan···························································································229
reset mac-authentication guest-vlan······································································································230
reset mac-authentication guest-vsi ········································································································230
reset mac-authentication statistics·········································································································231
Portal commands·······················································································232
aging-time ··············································································································································232
authentication-timeout····························································································································233
binding-retry···········································································································································233
default-logon-page·································································································································234
display portal··········································································································································235
display portal mac-trigger-server············································································································238

v
display portal packet statistics················································································································240
display portal rule···································································································································242
display portal server·······························································································································246
display portal user··································································································································247
display portal web-server·······················································································································254
display web-redirect rule························································································································255
if-match ··················································································································································257
ip (MAC binding server view)·················································································································259
ip (portal authentication server view) ·····································································································260
ipv6·························································································································································261
nas-port-type··········································································································································262
port (MAC binding server view)··············································································································263
port (portal authentication server view)··································································································263
portal { bas-ip | bas-ipv6 } (interface view)·····························································································264
portal { ipv4-max-user | ipv6-max-user } (interface view)·······································································265
portal apply mac-trigger-server··············································································································266
portal apply web-server (interface view) ································································································267
portal authorization strict-checking·········································································································268
portal delete-user···································································································································268
portal device-id·······································································································································269
portal domain (interface view)················································································································270
portal enable (interface view)·················································································································270
portal fail-permit server ··························································································································271
portal free-all except destination············································································································272
portal free-rule········································································································································273
portal free-rule destination ·····················································································································275
portal free-rule source····························································································································276
portal ipv6 free-all except destination·····································································································277
portal ipv6 layer3 source························································································································278
portal ipv6 user-detect····························································································································279
portal layer3 source································································································································280
portal local-web-server···························································································································281
portal log enable·····································································································································282
portal mac-trigger server························································································································283
portal max-user······································································································································284
portal nas-id-profile ································································································································284
portal nas-port-id format·························································································································285
portal outbound-filter enable ··················································································································288
portal pre-auth domain···························································································································289
portal pre-auth ip-pool····························································································································290
portal refresh enable······························································································································291
portal roaming enable ····························································································································292
portal server···········································································································································293
portal user-detect···································································································································293
portal user-dhcp-only (interface view)····································································································295
portal web-proxy port ·····························································································································295
portal web-server ···································································································································296
reset portal packet statistics···················································································································297
server-detect (portal authentication server view)···················································································298
server-detect (portal Web server view)··································································································299
server-type·············································································································································300
server-type (MAC binding server view)··································································································300
tcp-port···················································································································································301
url···························································································································································302
url-parameter··········································································································································303
user-sync················································································································································304
version····················································································································································305
vpn-instance···········································································································································306
web-redirect url ······································································································································307
Port security commands ············································································308
display port-security·······························································································································308

vi
display port-security mac-address block································································································311
display port-security mac-address security····························································································312
port-security access-user log enable ·····································································································313
port-security authentication open···········································································································314
port-security authentication open global ································································································315
port-security authorization ignore···········································································································316
port-security authorization-fail offline ·····································································································316
port-security enable································································································································317
port-security free-vlan ····························································································································318
port-security intrusion-mode···················································································································319
port-security mac-address aging-type inactivity·····················································································320
port-security mac-address dynamic·······································································································321
port-security mac-address security········································································································322
port-security mac-limit····························································································································324
port-security mac-move permit···············································································································325
port-security max-mac-count··················································································································325
port-security nas-id-profile······················································································································327
port-security ntk-mode ···························································································································327
port-security oui······································································································································328
port-security port-mode··························································································································329
port-security timer autolearn aging·········································································································332
port-security timer disableport················································································································333
snmp-agent trap enable port-security ····································································································334
Password control commands·····································································336
display password-control························································································································336
display password-control blacklist··········································································································337
password-control { aging | composition | history | length } enable ·························································338
password-control aging··························································································································339
password-control alert-before-expire ·····································································································341
password-control complexity··················································································································341
password-control composition················································································································342
password-control enable························································································································344
password-control expired-user-login······································································································345
password-control history························································································································345
password-control length·························································································································346
password-control login idle-time·············································································································347
password-control login-attempt··············································································································348
password-control super aging················································································································350
password-control super composition······································································································351
password-control super length···············································································································352
password-control update-interval···········································································································352
reset password-control blacklist·············································································································353
reset password-control history-record····································································································354
Keychain commands ·················································································355
accept-lifetime utc··································································································································355
accept-tolerance·····································································································································356
authentication-algorithm·························································································································356
default-send-key·····································································································································357
display keychain·····································································································································358
key··························································································································································359
keychain·················································································································································360
key-string················································································································································361
send-lifetime utc·····································································································································361
tcp-algorithm-id ······································································································································362
tcp-kind···················································································································································363
Public key management commands··························································365
display public-key local public················································································································365
display public-key peer···························································································································368
peer-public-key end································································································································370

vii
public-key local create····························································································································371
public-key local destroy··························································································································374
public-key local export dsa·····················································································································376
public-key local export ecdsa·················································································································378
public-key local export rsa······················································································································379
public-key peer·······································································································································381
public-key peer import sshkey················································································································382
PKI commands··························································································384
attribute··················································································································································384
ca identifier·············································································································································385
certificate request entity·························································································································386
certificate request from···························································································································387
certificate request mode·························································································································387
certificate request polling ·······················································································································389
certificate request url······························································································································389
common-name·······································································································································390
country ···················································································································································391
crl check·················································································································································391
crl url ······················································································································································392
display pki certificate access-control-policy ···························································································393
display pki certificate attribute-group······································································································394
display pki certificate domain·················································································································396
display pki certificate request-status······································································································400
display pki crl domain·····························································································································402
fqdn························································································································································403
ip ····························································································································································404
ldap-server·············································································································································405
locality····················································································································································406
organization············································································································································406
organization-unit·····································································································································407
pki abort-certificate-request····················································································································407
pki certificate access-control-policy········································································································408
pki certificate attribute-group··················································································································409
pki delete-certificate·······························································································································410
pki domain··············································································································································411
pki entity·················································································································································412
pki export················································································································································413
pki import················································································································································420
pki request-certificate·····························································································································424
pki retrieve-certificate·····························································································································425
pki retrieve-crl·········································································································································427
pki storage··············································································································································428
pki validate-certificate·····························································································································429
public-key dsa········································································································································431
public-key ecdsa ····································································································································432
public-key rsa·········································································································································433
root-certificate fingerprint ·······················································································································434
rule·························································································································································436
source ····················································································································································437
state ·······················································································································································438
usage ·····················································································································································438
SSH commands·························································································440
SSH server commands··································································································································440
display ssh server ··································································································································440
display ssh user-information ··················································································································441
free ssh ··················································································································································442
scp server enable···································································································································443
sftp server enable···································································································································444
sftp server idle-timeout···························································································································444
ssh server acl·········································································································································445

viii
ssh server acl-deny-log enable··············································································································446
ssh server authentication-retries············································································································447
ssh server authentication-timeout··········································································································448
ssh server compatible-ssh1x enable······································································································448
ssh server dscp······································································································································449
ssh server enable···································································································································450
ssh server ipv6 acl ·································································································································450
ssh server ipv6 dscp ······························································································································451
ssh server pki-domain····························································································································452
ssh server port ·······································································································································452
ssh server rekey-interval························································································································453
ssh user··················································································································································454
SSH client commands····································································································································456
bye ·························································································································································456
cd ···························································································································································457
cdup ·······················································································································································457
delete ·····················································································································································458
delete ssh client server-public-key·········································································································458
dir···························································································································································459
display sftp client source························································································································460
display ssh client server-public-key········································································································460
display ssh client source························································································································462
exit··························································································································································462
get··························································································································································463
help ························································································································································463
ls·····························································································································································464
mkdir ······················································································································································465
put··························································································································································465
pwd·························································································································································466
quit ·························································································································································466
remove ···················································································································································467
rename···················································································································································467
rmdir·······················································································································································468
scp··························································································································································468
scp ipv6··················································································································································471
scp ipv6 suite-b······································································································································474
scp suite-b··············································································································································476
sftp ·························································································································································478
sftp client ipv6 source·····························································································································480
sftp client source····································································································································481
sftp ipv6··················································································································································482
sftp ipv6 suite-b······································································································································485
sftp suite-b··············································································································································486
ssh client ipv6 source·····························································································································488
ssh client source ····································································································································489
ssh2························································································································································489
ssh2 ipv6················································································································································492
ssh2 ipv6 suite-b····································································································································495
ssh2 suite-b············································································································································497
SSH2 commands···········································································································································499
display ssh2 algorithm····························································································································499
ssh2 algorithm cipher·····························································································································500
ssh2 algorithm key-exchange ················································································································501
ssh2 algorithm mac································································································································502
ssh2 algorithm public-key·······················································································································503
SSL commands·························································································505
ciphersuite··············································································································································505
client-verify·············································································································································507
display crypto version·····························································································································508
display ssl client-policy···························································································································509
display ssl server-policy·························································································································510

ix
pki-domain (SSL client policy view)········································································································510
pki-domain (SSL server policy view)······································································································511
prefer-cipher···········································································································································512
server-verify enable································································································································514
session···················································································································································515
ssl client-policy·······································································································································516
ssl renegotiation disable·························································································································516
ssl server-policy ·····································································································································517
ssl version disable··································································································································518
version····················································································································································518
Attack detection and prevention commands ··············································520
ack-flood action······································································································································520
ack-flood detect······································································································································520
ack-flood detect non-specific··················································································································521
ack-flood threshold·································································································································522
attack-defense local apply policy ···········································································································523
attack-defense login block-timeout·········································································································524
attack-defense login enable···················································································································524
attack-defense login max-attempt··········································································································525
attack-defense login reauthentication-delay···························································································526
attack-defense policy ·····························································································································526
attack-defense signature log non-aggregate··························································································527
attack-defense tcp fragment enable·······································································································528
blacklist global enable····························································································································528
blacklist ip···············································································································································529
blacklist ipv6···········································································································································530
blacklist logging enable··························································································································531
blacklist user ··········································································································································532
display attack-defense flood statistics ip································································································533
display attack-defense flood statistics ipv6····························································································534
display attack-defense policy·················································································································536
display attack-defense policy ip ·············································································································540
display attack-defense policy ipv6··········································································································542
display attack-defense scan attacker ip·································································································544
display attack-defense scan attacker ipv6 ·····························································································545
display attack-defense scan victim ip·····································································································547
display attack-defense scan victim ipv6·································································································548
display attack-defense statistics local····································································································550
display blacklist ip ··································································································································553
display blacklist ipv6·······························································································································555
display blacklist user······························································································································556
dns-flood action······································································································································557
dns-flood detect······································································································································557
dns-flood detect non-specific ·················································································································559
dns-flood port·········································································································································559
dns-flood threshold·································································································································560
exempt acl··············································································································································561
fin-flood action········································································································································562
fin-flood detect········································································································································563
fin-flood detect non-specific ···················································································································564
fin-flood threshold···································································································································564
http-flood action······································································································································565
http-flood detect ·····································································································································566
http-flood detect non-specific·················································································································567
http-flood port·········································································································································568
http-flood threshold ································································································································569
icmp-flood action····································································································································570
icmp-flood detect ip································································································································570
icmp-flood detect non-specific················································································································571
icmp-flood threshold·······························································································································572
icmpv6-flood action································································································································573

x
icmpv6-flood detect ipv6 ························································································································574
icmpv6-flood detect non-specific············································································································575
icmpv6-flood threshold···························································································································575
reset attack-defense policy flood············································································································576
reset attack-defense statistics local ·······································································································577
reset blacklist ip······································································································································577
reset blacklist ipv6··································································································································578
reset blacklist statistics···························································································································579
rst-flood action········································································································································579
rst-flood detect ·······································································································································580
rst-flood detect non-specific···················································································································581
rst-flood threshold ··································································································································581
scan detect·············································································································································582
signature { large-icmp | large-icmpv6 } max-length················································································584
signature detect······································································································································584
signature level action ·····························································································································587
signature level detect·····························································································································588
syn-ack-flood action·······························································································································589
syn-ack-flood detect·······························································································································590
syn-ack-flood detect non-specific···········································································································591
syn-ack-flood threshold··························································································································592
syn-flood action······································································································································593
syn-flood detect······································································································································593
syn-flood detect non-specific··················································································································594
syn-flood threshold·································································································································595
udp-flood action······································································································································596
udp-flood detect ·····································································································································597
udp-flood detect non-specific·················································································································598
udp-flood threshold ································································································································598
TCP attack prevention commands·····························································600
tcp anti-naptha enable····························································································································600
tcp check-state interval ··························································································································600
tcp state··················································································································································601
IP source guard commands·······································································603
display ip source binding························································································································603
display ip verify source excluded ···········································································································604
display ipv6 source binding····················································································································606
display ipv6 source binding pd···············································································································607
ip source binding (interface view)···········································································································609
ip source binding (system view)·············································································································610
ip verify source·······································································································································611
ip verify source exclude··························································································································612
ipv6 source binding (interface view)·······································································································613
ipv6 source binding (system view)·········································································································614
ipv6 verify source···································································································································614
ARP attack protection commands······························································616
Unresolvable IP attack protection commands································································································616
arp resolving-route enable ·····················································································································616
arp resolving-route probe-count·············································································································616
arp resolving-route probe-interval··········································································································617
arp source-suppression enable··············································································································618
arp source-suppression limit··················································································································618
display arp source-suppression ·············································································································619
ARP packet rate limit commands···················································································································619
arp rate-limit···········································································································································619
arp rate-limit log enable··························································································································620
arp rate-limit log interval·························································································································621
snmp-agent trap enable arp···················································································································621
Source MAC-based ARP attack detection commands ··················································································622

xi
arp source-mac ······································································································································622
arp source-mac aging-time ····················································································································623
arp source-mac exclude-mac·················································································································624
arp source-mac threshold ······················································································································624
display arp source-mac··························································································································625
ARP packet source MAC consistency check commands···············································································626
arp valid-check enable···························································································································626
ARP active acknowledgement commands·····································································································626
arp active-ack enable·····························································································································626
Authorized ARP commands···························································································································627
arp authorized enable ····························································································································627
ARP attack detection commands···················································································································628
arp detection enable·······························································································································628
arp detection log enable·························································································································628
arp detection port-match-ignore·············································································································629
arp detection rule ···································································································································630
arp detection trust ··································································································································631
arp detection validate·····························································································································631
arp restricted-forwarding enable ············································································································632
display arp detection······························································································································633
display arp detection statistics ···············································································································633
reset arp detection statistics···················································································································634
ARP scanning and fixed ARP commands······································································································635
arp fixup ·················································································································································635
arp scan ·················································································································································636
ARP gateway protection commands··············································································································637
arp filter source ······································································································································637
ARP filtering commands·································································································································637
arp filter binding······································································································································637
ARP packet sender IP address checking commands····················································································638
arp sender-ip-range································································································································638
ND attack defense commands···································································640
Source MAC consistency check commands··································································································640
ipv6 nd check log enable························································································································640
ipv6 nd mac-check enable ·····················································································································640
ND attack detection commands·····················································································································641
display ipv6 nd detection statistics·········································································································641
ipv6 nd detection enable························································································································642
ipv6 nd detection trust····························································································································642
reset ipv6 nd detection statistics············································································································643
RA guard commands ·····································································································································643
display ipv6 nd raguard policy················································································································643
display ipv6 nd raguard statistics···········································································································644
if-match acl·············································································································································645
if-match autoconfig managed-address-flag····························································································646
if-match autoconfig other-flag·················································································································647
if-match hop-limit····································································································································647
if-match prefix·········································································································································648
if-match router-preference······················································································································649
ipv6 nd raguard apply policy ··················································································································650
ipv6 nd raguard log enable·····················································································································650
ipv6 nd raguard policy····························································································································651
ipv6 nd raguard role·······························································································································652
reset ipv6 nd raguard statistics ··············································································································653
IPv4 uRPF commands···············································································654
display ip urpf·········································································································································654
ip urpf·····················································································································································654
IPv6 uRPF commands···············································································656
display ipv6 urpf·····································································································································656

xii
ipv6 urpf ·················································································································································656
MFF commands·························································································658
display mac-forced-forwarding interface································································································658
display mac-forced-forwarding vlan ·······································································································658
mac-forced-forwarding···························································································································659
mac-forced-forwarding gateway probe···································································································660
mac-forced-forwarding network-port······································································································661
mac-forced-forwarding server················································································································661
FIPS commands························································································663
display fips status···································································································································663
fips mode enable····································································································································663
fips self-test············································································································································665
MACsec commands···················································································668
confidentiality-offset ·······························································································································668
display macsec·······································································································································668
display mka policy··································································································································671
display mka session·······························································································································672
display mka statistics ·····························································································································675
macsec confidentiality-offset··················································································································676
macsec desire········································································································································677
macsec mka-session log enable············································································································677
macsec replay-protection enable···········································································································678
macsec replay-protection window-size ··································································································679
macsec validation mode·························································································································680
mka apply policy·····································································································································681
mka enable·············································································································································682
mka policy··············································································································································682
mka priority·············································································································································683
mka psk··················································································································································684
replay-protection enable·························································································································685
replay-protection window-size················································································································686
reset mka session··································································································································687
reset mka statistics·································································································································687
validation mode······································································································································688
802.1X client commands············································································689
display dot1x supplicant·························································································································689
dot1x supplicant anonymous identify·····································································································690
dot1x supplicant eap-method·················································································································691
dot1x supplicant enable ·························································································································692
dot1x supplicant mac-address ···············································································································692
dot1x supplicant password·····················································································································693
dot1x supplicant ssl-client-policy············································································································694
dot1x supplicant username····················································································································695
Web authentication commands··································································697
display web-auth····································································································································697
display web-auth free-ip·························································································································698
display web-auth server·························································································································698
display web-auth user····························································································································699
ip ····························································································································································700
redirect-wait-time····································································································································701
url···························································································································································702
url-parameter··········································································································································703
web-auth auth-fail vlan···························································································································704
web-auth domain····································································································································705
web-auth enable·····································································································································705
web-auth free-ip·····································································································································706
web-auth max-user ································································································································707

xiii
web-auth offline-detect···························································································································708
web-auth proxy port ·······························································································································708
web-auth server ·····································································································································709
Document conventions and icons······························································711
Conventions···················································································································································711
Network topology icons··································································································································712
Support and other resources ·····································································713
Accessing Hewlett Packard Enterprise Support·····························································································713
Accessing updates·········································································································································713
Websites ················································································································································714
Customer self repair·······························································································································714
Remote support······································································································································714
Documentation feedback ·······················································································································714
Index··········································································································716

1
AAA commands
The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for
features, commands, and parameters might differ in FIPS mode and non-FIPS mode. For more
information about FIPS mode, see Security Configuration Guide.
General AAA commands
aaa nas-id profile
Use aaa nas-id profile to create a NAS-ID profile and enter its view, or enter the view of an existing
NAS-ID profile.
Use undo aaa nas-id profile to delete a NAS-ID profile.
Syntax
aaa nas-id profile profile-name
undo aaa nas-id profile profile-name
Default
No NAS-ID profiles exist. The device uses the device name (set by using the sysname command)
as the NAS-ID.
Views
System view
Predefined user roles
network-admin
mdc-admin
Parameters
profile-name: Specifies the NAS-ID profile name, a case-insensitive string of 1 to 31 characters.
Usage guidelines
Configure a NAS-ID profile to maintain NAS-ID and VLAN bindings on the device.
During RADIUS authentication, the device uses a NAS-ID to set the NAS-Identifier attribute of
RADIUS packets so that the RADIUS server can identify the access location of users.
Examples
# Create a NAS-ID profile named aaa and enter its view.
<Sysname> system-view
[Sysname] aaa nas-id profile aaa
[Sysname-nas-id-prof-aaa]
Related commands
nas-id bind vlan
port-security nas-id-profile
portal nas-id-profile

2
aaa session-limit
Use aaa session-limit to set the maximum number of concurrent users that can log on to the device
through the specified method.
Use undo aaa session-limit to restore the default maximum number of concurrent users for the
specified login method.
Syntax
In non-FIPS mode:
aaa session-limit { ftp | http | https | ssh | telnet } max-sessions
undo aaa session-limit { ftp | http | https | ssh | telnet }
In FIPS mode:
aaa session-limit { https | ssh } max-sessions
undo aaa session-limit { https | ssh }
Default
The maximum number of concurrent users is 32 for each user type.
Views
System view
Predefined user roles
network-admin
mdc-admin
Parameters
ftp: FTP users.
http: HTTP users.
https: HTTPS users.
ssh: SSH users.
telnet: Telnet users.
max-sessions: Specifies the maximum number of concurrent login users. The value range is 1 to 32
for FTP, SSH, and Telnet services, and is 1 to 64 for HTTP and HTTPS services.
Usage guidelines
After the maximum number of concurrent login users for a user type exceeds the upper limit, the
system denies the subsequent users of this type.
Examples
# Set the maximum number of concurrent FTP users to 4.
<Sysname> system-view
[Sysname] aaa session-limit ftp 4
accounting command
Use accounting command to specify the command line accounting method.
Use undo accounting command to restore the default.

3
Syntax
accounting command hwtacacs-scheme hwtacacs-scheme-name
undo accounting command
Default
The default accounting methods of the ISP domain are used for command line accounting.
Views
ISP domain view
Predefined user roles
network-admin
mdc-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
Usage guidelines
The command line accounting feature works with the accounting server to record valid commands
that have been successfully executed on the device.
•
When the command line authorization feature is disabled, the accounting server records all
valid commands that have been successfully executed.
•
When the command line authorization feature is enabled, the accounting server records only
authorized commands that have been successfully executed.
Command line accounting can use only a remote HWTACACS server.
Examples
# In ISP domain test, perform command line accounting based on HWTACACS scheme hwtac.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting command hwtacacs-scheme hwtac
Related commands
accounting default
command accounting (Fundamentals Command Reference)
hwtacacs scheme
accounting default
Use accounting default to specify default accounting methods for an ISP domain.
Use undo accounting default to restore the default.
Syntax
In non-FIPS mode:
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] [ none ]|local [none ] | none |radius-scheme
radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [local ] [ none ] }
undo accounting default
In FIPS mode:

4
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] | local |radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [local ] }
undo accounting default
Default
The default accounting method of an ISP domain is local.
Views
ISP domain view
Predefined user roles
network-admin
mdc-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive
string of 1 to 32 characters.
Usage guidelines
The default accounting method is used for all users that support this method and do not have an
accounting method configured.
Local accounting is only used for monitoring and controlling the number of local user connections. It
does not provide the statistics function that the accounting feature generally provides.
You can specify one primary default accounting method and multiple backup default accounting
methods.
When the primary method is invalid, the device attempts to use the backup methods in sequence.
For example, the accounting default radius-scheme radius-scheme-name local none command
specifies the primarydefault RADIUS accounting method and two backup methods (local accounting
and no accounting). The device performs RADIUS accounting by default and performs local
accounting when the RADIUS server is invalid. The device does not perform accounting when both
of the previous methods are invalid.
Examples
# In ISP domain test, use RADIUS scheme rd as the primary default accounting method and use
local accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting default radius-scheme rd local
Related commands
hwtacacs scheme
local-user
radius scheme
accounting dual-stack
Use accounting dual-stack to specify the accounting method for dual-stack users.

5
Use undo accounting dual-stack to restore the default.
Syntax
accounting dual-stack { merge | separate }
undo accounting dual-stack
Default
The merge method applies.
Views
ISP domain view
Predefined user roles
network-admin
mdc-admin
Parameters
merge: Merges IPv4 data with IPv6 data for accounting.
separate: Separates IPv4 data from IPv6 data for accounting.
Usage guidelines
If the charging rates are different for IPv4 and IPv6 data, use the separate method for the accounting
of dual-stack users.
Examples
# In ISP domain test, configure the device to separate IPv4 data from IPv6 data for the accounting of
dual-stack users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting dual-stack separate
accounting lan-access
Use accounting lan-access to specify accounting methods for LAN users.
Use undo accounting lan-access to restore the default.
Syntax
In non-FIPS mode:
accounting lan-access { broadcast radius-scheme radius-scheme-name1 radius-scheme
radius-scheme-name2 [ local ] [ none ] | local [none ] | none |radius-scheme
radius-scheme-name [ local ][none ]}
undo accounting lan-access
In FIPS mode:
accounting lan-access { broadcast radius-scheme radius-scheme-name1 radius-scheme
radius-scheme-name2 [local ] | local |radius-scheme radius-scheme-name [ local ] }
undo accounting lan-access
Default
The default accounting methods of the ISP domain are used for LAN users.
Views
ISP domain view