HPE FlexNetwork 10500 SERIES Installation manual

HPE FlexNetwork 10500 Switch Series
Security Command Reference
P
art number: 5200-1909a
Software
version: 10500-CMW710-R7557P01
Document version: 6W101-20171020

© Copyright 2017 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® and Acrobat® are trademarks of Adobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
AAA commands·····························································································1
General AAA commands····································································································································1
aaa nas-id profile········································································································································1
aaa session-limit ········································································································································2
accounting command·································································································································2
accounting default······································································································································3
accounting dual-stack ································································································································4
accounting lan-access································································································································5
accounting login·········································································································································7
accounting portal········································································································································8
accounting quota-out··································································································································9
accounting start-fail··································································································································10
accounting update-fail······························································································································11
authentication default·······························································································································11
authentication lan-access·························································································································13
authentication login··································································································································14
authentication portal·································································································································15
authentication super·································································································································16
authorization command····························································································································17
authorization default·································································································································19
authorization lan-access ··························································································································20
authorization login····································································································································21
authorization portal···································································································································22
authorization-attribute (ISP domain view)································································································24
display domain·········································································································································25
domain ·····················································································································································29
domain default enable······························································································································30
domain if-unknown···································································································································31
nas-id bind vlan········································································································································32
service-type (ISP domain view)················································································································32
session-time include-idle-time··················································································································33
state (ISP domain view)···························································································································34
user-address-type····································································································································35
Local user commands······································································································································36
access-limit ··············································································································································36
authorization-attribute (local user view/user group view)·········································································36
bind-attribute············································································································································39
company···················································································································································40
description················································································································································40
display local-user ·····································································································································41
display user-group····································································································································44
email·························································································································································46
full-name ··················································································································································46
group························································································································································47
local-guest email format···························································································································48
local-guest email sender··························································································································49
local-guest email smtp-server··················································································································49
local-guest generate·································································································································50
local-guest send-email·····························································································································51
local-user··················································································································································52
local-user auto-delete enable···················································································································53
local-user-export ······································································································································54
local-user-import ······································································································································55
password (device management user view)······························································································57
password (network access user view) ·····································································································58
phone·······················································································································································59
service-type (local user view)···················································································································60

ii
sponsor-department·································································································································61
sponsor-email···········································································································································61
sponsor-full-name ····································································································································62
state (local user view) ······························································································································62
user-group················································································································································63
validity-datetime·······································································································································64
RADIUS commands·········································································································································65
aaa device-id············································································································································65
accounting-on enable·······························································································································66
accounting-on extended···························································································································66
attribute 15 check-mode···························································································································67
attribute 25 car·········································································································································68
attribute 31 mac-format····························································································································69
attribute convert (RADIUS DAS view)······································································································70
attribute convert (RADIUS scheme view)·································································································71
attribute reject (RADIUS DAS view)·········································································································72
attribute reject (RADIUS scheme view)····································································································73
attribute remanent-volume·······················································································································74
attribute translate ·····································································································································75
client·························································································································································75
data-flow-format (RADIUS scheme view) ································································································76
display radius scheme······························································································································77
display radius statistics ····························································································································81
display stop-accounting-buffer (for RADIUS)···························································································82
key (RADIUS scheme view)·····················································································································83
nas-ip (RADIUS scheme view)·················································································································84
port···························································································································································85
primary accounting (RADIUS scheme view)····························································································86
primary authentication (RADIUS scheme view)·······················································································87
radius attribute extended··························································································································89
radius dscp···············································································································································91
radius dynamic-author server···················································································································91
radius nas-ip·············································································································································92
radius scheme··········································································································································93
radius session-control client·····················································································································94
radius session-control enable ··················································································································95
radius-server test-profile ··························································································································96
reset radius statistics································································································································97
reset stop-accounting-buffer (for RADIUS)······························································································97
retry··························································································································································98
retry realtime-accounting··························································································································99
retry stop-accounting (RADIUS scheme view)·······················································································100
secondary accounting (RADIUS scheme view) ·····················································································101
secondary authentication (RADIUS scheme view) ················································································103
server-load-sharing enable ····················································································································105
snmp-agent trap enable radius ··············································································································106
state primary ··········································································································································107
state secondary······································································································································108
stop-accounting-buffer enable (RADIUS scheme view)·········································································109
timer quiet (RADIUS scheme view)········································································································110
timer realtime-accounting (RADIUS scheme view)················································································111
timer response-timeout (RADIUS scheme view)····················································································112
user-name-format (RADIUS scheme view)····························································································113
vpn-instance (RADIUS scheme view)····································································································114
HWTACACS commands································································································································114
data-flow-format (HWTACACS scheme view) ·······················································································114
display hwtacacs scheme ······················································································································115
display stop-accounting-buffer (for HWTACACS)··················································································120
hwtacacs nas-ip ·····································································································································121
hwtacacs scheme···································································································································122
key (HWTACACS scheme view)············································································································123
nas-ip (HWTACACS scheme view)········································································································124

iii
primary accounting (HWTACACS scheme view)···················································································125
primary authentication (HWTACACS scheme view)··············································································126
primary authorization······························································································································128
reset hwtacacs statistics ························································································································129
reset stop-accounting-buffer (for HWTACACS)·····················································································130
retry stop-accounting (HWTACACS scheme view)················································································130
secondary accounting (HWTACACS scheme view) ··············································································131
secondary authentication (HWTACACS scheme view) ·········································································133
secondary authorization·························································································································134
stop-accounting-buffer enable (HWTACACS scheme view)··································································136
timer quiet (HWTACACS scheme view)·································································································137
timer realtime-accounting (HWTACACS scheme view)·········································································137
timer response-timeout (HWTACACS scheme view)·············································································138
user-name-format (HWTACACS scheme view)·····················································································139
vpn-instance (HWTACACS scheme view)·····························································································140
LDAP commands···········································································································································140
attribute-map··········································································································································140
authentication-server······························································································································141
authorization-server ·······························································································································142
display ldap scheme·······························································································································143
ip ····························································································································································144
ipv6·························································································································································145
ldap attribute-map··································································································································146
ldap scheme···········································································································································147
ldap server ·············································································································································148
login-dn ··················································································································································148
login-password·······································································································································149
map························································································································································150
protocol-version······································································································································151
search-base-dn······································································································································151
search-scope··········································································································································152
server-timeout········································································································································153
user-parameters·····································································································································153
RADIUS server commands····························································································································154
display radius-server active-client··········································································································154
display radius-server active-user ···········································································································155
radius-server activate·····························································································································156
radius-server client·································································································································157
802.1X commands·····················································································159
display dot1x··········································································································································159
display dot1x connection························································································································163
display dot1x mac-address ····················································································································166
dot1x ······················································································································································167
dot1x access-user log enable ················································································································168
dot1x after-mac-auth max-attempt·········································································································169
dot1x authentication-method··················································································································170
dot1x auth-fail vlan·································································································································171
dot1x auth-fail vsi···································································································································172
dot1x critical eapol ·································································································································173
dot1x critical vlan····································································································································173
dot1x critical vsi······································································································································174
dot1x critical-voice-vlan··························································································································175
dot1x domain-delimiter···························································································································176
dot1x ead-assistant enable····················································································································177
dot1x ead-assistant free-ip·····················································································································178
dot1x ead-assistant url···························································································································178
dot1x eapol untag···································································································································179
dot1x guest-vlan·····································································································································180
dot1x guest-vlan-delay···························································································································181
dot1x guest-vsi·······································································································································182
dot1x guest-vsi-delay·····························································································································183

iv
dot1x handshake····································································································································184
dot1x handshake reply enable···············································································································185
dot1x handshake secure························································································································185
dot1x mac-binding··································································································································186
dot1x mac-binding enable······················································································································187
dot1x mandatory-domain ·······················································································································188
dot1x max-user ······································································································································189
dot1x multicast-trigger····························································································································189
dot1x port-control···································································································································190
dot1x port-method··································································································································191
dot1x quiet-period ··································································································································192
dot1x re-authenticate ·····························································································································192
dot1x re-authenticate manual·················································································································193
dot1x re-authenticate server-unreachable keep-online··········································································194
dot1x retry··············································································································································194
dot1x timer ·············································································································································195
dot1x timer reauth-period·······················································································································197
dot1x unicast-trigger·······························································································································198
dot1x user-ip freeze ·······························································································································199
reset dot1x guest-vlan····························································································································199
reset dot1x guest-vsi······························································································································200
reset dot1x statistics·······························································································································200
MAC authentication commands·································································202
display mac-authentication·····················································································································202
display mac-authentication connection··································································································205
display mac-authentication mac-address·······························································································207
mac-authentication·································································································································209
mac-authentication access-user log enable···························································································210
mac-authentication carry user-ip············································································································210
mac-authentication critical vlan··············································································································211
mac-authentication critical vsi················································································································212
mac-authentication critical-voice-vlan····································································································213
mac-authentication domain····················································································································214
mac-authentication guest-vlan···············································································································215
mac-authentication guest-vlan auth-period····························································································216
mac-authentication guest-vsi ·················································································································217
mac-authentication guest-vsi auth-period······························································································218
mac-authentication host-mode···············································································································218
mac-authentication max-user·················································································································219
mac-authentication offline-detect enable ·······························································································220
mac-authentication parallel-with-dot1x···································································································221
mac-authentication re-authenticate········································································································222
mac-authentication re-authenticate server-unreachable keep-online····················································222
mac-authentication timer (interface view) ······························································································223
mac-authentication timer (system view)·································································································224
mac-authentication user-name-format···································································································226
reset mac-authentication critical vlan·····································································································227
reset mac-authentication critical vsi·······································································································227
reset mac-authentication critical-voice-vlan···························································································228
reset mac-authentication guest-vlan······································································································229
reset mac-authentication guest-vsi ········································································································229
reset mac-authentication statistics·········································································································230
Portal commands·······················································································231
aging-time ··············································································································································231
authentication-timeout····························································································································232
binding-retry···········································································································································232
default-logon-page·································································································································233
display portal··········································································································································234
display portal mac-trigger-server············································································································237
display portal packet statistics················································································································239

v
display portal rule···································································································································241
display portal server·······························································································································245
display portal user··································································································································246
display portal web-server·······················································································································253
display web-redirect rule························································································································254
if-match ··················································································································································256
ip (MAC binding server view)·················································································································258
ip (portal authentication server view) ·····································································································259
ipv6·························································································································································260
nas-port-type··········································································································································261
port (MAC binding server view)··············································································································262
port (portal authentication server view)··································································································262
portal { bas-ip | bas-ipv6 } (interface view)·····························································································263
portal { ipv4-max-user | ipv6-max-user } (interface view)·······································································264
portal apply mac-trigger-server··············································································································265
portal apply web-server (interface view) ································································································266
portal authorization strict-checking·········································································································267
portal delete-user···································································································································267
portal device-id·······································································································································268
portal domain (interface view)················································································································269
portal enable (interface view)·················································································································269
portal fail-permit server ··························································································································270
portal free-all except destination············································································································271
portal free-rule········································································································································272
portal free-rule destination ·····················································································································274
portal free-rule source····························································································································275
portal ipv6 free-all except destination·····································································································276
portal ipv6 layer3 source························································································································277
portal ipv6 user-detect····························································································································278
portal layer3 source································································································································279
portal local-web-server···························································································································280
portal log enable·····································································································································281
portal mac-trigger server························································································································282
portal max-user······································································································································283
portal nas-id-profile ································································································································283
portal nas-port-id format·························································································································284
portal outbound-filter enable ··················································································································287
portal pre-auth domain···························································································································288
portal pre-auth ip-pool····························································································································289
portal refresh enable······························································································································290
portal roaming enable ····························································································································291
portal server···········································································································································292
portal user-detect···································································································································292
portal user-dhcp-only (interface view)····································································································294
portal web-proxy port ·····························································································································294
portal web-server ···································································································································295
reset portal packet statistics···················································································································296
server-detect (portal authentication server view)···················································································297
server-detect (portal Web server view)··································································································298
server-type·············································································································································299
server-type (MAC binding server view)··································································································299
tcp-port···················································································································································300
url···························································································································································301
url-parameter··········································································································································302
user-sync················································································································································303
version····················································································································································304
vpn-instance···········································································································································305
web-redirect url ······································································································································306
Port security commands ············································································307
display port-security·······························································································································307
display port-security mac-address block································································································310

vi
display port-security mac-address security····························································································311
port-security access-user log enable ·····································································································312
port-security authentication open···········································································································313
port-security authentication open global ································································································314
port-security authorization ignore···········································································································315
port-security authorization-fail offline ·····································································································315
port-security enable································································································································316
port-security free-vlan ····························································································································317
port-security intrusion-mode···················································································································318
port-security mac-address aging-type inactivity·····················································································319
port-security mac-address dynamic·······································································································320
port-security mac-address security········································································································321
port-security mac-limit····························································································································323
port-security mac-move permit···············································································································324
port-security max-mac-count··················································································································324
port-security nas-id-profile······················································································································326
port-security ntk-mode ···························································································································326
port-security oui······································································································································327
port-security port-mode··························································································································328
port-security timer autolearn aging·········································································································331
port-security timer disableport················································································································332
snmp-agent trap enable port-security ····································································································333
Password control commands·····································································335
display password-control························································································································335
display password-control blacklist··········································································································336
password-control { aging | composition | history | length } enable ·························································337
password-control aging··························································································································338
password-control alert-before-expire ·····································································································340
password-control complexity··················································································································340
password-control composition················································································································341
password-control enable························································································································343
password-control expired-user-login······································································································344
password-control history························································································································344
password-control length·························································································································345
password-control login idle-time·············································································································346
password-control login-attempt··············································································································347
password-control super aging················································································································349
password-control super composition······································································································350
password-control super length···············································································································351
password-control update-interval···········································································································351
reset password-control blacklist·············································································································352
reset password-control history-record····································································································353
Keychain commands ·················································································354
accept-lifetime utc··································································································································354
accept-tolerance·····································································································································355
authentication-algorithm·························································································································355
default-send-key·····································································································································356
display keychain·····································································································································357
key··························································································································································358
keychain·················································································································································359
key-string················································································································································360
send-lifetime utc·····································································································································360
tcp-algorithm-id ······································································································································361
tcp-kind···················································································································································362
Public key management commands··························································364
display public-key local public················································································································364
display public-key peer···························································································································367
peer-public-key end································································································································369
public-key local create····························································································································370

vii
public-key local destroy··························································································································373
public-key local export dsa·····················································································································375
public-key local export ecdsa·················································································································377
public-key local export rsa······················································································································378
public-key peer·······································································································································380
public-key peer import sshkey················································································································381
PKI commands··························································································383
attribute··················································································································································383
ca identifier·············································································································································384
certificate request entity·························································································································385
certificate request from···························································································································386
certificate request mode·························································································································386
certificate request polling ·······················································································································388
certificate request url······························································································································388
common-name·······································································································································389
country ···················································································································································390
crl check·················································································································································390
crl url ······················································································································································391
display pki certificate access-control-policy ···························································································392
display pki certificate attribute-group······································································································393
display pki certificate domain·················································································································395
display pki certificate request-status······································································································399
display pki crl domain·····························································································································401
fqdn························································································································································402
ip ····························································································································································403
ldap-server·············································································································································404
locality····················································································································································405
organization············································································································································405
organization-unit·····································································································································406
pki abort-certificate-request····················································································································406
pki certificate access-control-policy········································································································407
pki certificate attribute-group··················································································································408
pki delete-certificate·······························································································································409
pki domain··············································································································································410
pki entity·················································································································································411
pki export················································································································································412
pki import················································································································································419
pki request-certificate·····························································································································423
pki retrieve-certificate·····························································································································424
pki retrieve-crl·········································································································································426
pki storage··············································································································································427
pki validate-certificate·····························································································································428
public-key dsa········································································································································430
public-key ecdsa ····································································································································431
public-key rsa·········································································································································432
root-certificate fingerprint ·······················································································································433
rule·························································································································································435
source ····················································································································································436
state ·······················································································································································437
usage ·····················································································································································437
IPsec commands·······················································································439
ah authentication-algorithm····················································································································439
description··············································································································································440
display ipsec { ipv6-policy | policy }········································································································440
display ipsec { ipv6-policy-template | policy-template }·········································································445
display ipsec profile································································································································447
display ipsec sa······································································································································448
display ipsec statistics····························································································································452
display ipsec transform-set ····················································································································454
display ipsec tunnel································································································································456

viii
encapsulation-mode·······························································································································458
esn enable··············································································································································459
esp authentication-algorithm··················································································································460
esp encryption-algorithm························································································································461
ike-profile················································································································································463
ikev2-profile············································································································································463
ipsec { ipv6-policy | policy }····················································································································464
ipsec { ipv6-policy | policy } isakmp template·························································································465
ipsec anti-replay check···························································································································468
ipsec anti-replay window························································································································469
ipsec apply·············································································································································470
ipsec decrypt-check enable····················································································································470
ipsec df-bit··············································································································································471
ipsec fragmentation································································································································472
ipsec global-df-bit···································································································································473
ipsec limit max-tunnel·····························································································································473
ipsec logging packet enable···················································································································474
ipsec profile············································································································································475
ipsec redundancy enable·······················································································································476
ipsec sa global-duration·························································································································476
ipsec sa idle-time ···································································································································477
ipsec transform-set·································································································································478
local-address··········································································································································479
pfs ··························································································································································479
protocol ··················································································································································480
qos pre-classify······································································································································481
redundancy replay-interval·····················································································································482
remote-address······································································································································483
reset ipsec sa·········································································································································484
reset ipsec statistics·······························································································································485
reverse-route dynamic ···························································································································486
reverse-route preference························································································································487
reverse-route tag····································································································································488
sa duration ·············································································································································488
sa hex-key authentication ······················································································································489
sa hex-key encryption····························································································································491
sa idle-time·············································································································································492
sa spi······················································································································································493
sa string-key···········································································································································494
security acl·············································································································································495
snmp-agent trap enable ipsec················································································································497
tfc enable················································································································································498
transform-set··········································································································································498
IKE commands··························································································500
aaa authorization····································································································································500
authentication-algorithm·························································································································501
authentication-method····························································································································502
certificate domain···································································································································502
client-authentication·······························································································································504
description··············································································································································504
dh···························································································································································505
display ike proposal································································································································506
display ike sa··········································································································································507
display ike statistics································································································································510
dpd·························································································································································511
encryption-algorithm·······························································································································512
exchange-mode ·····································································································································513
ike address-group ··································································································································514
ike dpd····················································································································································515
ike identity··············································································································································516
ike invalid-spi-recovery enable···············································································································517