HP (Hewlett-Packard) A3100-8 v2 EI S Bedienungsanleitung

HP A3100 v2 Switch Series Fundamentals Configuration Guide HP A3100-8 v2 SI Switch (JG221A) HP A3100-16 v2 SI Switch (JG222A) HP A3100-24 v2 SI Switch (JG223A) HP A3100-8 v2 EI Switch (JD318B) HP A3100-16 v2 EI Switch (JD319B) HP A3100-24 v2 EI Switch (JD320B) HP A3100-8-PoE v2 EI Switch (JD311B) HP A3100-16-PoE v2 EI Switch (JD312B) HP A3100-24-Po[...]

Legal and notice information © Copyright 2011 Hewlett -Packard Development Company, L.P. No part of this documentation may be reproduced or transmitted in any form or by any means without prior written consent of Hewlett-Pa ckard Development Company, L.P. The information contained herein is subject to change without notice. HEWLETT-PACKARD COM PAN[...]

Contents CLI configuration ·························································································································································· 1 What is CLI?[...]

Telnet login authentication modes ······················································································································· 37 Configuring none authent ication for Telnet login ············[...]

FTP operation ························································································································································· 85 Configuring the FTP client[...]

Setting configuration rollback ······························································································································· ······ 108 Configuration rollback ············[...]

Diagnosing transceiver modules ························································································································ 137 Displaying and maintaining device manag ement configuration ·······[...]

CLI configuration What is CLI? The command li ne interface (C LI) enables y ou to intera ct wit h your device by t ypin g text co mm an ds. At the CLI, y ou can instruc t y our de vi ce to perform a gi ven ta sk by typ ing a text comma nd and then pressing Enter . Com pared w ith a graphi cal user inte rface (GUI) w here y ou can use a mou se to pe[...]

Convention Description [ ] Square brackets enclose syntax choice s (keywords or arguments) that are optional. { x | y | ... } Braces enclose a set of required syntax choices separ ated by vertical bars, from which you select one. [ x | y | ... ] Square brackets enclose a set of opti onal syntax choices separated by vertical bars, from which you sel[...]

CLI v iew s adopt a hierar chical str ucture . See Fig u re 3 . • A f t e r l o g g i n g i n t o t h e sw i t c h, yo u a r e i n u s e r vi ew. T h e u s er v i e w p ro m p t i s < dev ice name >. In user vi ew , y ou can perform displa y , debugging, and f ile management operati ons, set the s ystem t ime , r estart yo ur dev ice , and [...]

To do… Use the command… Remarks Return to the parent view from the current view quit Required Available in any view. NOTE: • The quit command in use r vie w stops t he c urr ent conn ection be t ween the t er minal and the de vi ce . • In publi c ke y code vi ew , use th e public-ke y-code end c o m m a n d t o re t u rn t o t h e p a re n [...]

<1-4094> VLAN interface [sysname] interface vlan-interface 1 ? <cr> [sysname] interface vlan-interface 1 The stri ng <cr> indicates that the command is a com plete command , and can be ex ecut ed by pr essing Enter . 3. Type an incomplete character string followed by ? . The CLI displays all commands starting with the typed charac[...]

• T o set the conf iguratio n file for ne xt startup , type st s . Y ou can also pr ess Ta b to hav e an inc omplete ke yword automatically completed. Configuring command aliases The command alias f u nction allo ws y ou to replace the f irst k eyw ord of a command w ith your pr efer r ed k eywor d. F or e xam ple , if y ou configur e show as the[...]

NOTE: By default, the Ctrl+G , Ctrl+L and Ctrl+O hotkeys are ass ociated with pre-defined commands as defined below, the Ctrl+T and Ctrl+U hotkeys are not. • Ctrl+G cor responds t o the display current-configur ation comma nd . • Ctrl+L co rr esponds to t he display ip routing-table comm and. • Ctrl+O corr esponds to the undo debugging all co[...]

NOTE: The hotkeys in Table 3 are defined by the switch. If the same hotkeys are defined by the terminal software that you use to interact with the switch, the hotk eys defined by the terminal software take effect. Redisplaying input but not submitted commands If you r c om m an d in p ut i s in te rru pt e d by ou t pu t syste m i n form a tio n, y[...]

Accessing history commands F ollow a st ep belo w to access history commands: To do… Use the key/command… Result Display history commands display history-command Displays valid history commands you used Display the previous history command Up arrow key or Ctrl+P Displays the previous history command, if any Display the next history command Down[...]

Controlling the CLI display Multi-screen display Controlling multi-screen display If the output inf ormati on spans multiple scr eens, ea ch s cr een paus es after it is display ed. P erfor m one of the foll o w ing operati ons to pr oceed. Action Function Press Space Displays the next screen. Press Enter Displays the next line. Press Ctrl+C Stops [...]

• When the s yst em displa ys the output inf ormati on in multiple scr eens, us e / , - or + plus a regular e x p r e s s i o n t o f i l t e r s u b s e q u e n t o u t p u t i n f o r m a t i o n . / equals the k eyw or d begin , - equals the key wo r d exc l u d e , and + equals the k eyw or d includ e . The f ollow ing def initions appl y to [...]

Character Meaning Remarks index Repeats the character string specified by the index. A character string refers to the string within () before . index refers to the sequence number (starting from 1 from left to right) of the character group before . If only one character group appears before , index can only be 1; if n character groups appear be[...]

user privilege level 3 # return 2. Example of using the exclude keyword # Displa y the non-direct r outes in the r outing table (the output depends on the cur rent conf igur ation). <Sysname> display ip routing-table | exclude Direct Routing Tables: Public Destination/Mask Proto Pre Cost NextHop Interface 1.1.1.0/24 Static 60 0 192.168.0.0 Vl[...]

Level Privilege Description 3 Manage Involves commands that influence th e basic operation of the system and commands for configuring system support modules. By default, commands at this level invo lve the configuration c ommands of file system, FTP, TFTP, Xmodem download , user management, level setting, and parameter settings within a system (whi[...]

<Sysname> system-view [Sysname] user-interface vty 1 [Sysname-ui-vty1] authentication-mode scheme [Sysname-ui-vty1] quit [Sysname] local-user test [Sysname-luser-test] password cipher 12345678 [Sysname-luser-test] service-type telnet W h e n u s e r s t e l n e t t o t h e s w i t c h t h r o u g h V T Y 1 , t h e y n e e d t o i n p u t u s [...]

To do… Use the command… Remarks Enter system view system-view — Enter user interface view user-interface { first-num1 [ last-num1 ] | { aux | vty } first-num2 [ last-num2 ] } — Configure the authentication mode for any user that uses the current user interface to log in to the switch authentication-mode { none | password } Optional By defau[...]

displa y commands. T he sw itc hing oper ation is eff ecti ve f or the c urr ent login. A fter the user lo gs bac k in, the user pr iv ilege r estor es to the or iginal lev el. • T o av oid pr oblems, HP r e commends that administrat ors log in to the sw itch b y using a low er pri vilege le vel and v iew s witc h oper ating paramet er s. T o mai[...]

To do… Use the command… Remarks Configure the password for user privilege level switch super password [ level user-level ] { simple | cipher } password Required if the authentication mode is set to local . By default, no privilege level switch password is configured. CAUTION: • If no use r pri vilege le ve l is sp ecif ied when y ou confi g u[...]

User interface authentication mode User privilege level switch authentication mode Information input for the first authentication mode Information input after the authentication mode changes local Local user privilege level switch password — local scheme Local user privilege level switch password Password for privilege level switch (configured on[...]

CAUTION: HP recommends that you use the default command level or modify the command level under the g uidance of professional staff. An improper change of the command level may bring inconvenience to your maintenance and operation, or ev en potential security problems. Saving the current configuration On the dev ice , yo u can input the save comman[...]

Login methods Login methods Y ou can log in to the s wit ch b y using the f ollow ing methods. Table 7 Login methods Login method Default state Logging in through the console port By default, you can log in to a device through the console port, the authentication mode is None (n o username or password required), and the user privilege level is 3. L[...]

Login method Default state NMS login By default, you cannot log in to a device through a network m a n a g e m e n t s y s t e m ( N M S ) . T o d o s o , l o g i n t o t h e d e v i c e t h r o u g h t h e console port, and complete the following configuration: • Conf igur e the IP addr ess of the VLAN interface , and make sur e the dev ice and [...]

V TY user in terfac es. Y ou can use the display user -inter face command w ithout any par ameters to v iew supported user interfaces and the i r absolute numbe rs. Relative numbering Relati ve number ing allow s you to spec if y a user interface or a gr oup of user interfaces o f a specif ic type . The n u mber for mat is “ user interface type +[...]

CLI login Overview Th e C LI en ab l es you to in te ra ct w i t h a de vi c e b y t yp i n g t ex t c om ma nd s. A t t h e C L I , y o u c a n i n s t r u c t y o u r dev ice to perfor m a giv en task b y typing a te xt command and then pr essing Enter t o s ub mi t i t t o y o ur dev ice . Compar ed with a GUI , wher e you can use a mo use to pe[...]

The port pr oper ties of the h yper ter minal must be th e s ame as the default settings of the cons ole port sho wn in the f ollo wing ta ble. Setting Default Bits per second 9,600 bps Flow control None Parity None Stop bits 1 Data bits 8 Login procedure Step1 Use the co nsole cable shipped w ith the de vice t o connect the P C and the dev ice . P[...]

Figure 5 Connection description Figure 6 Specify the serial port used to establish the connection 26[...]

Figure 7 Set the properties of the serial port Step3 T urn on the de vice . Y ou are pr ompted to pr ess Enter if the de vi ce successf ully compl etes the po wer -on sel f test (P OS T) . A prompt suc h as <HP> appears after yo u press Enter , as sho wn in Fig u re 8 . Figure 8 Configuration page Step4 Exec ute commands to conf igur e the de[...]

• none —Requir es no user name and passw ord at the ne xt login thr ough the console port. T his mode is insec ure . • pass wor d —Req uir es pass wor d authenti cation at the nex t login through the con sole port. K eep your pass wor d. • sch em e —Requir es us ername and pa ssw ord a uthenticati on at the next login thr ough the conso[...]

By de fault , you can log in t o the dev ice thro ugh th e console port with out authenti cation and hav e user pri vilege le vel 3 afte r login. For inf ormati on about logging in to the de vi ce with th e def ault confi guratio n, see “ C onfigur ation r equire ments .” Configuration procedure F ollow th ese steps to configur e none authen ti[...]

By de fault , you can log in t o the dev ice thro ugh th e console port with out authenti cation and hav e user pri vilege le vel 3 afte r login. For inf ormati on about logging in to the de vi ce with th e def ault confi guratio n, see “ C onfigur ation r equire ments .” Configuration procedure F ollow th ese steps to configur e pass wor d aut[...]

Configuring scheme authentication for console login Configuration prerequisites Y ou hav e logged in to the dev ice. By de fault , you can log in t o the dev ice thro ugh th e console port with out authenti cation and hav e user pri vilege le vel 3 afte r login. For inf ormati on about logging in to the de vi ce with th e def ault confi guratio n, [...]

To do… Use the command… Remarks Enable command accounting command accounting Optional • By def ault, command accounting is disabled . The accounting server does not record the commands e xec uted by users . • Command acco unting allo ws the H W TA C ACS s e r ve r t o re c o rd a l l the commands e xec uted b y users, r egardless o f comman[...]

To do… Use the command… Remarks Specify the service type for the local user service-type terminal Required By default, no service type is specified. Configure common settings for AUX user interface view — Optional See “ Configuring common settings for console login (optional) .” After y ou enable command a uthori z ation , y ou need to pe[...]

Figure 11 Configuration page Configuring common settings for console login (optional) F ollow the se steps to conf igur e common settings f or console port login To do… Use the command… Remarks Enter system view system-view — Enable display of copyright information copyright-info enable Optional Enabled by default. Enter AUX user interface vi[...]

To do… Use the command… Remarks Configure the data bits databits { 5 | 6 | 7 | 8 } Optional By default, the data bits of the console port is 8. Data bits is the number of bits representing one character. The setting depends on the contexts to be transmitted. For example, you can set it to 7 if standard ASCII characters are to be sent, and set i[...]

To do… Use the command… Remarks Set the idle-timeout timer idle-timeout minutes [ seconds ] Optional The default idle-timeout is 10 minutes. The system automatically terminates the user’s connection if no information interaction oc curs between the device and the user within the idle-timeout time. Setting idle-timeout to 0 disables the timer.[...]

This section inclu des these topics : • T elnet login authen ticati on modes • Conf igur ing none a uthenti cation for T elnet login • Conf igur ing pass wo rd authen ticati on for T elnet login • Conf igurin g scheme authen tication f or T elnet login • Conf igur ing common settin gs fo r V TY user interf aces (opti onal) • Conf igurin[...]

Authentication mode Configuration Remarks Configure the authentication scheme Configure a RADIUS/HWTACAC S scheme Configure the AAA scheme used by the domain Remote AAA authentication Configure the username and password on the AAA server Configure the authentication username and password Scheme Select an authenticati on scheme Local authentication [...]

To do… Use the command… Remarks Configure common settings for VTY user interfaces — Optional See “ Configuring common settings for VTY user interfaces (optional) .” When y ou log in to the dev ice thro ugh T elnet again: • Y ou enter the VT Y user interf ac e , as show n in Fi g u r e 1 3 . • If “ All user int erfaces are u sed, ple[...]

To do… Use the command… Remarks Enter one or multiple VTY user interface views user-interface vty first - number [ last-number ] — Specify the password authentication mode authentication-mode password Required By default, authentication mode for VTY user interfaces is password . Set the local password set authentication password { cipher | si[...]

Configuring scheme authentication for Telnet login Configuration prerequisites Y ou hav e logged in to the dev ice. By de fault , you can log in t o the dev ice thro ugh th e console port with out authenti cation and hav e user pri vilege le vel 3 afte r login. For inf ormati on about logging in to the de vi ce with th e def ault confi guratio n, s[...]

To do… Use the command… Remarks Enable command authorization command authorization Optional • By def ault, command author iz ation is no t enabled. • By def ault, the co mmand lev el depends on the us er pr iv ilege lev el. A user is author i z ed a command lev el not higher than the user pr iv ilege leve l. With command author iz ation ena[...]

To do… Use the command… Remarks Enable command accounting command accounting Optional • By def ault, command accounting is disabled. T he accounting ser ver does not r ecor d the commands ex ecuted by u se rs. • Command accoun ting allows the HWT A CA CS serve r to r ecor d all ex ecuted commands that ar e supported b y the d evic e, re g a[...]

To do… Use the command… Remarks Specify the command level of the local user authorization-attribute level level Optional By default, the command level is 0. Specify the service type for the local user service-type Telnet Required By default, no service type is specified. Exit to system view quit — Configure common settings for VTY user interf[...]

Figure 15 Configuration page Configuring common settings for VTY user interfaces (optional) F ollow th ese s teps to conf igur e common settings f or V TY user int erfa ces: To do… Use the command… Remarks Enter system view system-view — Enable display of copyright information copyright-info enable Optional Enabled by default. Enter one or mu[...]

To do… Use the command… Remarks Set the maximum number of lines on the next screen screen-length screen-length Optional By default, the next screen displays 24 lines. A value of 0 disables the function. Set the size of history command buffer history-command max-size value Optional By default, the buffer saves 10 history commands. Set the idle-t[...]

By de fault , you can log in t o the dev ice thro ugh th e console port with out authenti cation and hav e user pri vilege le vel 3 afte r login. For inf ormati on about logging in to the de vi ce with th e def ault confi guratio n, see “ C onfigur ation r equire ments .” Figure 16 Log in to another device from the current device NOTE: If the T[...]

Object Requirements Configure the IP address of the VLAN in terface, and make sure the SSH server and client can reach each other. SSH server Configure the authentication mode and other settings. Run the SSH client program. SSH client Obtain the IP address of the VLAN interface on the server. By de fault , the dev ice is enabled w i th the S SH ser[...]

To do… Use the command… Remarks Enable the current user interface to support SSH protocol inbound { all | ssh } Optional By default, Telnet and SSH are supported. Enable command authorization command authorization Optional • By def ault, command author iz ation is no t enabled. • B y defa ult, command le vel f or a login user depends on the[...]

To do… Use the command… Remarks Enter the de ISP domain view fault e domain domain-nam Apply the specified AAA scheme to the domain hwtacacs-scheme-name [ local ] | local | none | radius-scheme radius-scheme-name [ local } authentication default { hwtacacs-scheme ] Configure the authentication mode Exit to system view quit al pass wor d on the [...]

• Re fer ence the c r eated HW T ACA CS sch eme in the ISP do main. F or mor e info rmati on, see th e Sec urity Co nfi g urati on Guide . When us ers adopt the sc heme mode to log in to the dev ice , the lev el of the commands that the user s can access depends on the user pr iv ileg e lev el def ined in the AAA sc heme. • When the AA A sc hem[...]

Logging in through modems Introduction The admini str ator can use tw o modems to r emotely ma intain a sw itc h through its Cons ole por t o ver the P ublic S witc hed T elephone Networ k (P STN) w hen the IP networ k connection is br ok en. This section inclu des these topics : • Conf iguration r equ irements • Login pr ocedur e • Modem log[...]

Step2 Conf iguratio n on the administrator si de The P C and the modem are co rre ctly connect ed, the modem is connect ed to a telephone cable , and th e telephone n umber of the r emote modem connec ted to the con sole port of the r emote s witc h is obtained . NOTE: Note the following device settings: • The baud r ate of the Console port is lo[...]

Figure 20 Connection description Figure 21 Enter the phone number Figure 22 Dial the number 54[...]

Step6 Char acter string C ONNECT9 600 is display ed on the terminal . Then a prom pt appears when y ou pres s Enter . Figure 23 Configuration page Step7 If the authenti cation mode is passw o rd , a pr ompt (for e xample , HP) appears when y ou type the c o n f i g u r e d p a s s w o r d o n t h e r e m o t e t e r m i n a l . T h e n y o u can co[...]

and pass wor d on the r emote authenti cation server . F or more info rmati on about authenticati on modes and parameter s, see the Sec u rity Conf igur ation Guide . K eep yo u r user name and passw ord . The f ollow ing table lists mo dem login configur ations fo r differ ent authentication modes: Authentication mode Configuration Remarks None Co[...]

To do… Use the command… Remarks Enter system view system-view — Enter one or more AUX user interface views user-interface aux first - number [ last-number ] — Specify the none authentication mode authentication-mode none Required By default, users that log in through the console port are not authenticated. Configure common settings for VTY [...]

To do… Use the command… Remarks Enter system view system-view — Enter one or more AUX user interface views user-interface aux first - number [ last-number ] — Specify the password authentication mode authentication-mode password Required By default, the authentication mode is none for modem users Set the local password set authentication pa[...]

Configuration procedure F ollow th ese s teps to confi gure s cheme a uthenti cation for modem login: To do… Use the command… Remarks Enter system view system-view — Enter AUX user interface view user-interface aux first - number [ last-number ] — Specify the scheme authentication mode authentication-mode scheme Required Whether local, RADI[...]

To do… Use the command… Remarks Optional • By def ault, command accounting is disabled . The accounting server does not record the commands e xec uted by users . • Command acco unting allo ws the H W TA C ACS s e r ve r t o re c o rd a l l ex ecu ted commands that ar e supported b y the dev ice , r egardle ss of the command ex ecuti on resu[...]

To do… Use the command… Remarks Specify the service type for the local user service-type terminal Required By default, no service type is specified. Configure common settings for VTY user interfaces — Optional See “ Configuring common settings for VTY user interfaces (optional) .” After y ou enable command a uthori z ation , y ou need to [...]

Figure 26 Configuration page Configuring common settings for modem login (optional) F ollo w these s teps to conf igur e co mmon settings fo r modem login: To do… Use the command… Remarks Enter system view system-view — Enable display of copyright information copyright-info enable Optional Enabled by default. Enter one or more AUX user interf[...]

To do… Use the command… Remarks Configure the data bits databits { 5 | 6 | 7 | 8 } Optional By default, the data bits is 8. Data bits is the number of bits representing one character. The setting depends on the contexts to be transmitted. For example, you can set it to 7 if standard ASCII characters are to be sent, and set it to 8 if extended A[...]

To do… Use the command… Remarks Set the idle-timeout timer idle-timeout minutes [ seconds ] Optional The default idle-timeout is 10 minutes. The system automatically terminates the user’s connection if no information interaction oc curs between the device and the user within the idle-timeout time. Setting idle-timeout to 0 disables the timer.[...]

To do… Use the command… Remarks Release a specified user interface free user-interface { num1 | { aux | vty } num2 } Available in user view Multiple users can log in to the system to simultaneously configure the device. In some circumstan ces, when the administrator wants to make configurations without interruption from the users that have logg[...]

Web login Web login overview The de vice pr ov ides a built-in web server that enables y ou to log in to the web interface of the de vice fr om a PC . W eb login is disabled b y default . T o enable w eb login, log in to the de vi c e v ia the console port, and perf orm the follo wing confi guration: • Enable HTTP or HTTPS serv ice • Conf igur [...]

To do… Use the command… Remarks Configure the HTTP service port number ip http port port-number Optional 80 by default. If you execute the command multiple times, the last one takes effect. Associate the HTTP service with an ACL ip http acl acl-number Optional By default, the HTTP service is not associated with any ACL. Associating the HTTP ser[...]

To do… Use the command… Remarks Configure PKI and SSL related features — Required By default, PKI and SSL are not configured. • F or more inf ormation about PK I, see the Secu rit y Co nfig urat ion Gu ide . • F or more inf ormation abou t S SL, see the Secu rit y Co nfig urat ion Gu ide . Associate the HTTPS service with an SSL server po[...]

To do… Use the command… Remarks Associate the HTTPS service with a certificate attribute-based access control policy ip https certificate access-control-policy policy-name Optional By default, the HTTPS se rvice is not associated with any certificate-based attribute ac cess control policy. • Assoc iating the HT TPS servi ce with a certif icat[...]

Displaying and maintaining web login To do… Use the command… Remarks Display information about web users display web users [ | { begin | exclude | include } regular-expression ] Available in any view Display HTTP state information display ip http [ | { begin | exclude | include } regular-expression ] Available in any view Display HTTPS state in[...]

Figure 28 Web login page # T ype the user name , pass wor d, v erify code, selec t English , and clic k Login . The homepage appears . After login , yo u can conf igur e dev ice settings thr ough the w e b interfa ce. HTTPS login example Network requirements As sho wn in Fig u r e 29 , to pre ven t unautho ri z ed use rs fr om accessing the De vi c[...]

Configuration procedure 1. Configure the device that acts as the HTTPS server # Conf igur e a PKI entity , conf igur e the common name of the entity as http-server1 , and the FQDN of the entity as ssl.s ec u rit y .c om . <Device> system-view [Device] pki entity en [Device-pki-entity-en] common-name http-server1 [Device-pki-entity-en] fqdn ss[...]

# Enable the HTTPS s er vi ce. [Device] ip https enable # Cr eate a local user named usera , set the pass wo rd t o 12 3 for the user , and spec if y the T elnet service type f or the local u ser . [Device] local-user usera [Device-luser-usera] password simple 123 [Device-luser-usera] service-type telnet 2. Configure the host that acts as the HTTPS[...]

NMS login NMS login overview An NMS runs the SNMP client softwar e. It offers a user-fr iendly inter face to fac i litate net wor k management . An agent is a progr am that resi des in the de vice . It r ecei ves and handles r equests f r om the NMS . An NM S is a manager in an S NMP enabled networ k, wher eas agents ar e managed by the NM S. The N[...]

To do… Use the command… Remarks Add a user to the SNMP group snmp-agent usm-user v3 user-name group-name [ [ cipher ] authentication-mode { md5 | sha } auth-password [ privacy-mode { 3des | aes128 | des56 } priv-password ] ] [ acl acl-number ] Required If the cipher keyword is specified, both auth-password and priv-password are cipher text pass[...]

# Enter s y stem vi ew . <Sysname> system-view # Enable the S NMP agent. [Sysname] snmp-agent # Conf igur e an SNMP gr oup . [Sysname] snmp-agent group v3 managev3group read-view test write-view test # Add a use r to the SNMP gr oup . [Sysname] snmp-agent usm-user v3 managev3user managev3group 2. Configuration on the NMS On the PC , start the[...]

Figure 32 iMC homepage Log in t o the i MC and conf igur e S NMP settings f or the iMC to f ind the dev ice. A fter the dev ice is fo und, y ou c an manage and maintain the dev ice thr ough the iMC. F or ex ample , y ou c an query dev ice infor mation or config ure de v ice par ameter s. The S NMP settings o n the iMC mu st be the same as tho se co[...]

User login control User login control methods The de vice pr ov ides the follo wing login contro l methods. Login Through Login control methods ACL used Configuring source IP-based login control over Telnet users Basic ACL Configuring source and de stination IP-based login control over Telnet users Advanced ACL Telnet Configuring source MAC-based l[...]

To do… Use the command… Remarks Enter user interface view user-interface [ type ] first-number [ last-number ] — Use the ACL to control user login by source IP address acl [ ipv6 ] acl-number { inbound | outbound } Required inbound : Filters incoming Telnet packets. outbound : Filters outgoing Telnet packets. Configuring source and destinatio[...]

To do… Use the command… Remarks Create an Ethernet frame header ACL and enter its view acl number acl-number [ match-order { config | auto } ] Required By default, no advanced ACL exists. Configure rules for the ACL rule [ rule-id ] { permit | deny } rule-string Required Exit the advanced ACL view quit — Enter user interface view user-interfa[...]

[Sysname] user-interface vty 0 4 [Sysname-ui-vty0-4] acl 2000 inbound Configuring source IP-based login control over NMS users Y ou c a n l o g i n t o t h e NM S to re m o t el y m an a g e t h e d evi c es . SN M P i s us e d fo r c o mm u n ic a t i o n b e t we e n the NMS and the agent that r esides in the dev ice . By using the A CL , y ou ca[...]

To do… Use the command… Remarks Associate the user with the ACL snmp-agent usm-user { v1 | v2c } user-name group-name [ acl acl-number ] snmp-agent usm-user v3 user-name group-name [ [ cipher ] authentication-mode { md5 | sha } auth-password [ privacy-mode { 3des | aes128 | des56 } priv-password ] ] [ acl acl-number ] Source IP-based login cont[...]

Configuring source IP-based login control over web users Yo u c a n l o g i n t o t h e w e b m a n a g e m e n t p a g e o f t h e d e v i c e t h r o u g h H T T P / H T T P S t o r e m o t e l y m a n a g e t h e dev ices. B y using the A CL, y ou can control w eb user access to the de vice . Configuration preparation Befo r e c onf igur ation, [...]

Source IP-based login control over web users configuration example Network requirements As sho wn in Fig u re 3 5 , configur e the dev ice to allo w only web u sers fr om Host B to access. Figure 35 Network diagram for configuring source IP-based login control Configuration procedure # Cr eate AC L 2000, and configur e rule 1 to per mit packe ts so[...]

FTP configuration FTP overview Introduction to FTP The F ile T ransfer Pr otocol (FTP) is an appli cation la yer pr otoc ol fo r shar ing files betw een server and c lient over a TCP / I P n e t wo rk. FTP use s T CP ports 20 and 2 1 for file tr ansfer . P or t 20 is used to tr ansmit data, and port 2 1 to transmit contr ol commands . For mor e inf[...]

Table 9 Configuration when the device serves as the FTP server Device Configuration Remarks Enable the FTP server function Disabled by default. You can use the display ftp-server command to view the FTP server configuration on the device. Configure authentication and authorization Configure the username, password, and authorized directory for an FT[...]

• If y ou use the ftp client source command and the ftp command to spec ify a sour c e addr ess r especti vel y , the sour ce addres s specif ied with the ft p c o m m a n d i s u s e d t o c o m m u n i c a t e w i t h a n F T P server . • The s ource addr ess spec ified w ith the ftp clien t sour ce command is vali d for all FTP connecti ons [...]

F ollow th ese steps t o oper ate the dire ctor ies on an FT P serve r: To do… Use the command… Remarks Display detailed informatio n about a directory or file on the remote FTP server dir [ remotefile [ localfile ] ] Optional Query a directory or file on the remote FTP server ls [ remotefile [ localfile ] ] Optional Change the working director[...]

To do… Use the command… Remarks Set the file transfer mode to binary binary Optional ASCII by default. Set the data transmission mode to passive passive Optional Passive by default. Display the local working directory of the FTP client lcd Optional Upload a file to the FTP server put localfile [ remotefile ] Optional Download a file from the FT[...]

To do… Use the command… Remarks Terminate the connection to the FTP server without exiting FTP client view disconnect Optional Equal to the close command. Terminate the connection to the FTP server without exiting FTP client view close Optional Equal to the disconnect command. Terminate the connection to the FTP server and return to user view b[...]

230 Logged in successfully # Set the f i le transf er mode to binary to transmit s ystem so ft war e image file . [ftp] binary 200 Type set to I. # Do wnload the s y stem softwar e image file ne west .bin f rom the P C to the dev ice. [ftp] get newest.bin # Upload the conf igurati on file config.cfg o f the dev ice to the serv er fo r backup . [ftp[...]

To do… Use the command… Remarks Use an ACL to control FTP clients’ access to the switch ftp server acl acl- number Optional By default, no ACL is used to control FTP clients’ access to the switch. Configure the idle-timeout timer ftp timeout min utes Optional 30 minutes by default. Within the idle-timeout time, if there is no information in[...]

To do… Use the command… Remarks Configure user properties authorization-attribute { acl acl-number | callback-number callback-number | idle-cut minute | level level | user-profile profile-name | user-role security-audit | vlan vlan-id | work-directory directory-name } * Optional By default, the FTP/SFTP users can access the root directory of th[...]

# Chec k files on y our dev ice . Remov e those r edundan t to ensur e adequate space fo r the s ystem softwar e image file to be upload ed. <Sysname> dir Directory of flash:/ 0 drw- - Dec 07 2005 10:00:57 filename 1 drw- - Jan 02 2006 14:27:51 logfile 2 -rw- 1216 Jan 02 2006 14:28:59 config.cfg 3 -rw- 1216 Jan 02 2006 16:27:26 back.cfg 14986[...]

Displaying and maintaining FTP To do… Use the command… Remarks Display the configuration of the FTP client display ftp client configuration [ | { begin | exclude | include } regular-expression ] Available in any view Display the configuration of the FTP server display ftp-server [ | { begin | exclude | include } regular-expression ] Available i[...]

TFTP configuration TFTP overview Introduction to TFTP T he T r i vi al F il e T ra nsf er Pr ot oco l ( TFT P) p r o vi de s f unc ti on s s im ila r to th os e pr ov ide d b y F TP , b ut it is les s comple x than FTP in inte racti ve acces s interface and a uthenticati on. It is mor e suitable in e n vir onments whe r e complex in teracti on is n[...]

Table 10 Configuration when the device serves as the TFTP client Device Configuration Remarks Device (TFTP client) • Conf igur e the I P addr ess and r outing func tion, and ensur e that the rou te betw een the dev ice and the TFTP serve r is available . • Use the tftp comma nd to establ ish a conne ction to the remote TFTP server to upload /do[...]

To do… Use the command… Remarks Configure the source address of the TFTP client tftp client source { interface interface-type interface-number | ip source-ip-address } Optional A device uses the source address determined by the matched route to communicate with the TFTP server by default. Return to user view quit — Download or upload a file i[...]

Configuration procedure 1. Configure the PC (TFTP Ser ver), the configuration procedure is om itted. • On the PC , enable the TFTP serv er • Conf igur e a TFTP w orking dir ectory 2. Configure the device ( TFTP Client) CAUTION: If the available memory space of the device is not enough, use the fixdisk command to clear the memor y or use the del[...]

100 File management Managing files F iles such as h ost softwar e and confi guration f iles that ar e necessary for the oper ation o f the dev ice ar e sav ed in the storage medi a of the dev ice. Y ou can manage files on y our dev ice thr ough these oper ations: P er for ming direct ory operati ons , P erforming f ile operati ons , P erforming bat[...]

101 Displaying directory information To do… Use the command… Remarks Display directory or file information dir [ / all ] [ file - url ] Required Available in user view Displaying the current working directory To do… Use the command… Remarks Display the current working directory pwd Required Available in user view Changing the current workin[...]

102 NOTE: You can create a file by copying, downloading or using t he save command. Displaying file information To do… Use the command… Remarks Display file or directory information dir [ / all ] [ file - url ] Required Available in user view Displaying the contents of a file To do… Use the command… Remarks Display the contents of a file mo[...]

103 CAUTION: • The f iles in the r ecy cle bin still oc c upy st or age space. T o delete a f ile in the r ecycle b in, e xec ute the re se t recyc l e - bi n command in the dir ectory to w hich t he f ile ori ginally bel ongs . HP reco mmends y ou to em pt y the r e cycle b in peri odically with the re s et recyc l e - bi n comma nd to sav e sto[...]

104 Performing storage medium operations Managing the space of a storage medium When the space of a stor age medium becomes inac cessible due to abnormal oper ations, y ou can use the fixdisk command to r esto re it . The e xec ution o f the format command for mats the storage medium , and all the data on the storage medium is deleted . Use the f o[...]

105 1 -rw- 1218 Feb 16 2006 11:46:19 config.cfg 2 drw- - Feb 16 2006 15:20:27 test 3 -rw- 184108 Feb 16 2006 15:30:20 aaa.bin 14986 KB total (2521 KB free) # Cr eate a new fo lder my t e s t in the test dir ectory . <Sysname> cd test <Sysname> mkdir mytest %Created dir flash:/test/mytest. # Displa y the c urr ent wo rking dir ectory . &[...]

Configuration file management Configuration file overview A confi guration f ile contains a set of commands. Y ou can sav e the cur rent conf igurati on to a confi guration f ile so that the configur ation can tak e effect after a sw itch r eboot. In additi on, y ou can conv enientl y v iew the conf iguratio n infor mation , or upload and dow nload[...]

Coexistence of multiple configuration files The s wit ch can sa v e multiple conf igurati on files on its storage media . Y ou can sa v e the conf igur ations used in differ ent net wor k ing env ironments as differ ent c onfi gu rati on files. When the s witch mo ves between netw orking env iro nments, spec ify the configur ation f ile as the star[...]

The f ast sa ving mode is suitable f or env ir onments wher e the po wer suppl y is stable. T he safe mode is pr efer red in env ironments w here a stable po wer su pply is un av ailable or remote maintenanc e is in vo lved . F ollow th ese steps t o sa ve the c urr ent conf igurati on: To do… Use the command… Remarks Save the current configura[...]

When y ou enter the configuration r e place file command , the sy stem compar es the running conf igurati on and the spec ified r eplacement confi gurati on file . The co nfiguration r e place file command performs the fol lowing ac tio ns : • Preserves a ll c omm and s present in b oth t he re placement conf igur ation f ile and the running co n[...]

To do… Use the command… Remarks Set the maximum number of configuration files that can be saved archive configuration max file-number Optional The default number is 5. NOTE: • If the undo ar c hive configur a tion location command is e xecu ted, the r unning confi gurati on cannot be sav ed either manually o r automatically , and the confi gu[...]

To do… Use the command… Remarks Manually save the running configuration archive configuration Required Available in user view NOTE: Specify the path and filename prefix of a save conf iguration file before you manually save the running configuration; otherwise, the operation fails. Setting configuration rollback F ollow these s teps to set conf[...]

To do… Use the command… Remarks Specify a startup configurati on file to be used at the next startup startup saved-configuration cfgfile [ backup | main ] Required Available in user view CAUTION: A configuration file must use .cfg as its extension name and the startu p configuration file must be saved in the storage media’s root directory. Ba[...]

To do… Use the command… Remarks Delete a startup configuratio n file to be used at the next startup from the storage media reset saved-configuration [ backup | main ] Required Available in user view CAUTION: This command permanently deletes startup configuratio n files to be used at the next startup from the switch. Use the command with caution[...]

To do… Use the command… Remarks Display the configuration files used at this and the next system startup display startup [ | { begin | exclude | include } regular-expression ] Available in any view Display the valid configuration under the current view display this [ by-linenum ] [ | { begin | exclude | include } regular-expression ] Available [...]

Software upgrade configuration Switch software overview S witc h soft war e includes the Boot RO M and the sy stem softwar e images. After po wer ed on, the dev ice runs the Boot RO M image, initi aliz es the hard war e, and displa ys the har d war e infor mation . Then the dev ice runs the s ystem so ft war e image, w hich pr ov ides dri ver s and[...]

Upgrade method Upgrade object Description Upgrading system software through a system reboot System software upgr ade pr ocess, and is not r ecommended. Software upgrade by installing hotfixes System software • Hotfi x is a fast , cost-effecti ve method to r epair softwar e defec ts of a s wit ch . • Com par ed w ith so ftwar e ver sion upgr ade[...]

Upgrading system software through a system reboot F ollow th ese steps t o upgr ade sy stem softwa r e thr ough a sy stem r eboot: To do… Use the command… Remarks Save the system software image to the root directory of the Flash of the switch by using FTP, TFTP, or other approaches. — Required For more information about FTP or TFTP, see the c[...]

Common patch and temporary patch • Common pat ches ar e thos e formall y releas ed through the v ersion r elease f lo w . • T empor ar y patches ar e those not for mally re leased thr ough the ve rsio n relea se flo w , but temporar ily pr ov ided to sol ve the e mer gent proble ms. Common patc hes alw ay s include the f u nctions of the pr ev [...]

Figure 43 Patches are not loaded to the memory patch area Patch 1 IDLE Patch 2 IDLE Patch 3 IDLE Patch 4 IDLE Patch 5 IDLE Patch 6 IDLE Patch 7 IDLE Patch 8 IDLE Memory patch area NOTE: The memory patch area supports up to 200 patches. DEACTIVE state P atches in the DEA CTIVE stat e have been loaded to the memor y patch ar ea but hav e not run in t[...]

Figure 45 Patches are activated Patch 1 ACTIVE Patch 2 ACTIVE Patch 3 ACTIVE Patch 4 ACTIVE Patch 5 ACTIVE Patch 6 DEACTIVE Patch 7 DEACTIVE Patch 8 IDLE Memory patch area RUNNING state After y ou conf irm the A CTI VE patc hes ar e running , the patch state becomes R UNNING and they ar e placed in the RUNNING st ate after sy stem r e boot . For th[...]

o n t h e PA TC H - F L AG . I f t h e r e i s a m a t c h , t h e s y s t e m l o a d s p a t c h e s t o o r i n s t a l l s t h e m o n t h e m e m o r y patch ar ea. The f ollow ing table de scr i bes the de fault patc h name for the s witc h ser ies. PATCH-FLAG Default patch name PATCH-311 patch_311.bin One-step patch installation T o install [...]

To do… Use the command… Remarks Activate the specified patches patch active patch-number slot slot-number Required • After you activ ate a patch, the patch takes effec t and is in the test-run stage. After the sw itch is res e t o r re b oo t e d, t h e p a t ch becomes in valid . • If yo u find that an A CTIVE patc h is of some pr oblem, r[...]

Displaying and maintaining the software upgrade To do… Use the command… Remarks Display information about system software display boot-loader [ slot slot-number ] [ | { begin | exclude | include } regular-expression ] Available in any view Display the patch information display patch information [ | { begin | exclude | include } regular-expressi[...]

[FTP-Server] local-user aaa [FTP-Server-luser-aaa] password cipher hello [FTP-Server-luser-aaa] service-type ftp [FTP-Server-luser-aaa] authorization-attribute work-directory flash:/aaa • Use t ext edit or on the FTP se rver t o edit batch f ile auto -update.txt . The f ollow ing is the content o f the batch f ile: return startup saved-configurat[...]

Hotfix configuration example Network requirements • As sho wn in Fig u r e 4 8 , the softwar e running on De vice is ha ving pr oblems, and a hotfi x is needed . • The patc h file patch_3 1 1 .bin is sa ved on th e TFTP se r ver . • The IP addr ess of De vi ce is 1 . 1 . 1 . 1/2 4 , and IP address of TFTP Server is 2 .2 .2 .2/2 4. Dev ice and[...]

Device management Dev ice management inc ludes monitor ing the oper atin g status of dev ices and conf igur ing their r unning parameter s. NOTE: The configuration tasks in this document are order in dependent. You can perform these tasks in any order. Configuring the device name A dev ice name identif ies a de vi ce in a net wor k and wor ks as th[...]

Command Effective system ti me Configuration example System time 1, 2 date-time ± zone-offset clock datetime 2:00 2007/2/2 clock timezone zone-time add 1 03:00:00 zone-time Fri 02/02/2007 2, 1 date-time clock timezone zone-time add 1 clock datetime 3:00 2007/3/3 03:00:00 zone-time Sat 03/03/2007 The original system time outside the daylight saving[...]

Command Effective system ti me Configuration example System time date-time – summer-offset outside the daylight saving time range: date-time – summer-offset clock summer-time s s one-off 1:00 2007 / 1/1 1:00 2007/8/8 2 clock datetime 1:30 2007/1/1 23:30:00 UTC Sun 12/31/2006 3, 1 ( date-time in the daylight saving time range) date-time – summ[...]

Command Effective system ti me Configuration example System time date-time in the daylight saving time range, but date-time – summer-offset outside the summer-time range: date-time – summer-offset c lock timezone zone-time add 1 clock summer-time s s one-off 1:00 2008 / 1/1 1:00 2008/8/8 2 clock datetime 1:3 0 2008/1/1 23:30:00 zone-time Mon 12[...]

To do… Use the command… Remarks Enter system view system-view — Enable displaying the copyri ght statement copyright-info enable Optional Enabled by default. Configuring banners Introduction to banners Banners ar e messages that the s ystem displa ys when a u ser connects to the dev ice to perform login authenti cation, and start inter acti v[...]

Configuration procedure F ollow th ese step s to conf igur e a banner: To do… Use the command… Remarks Enter system view system-view — Configure the incoming banner header incoming text Optional Configure the login banner header login text Optional Configure the legal banner header legal text Optional Configure the shell banner header shell t[...]

Rebooting the device Y ou can r e boot the dev ice in one of the f ollow ing wa ys to r ecov er fro m an err or condition: • Reboot the de vi c e immediatel y at the CLI. • At the CLI, schedule a r eboot to occur at a spec ifi c time and date or after a delay . • P ow er off and then r e -pow er on the dev ice . This meth od might cause data [...]

Scheduling jobs Y ou can schedule a j ob to automaticall y run a command or a set of commands w i thout administr ativ e interfer ence. T he commands in a job ar e polled every minu te. W hen the scheduled time for a command is r e ached , the j ob autom atically e xec utes the co mmand . If a confir mation is r e quir ed while the c o m m a n d i [...]

Scheduling a job in the non-modular approach P er for m one of the follo wing commands in user v iew t o sc hedule a job: To do… Use the command… Remarks Schedule a job to run a command at a specific time schedule job at time [ date ] view view command Schedule a job to run a command after a delay schedule job delay time view view command Requi[...]

T o v iew Boo t RO M accessibility statu s, use the displa y star tup command. F or more inf ormati on about the displa y startup command, see the F u ndamentals Command R efer enc e . F ollow the st ep below to disa ble Boot ROM acces s: To do… Use the command… Remarks Disable Boot ROM access undo startup bootrom-access enable Required By defa[...]

To do… Use the command… Remarks Configure temperature alarm thresholds temperature-limit slot slot-number inflow sensor-number lowerlimit warninglimit [ alarmlimit ] Optional By default : • The lo wer t emper ature limit is 5°C (4 1 ° F) . • The w arning temper ature thr eshold is 7 0°C ( 1 5 8°F) . • The A larming temper ature thr es[...]

• Displa y its electr onic label . The elec troni c label is a pro file of the tr ansceiv er module and contains the permanent conf igurati on including the ser ial number , manufac t ur ing date, and v endor name . The data is w ritten to the stor age comp onent during debugging or testing . P er for m the follo wing commands in an y vie w to ve[...]

To do… Use the command… Remarks Display the system time and date display clock [ | { begin | exclude | include } regular-expression ] Available in any view Display or save operating statistics for multiple feature modules display diagnostic-information [ | { begin | exclude | include } regular-expression ] Available in any view Display CPU usag[...]

To do… Use the command… Remarks Display the device reboot setting display schedule reboot [ | { begin | exclude | include } regular-expression ] Available in any view Display the configuration of job s configured by using the job command display job [ job-name ] [ | { begin | exclude | include } regular-expression ] Available in any view Displa[...]

Automatic configuration Automatic configuration overview Aut omatic conf igurati on enables a dev ice w ithout an y configur ation file to a utomatically obtain and ex ecut e a configur ation f ile during startup . Automati c configur ation simplif ies netw ork conf igurati on, fac ilitates centrali z ed management, and r educes maintenance wo rklo[...]

How automatic configuration works Aut omatic conf igurati on w orks in the fo llo wing manner : 1. During startup, the device sets the first up interfa c e (if up Layer 2 Ethernet inter faces are available, the VLAN interface of the default VLAN of the Ethernet interfa ces is selected as the first up interface.) as the DHCP client to request parame[...]

Using DHCP to obtain an IP address and other configuration information Address acquisition process As mentioned be for e, a dev ice sets the f irst up interface as the DHCP c lient dur ing star tup . The DHCP cli ent broadca sts a D HCP r equest , wher e the Option 5 5 fi eld specif ies the infor mation that the c lient wants to obtain f rom the DH[...]

administrator can T elnet to each de vi ce to perfor m spec ifi c configur ations (fo r exa mple, conf igur e the IP addres s of each interf ace) . • If dev ices u se differ ent confi guration f iles, y ou need to confi gure static addr ess pools to ensur e that each de vice can get a f ix ed IP address and a spec ifi c configur ation file . With[...]

Obtaining the configurati on file Figure 51 Obtain the configuration file Is the configura tio n fil e contained in the DHCP response? Obtain the n etwork intermediate fi le Search the domain name corresponding to t he IP address in the network interm ediate file Yes Obtain the sp ecified configuration file in the response Obtain the c onfiguration[...]

NOTE: After broadcasting a TFTP request, the device selects the TFTP server that responds first to obtain the configuration file. If the requested configuration fi le does not exist on the TFTP server, the request operation fails, and the device removes the temporary configuration and starts up with factory defaults. Executing the configuration fil[...]

Support and other resources Contacting HP F or wor ldw ide techni cal support infor mation , see the HP support w ebsite: http ://www .hp .com/s upport Bef or e contact ing HP , collect the follo w ing infor mation: • Pr oduct model names and n u mbers • T echnical supp ort registration number (i f applicabl e) • Pr oduct ser ial n umbers •[...]

Conventions This sec tion de scr ibes the con ventions u sed in this documentati on set . Command conventions Convention Description Boldface Bold text represents commands and keywords that you enter literally as shown. Italic Italic text represents arguments that you replace with actual values. [ ] Square br ackets enclose syntax choices (keywords[...]

Represents a generic network device, such as a router, switch, or firewall. Represents a routing-capable device, such as a router or Layer 3 switch. Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports Layer 2 forwarding and other Layer 2 features. Port numbering in examples The port number s in this document [...]

Index A B C D E F H L M N O P R S T U V W A Aut omatic conf igur ation o v ervi ew , 14 0 B Backing up the startup conf igur ation file , 1 12 C Changing the s yst em time, 12 6 Checking co mmand-line err ors, 8 Clear ing idle 1 6 -bit interf ace index es, 13 6 CLI v iew des cripti on, 2 Command co nven tions , 1 Con figu rat ion fi l e over view ,[...]

T yping commands , 5 Rebooting the de vice , 13 2 Related inf ormation , 14 6 U Re stor ing a startup c onf igurati on f ile, 1 13 Undo for m of a command, 2 S Upgrading s ystem softwar e through a s ystem re b o o t, 1 17 Sa ving the c urr ent confi g ura tion, 20 Upgr ading the Boot ROM pr ogram thr ough a sy stem re b o o t, 1 16 Sa v ing the ru[...]