HPE FlexNetwork HSR6800 series Installation manual

HPE FlexNetwork HSR6800 Routers
Security Command Reference
Part number: 5998-4511R
Software version: HSR6800-CMW520-R3303P25
Document version: 6W105-20151231

© Copyright 2015 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® andAcrobat® are trademarks ofAdobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
AAA configuration commands·········································································1
General AAA configuration commands··············································································································1
aaa nas-id profile········································································································································1
access-limit enable·····································································································································1
accounting command·································································································································2
accounting default······································································································································3
accounting dvpn·········································································································································3
accounting lan-access································································································································4
accounting login·········································································································································5
accounting optional····································································································································6
accounting portal········································································································································7
accounting ppp···········································································································································8
authentication default·································································································································9
authentication dvpn····································································································································9
authentication lan-access·························································································································10
authentication login··································································································································11
authentication portal·································································································································12
authentication ppp····································································································································13
authentication super·································································································································14
authorization command····························································································································15
authorization default·································································································································16
authorization dvpn····································································································································17
authorization lan-access ··························································································································17
authorization login····································································································································18
authorization portal···································································································································19
authorization ppp······································································································································20
authorization-attribute user-profile ···········································································································21
cut connection··········································································································································22
display connection····································································································································23
display domain·········································································································································26
domain ·····················································································································································29
domain default enable······························································································································29
domain if-unknown···································································································································30
idle-cut enable··········································································································································31
ip pool·······················································································································································32
nas-id bind vlan········································································································································33
self-service-url enable······························································································································33
session-time include-idle-time··················································································································34
state (ISP domain view)···························································································································35
Local user configuration commands ················································································································35
access-limit ··············································································································································35
authorization-attribute ······························································································································36
bind-attribute············································································································································38
display local-user ·····································································································································39
display user-group····································································································································42
expiration-date ·········································································································································43
group························································································································································44
group-attribute allow-guest·······················································································································44
local-user··················································································································································45
password··················································································································································46
service-type··············································································································································47
state (local user view) ······························································································································48
user-group················································································································································48
validity-date··············································································································································49
RADIUS configuration commands ···················································································································50
accounting-on enable·······························································································································50
attribute 25 car·········································································································································51

ii
data-flow-format (RADIUS scheme view) ································································································51
display radius scheme······························································································································52
display radius statistics ····························································································································55
display stop-accounting-buffer (for RADIUS)···························································································58
key (RADIUS scheme view)·····················································································································60
nas-ip (RADIUS scheme view)·················································································································61
primary accounting (RADIUS scheme view)····························································································62
primary authentication (RADIUS scheme view)·······················································································63
radius client··············································································································································65
radius nas-ip·············································································································································66
radius scheme··········································································································································67
radius trap················································································································································67
reset radius statistics································································································································68
reset stop-accounting-buffer (for RADIUS)······························································································69
retry··························································································································································70
retry realtime-accounting··························································································································71
retry stop-accounting (RADIUS scheme view)·························································································72
secondary accounting (RADIUS scheme view) ·······················································································72
secondary authentication (RADIUS scheme view) ··················································································74
security-policy-server·······························································································································76
server-type···············································································································································77
state primary ············································································································································78
state secondary········································································································································78
stop-accounting-buffer enable (RADIUS scheme view)···········································································79
timer quiet (RADIUS scheme view)··········································································································80
timer realtime-accounting (RADIUS scheme view)··················································································81
timer response-timeout (RADIUS scheme view)······················································································82
user-name-format (RADIUS scheme view)······························································································83
vpn-instance (RADIUS scheme view)······································································································83
HWTACACS configuration commands ············································································································84
data-flow-format (HWTACACS scheme view) ·························································································84
display hwtacacs······································································································································85
display stop-accounting-buffer (for HWTACACS)····················································································88
hwtacacs nas-ip ·······································································································································89
hwtacacs scheme·····································································································································90
key (HWTACACS scheme view)··············································································································91
nas-ip (HWTACACS scheme view)··········································································································92
primary accounting (HWTACACS scheme view)·····················································································93
primary authentication (HWTACACS scheme view)················································································94
primary authorization································································································································95
reset hwtacacs statistics ··························································································································96
reset stop-accounting-buffer (for HWTACACS)·······················································································96
retry stop-accounting (HWTACACS scheme view)··················································································97
secondary accounting (HWTACACS scheme view) ················································································98
secondary authentication (HWTACACS scheme view) ···········································································99
secondary authorization·························································································································100
stop-accounting-buffer enable (HWTACACS scheme view)··································································101
timer quiet (HWTACACS scheme view)·································································································101
timer realtime-accounting (HWTACACS scheme view)·········································································102
timer response-timeout (HWTACACS scheme view)·············································································103
user-name-format (HWTACACS scheme view)·····················································································103
vpn-instance (HWTACACS scheme view)·····························································································104
802.1X commands······················································································106
display dot1x··········································································································································106
dot1x ······················································································································································109
dot1x authentication-method··················································································································111
dot1x auth-fail vlan·································································································································112
dot1x critical vlan····································································································································113
dot1x critical recovery-action··················································································································114
dot1x domain-delimiter···························································································································114
dot1x guest-vlan·····································································································································115

iii
dot1x handshake····································································································································116
dot1x handshake secure························································································································117
dot1x mandatory-domain ·······················································································································118
dot1x max-user ······································································································································119
dot1x multicast-trigger····························································································································120
dot1x port-control···································································································································120
dot1x port-method··································································································································121
dot1x quiet-period ··································································································································123
dot1x re-authenticate ·····························································································································123
dot1x retry··············································································································································124
dot1x supp-proxy-check·························································································································125
dot1x timer ·············································································································································126
dot1x unicast-trigger·······························································································································127
reset dot1x statistics·······························································································································128
EAD fast deployment commands································································129
dot1x free-ip···········································································································································129
dot1x timer ead-timeout ·························································································································129
dot1x url ·················································································································································130
MAC authentication configuration commands·············································132
display mac-authentication·····················································································································132
mac-authentication·································································································································134
mac-authentication domain····················································································································135
mac-authentication max-user·················································································································136
mac-authentication timer························································································································136
mac-authentication user-name-format···································································································137
reset mac-authentication statistics·········································································································139
Portal configuration commands ··································································140
access-user detect·································································································································140
display portal acl ····································································································································141
display portal connection statistics·········································································································143
display portal free-rule····························································································································146
display portal interface···························································································································147
display portal server·······························································································································149
display portal server statistics················································································································150
display portal tcp-cheat statistics ···········································································································152
display portal user··································································································································154
portal auth-network ································································································································155
portal auth-network destination··············································································································156
portal delete-user···································································································································157
portal device-id·······································································································································157
portal domain ·········································································································································158
portal free-rule········································································································································159
portal max-user······································································································································160
portal nas-id ···········································································································································160
portal nas-id-profile ································································································································161
portal nas-ip ···········································································································································162
portal nas-port-id····································································································································162
portal nas-port-type································································································································163
portal redirect-url····································································································································164
portal server···········································································································································164
portal server method······························································································································166
portal server server-detect·····················································································································167
portal server user-sync···························································································································168
reset portal connection statistics············································································································169
reset portal server statistics ···················································································································170
reset portal tcp-cheat statistics···············································································································170
Port security configuration commands························································171
display port-security·······························································································································171

iv
display port-security mac-address block································································································174
display port-security mac-address security····························································································176
port-security authorization ignore···········································································································177
port-security enable································································································································178
port-security intrusion-mode···················································································································179
port-security mac-address aging-type inactivity·····················································································179
port-security mac-address dynamic·······································································································180
port-security mac-address security········································································································181
port-security max-mac-count··················································································································183
port-security ntk-mode ···························································································································183
port-security oui······································································································································184
port-security port-mode··························································································································185
port-security timer autolearn aging·········································································································187
port-security timer disableport················································································································187
port-security trap····································································································································188
User profile configuration commands··························································190
display user-profile·································································································································190
user-profile enable ·································································································································190
user-profile·············································································································································191
Password control configuration commands ················································193
display password-control························································································································193
display password-control blacklist··········································································································194
password················································································································································195
password-control { aging | composition | history | length } enable ·························································197
password-control aging··························································································································198
password-control alert-before-expire ·····································································································199
password-control authentication-timeout ·······························································································199
password-control complexity··················································································································200
password-control composition················································································································200
password-control enable························································································································202
password-control expired-user-login······································································································202
password-control history························································································································203
password-control length·························································································································203
password-control login idle-time·············································································································204
password-control login-attempt··············································································································205
password-control password update interval···························································································206
password-control super aging················································································································207
password-control super composition······································································································208
password-control super length···············································································································208
reset password-control blacklist·············································································································209
reset password-control history-record····································································································210
RSH configuration commands ····································································211
rsh··························································································································································211
Public key configuration commands ···························································213
display public-key local public················································································································213
display public-key peer···························································································································214
peer-public-key end································································································································216
public-key-code begin····························································································································216
public-key-code end·······························································································································217
public-key local create····························································································································218
public-key local destroy··························································································································219
public-key local export····························································································································220
public-key local export public dsa ··········································································································221
public-key local export public rsa···········································································································223
public-key local import····························································································································224
public-key peer·······································································································································225
public-key peer import sshkey················································································································226

v
PKI configuration commands······································································227
attribute··················································································································································227
ca identifier·············································································································································228
certificate request entity·························································································································228
certificate request from···························································································································229
certificate request mode·························································································································229
certificate request polling ·······················································································································230
certificate request url······························································································································231
common-name·······································································································································232
country ···················································································································································232
crl check·················································································································································233
crl update-period····································································································································233
crl url ······················································································································································234
display pki certificate······························································································································235
display pki certificate access-control-policy ···························································································236
display pki certificate attribute-group······································································································237
display pki crl domain·····························································································································238
fqdn························································································································································239
include serial-number·····························································································································240
ip (PKI entity view) ·································································································································241
ldap-server·············································································································································241
locality····················································································································································242
organization············································································································································242
organization-unit·····································································································································243
pki certificate access-control-policy········································································································243
pki certificate attribute-group··················································································································244
pki delete-certificate·······························································································································244
pki domain··············································································································································245
pki entity·················································································································································245
pki import-certificate·······························································································································246
pki request-certificate domain················································································································247
pki retrieval-certificate····························································································································248
pki retrieval-crl domain···························································································································248
pki validate-certificate·····························································································································249
root-certificate fingerprint ·······················································································································249
rule (PKI CERT ACP view)·····················································································································250
state ·······················································································································································251
IPsec configuration commands···································································252
ah authentication-algorithm····················································································································252
connection-name····································································································································252
cryptoengine enable·······························································································································253
display ipsec policy ································································································································253
display ipsec policy-template ·················································································································258
display ipsec profile································································································································260
display ipsec sa······································································································································262
display ipsec statistics····························································································································267
display ipsec transform-set ····················································································································268
display ipsec tunnel································································································································270
encapsulation-mode·······························································································································271
esp authentication-algorithm··················································································································272
esp encryption-algorithm························································································································273
ike-peer (IPsec policy view/IPsec policy template view/IPsec profile view)···········································274
ipsec anti-replay check···························································································································274
ipsec anti-replay window························································································································275
ipsec decrypt check································································································································275
ipsec fragmentation before-encryption···································································································276
ipsec invalid-spi-recovery enable···········································································································277
ipsec policy (interface view)···················································································································277
ipsec policy (system view)······················································································································278
ipsec policy isakmp template ·················································································································279

vi
ipsec policy-template······························································································································280
ipsec profile (system view)·····················································································································280
ipsec profile (tunnel interface view)········································································································281
ipsec sa global-duration·························································································································282
ipsec transform-set·································································································································283
pfs ··························································································································································283
policy enable··········································································································································284
qos pre-classify······································································································································285
reset ipsec sa·········································································································································286
reset ipsec statistics·······························································································································287
reverse-route··········································································································································287
reverse-route preference························································································································290
reverse-route tag····································································································································291
sa authentication-hex·····························································································································292
sa duration ·············································································································································293
sa encryption-hex···································································································································294
sa spi······················································································································································295
sa string-key···········································································································································296
security acl·············································································································································297
transform················································································································································298
transform-set··········································································································································299
tunnel local·············································································································································300
tunnel remote·········································································································································301
IKE configuration commands······································································302
authentication-algorithm·························································································································302
authentication-method····························································································································302
certificate domain···································································································································303
dh···························································································································································303
display ike dpd ·······································································································································304
display ike peer······································································································································305
display ike proposal································································································································306
display ike sa··········································································································································307
dpd·························································································································································311
encryption-algorithm·······························································································································312
exchange-mode ·····································································································································312
id-type ····················································································································································313
ike dpd····················································································································································314
ike local-name········································································································································315
ike next-payload check disabled············································································································316
ike peer (system view) ···························································································································316
ike proposal············································································································································316
ike sa keepalive-timer interval················································································································317
ike sa keepalive-timer timeout················································································································318
ike sa nat-keepalive-timer interval··········································································································319
interval-time············································································································································319
local························································································································································320
local-address··········································································································································320
local-name··············································································································································321
nat traversal ···········································································································································322
peer························································································································································322
pre-shared-key·······································································································································323
proposal (IKE peer view)························································································································323
remote-address······································································································································324
remote-name··········································································································································325
reset ike sa·············································································································································326
sa duration ·············································································································································327
time-out··················································································································································327
SSH configuration commands ····································································329
SSH server configuration commands ············································································································329
display ssh server ··································································································································329

vii
display ssh user-information ··················································································································330
sftp server enable···································································································································332
sftp server idle-timeout···························································································································332
ssh server authentication-retries············································································································333
ssh server authentication-timeout··········································································································333
ssh server compatible-ssh1x enable······································································································334
ssh server enable···································································································································335
ssh server rekey-interval························································································································335
ssh user··················································································································································336
SSH client configuration commands··············································································································338
bye ·························································································································································338
cd ···························································································································································338
cdup ·······················································································································································339
delete ·····················································································································································339
dir···························································································································································339
display sftp client source························································································································340
display ssh client source························································································································341
display ssh server-info ···························································································································342
exit··························································································································································342
get··························································································································································343
help ························································································································································343
ls·····························································································································································344
mkdir ······················································································································································345
put··························································································································································345
pwd·························································································································································345
quit ·························································································································································346
remove···················································································································································346
rename···················································································································································347
rmdir·······················································································································································347
scp··························································································································································348
sftp ·························································································································································349
sftp client ipv6 source·····························································································································351
sftp client source····································································································································352
sftp ipv6··················································································································································353
ssh client authentication server··············································································································355
ssh client first-time enable······················································································································355
ssh client ipv6 source·····························································································································356
ssh client source ····································································································································357
ssh2························································································································································357
ssh2 ipv6················································································································································359
Firewall configuration commands ·······························································362
Packet-filter firewall configuration commands································································································362
display firewall ipv6 statistics ·················································································································362
display firewall-statistics·························································································································363
firewall default········································································································································364
firewall enable········································································································································364
firewall ipv6 default·································································································································365
firewall ipv6 enable·································································································································365
firewall packet-filter ································································································································366
firewall packet-filter ipv6·························································································································367
reset firewall ipv6 statistics·····················································································································367
reset firewall-statistics····························································································································368
ASPF configuration commands ·····················································································································368
aspf-policy··············································································································································368
display aspf all········································································································································369
display aspf interface ·····························································································································370
display aspf policy··································································································································371
display port-mapping······························································································································371
firewall aspf············································································································································372
icmp-error drop·······································································································································373
port-mapping··········································································································································374

viii
tcp syn-check·········································································································································374
ALG configuration commands·····································································376
alg ··························································································································································376
Session management commands·······························································377
application aging-time····························································································································377
display application aging-time················································································································377
display session aging-time·····················································································································378
display session hardware·······················································································································379
display session relation-table·················································································································380
display session statistics························································································································381
display session table······························································································································383
reset session··········································································································································386
reset session statistics···························································································································387
session aging-time·································································································································388
session checksum··································································································································389
session early-ageout······························································································································389
session log bytes-active·························································································································390
session log enable ·································································································································391
session log packets-active·····················································································································392
session log time-active···························································································································392
session max-entries·······························································································································393
session persist acl··································································································································393
Connection limit configuration commands ··················································395
connection-limit apply policy ··················································································································395
connection-limit policy····························································································································395
display connection-limit policy················································································································396
limit·························································································································································397
Web filtering configuration commands························································399
display firewall http activex-blocking······································································································399
display firewall http java-blocking···········································································································400
display firewall http url-filter host············································································································401
display firewall http url-filter parameter ··································································································402
firewall http activex-blocking acl·············································································································404
firewall http activex-blocking enable·······································································································405
firewall http activex-blocking suffix·········································································································405
firewall http java-blocking acl ·················································································································406
firewall http java-blocking enable···········································································································406
firewall http java-blocking suffix··············································································································407
firewall http url-filter host acl···················································································································408
firewall http url-filter host default ············································································································408
firewall http url-filter host enable ············································································································409
firewall http url-filter host ip-address ······································································································409
firewall http url-filter host url-address·····································································································410
firewall http url-filter parameter···············································································································411
firewall http url-filter parameter enable···································································································413
reset firewall http····································································································································413
Attack detection and protection configuration commands···························415
attack-defense apply policy····················································································································415
attack-defense logging enable···············································································································415
attack-defense policy ·····························································································································416
attack-defense tcp fragment enable·······································································································416
blacklist enable·······································································································································417
blacklist ip···············································································································································418
defense icmp-flood action drop-packet··································································································418
defense icmp-flood enable·····················································································································419
defense icmp-flood ip·····························································································································420
defense icmp-flood rate-threshold··········································································································421

ix
defense scan add-to-blacklist·················································································································422
defense scan blacklist-timeout···············································································································423
defense scan enable······························································································································423
defense scan max-rate···························································································································424
defense syn-flood action························································································································425
defense syn-flood enable·······················································································································425
defense syn-flood ip·······························································································································426
defense syn-flood rate-threshold············································································································427
defense udp-flood action drop-packet····································································································428
defense udp-flood enable·······················································································································428
defense udp-flood ip·······························································································································429
defense udp-flood rate-threshold···········································································································430
display attack-defense policy·················································································································431
display attack-defense statistics interface······························································································434
display blacklist······································································································································436
display flow-statistics statistics···············································································································438
display flow-statistics statistics interface································································································440
display tcp-proxy protected-ip················································································································441
flow-statistics enable······························································································································442
reset attack-defense statistics interface·································································································443
signature-detect ·····································································································································443
signature-detect action drop-packet·······································································································444
signature-detect large-icmp max-length·································································································445
tcp-proxy enable·····································································································································445
tcp-proxy mode ······································································································································446
TCP attack protection configuration commands ·········································448
display tcp status····································································································································448
tcp anti-naptha enable····························································································································449
tcp state··················································································································································449
tcp syn-cookie enable ····························································································································450
tcp timer check-state······························································································································451
IP source guard configuration commands···················································452
display ip source binding························································································································452
ip source binding····································································································································453
ip verify source·······································································································································454
ip verify source max-entries···················································································································455
ARP attack protection configuration commands·········································457
IP flood protection configuration commands··································································································457
arp resolving-route enable ·····················································································································457
arp source-suppression enable··············································································································457
arp source-suppression limit··················································································································458
display arp source-suppression ·············································································································458
ARP packet rate limit configuration commands ·····························································································459
arp rate-limit···········································································································································459
ARP packet source MAC consistency check configuration commands·························································460
arp anti-attack valid-ack enable ·············································································································460
ARP active acknowledgement configuration commands···············································································460
arp anti-attack active-ack enable ···········································································································460
Authorized ARP configuration commands ·····································································································461
arp authorized enable ····························································································································461
ARP detection configuration commands········································································································462
arp detection ··········································································································································462
arp detection enable·······························································································································463
arp detection trust ··································································································································463
arp detection validate·····························································································································464
arp restricted-forwarding enable ············································································································464
display arp detection······························································································································465
display arp detection statistics ···············································································································465
reset arp detection statistics···················································································································466

x
ARP automatic scanning and fixed ARP configuration commands ·······························································467
arp fixup ·················································································································································467
arp scan ·················································································································································468
ARP gateway protection configuration commands ························································································468
arp filter source ······································································································································469
ARP filtering configuration commands···········································································································469
arp filter binding······································································································································469
ND attack defense configuration commands ··············································471
ipv6 nd mac-check enable ·····················································································································471
URPF configuration commands··································································472
ip urpf·····················································································································································472
FIPS configuration commands····································································473
display fips status···································································································································473
fips mode enable····································································································································473
fips self-test············································································································································474
Group Domain VPN commands··································································476
KS configuration commands··························································································································476
display gdoi ks········································································································································476
display gdoi ks acl··································································································································478
display gdoi ks members························································································································479
display gdoi ks policy ·····························································································································480
display gdoi ks redundancy····················································································································482
display gdoi ks rekey······························································································································483
gdoi ks group··········································································································································485
gdoi ks redundancy port·························································································································485
gdoi ks rekey··········································································································································486
identity address······································································································································486
identity number·······································································································································487
ipsec·······················································································································································488
local priority············································································································································488
peer address··········································································································································489
profile (GDOI KS group IPsec policy view) ····························································································490
redundancy enable·································································································································491
redundancy hello····································································································································491
redundancy retransmit ···························································································································492
rekey acl·················································································································································493
rekey authentication·······························································································································494
rekey encryption·····································································································································495
rekey lifetime··········································································································································495
rekey retransmit ·····································································································································496
rekey transport unicast···························································································································497
reset gdoi ks···········································································································································497
reset gdoi ks members···························································································································498
reset gdoi ks redundancy role················································································································498
security acl (GDOI KS group IPsec policy view)····················································································499
source address·······································································································································499
GM configuration commands·························································································································500
client registration interface·····················································································································500
display gdoi gm······································································································································501
display gdoi gm acl·································································································································504
display gdoi gm ipsec sa························································································································506
display gdoi gm members······················································································································507
display gdoi gm pubkey··························································································································509
display gdoi gm rekey ····························································································································510
gdoi gm group········································································································································511
group······················································································································································512
identity····················································································································································512
reset gdoi gm ·········································································································································513

xi
server address ·······································································································································514
Document conventions and icons·······························································515
Conventions···················································································································································515
Network topology icons··································································································································516
Support and other resources ······································································517
Accessing Hewlett Packard Enterprise Support ····························································································517
Accessing updates·········································································································································517
Websites ················································································································································518
Customer self repair·······························································································································518
Remote support······································································································································518
Documentation feedback ·······················································································································518
Index···········································································································520

1
AAA configuration commands
General AAA configuration commands
aaa nas-id profile
Use aaa nas-id profile to create a NAS ID profile and enter its view. A NAS ID profile maintains the
bindings between NAS IDs and VLANs.
Use undo aaa nas-id profile to remove a NAS ID profile.
Syntax
aaa nas-id profile profile-name
undo aaa nas-id profile profile-name
Views
System view
Default command level
2: System level
Parameters
profile-name: Name of the NAS ID profile, a case-insensitive string of 1 to 16 characters.
Examples
# Create a NAS ID profile named aaa.
<Sysname> system-view
[Sysname] aaa nas-id profile aaa
[Sysname-nas-id-prof-aaa]
Related commands
nas-id bind vlan
access-limit enable
Use access-limit enable to set the maximum number of online users in an ISP domain. After the
number of online users reaches the allowed maximum number, no more users are accepted.
Use undo access-limit enable to restore the default.
Syntax
access-limit enable max-user-number
undo access-limit enable
Default
There is no limit to the number of online users in an ISP domain.
Views
ISP domain view
Default command level
2: System level

2
Parameters
max-user-number: Maximum number of online users that the ISP domain can accommodate, in the
range of 1 to 2147483646.
Usage guidelines
System resources are limited, and user connections may compete for network resources when there
are many users. Setting a proper limit to the number of online users helps provide reliable system
performance.
Examples
# Set a limit of 500 user connections for ISP domain test.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] access-limit enable 500
Related commands
display domain
accounting command
Use accounting command to specify the command line accounting method.
Use undo accounting command to restore the default.
Syntax
accounting command hwtacacs-scheme hwtacacs-scheme-name
undo accounting command
Default
The default accounting method for the ISP domain is used for command line accounting.
Views
ISP domain view
Default command level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
Usage guidelines
The specified HWTACACS scheme must have been configured.
Command line accounting can use only an HWTACACS scheme.
Examples
# Configure ISP domain test to use HWTACACS scheme hwtac for command line accounting.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting command hwtacacs-scheme hwtac
Related commands
•accounting default
•hwtacacs scheme

3
accounting default
Use accounting default to configure the default accounting method for an ISP domain.
Use undo accounting default to restore the default.
Syntax
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none |
radius-scheme radius-scheme-name [ local ] }
undo accounting default
Default
The default accounting method of an ISP domain is local.
Views
ISP domain view
Default command level
2: System level
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive
string of 1 to 32 characters.
Usage guidelines
The specified RADIUS or HWTACACS scheme must have been configured.
The default accounting method is used for all users who support the specified accounting method
and have no specific accounting method configured.
Local accounting is only used for monitoring and controlling the number of local user connections. It
does not provide the statistics function that the accounting feature generally provides.
Examples
# Configure the default accounting method for ISP domain test to use RADIUS accounting scheme
rd and use local accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting default radius-scheme rd local
Related commands
•local-user
•hwtacacs scheme
•radius scheme
accounting dvpn
Use accounting dvpn to configure the accounting method for DVPN users.
Use undo accounting dvpn to restore the default.

4
Syntax
accounting dvpn { local | none | radius-scheme radius-scheme-name [ local ] }
undo accounting dvpn
Default
The default accounting method for the ISP domain is used for DVPN users.
Views
ISP domain view
Default command level
2: System level
Parameters
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive
string of 1 to 32 characters.
Usage guidelines
The specified RADIUS scheme must have been configured.
Examples
# Configure ISP domain test to use local accounting for DVPN users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting dvpn local
# Configure ISP domain test to use RADIUS accounting scheme rd for DVPN users and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting dvpn radius-scheme rd local
Related commands
•local-user
•accounting default
•radius scheme
accounting lan-access
Use accounting lan-access to configure the accounting method for LAN users.
Use undo accounting lan-access to restore the default.
Syntax
accounting lan-access { local | none | radius-scheme radius-scheme-name [ local | none ] }
undo accounting lan-access
Default
The default accounting method for the ISP domain is used for LAN users.

5
Views
ISP domain view
Default command level
2: System level
Parameters
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive
string of 1 to 32 characters.
Usage guidelines
This command is supported only on SAP interface modules that are operating in Layer 2 mode.
The specified RADIUS scheme must have been configured.
Examples
# Configure ISP domain test to use local accounting for LAN users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting lan-access local
# Configure ISP domain test to use RADIUS accounting scheme rd for LAN users and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting lan-access radius-scheme rd local
Related commands
•local-user
•accounting default
•radius scheme
accounting login
Use accounting login to configure the accounting method for login users through the console, AUX,
or Asyn port or through Telnet.
Use undo accounting login to restore the default.
Syntax
accounting login { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none |
radius-scheme radius-scheme-name [ local ] }
undo accounting login
Default
The default accounting method for the ISP domain is used for login users.
Views
ISP domain view
Default command level
2: System level

6
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive
string of 1 to 32 characters.
Usage guidelines
The specified RADIUS or HWTACACS scheme must have been configured.
Accounting is not supported for login users who use FTP.
Examples
# Configure ISP domain test to use local accounting for login users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login local
# Configure ISP domain test to use RADIUS accounting scheme rd for login users and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login radius-scheme rd local
Related commands
•local-user
•accounting default
•hwtacacs scheme
•radius scheme
accounting optional
Use accounting optional to enable the accounting optional feature.
Use undo accounting optional to disable the feature.
Syntax
accounting optional
undo accounting optional
Default
The feature is disabled.
Views
ISP domain view
Default command level
2: System level
Usage guidelines
After you configure the accounting optional command for a domain, a user who would otherwise be
disconnected can continue to use the network resources when no accounting server is available or
when communication with the current accounting server fails. However, the device no longer sends

7
real-time accounting updates for the user. The accounting optional feature applies to scenarios
where accounting is not important.
After you configure the accounting optional command, the setting configured by the access-limit
command in local user view has no effect.
Examples
# Enable the accounting optional feature for users in domain test.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting optional
accounting portal
Use accounting portal to configure the accounting method for portal users.
Use undo accounting portal to restore the default.
Syntax
accounting portal {local | none | radius-scheme radius-scheme-name [ local ] }
undo accounting portal
Default
The default accounting method for the ISP domain is used for portal users.
Views
ISP domain view
Default command level
2: System level
Parameters
local: Performs local accounting.
none: Does not perform any accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive
string of 1 to 32 characters.
Usage guidelines
The specified RADIUS scheme must have been configured.
Examples
# Configure ISP domain test to use local accounting for portal users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting portal local
# Configure ISP domain test to use RADIUS scheme rd for accounting on portal users and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting portal radius-scheme rd local
Related commands
•local-user
•accounting default