HPE FlexFabric 7900 Series Installation manual

HPE FlexFabric 7900 Switch Series
Security
Command Reference
Part number: 5998-8251R
Software version: Release 231x
Document version: 6W101-20151113

© Copyright 2015 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® andAcrobat® are trademarks ofAdobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
AAA commands······························································································1
General AAA commands ···································································································································1
aaa session-limit ········································································································································1
accounting command·································································································································2
accounting default······································································································································2
accounting login·········································································································································3
authentication default·································································································································5
authentication login····································································································································6
authentication super···································································································································7
authorization command······························································································································8
authorization default···································································································································9
authorization login····································································································································11
display domain·········································································································································12
domain ·····················································································································································13
domain default enable······························································································································14
state (ISP domain view)···························································································································15
Local user commands······································································································································16
access-limit ··············································································································································16
authorization-attribute ······························································································································17
display local-user ·····································································································································18
display user-group····································································································································20
group························································································································································21
local-user··················································································································································22
password··················································································································································23
service-type··············································································································································24
state (local user view) ······························································································································25
user-group················································································································································26
RADIUS commands·········································································································································26
accounting-on enable·······························································································································26
attribute 15 check-mode···························································································································27
data-flow-format (RADIUS scheme view) ································································································28
display radius scheme······························································································································29
display radius statistics ····························································································································31
key (RADIUS scheme view)·····················································································································33
nas-ip (RADIUS scheme view)·················································································································34
primary accounting (RADIUS scheme view)····························································································35
primary authentication (RADIUS scheme view)·······················································································36
radius nas-ip·············································································································································38
radius session-control enable ··················································································································39
radius scheme··········································································································································39
reset radius statistics································································································································40
retry··························································································································································41
retry realtime-accounting··························································································································41
secondary accounting (RADIUS scheme view) ·······················································································42
secondary authentication (RADIUS scheme view) ··················································································44
security-policy-server·······························································································································46
snmp-agent trap enable radius ················································································································46
state primary ············································································································································47
state secondary········································································································································48
timer quiet (RADIUS scheme view)··········································································································49
timer realtime-accounting (RADIUS scheme view)··················································································50
timer response-timeout (RADIUS scheme view)······················································································51
user-name-format (RADIUS scheme view)······························································································52
vpn-instance (RADIUS scheme view)······································································································53
HWTACACS commands··································································································································53
data-flow-format (HWTACACS scheme view) ·························································································53
display hwtacacs scheme ························································································································54

ii
hwtacacs nas-ip ·······································································································································57
hwtacacs scheme·····································································································································58
key (HWTACACS scheme view)··············································································································59
nas-ip (HWTACACS scheme view)··········································································································60
primary accounting (HWTACACS scheme view)·····················································································61
primary authentication (HWTACACS scheme view)················································································62
primary authorization································································································································64
reset hwtacacs statistics ··························································································································65
secondary accounting (HWTACACS scheme view) ················································································66
secondary authentication (HWTACACS scheme view) ···········································································67
secondary authorization···························································································································69
timer quiet (HWTACACS scheme view)···································································································70
timer realtime-accounting (HWTACACS scheme view)···········································································71
timer response-timeout (HWTACACS scheme view)···············································································72
user-name-format (HWTACACS scheme view)·······················································································73
vpn-instance (HWTACACS scheme view)·······························································································73
Password control commands········································································75
display password-control··························································································································75
display password-control blacklist············································································································76
password-control { aging | composition | history | length } enable ···························································77
password-control aging····························································································································78
password-control alert-before-expire ·······································································································79
password-control complexity····················································································································80
password-control composition··················································································································81
password-control enable··························································································································83
password-control expired-user-login········································································································84
password-control history··························································································································85
password-control length···························································································································85
password-control login idle-time···············································································································87
password-control login-attempt················································································································87
password-control super aging··················································································································89
password-control super composition········································································································90
password-control super length·················································································································91
password-control update-interval·············································································································92
reset password-control blacklist···············································································································92
reset password-control history-record······································································································93
Public key management commands·····························································94
display public-key local public··················································································································94
display public-key peer·····························································································································97
peer-public-key end··································································································································99
public-key local create····························································································································100
public-key local destroy··························································································································103
public-key local export dsa·····················································································································104
public-key local export rsa······················································································································106
public-key peer·······································································································································108
public-key peer import sshkey················································································································109
PKI commands····························································································111
attribute··················································································································································111
ca identifier·············································································································································112
certificate request entity·························································································································113
certificate request from···························································································································114
certificate request mode·························································································································114
certificate request polling ·······················································································································116
certificate request url······························································································································116
common-name·······································································································································117
country ···················································································································································118
crl check·················································································································································118
crl url ······················································································································································119
display pki certificate access-control-policy ···························································································120

iii
display pki certificate attribute-group······································································································121
display pki certificate domain·················································································································122
display pki certificate request-status······································································································127
display pki crl··········································································································································128
fqdn························································································································································130
ip ····························································································································································130
ldap-server·············································································································································131
locality····················································································································································132
organization············································································································································133
organization-unit·····································································································································133
pki abort-certificate-request····················································································································134
pki certificate access-control-policy········································································································135
pki certificate attribute-group··················································································································135
pki delete-certificate·······························································································································136
pki domain··············································································································································137
pki entity·················································································································································138
pki export················································································································································139
pki import················································································································································145
pki request-certificate·····························································································································149
pki retrieve-certificate·····························································································································150
pki retrieve-crl·········································································································································152
pki storage··············································································································································152
pki validate-certificate·····························································································································153
public-key dsa········································································································································155
public-key rsa·········································································································································156
root-certificate fingerprint ·······················································································································158
rule·························································································································································159
source ····················································································································································160
state ·······················································································································································161
usage ·····················································································································································161
SSL commands···························································································163
ciphersuite··············································································································································163
client-verify enable·································································································································164
display ssl client-policy···························································································································165
display ssl server-policy·························································································································166
pki-domain··············································································································································167
prefer-cipher···········································································································································167
server-verify enable································································································································169
session cachesize··································································································································170
ssl client-policy·······································································································································170
ssl server-policy ·····································································································································171
ssl version ssl3.0 disable ·······················································································································172
version····················································································································································173
IPsec commands ························································································174
ah authentication-algorithm····················································································································174
description··············································································································································175
display ipsec policy ································································································································175
display ipsec sa······································································································································178
display ipsec statistics····························································································································180
display ipsec transform-set ····················································································································182
display ipsec tunnel································································································································183
encapsulation-mode·······························································································································186
esp authentication-algorithm··················································································································187
esp encryption-algorithm························································································································188
ike-profile················································································································································189
ipsec anti-replay check···························································································································189
ipsec anti-replay window························································································································190
ipsec apply policy···································································································································191
ipsec decrypt-check enable····················································································································192
ipsec logging packet enable···················································································································192

iv
ipsec df-bit··············································································································································193
ipsec global-df-bit···································································································································194
ipsec policy·············································································································································194
ipsec policy local-address······················································································································195
ipsec sa global-duration·························································································································196
ipsec sa idle-time ···································································································································197
ipsec transform-set·································································································································198
local-address··········································································································································199
pfs ··························································································································································199
protocol ··················································································································································200
qos pre-classify······································································································································201
remote-address······································································································································202
reset ipsec sa·········································································································································203
reset ipsec statistics·······························································································································204
sa duration ·············································································································································205
sa hex-key authentication ······················································································································205
sa hex-key encryption····························································································································207
sa idle-time·············································································································································208
sa spi······················································································································································208
sa string-key···········································································································································209
security acl·············································································································································210
snmp-agent trap enable ipsec················································································································212
transform-set··········································································································································213
IKE commands····························································································214
authentication-algorithm·························································································································214
authentication-method····························································································································214
certificate domain···································································································································215
dh···························································································································································217
display ike proposal································································································································217
display ike sa··········································································································································218
dpd·························································································································································221
encryption-algorithm·······························································································································222
exchange-mode ·····································································································································223
ike dpd····················································································································································224
ike identity··············································································································································225
ike invalid-spi-recovery enable···············································································································226
ike keepalive interval······························································································································227
ike keepalive timeout······························································································································227
ike keychain ···········································································································································228
ike limit···················································································································································229
ike nat-keepalive····································································································································230
ike profile················································································································································230
ike proposal············································································································································231
ike signature-identity from-certificate ·····································································································232
keychain·················································································································································232
local-identity···········································································································································233
match local address (IKE keychain view)·······························································································234
match local address (IKE profile view)···································································································235
match remote·········································································································································236
pre-shared-key·······································································································································237
priority (IKE keychain view)····················································································································238
priority (IKE profile view)························································································································239
proposal ·················································································································································240
reset ike sa·············································································································································240
reset ike statistics···································································································································241
sa duration ·············································································································································242
snmp-agent trap enable ike····················································································································242
SSH commands··························································································244
SSH server commands··································································································································244
display ssh server ··································································································································244

v
display ssh user-information ··················································································································245
scp server enable···································································································································246
sftp server enable···································································································································247
sftp server idle-timeout···························································································································247
ssh server acl·········································································································································248
ssh server authentication-retries············································································································249
ssh server authentication-timeout··········································································································250
ssh server compatible-ssh1x enable······································································································250
ssh server dscp······································································································································251
ssh server enable···································································································································252
ssh server rekey-interval························································································································252
ssh user··················································································································································253
SSH client commands····································································································································255
bye ·························································································································································255
cd ···························································································································································255
cdup ·······················································································································································256
delete ·····················································································································································256
dir···························································································································································257
display sftp client source························································································································258
display ssh client source························································································································258
exit··························································································································································259
get··························································································································································259
help ························································································································································260
ls·····························································································································································261
mkdir ······················································································································································262
put··························································································································································262
pwd·························································································································································263
quit ·························································································································································263
remove···················································································································································263
rename···················································································································································264
rmdir·······················································································································································264
scp··························································································································································265
sftp ·························································································································································267
sftp client source····································································································································269
ssh client source ····································································································································269
ssh2························································································································································270
IP source guard commands········································································273
display ip source binding························································································································273
ip source binding (interface view)···········································································································274
ip source binding (system view)·············································································································275
ip verify source·······································································································································276
ARP attack protection commands·······························································278
Unresolvable IP attack protection commands································································································278
arp resolving-route enable ·····················································································································278
arp resolving-route probe-count·············································································································278
arp resolving-route probe-interval··········································································································279
arp source-suppression enable··············································································································279
arp source-suppression limit··················································································································280
display arp source-suppression ·············································································································280
ARP packet rate limit commands···················································································································281
arp rate-limit···········································································································································281
arp rate-limit log enable··························································································································282
arp rate-limit log interval·························································································································282
snmp-agent trap enable arp···················································································································283
Source MAC-based ARP attack detection commands ··················································································284
arp source-mac······································································································································284
arp source-mac aging-time ····················································································································285
arp source-mac exclude-mac·················································································································285
arp source-mac threshold ······················································································································286
display arp source-mac··························································································································286

vi
ARP packet source MAC consistency check commands ··············································································287
arp valid-check enable···························································································································287
ARP active acknowledgement commands·····································································································288
arp active-ack enable·····························································································································288
Authorized ARP commands···························································································································289
arp authorized enable ····························································································································289
ARP detection commands ·····························································································································289
arp detection enable·······························································································································289
arp detection log enable·························································································································290
arp detection trust ··································································································································290
arp detection validate·····························································································································291
arp restricted-forwarding enable ············································································································291
display arp detection······························································································································292
display arp detection statistics ···············································································································292
reset arp detection statistics···················································································································293
ARP scanning and fixed ARP commands······································································································294
arp fixup ·················································································································································294
arp scan ·················································································································································295
ARP gateway protection commands··············································································································295
arp filter source ······································································································································296
ARP filtering commands ································································································································296
arp filter binding······································································································································296
uRPF commands························································································298
display ip urpf·········································································································································298
ip urpf·····················································································································································298
FIPS commands ·························································································300
display fips status···································································································································300
fips mode enable····································································································································300
fips self-test············································································································································302
Attack detection and prevention commands···············································304
attack-defense tcp fragment enable·······································································································304
Document conventions and icons·······························································305
Conventions···················································································································································305
Network topology icons··································································································································306
Support and other resources ······································································307
Accessing Hewlett Packard Enterprise Support ····························································································307
Accessing updates·········································································································································307
Websites ················································································································································308
Customer self repair·······························································································································308
Remote support······································································································································308
Documentation feedback ·······················································································································308
Index···········································································································309

1
AAA commands
The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for
features, commands, and parameters might differ in FIPS mode and non-FIPS mode. For more
information about FIPS mode, see Security Configuration Guide.
General AAA commands
aaa session-limit
Use aaa session-limit to set the maximum number of concurrent users who can log on to the device
through the specified method.
Use undo aaa session-limit to restore the default maximum number of concurrent users for the
specified login method.
Syntax
In non-FIPS mode:
aaa session-limit { ftp | ssh | telnet } max-sessions
undo aaa session-limit { ftp | ssh | telnet }
In FIPS mode:
aaa session-limit ssh max-sessions
undo aaa session-limit ssh
Default
The maximum number of concurrent users is 32 for each user type.
Views
System view
Predefined user roles
network-admin
mdc-admin
Parameters
ftp: FTP users.
ssh: SSH users.
telnet: Telnet users.
max-sessions: Specifies the maximum number of concurrent login users. The value range is 1 to 32.
Usage guidelines
After the maximum number of concurrent login users for a user type exceeds the upper limit, the
system denies the subsequent users of this type.
Examples
# Set the maximum number of concurrent FTP users to 4.
<Sysname> system-view
[Sysname] aaa session-limit ftp 4

2
accounting command
Use accounting command to specify the command line accounting method.
Use undo accounting command to restore the default.
Syntax
accounting command hwtacacs-scheme hwtacacs-scheme-name
undo accounting command
Default
The default accounting method of the ISP domain is used for command line accounting.
Views
ISP domain view
Predefined user roles
network-admin
mdc-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
Usage guidelines
The command line accounting feature works with the accounting server to record all commands that
have been successfully executed on the device.
Command line accounting can use only a remote HWTACACS server.
Examples
# In ISP domain test, perform command line accounting based on HWTACACS scheme hwtac.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting command hwtacacs-scheme hwtac
Related commands
•accounting default
•command accounting (Fundamentals Command Reference)
•hwtacacs scheme
accounting default
Use accounting default to specify the default accounting method for an ISP domain.
Use undo accounting default to restore the default.
Syntax
In non-FIPS mode:
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] [ none ]|local [none ] | none |radius-scheme
radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }
undo accounting default
In FIPS mode:

3
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [ local ] }
undo accounting default
Default
The default accounting method of an ISP domain is local.
Views
ISP domain view
Predefined user roles
network-admin
mdc-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive
string of 1 to 32 characters.
Usage guidelines
The default accounting method is used for all users who support this method and do not have an
accounting method configured.
Local accounting is only used for monitoring and controlling the number of local user connections. It
does not provide the statistics function that the accounting feature generally provides.
You can specify one primary default accounting method and multiple backup default accounting
methods.
When the primary method is invalid, the device attempts to use the backup methods in sequence.
For example, the accounting default radius-scheme radius-scheme-name local none command
specifies the primary default RADIUS accounting method and two backup methods (local accounting
and no accounting). The device performs RADIUS accounting by default and performs local
accounting when the RADIUS server is invalid. The device does not perform accounting when both
of the previous methods are invalid.
Examples
# Configure the default accounting method for ISP domain test to use RADIUS scheme rd and use
local accounting as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting default radius-scheme rd local
Related commands
•hwtacacs scheme
•local-user
•radius scheme
accounting login
Use accounting login to specify the accounting method for login users.

4
Use undo accounting login to restore the default.
Syntax
In non-FIPS mode:
accounting login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] [ none ]|local [none ] | none |radius-scheme
radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ]}
undo accounting login
In FIPS mode:
accounting login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [ local ] }
undo accounting login
Default
The default accounting method of the ISP domain is used for login users.
Views
ISP domain view
Predefined user roles
network-admin
mdc-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive
string of 1 to 32 characters.
Usage guidelines
Accounting is not supported for FTP, SFTP, and SCP users.
You can specify one primary accounting method and multiple backup accounting methods.
When the primary method is invalid, the device attempts to use the backup methods in sequence.
For example, the accounting login radius-scheme radius-scheme-name local none command
specifies a primary default RADIUS accounting method and two backup methods (local accounting
and no accounting). The device performs RADIUS accounting by default and performs local
accounting when the RADIUS server is invalid. The device does not perform accounting when both
of the previous methods are invalid.
Examples
# In ISP domain test, perform local accounting for login users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] accounting login local
# In ISP domain test, perform RADIUS accounting for login users based onscheme rd and use local
accounting as the backup.
<Sysname> system-view
[Sysname] domain test

5
[Sysname-isp-test] accounting login radius-scheme rd local
Related commands
•accounting default
•hwtacacs scheme
•local-user
•radius scheme
authentication default
Use authentication default to specify the default authentication method for an ISP domain.
Use undo authentication default to restore the default.
Syntax
In non-FIPS mode:
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] [ none ] | local [ none ] | none | radius-scheme
radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }
undo authentication default
In FIPS mode:
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [ local ] }
undo authentication default
Default
The default authentication method of an ISP domain is local.
Views
ISP domain view
Predefined user roles
network-admin
mdc-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authentication.
none: Does not perform authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive
string of 1 to 32 characters.
Usage guidelines
The default authentication method is used for all users who support this method and do not have an
authentication method configured.
You can specify one primary default authentication method and multiple backup default
authentication methods.
When the primary method is invalid, the device attempts to use the backup methods in sequence.
For example, the authentication default radius-scheme radius-scheme-name local none

6
command specifies a primary default RADIUS authentication method and two backup methods
(local authentication and no authentication). The device performs RADIUS authentication by default
and performs local authentication when the RADIUS server is invalid. The device does not perform
authentication when both of the previous methods are invalid.
Examples
# Configure the default authentication method for ISP domain test to use RADIUS scheme rd and
use local authentication as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication default radius-scheme rd local
Related commands
•hwtacacs scheme
•local-user
•radius scheme
authentication login
Use authentication login to specify the authentication method for login users.
Use undo authentication login to restore the default.
Syntax
In non-FIPS mode:
authentication login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] [ none ] | local [ none ] | none | radius-scheme
radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }
undo authentication login
In FIPS mode:
authentication login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [ local ] }
undo authentication login
Default
The default authentication method of the ISP is used for login users.
Views
ISP domain view
Predefined user roles
network-admin
mdc-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authentication.
none: Does not perform authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive
string of 1 to 32 characters.

7
Usage guidelines
You can specify one primary authentication method and multiple backup authentication methods.
When the primary method is invalid, the device attempts to use the backup methods in sequence.
For example, the authentication login radius-scheme radius-scheme-name local none command
specifies the default primary RADIUS authentication method and two backup methods (local
authentication and no authentication). The device performs RADIUS authentication by default and
performs local authentication when the RADIUS server is invalid. The device does not perform
authentication when both of the previous methods are invalid.
Examples
# In ISP domain test, perform local authentication for login users.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication login local
# In ISP domain test, perform RADIUS authentication for login users based on scheme rd and use
local authentication as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authentication login radius-scheme rd local
Related commands
•authentication default
•hwtacacs scheme
•local-user
•radius scheme
authentication super
Use authentication super to specify a method for user role authentication.
Use undo authentication super to restore the default.
Syntax
authentication super { hwtacacs-scheme hwtacacs-scheme-name | radius-scheme
radius-scheme-name } *
undo authentication super
Default
The default authentication method of the ISP domain is used for user role authentication.
Views
ISP domain view
Predefined user roles
network-admin
mdc-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive
string of 1 to 32 characters.

8
Usage guidelines
You can specify one authentication method and one backup authentication method to use in case
that the previous authentication method is invalid.
If you specify a scheme to provide the method foruser role authentication, the method applies only to
users whose user role is in the format of level-n.
•If an HWTACACS scheme is specified, the device uses the entered username for role
authentication. The username must already exist on the HWTACACS server to represent the
highest user level that a user can obtain. For example, to obtain a level-3 user role whose
username is test, the device uses the string test@domain-name or test for role authentication,
depending on whether the domain name is required.
•If a RADIUS scheme is specified, the device uses the username $enabn$on the RADIUS
server for role authentication of any usernames. The variable nhas the same value as the level
of the target user role. For example, to obtain a level-3 user role, the device uses the username
string $enab3$@domain-name or $enab3$, depending on whether the domain name is
required.
Examples
# In ISP domain test, perform user role authentication based on HWTACACS scheme tac.
<Sysname> system-view
[Sysname] super authentication-mode scheme
[Sysname] domain test
[Sysname-domain-test] authentication super hwtacacs-scheme tac
Related commands
•authentication default
•hwtacacs scheme
•radius scheme
authorization command
Use authorization command to specify the command authorization method.
Use undo authorization command to restore the default.
Syntax
In non-FIPS mode:
authorization command { hwtacacs-scheme hwtacacs-scheme-name [ local ] [ none ] | local
[ none ] | none }
undo authorization command
In FIPS mode:
authorization command { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local }
undo authorization command
Default
The default authorization method of the ISP domain is used for command authorization.
Views
ISP domain view
Predefined user roles
network-admin

9
mdc-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authorization.
none: Does not perform authorization. The authorization server does not verify whether the entered
commands are permitted by the user role. The commands are executed successfully if the user role
has permission to the commands.
Usage guidelines
Command authorization restricts login users to execute only authorized commands by employing an
authorization server to verify whether or not each entered command is permitted.
After login, users can access the command lines permitted by their authorized user roles.
You can specify one primary command authorization method and multiple backup authorization
methods.
When the default authorization method is invalid, the device attempts to use the backup
authorization methods in sequence. For example, the authorization command hwtacacs-scheme
hwtacacs-scheme-name local none command specifies the default HWTACACS authorization
method and two backup methods (local authorization and no authorization). The device performs
HWTACACS authorization by default and performs local authorization when the HWTACACS server
is invalid. The device does not perform command authorization when both of the previous methods
are invalid.
Examples
# In ISP domain test, configure the device to perform local command authorization.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization command local
# In ISP domain test, perform command authorization based on HWTACACS scheme hwtac and
use local authorization as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization command hwtacacs-scheme hwtac local
Related commands
•authorization accounting (Fundamentals Command Reference)
•hwtacacs scheme
•local-user
authorization default
Use authorization default to specify the default authorization method for an ISP domain.
Use undo authorization default to restore the default.
Syntax
In non-FIPS mode:
authorization default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] [ none ] | local [ none ] | none | radius-scheme
radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }
undo authorization default

10
In FIPS mode:
authorization default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [ local ] }
undo authorization default
Default
The default authorization method of an ISP domain is local.
Views
ISP domain view
Predefined user roles
network-admin
mdc-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authorization.
none: Does not perform authorization.After passing authentication, FTP, SFTP and SCP users use
the root directory of the device as the working directory but cannot access to it, and other login users
get the default user role. For more information about the default user role, see Fundamentals
Configuration Guide.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive
string of 1 to 32 characters.
Usage guidelines
The default authorization method is used for all users who support this method and do not have an
authorization method configured.
The RADIUS authorization configuration takes effect only when the authentication method and
authorization method of the ISP domain use the same RADIUS scheme.
You can specify one primary authorization method and multiple backup authorization methods.
When the default authorization method is invalid, the device attempts to use the backup
authorization methods in sequence. For example, the authorization default radius-scheme
radius-scheme-name local none command specifies the default RADIUS authorization method and
two backup methods (local authorization and no authorization). The device performs RADIUS
authorization by default and performs local authorization when the RADIUS server is invalid. The
device does not perform authorization when both of the previous methods are invalid.
Examples
# Configure the default authorization method for ISPdomain test to use RADIUS scheme rd for user
authorization and use local authorization as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization default radius-scheme rd local
Related commands
•hwtacacs scheme
•local-user
•radius scheme

11
authorization login
Use authorization login to configure the authorization method for login users.
Use undo authorization login to restore the default.
Syntax
In non-FIPS mode:
authorization login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] [ none ]|local [none ] | none | radius-scheme
radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ]}
undo authorization login
In FIPS mode:
authorization login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme
radius-scheme-name ] [ local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme
hwtacacs-scheme-name ] [ local ]}
undo authorization login
Default
The default authorization method of the ISP domain is used for login users.
Views
ISP domain view
Predefined user roles
network-admin
mdc-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a
case-insensitive string of 1 to 32 characters.
local: Performs local authorization.
none: Does not perform authorization.After passing authentication, FTP, SFTP, and SCP users use
the root directory of the device as the working directory but cannot access it, and other login users
get the default user role. For more information about the default user role, see Fundamentals
Configuration Guide.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive
string of 1 to 32 characters.
Usage guidelines
The RADIUS authorization configuration takes effect only when the authentication method and
authorization method of the ISP domain use the same RADIUS scheme.
You can specify one primary authorization method and multiple backup authorization methods.
When the default authorization method is invalid, the device attempts to use the backup
authorization methods in sequence. For example, the authorization login radius-scheme
radius-scheme-name local none command specifies the default RADIUS authorization method and
two backup methods (local authorization and no authorization). The device performs RADIUS
authorization by default and performs local authorization when the RADIUS server is invalid. The
device does not perform authorization when both of the previous methods are invalid.
Examples
# In ISP domain test, perform local authorization for login users.

12
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization login local
# In ISP domain test, perform RADIUS authorization for login users based on scheme rd and use
local authorization as the backup.
<Sysname> system-view
[Sysname] domain test
[Sysname-isp-test] authorization login radius-scheme rd local
Related commands
•authorization default
•hwtacacs scheme
•local-user
•radius scheme
display domain
Use display domain to display the ISP domain configuration.
Syntax
display domain [ isp-name ]
Views
Any view
Predefined user roles
network-admin
network-operator
mdc-admin
mdc-operator
Parameters
isp-name: Specifies an ISPdomain by its name, a case-insensitive string of 1 to 24 characters. If you
do not specify an ISP domain, the command displays the configuration of all ISP domains.
Examples
# Display the configuration of all ISP domains.
<Sysname> display domain
Total 2 domain(s)
Domain:system
State: Active
Access-limit: Disable
Access-Count: 0
default Authentication Scheme: local
default Authorization Scheme: local
default Accounting Scheme: local
Authorization attributes :
Idle-cut : Disable