Documente Academic
Documente Profesional
Documente Cultură
Copyright Huawei Technologies Co., Ltd. 2011. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd.
Notice
The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied.
Website: Email:
Issue 02 (2011-07-15)
Symbol Conventions
The symbols that may be found in this document are defined as follows. Symbol Description
DANGER
Indicates a hazard with a high level of risk, which if not avoided, will result in death or serious injury. Indicates a hazard with a medium or low level of risk, which if not avoided, could result in minor or moderate injury. Indicates a potentially hazardous situation, which if not avoided, could result in equipment damage, data loss, performance degradation, or unexpected results. Indicates a tip that may help you solve a problem or save time. Provides additional information to emphasize or supplement important points of the main text.
WARNING
CAUTION
TIP
NOTE
Issue 02 (2011-07-15)
ii
Command Conventions
The command conventions that may be found in this document are defined as follows. Convention Boldface Italic [] { x | y | ... } [ x | y | ... ] { x | y | ... }* Description The keywords of a command line are in boldface. Command arguments are in italics. Items (keywords or arguments) in brackets [ ] are optional. Optional items are grouped in braces and separated by vertical bars. One item is selected. Optional items are grouped in brackets and separated by vertical bars. One item is selected or no item is selected. Optional items are grouped in braces and separated by vertical bars. A minimum of one item or a maximum of all items can be selected. Optional items are grouped in brackets and separated by vertical bars. Several items or no item can be selected. The parameter before the & sign can be repeated 1 to n times. A line starting with the # sign is comments.
[ x | y | ... ]* &<1-n> #
Change History
Updates between document issues are cumulative. Therefore, the latest document issue contains all updates made in previous issues.
Issue 02 (2011-07-15)
iii
Contents
Contents
About This Document.....................................................................................................................ii 1 Logging In to Switch.....................................................................................................................1
1.1 Introduction........................................................................................................................................................2 1.1.1 Login Through the Console.......................................................................................................................2 1.1.2 Login Through Telnet................................................................................................................................2 1.2 Logging In to the Device Through the Console Port..........................................................................................2 1.2.1 Establishing the Configuration Task.........................................................................................................3 1.2.2 Establishing the Physical Connection........................................................................................................3 1.2.3 Configuring Terminals..............................................................................................................................4 1.2.4 Logging In to the Device...........................................................................................................................4 1.3 Logging In to Device Through Telnet................................................................................................................4 1.3.1 Establishing the Configuration Task.........................................................................................................5 1.3.2 Establishing the Physical Connection........................................................................................................5 1.3.3 Configuring Login User Parameters..........................................................................................................6 1.3.4 Logging In from the Telnet Client.............................................................................................................6 1.4 Configuration Examples.....................................................................................................................................6 1.4.1 Example for Logging In Through the Console Port..................................................................................6 1.4.2 Example for Logging In Through Telnet..................................................................................................9
2 CLI Overview...............................................................................................................................11
2.1 CLI Introduction...............................................................................................................................................12 2.1.1 Command Line Interface.........................................................................................................................12 2.1.2 Command Levels.....................................................................................................................................12 2.1.3 Command Views.....................................................................................................................................13 2.2 Online Help.......................................................................................................................................................15 2.2.1 Full Help..................................................................................................................................................16 2.2.2 Partial Help..............................................................................................................................................16 2.2.3 Error Messages of the Command Line Interface.....................................................................................17 2.3 Features of Command Line Interface...............................................................................................................17 2.3.1 Editing.....................................................................................................................................................17 2.3.2 Displaying................................................................................................................................................18 2.3.3 Regular Expressions................................................................................................................................19 2.3.4 History Commands..................................................................................................................................22 Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. iv
Contents
2.4 Shortcut Keys...................................................................................................................................................23 2.4.1 System Shortcut Keys..............................................................................................................................23 2.5 Configuration Examples...................................................................................................................................24 2.5.1 Example for Using the Tab Key..............................................................................................................24
4 Basic Configuration.....................................................................................................................36
4.1 Basic Configuration Introduction.....................................................................................................................37 4.2 Configuring the Basic System Environment....................................................................................................37 4.2.1 Establishing the Configuration Task.......................................................................................................37 4.2.2 Configuring the Equipment Name...........................................................................................................38 4.2.3 Setting the System Clock.........................................................................................................................38 4.2.4 Configuring a Header..............................................................................................................................39 4.2.5 Configuring Command Levels................................................................................................................40 4.3 Configuring Basic User Environment..............................................................................................................41 4.3.1 Establishing the Configuration Task.......................................................................................................41 4.3.2 Configuring the Password for Switching User Levels............................................................................41 4.3.3 Switching User Levels.............................................................................................................................42 4.3.4 Locking User Interfaces...........................................................................................................................43 4.4 Displaying System Status Messages.................................................................................................................43 4.4.1 Displaying System Configuration...........................................................................................................43 4.4.2 Displaying System Status........................................................................................................................44 4.4.3 Collecting System Diagnostic Information.............................................................................................44
5 User Management........................................................................................................................45
5.1 User Management Introduction........................................................................................................................46 5.1.1 User Interface..........................................................................................................................................46 Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. v
Contents
5.1.2 User Authentication.................................................................................................................................47 5.2 Logging In to the S2300 Through the Console Port.........................................................................................49 5.2.1 Establishing the Configuration Task.......................................................................................................49 5.2.2 Logging In to the S2300 Through the Console Interface........................................................................50 5.3 Configuring Console User Interface.................................................................................................................53 5.3.1 Establishing the Configuration Task.......................................................................................................53 5.3.2 Configuring Console Interface Attributes...............................................................................................54 5.3.3 Setting Console Terminal Attributes.......................................................................................................55 5.3.4 Configuring User Priority........................................................................................................................56 5.3.5 Configuring User Authentication............................................................................................................57 5.3.6 Checking the Configuration.....................................................................................................................58 5.4 Configuring VTY User Interface......................................................................................................................58 5.4.1 Establishing the Configuration Task.......................................................................................................58 5.4.2 Configuring Maximum VTY User Interfaces.........................................................................................59 5.4.3 (Optional)Configuring Limits for Incoming Calls and Outgoing Calls..................................................60 5.4.4 Configuring VTY Terminal Attributes....................................................................................................60 5.4.5 Configuring User Authentication............................................................................................................61 5.4.6 Checking the Configuration.....................................................................................................................63 5.5 Managing User Interfaces.................................................................................................................................63 5.5.1 Establishing the Configuration Task.......................................................................................................63 5.5.2 Sending Messages to Other User Interfaces............................................................................................64 5.5.3 Clearing Online User...............................................................................................................................64 5.5.4 Checking the Configuration.....................................................................................................................65 5.6 Configuring User Management........................................................................................................................65 5.6.1 Establishing the Configuration Task.......................................................................................................65 5.6.2 Configuring Authentication Mode...........................................................................................................66 5.6.3 Configuring Authentication Password.....................................................................................................66 5.6.4 Setting Username and Password for AAA Local Authentication...........................................................67 5.6.5 Configuring Non-Authentication.............................................................................................................67 5.6.6 Configuring User Priority........................................................................................................................68 5.6.7 Checking the Configuration.....................................................................................................................68 5.7 Configuration Examples...................................................................................................................................69 5.7.1 Example for Configuring Logging In to the Switch Through Password.................................................69 5.7.2 Example for Logging In to the Device Through AAA............................................................................70
Contents
6.3.2 Viewing the Current Directory................................................................................................................75 6.3.3 Switching a Directory..............................................................................................................................75 6.3.4 Displaying a Directory or File.................................................................................................................76 6.3.5 Creating a Directory................................................................................................................................76 6.3.6 Deleting a Directory................................................................................................................................76 6.4 Managing Files.................................................................................................................................................77 6.4.1 Establishing the Configuration Task.......................................................................................................77 6.4.2 Displaying Contents of Files...................................................................................................................78 6.4.3 Copying Files...........................................................................................................................................78 6.4.4 Moving Files............................................................................................................................................78 6.4.5 Renaming Files........................................................................................................................................79 6.4.6 Compressing Files...................................................................................................................................79 6.4.7 Deleting Files...........................................................................................................................................79 6.4.8 Deleting Files in the Recycle Bin............................................................................................................80 6.4.9 Undeleting Files.......................................................................................................................................80 6.4.10 Running Files in Batch..........................................................................................................................81 6.4.11 Configuring Prompt Modes...................................................................................................................81
Contents
8.3.1 Establishing the Configuration Task.......................................................................................................95 8.3.2 Enabling the FTP Server..........................................................................................................................96 8.3.3 Configuring a Basic ACL........................................................................................................................96 8.3.4 Configuring the Basic FTP ACL.............................................................................................................97 8.3.5 Checking the Configuration.....................................................................................................................97 8.4 Configuring the Switch to Be the FTP Client...................................................................................................98 8.4.1 Establishing the Configuration Task.......................................................................................................98 8.4.2 Logging In to the FTP Server..................................................................................................................99 8.4.3 Configuring Data Type and Transmission Mode for the File...............................................................100 8.4.4 (Optional) Viewing Online Help of the FTP Command.......................................................................100 8.4.5 Uploading or Downloading Files..........................................................................................................101 8.4.6 Managing Directories............................................................................................................................101 8.4.7 Managing Files......................................................................................................................................102 8.4.8 (Optional) Changing Login Users.........................................................................................................102 8.4.9 Disconnecting from the FTP Server......................................................................................................103 8.5 Configuring the Switch to Be the TFTP Client..............................................................................................103 8.5.1 Establishing the Configuration Task.....................................................................................................104 8.5.2 (Optional) Configuring a Source IP Address for a TFTP Client...........................................................104 8.5.3 Downloading Files Through TFTP........................................................................................................105 8.5.4 Uploading Files Through TFTP............................................................................................................105 8.6 Limiting the Access to the TFTP Server........................................................................................................106 8.6.1 Establishing the Configuration Task.....................................................................................................106 8.6.2 Configuring the Basic ACL...................................................................................................................106 8.6.3 Configuring the Basic TFTP ACL.........................................................................................................107 8.7 Configuration Examples.................................................................................................................................107 8.7.1 Example for Configuring the FTP Server..............................................................................................107 8.7.2 Example for Configuring an ACL of the FTP Server...........................................................................110 8.7.3 Example for Configuring the FTP Client..............................................................................................111 8.7.4 Example for Configuring the TFTP Client............................................................................................114
Contents
9.3.1 Establishing the Configuration Task.....................................................................................................123 9.3.2 Creating SSH User.................................................................................................................................124 9.3.3 Configuring SSH for the VTY User Interface.......................................................................................125 9.3.4 Generating a Local RSA Key Pair.........................................................................................................125 9.3.5 Configuring the Authentication Mode for SSH Users...........................................................................126 9.3.6 (Optional) Configuring the Basic Authentication Information for SSH Users.....................................127 9.3.7 (Optional) Authorizing SSH Users Through the Command Line.........................................................128 9.3.8 Configuring the Service Type of SSH Users.........................................................................................128 9.3.9 (Optional) Configuring the Authorized Directory of the SFTP Service for SSH Users.......................129 9.3.10 Checking the Configuration.................................................................................................................129 9.4 Configuring the SSH Server Function............................................................................................................130 9.4.1 Establishing the Configuration Task.....................................................................................................130 9.4.2 Enabling the STelnet Service................................................................................................................131 9.4.3 Enabling the SFTP Service....................................................................................................................131 9.4.4 Enabling SCP Services..........................................................................................................................131 9.4.5 (Optional) Enabling the Earlier Version - Compatible Function...........................................................132 9.4.6 (Optional) Configuring the Number of the Port Monitored by the SSH Server....................................132 9.4.7 (Optional) Configuring the Interval for Updating the Key Pair on the SSH Server..............................133 9.4.8 Checking the Configuration...................................................................................................................133 9.5 Configuring the STelnet Client Function.......................................................................................................134 9.5.1 Establishing the Configuration Task.....................................................................................................134 9.5.2 Enabling the First-Time Authentication on the SSH Client..................................................................135 9.5.3 (Optional) Assigning an RSA Public Key to the SSH Server...............................................................136 9.5.4 Enabling the STelnet Client...................................................................................................................137 9.5.5 Checking the Configuration...................................................................................................................138 9.6 Configuring the SFTP Client Function...........................................................................................................138 9.6.1 Establishing the Configuration Task.....................................................................................................138 9.6.2 Configuring the First-Time Authentication on the SSH Client.............................................................139 9.6.3 (Optional) Assigning an RSA Public Key to the SSH Server...............................................................140 9.6.4 Enabling the SFTP Client......................................................................................................................141 9.6.5 (Optional) Managing the Directory.......................................................................................................142 9.6.6 (Optional) Managing the File................................................................................................................143 9.6.7 (Optional) Displaying the SFTP Client Command Help.......................................................................144 9.6.8 Checking the Configuration...................................................................................................................145 9.7 Configuring the SCP Client............................................................................................................................146 9.7.1 Establishing the Configuration Task.....................................................................................................146 9.7.2 (Optional) Configuring a Source IP Address for the SCP Client..........................................................146 9.7.3 Copying Files.........................................................................................................................................147 9.7.4 Checking the Configuration...................................................................................................................148 9.8 Configuration Examples.................................................................................................................................148 9.8.1 Example for Configuring the Telnet Terminal Service.........................................................................148 9.8.2 Example for Configuring the PC as the STelnet Client to Connect to the SSH Server........................150 Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. ix
Contents
9.8.3 Example for Configuring the Switch as the STelnet Client to Connect to the SSH Server .................153 9.8.4 Example for Connecting the SFTP Clinet and the SSH Server.............................................................160 9.8.5 Example for Configuring the SSH Server to Support the Access from Another Port...........................165 9.8.6 Example for Authenticating SSH Through RADIUS............................................................................172 9.8.7 Example for Configuring the SCP Client..............................................................................................177
Issue 02 (2011-07-15)
1 Logging In to Switch
1
About This Chapter
Logging In to Switch
Before configuring switches, you need to log in to the switch. 1.1 Introduction You can log in to switches through console port or Telnet. 1.2 Logging In to the Device Through the Console Port This section describes how to connect a terminal to a switch through the console port to establish the configuration environment. 1.3 Logging In to Device Through Telnet This section describes how to connect a terminal to a switch through Telnet to establish the configuration environment. 1.4 Configuration Examples This section provides examples for configuring users to log in to the switch through the console port or Telnet together with the configuration flowchart. The configuration examples explain networking requirements, configuration notes, and configuration roadmap.
Issue 02 (2011-07-15)
1 Logging In to Switch
1.1 Introduction
You can log in to switches through console port or Telnet.
If the login succeeds, a command line prompt such as <Quidway> appears on the Telnet client interface. Enter a command to check the running status of the switch or to configure the switch. Enter "?" for help.
NOTE
Do not modify the IP address of the switch when you configure the switch through Telnet because the modification may terminate Telnet connection. Otherwise, set up the connection again after entering a new IP address.
Issue 02 (2011-07-15)
1 Logging In to Switch
Applicable Environment
If you log in to the switch for the first time or perform the local configuration, you need to log in to the switch through the console port.
NOTE
If you cannot log in to the switch through the telnet, you need to log in to the switch through the console port.
Pre-configuration Tasks
Before configuring login to the switch through the console port, complete the following tasks: l l Preparing the PC/terminal (including serial port and RS-232 cable) Installing terminal emulation program on the PC (such as Windows XP HyperTerminal)
Data Preparation
To login the switch through the console port, you need the following data.
NOTE
If the AAA authentication mode is configured for users to log in to the switch through the console interface, the correct user name and password must be entered for a successful login.
No. 1
Data Terminal communication parameters l Baud rate l Data bit l Parity l Stop bit l Flow-control mode
(Optional) User name and password to be entered for a successful login in AAA authentication mode
Context
Do as follows on the switch:
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 3
1 Logging In to Switch
Procedure
Step 1 Connect the COM port on the PC and the console port on the switch by a cable. Step 2 Power on all devices to perform a self-check. ----End
Context
Do as follows on the PC:
Procedure
Step 1 Run the terminal emulation program on the PC, setting the communication parameters as follows: l Baud rate: 9600 bps l Data bit: 8 l Stop bit: 1 l Parity: none l Flow control: none ----End
Context
Do as follows on the PC:
Procedure
Step 1 Press Enter until a command line prompt such as <Quidway> appears. Now the user view is displayed for you to configure the switch.
NOTE
If the AAA or Password authentication mode is configured for users to log in to the switch through the console interface, the correct user name and password must be entered for a successful login.
----End
1 Logging In to Switch
Applicable Environment
If you know the IP address of the switch, you can log in to the switch through Telnet for local or remote configuration.
Pre-configuration Tasks
Before configuring the switch through Telnet, complete the following tasks: l l Powering on devices and performing a self-check Preparing the PC (including the serial port and Ethernet crossover/direct cable)
Data Preparation
To log in to the switch through Telnet, you need the following data. No. 1 2 3 Data IP address of the PC IP address of the Ethernet interface on the switch User information accessed through Telnet: l User name l Password l Authentication mode
Prerequisite
Establishing the Physical Connection are complete.
Procedure
Step 1 Connect the switch and the PC directly or connect the switch and the PC to the network through cables. ----End
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 5
1 Logging In to Switch
Context
Do as follows on the switch:
Procedure
Step 1 Configure the authentication mode of login users. Step 2 Configure the authority limitation of login user. For details, see 5.4 Configuring VTY User Interface and 5.6 Configuring User Management. ----End
Context
Do as follows on the PC:
Procedure
Step 1 Run the Telnet program on the PC that functions as a client, and enter the IP address of the interface on the destination switch that provides the Telnet service. Step 2 Enter the user name and password in the login window. After authentication, a command line prompt such as <Quidway> appears. Now enter the configuration environment in the user view. ----End
Networking Requirements
Initialize the configuration of the switch when the switch is powered on for the first time.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 6
1 Logging In to Switch
PC
Switch
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. 3. Connect the PC and the switch through the console port. Configure the login on the PC end. Log in to the switch.
Data Preparation
To complete the configuration, you need the terminal communication parameters (including baud rate, data bit, parity, stop bit, and flow control).
Procedure
Step 1 Connect the serial port of the PC (or terminal) to the console port of the switch through a standard RS-232 cable. The local configuration environment is established. Step 2 Run the terminal emulation program on the PC. Set the terminal communication parameters to be 9600 bps, data bit to be 8, stop bit to be 1. Specify no parity and no flow control as shown from Figure 1-2 to Figure 1-4. Figure 1-2 New connection
Issue 02 (2011-07-15)
1 Logging In to Switch
Issue 02 (2011-07-15)
1 Logging In to Switch
Step 3 Power on the switch to perform a self-check and the system performs automatic configuration. When the self-check ends, you are prompted to press Enter until a command line prompt such as <Quidway> appears. Enter the command to check the running status of the switch or configure the switch. Enter "?" for help. ----End
Networking Requirements
You can log in to the switch on other network segments through the PC or other terminals to perform remote maintenance. Figure 1-5 Establishing the configuration environment through WAN
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. 3. Establish the physical connection. Configure user login parameters. Log in to the switch from the client side.
Data Preparation
To complete the configuration, you need the following data l l l IP address of the PC IP address of the Ethernet interface on the switch User information accessed through Telnet (including the user name, password, and authentication mode)
Procedure
Step 1 Connect the PC and the switch to the network.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 9
1 Logging In to Switch
Step 2 Configure login user parameters on the target switch. # Configure the login address
<Quidway> system-view [Quidway] vlan 10 [Quidway-vlan10] quit [Quidway] interface gigabitethernet 0/0/1 [Quidway-GigabitEthernet0/0/1] port link-type hybrid [Quidway-GigabitEthernet0/0/1] port hybrid pvid vlan 10 [Quidway-GigabitEthernet0/0/1] port untagged vlan 10 [Quidway-GigabitEthernet0/0/1] quit [Quidway]interface vlanif 10 [Quidway-vlanif10] ip address 202.38.160.92 255.255.0.0 [Quidway-vlanif10] quit
Step 3 Configure the client login. Run the Telnet on the PC, as shown in Figure 1-6. Figure 1-6 Running the Telnet program on the PC
Click OK. Enter the user name and password in the login window. After authentication, a command line prompt such as <Quidway> appears. Now enter the configuration environment in the user view.
NOTE
Before logging in to the switch, ensure that the PC and switch can ping each other.
----End
Issue 02 (2011-07-15)
10
2 CLI Overview
2
About This Chapter
CLI Overview
Users operate devices, that is, configure the device and perform routine maintenance, by entering command lines. 2.1 CLI Introduction The command line interface (CLI) is the common tool for running commands. 2.2 Online Help When you enter command lines or configure services, online help offers real-time help in addition to the configuration guide. 2.3 Features of Command Line Interface You can edit command lines, display command lines, use the regular expression for command lines, and invoke historical commands. 2.4 Shortcut Keys Using the system shortcut keys makes it easier to enter commands. 2.5 Configuration Examples This section provides several examples for using command lines.
Issue 02 (2011-07-15)
11
2 CLI Overview
l The system supports the command with up to 512 characters. The command can be incomplete. l The system saves the incomplete command to the configuration files in the complete form; therefore, the command may have more than 512 characters. When the system is restarted, however, the incomplete command cannot be restored. Therefore, pay attention to the length of the incomplete command.
Issue 02 (2011-07-15)
2 CLI Overview
l l
Level 1-Monitoring level: Commands of this level, including the display commands, are used for system maintenance and fault diagnosis. Level 2-Configuration level: Commands of this level are service configuration commands that provide direct network service to the user, including routing and network layer commands. Level 3-Management level: Commands of this level are commands that influence the basic operation of the system and provide support to the service. They include file system commands, FTP commands, TFTP commands, XModem downloading commands, configuration file switching commands, power supply control commands, backup board control commands, user management commands, level setting commands, system internal parameter setting commands, and debugging commands that are used for fault diagnosis.
CAUTION
Not all display commands are of the monitoring level. For example, the display currentconfiguration and display saved-configuration commands are of the management level. For the level of a command, see the Quidway S2300 Series Command Reference. To implement efficient management, you can increase the command levels to 0-15. For the increase in the command levels, refer to Chapter 4 "Basic Configuration" Configuring Command Levels in the Quidway S2300 Series Configuration Guide - Basic Configurations.
NOTE
l The default command level may be higher than the command level defined according to the command rules in application. l Login users have the same 16 levels as the command levels. The login users can use only the command of the levels that are equal to or lower than their own levels. For details of login user levels, refer to User Management.
# Type aaa in the system view, and you can enter the AAA view.
[Quidway] aaa [Quidway-aaa]
Issue 02 (2011-07-15)
13
2 CLI Overview
The prompt <Quidway> indicates the default switch name. The prompt <> indicates the user view and the prompt [] indicates other views.
Some commands that are implemented in the system view can also be implemented in the other views; however, the functions that can be implemented are command view-specific.
Common Views
The S2300 provides various command line views. For the methods of entering the command line views except the following views, see the Quidway S2300 Command Reference. l User View Item Function Entry command Prompt upon entry Quit command Prompt upon quit Description Displays the running status and statistics of the S2300. Enters the user view after the connection is set up. <Quidway> <Quidway>quit None.
System View Item Function Entry command Prompt upon entry Quit command Prompt upon quit Description Sets the system parameters of the S2300, and enters other function views from this view. <Quidway> system-view [Quidway] [Quidway] quit <Quidway>
Ethernet Interface View Fast Ethernet (FE) interface view Item Function Entry command Description Sets parameters related to FE interfaces of the S2300 and manages the FE interfaces. [Quidway] interface ethernet X/Y/Z
Issue 02 (2011-07-15)
14
2 CLI Overview
NOTE
X/Y/Z indicates the number of an FE interface that needs to be configured. It is in the format of slot number/sub card number/interface sequence number.
GE interface view Item Function Entry command Prompt upon entry Quit command Prompt upon quit Description Configures related parameters about the GE interfaces of the S2300 and manages the GE interfaces. [Quidway] interface GigabitEthernet X/Y/Z [Quidway-GigabitEthernetX/Y/Z] [Quidway-GigabitEthernetX/Y/Z] quit [Quidway]
NOTE
X/Y/Z indicates the number of a GE interface that needs to be configured. It is in the format of slot number/sub card number/interface sequence number. If an LPU provides GE interfaces and 10GE interfaces, the difference lies in the subcard where the 10GE interfaces reside. Generally, the sequence number of a 10GE interface is 1. If an LPU provides only 10GE interfaces, the method of entering the 10GE interface view is the same as the method of entering the GE interface view.
Context
The command line of S2300 provides three types of online help: l
Issue 02 (2011-07-15)
Full help
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 15
2 CLI Overview
l l
Enter a command and a ? separated by a space. If a keyword is in place of the ?, all keywords and their descriptions are listed. Here is an example.
[Quidway-ui-vty0] authentication-mode ? aaa AAA authentication none Login without checking password Authentication through the password of a user terminal interface [Quidway-ui-vty0] authentication-mode aaa ? <cr> [Quidway-ui-vty0] authentication-mode aaa
aaa, none and password are keywords. AAA authentication, Login without checking and Authentication through the password of a user terminal interface are the descriptions of the two keywords. <cr> indicates that no key word or parameter is in this position and you can press Enter to repeat the command in the next command line. l Enter a command and a ? separated by a space. If a parameter is in place of the ?, all parameters and their descriptions are listed. Here is an example.
<Quidway> system-view [Quidway] sysname ? TEXT Host name(1 to 246 characters)
Context
You can obtain the partial help of the command line in the following ways.
Procedure
l Enter a character string with a "?" closely following it to display all commands that begin with this character string.
<Quidway> d? debugging dir delete display
Enter a command and a character string with "?" closely following it to display all the key words that begin with this character string.
<Quidway> display b?
Issue 02 (2011-07-15)
16
2 CLI Overview
Enter the first several letters of a key word in the command and then press Tab to display the complete key word on the condition that the letters uniquely identify the key word. Otherwise, if you continue to press Tab, different key words are displayed. You can select the needed key word.
----End
2.3.1 Editing
The editing function of command lines helps you edit command lines or obtain help by using certain keys. The command line supports multi-line edition. The maximum length of each command is 512 characters. Keys for editing that are often used are shown in Table 2-2.
Issue 02 (2011-07-15)
17
2 CLI Overview
Table 2-2 Keys for editing Key Common key Function Inserts a character in the current position of the cursor if the editing buffer is not full and the cursor moves to the right. Otherwise, an alarm is generated. Deletes the character on the left of the cursor that moves to the left. When the cursor reaches the head of the command, an alarm is generated. Moves the cursor to the left by the space of a character. When the cursor reaches the head of the command, an alarm is generated. Moves the cursor to the right by the space of a character. When the cursor reaches the end of the command, an alarm is generated. Press Tab after typing the incomplete key word and the system runs the partial help: l If the matching key word is unique, the system replaces the typed one with the complete key word and displays it in a new line with the cursor a space behind. l If there are several matches or no match at all, the system displays the prefix first. Then you can press Tab to view the matching key word one by one. In this case, the cursor closely follows the end of the word and you can type a space to enter the next word. l If a wrong key word is entered, press Tab and the word is displayed in a new line.
Backspace
2.3.2 Displaying
All command lines have the same displaying feature. You can construct the displaying mode as required. You can control the display of information on CLI as follows: l l Display prompt and help information in both Chinese and English. When the information displayed exceeds a full screen, it provides the pause function. In this case, the user has three choices as shown in Table 2-3.
Table 2-3 Keys for displaying Key Ctrl_C Function Stops the display and running of the command.
NOTE You can also press any of the keys except the spacebar and Enter key to stop the display and running of the command.
Space
Issue 02 (2011-07-15)
2 CLI Overview
Key Enter
Defines an escape character, which is used to mark the next character (common or particular) as the common character. Matches the starting position of the string. Matches the ending position of the string.
\* matches "*".
^ $
Issue 02 (2011-07-15)
19
2 CLI Overview
Particul ar characte r *
Syntax
Example
10* matches "1", "10", "100", and "1000". (10)* matches "null", "10", "1010", and "101010".
10+ matches "10", "100", and "1000". (10)+ matches "10", "1010", and "101010".
Matches the preceding element zero or one time. Matches any single character.
10? matches "1" and "10". (10)? matches "null" and "10". 0.0 matches "0x0" and "020". .oo matches "book", "look", and "tool".
()
Defines a subexpression, which can be null. Both the expression and the subexpression should be matched. Matches x or y.
100(200)+ matches "100200" and "100200200". 100|200 matches "100" or "200". 1(2|3)4 matches "124" or "134", instead of "1234", "14", "1224", and "1334".
x|y
Matches any single character in the regular expression. Matches any character that is not contained within the brackets. Matches any character within the specified range. Matches any character beyond the specified range. Matches a comma "," left brace "{", right brace "}", left parenthesis "(", and right parenthesis ")". Matches the starting position of the input string. Matches the ending position of the input string. Matches a space.
[123] matches the character 2 in "255". [^123] matches any character except for "1", "2", and "3". [0-9] matches any character ranging from 0 to 9. [^0-9] matches all non-numeric characters. _2008_ matches "2008", "space 2008 space", "space 2008", "2008 space", ",2008,", "{2008}", "(2008)", "{2008", and "(2008}".
Issue 02 (2011-07-15)
20
2 CLI Overview
Unless otherwise specified, all characters in the preceding table are displayed on the screen.
Degeneration of particular characters Certain particular characters, when being placed at the following positions in the regular expression, degenerate to common characters. The particular characters following "\" is transferred to match particular characters themselves. The particular characters "*", "+", and "?" placed at the starting position of the regular expression. For example, +45 matches "+45" and abc(*def) matches "abc*def". The particular character "^" placed at any position except for the start of the regular expression. For example, abc^ matches "abc^". The particular character "$" placed at any position except for the end of the regular expression. For example, 12$2 matches "12$2". The right bracket such as ")" or "]" being not paired with its corresponding left bracket "(" or "[". For example, abc) matches "abc)" and 0-9] matches "0-9]".
NOTE
Unless otherwise specified, degeneration rules are applicable when preceding regular expressions serve as subexpressions within parentheses.
Combination of common and particular characters In actual application, a regular expression combines multiple common and particular characters to match certain strings.
CAUTION
The Quidway S2300 Series uses a regular expression to implement the filtering function of the pipe character. A display command supports the pipe character only when there is excessive output information. When the output information is queried according to the filtering conditions, the first line of the command output starts with the information containing the regular expression. The command can carry the parameter | count to display the number of matching entries. The parameter | count can be used together with other parameters. For the commands supporting regular expressions, the three filtering methods are as follows: l l l | begin regular-expression: displays the information that begins with the line that matches regular expression. | exclude regular-expression: displays the information that excludes the lines that match regular expression. | include regular-expression: displays the information that includes the lines that match regular expression.
NOTE
Issue 02 (2011-07-15)
21
2 CLI Overview
Display the last history command if there is an earlier history command. Otherwise, a bell is generated. Display the next history command if there is a later history command. Otherwise, the command is cleared and a bell is generated.
NOTE
On the HyperTerminal of Windows 9X, cursor key is invalid as the HyperTerminals of Windows 9X define the keys differently. In this case, you can replace the cursor key with Ctrl_P.
When you use the history commands, note the following: l l The saved history commands are the same as that those entered by users. For example, if the user enters an incomplete command, the saved command also is incomplete. If the user runs the same command several times, the earliest command is saved. If the command is entered in different forms, they are considered as different commands. For example, if the display ip routing-table command is run several times, only one history command is saved. If the disp ip routing command and the display ip routing-table command are run, two history commands are saved.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 22
2 CLI Overview
Different terminal software defines these keys differently. Therefore, the shortcut keys on the terminal may be different from those listed in this section.
Table 2-6 System-defined shortcut keys Key CTRL_A CTRL_B CTRL_C CTRL_D CTRL_E CTRL_F CTRL_H CTRL_K CTRL_N CTRL_P CTRL_R CTRL_T CTRL_V CTRL_W CTRL_X CTRL_Y CTRL_Z CTRL_] ESC_B ESC_D
Issue 02 (2011-07-15)
Function The cursor moves to the beginning of the current line. The cursor moves to the left by the space of a character. Terminates the running function. Deletes the character where the cursor lies. The cursor moves to the end of the current line. The cursor moves to the right by the space of a character. Deletes one character on the left of the cursor. Stops the creation of the outbound connection. Displays the next command in the history command buffer. Displays the previous command in the history command buffer. Repeats the display of the information of the current line. Terminates the outbound connection. Pastes the contents on the clipboard. Deletes a character string or character on the left of the cursor. Deletes all the characters on the left of the cursor. Deletes all the characters on the right of the cursor. Returns to the user view. Terminates the inbound or redirection connections. The cursor moves to the left by the space of a word. Deletes a word on the right of the cursor.
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 23
2 CLI Overview
Function The cursor moves to the right to the end of next word. The cursor moves downward to the next line. The cursor moves upward to the previous line.
Procedure
l If only one keyword contains the incomplete keyword, do as follows on the S2300. 1. 2. Enter an incomplete keyword.
[Quidway] info-
Press Tab. The system replaces the incomplete keyword with a complete keyword and displays the complete keyword in another line. There is only one space between the cursor and the end of the keyword.
[Quidway] info-center
If more than one keyword contains the incomplete keyword, do as follows on the S2300. # The keyword info-center can be followed by the following keywords.
[Quidway] info-center log? logbuffer loghost
1. 2.
Press Tab. The system displays the prefix of all the matched keywords. The prefix in this example is log.
[Quidway] info-center log
3.
Continue to press Tab to display all the keywords. There is no space between the cursor and the end of the keywords.
[Quidway] info-center loghost [Quidway] info-center logbuffer
Stop pressing Tab when you find the required keyword logbuffer.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 24
2 CLI Overview
4. ----End
Issue 02 (2011-07-15)
25
3
About This Chapter
This chapter describes the concept of the interface and the basic configuration about the interface. 3.1 Introduction to Interfaces This section describes different types of interfaces. The interfaces are provided by the S2300 to receive and send data. 3.2 Setting Basic Parameters of an Interface This section describes how to set the basic parameters of an interface. 3.3 Configuring the Loopback Interface This section describes how to configure the loopback interface. 3.4 Maintaining the Interface This section describes how to maintain the interface.
Issue 02 (2011-07-15)
26
A physical interface is sometimes called a port. Both physical interfaces and logical interfaces are called interfaces in this document.
Management Interface
Management interfaces are used to manage and configure a device. You can log in to the S2300 through a management interface to configure and manage the S2300. Management interfaces do not transmit service data. The management interface of the S2300 is a console interface. Table 3-1 Description of management interfaces Name Console interface Description The console interface complies with the EIA/TIA-232 standard and the interface type is DCE. Usage The console interface is connected to the COM series port of a configuration terminal. It is used to set up the onsite configuration environment.
The following table shows the rule for numbering management interfaces. Table 3-2 Management interface numbers Name Console interface Number Console 0
l l l
Slot ID: indicates the slot where an interface is located. The value is 0. Subcard ID: indicates the subcard where an interface is located. The value is 0. Interface sequence number: indicates the sequence number of an interface.
In a stack system, interfaces are numbered in the format stack ID/subcard ID/interface sequence number. l l l Stack ID: indicates the ID of an S2300 in the stack system. The value ranges from 1 to 16. Subcard ID: indicates the ID of a subcard. The value is 0. Interface sequence number: indicates the sequence number of an interface on the S2300.
Description The S2300 has two rows of service interfaces with the lower-left interface numbered 1. The other interfaces are numbered in ascending order from bottom to up, and then from left to right. For example, the upper-left interface numbered 0/0/2.
Physical Interfaces
Physical interfaces are interfaces that actually exist on the S2300. Physical interfaces include management interfaces and service interfaces. The S2300 supports the following physical interfaces: l l l l Console interface Eth interface Fast Ethernet interface Gigabit Ethernet interface
Logical Interfaces
Logical interfaces do not exist and are set up by configurations. The S2300 supports the following logical interfaces: l Eth-Trunk The Eth-Trunk consists of Ethernet links only. The Eth-Trunk technique has the following advantages: Increased bandwidth: The bandwidth of an Eth-Trunk is the total bandwidth of all member interfaces. Improved reliability: When a link fails, traffic is automatically switched to other available links. This ensures link reliability.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 28
For details about the Eth-Trunk configuration, see "Configuring the Eth-Trunk" in the Quidway S2300 Series Ethernet Switches Configuration Guide - Ethernet. l Loopback interface A loopback interface is a virtual interface. The TCP/IP protocol suite defines IP address 127.0.0.0 as a loopback address. When the system starts, it automatically creates an interface using the loopback address 127.0.0.1 to receive all data packets sent to the local device. Some applications need a local interface with a specified IP address without affecting the configuration of physical interfaces. This IP address has a 32-bit mask (to save IP addresses) and can be advertised by routing protocols. The status of a loopback interface is always Up; therefore, the IP address of the loopback interface can be used as the router ID, the label switching router (LSR) ID, or be land to a tunnel. For details, see 3.3 Configuring the Loopback Interface. l Null interface Null interfaces are similar to null devices supported by certain operating systems. Any data packets sent to a null interface are discarded. Null interfaces are used for route selection and policy-based routing (PBR). For example, if a packet matches no route during route selection, the packet is sent to the null interface. l VLANIF interface When the S2300 needs to communicate with devices at the network layer, you can create a logical interface of the Virtual Local Area Network (VLAN) on the S2300, namely, a VLANIF interface. You can assign IP addresses to VLANIF interfaces because VLANIF interfaces work at the network layer. The S2300 then communicates with devices at the network layer through VLANIF interfaces. For details about the configuration, see "Configuring the VLANIF Interface" in the Quidway S2300 Series Ethernet Switches Configuration Guide - Ethernet.
Applicable Environment
To facilitate the configuration and maintenance of an interface, the S2300 provides interface views. The commands related to the interface are valid only in the interface views. The basic interface configurations include entering an interface view, configuring interface description, enabling an interface, and disabling an interface.
Pre-configuration Tasks
Installing the LPU on the S2300
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 29
Data Preparation
To set parameters of an interface, you need the following data. No. 1 2 Data Type and number of the interface to be configured Description of the interface
Context
Do as follows on the S2300.
Procedure
Step 1 Run:
system-view
The view of a specified interface is displayed. interface-type specifies the type of the interface and interface-number specifies the number of the interface. ----End
Context
Do as follows on the S2300.
Procedure
Step 1 Run:
system-view
Step 3 Run:
?
All the commands in the view of the specified interface are displayed. ----End
Procedure
Step 1 Run:
system-view
Context
NOTE
l A null interface is always Up and cannot be shut down by command. l A loopback interface is always Up and cannot be shut down by command.
Procedure
l Shutting down the interface Do as follows on the S2300. 1. Run:
system-view
Issue 02 (2011-07-15)
31
Context
When you access a network through an interface, you need to further setting multiple parameters of the interface based on the networking requirements in addition to performing basic configurations on the interface. Further configurations of an interface include: l l Configuring the operation mode of an interface Configuring routes
For the detailed Configuration, please see the other configuration manuals of S2300. For the detailed Configuration, please see Quidway S2300 Series Ethernet Switches Configuration Guide - Ethernet and Quidway S2300 Series Ethernet Switches Configuration Guide - IP Routing.
Procedure
Step 1 Run the display interface [ interface-type [ interface-number ] ] command to check the running status of the interface and the statistics on the interface. Step 2 Run the display interface description command to check the brief information about the interface Step 3 Run the display ip interface [ interface-type interface-number ] command to check the main configurations of the interface. Step 4 Run the display ip interface brief [ interface-type interface-number ] command to check the brief state of the interface. ----End
Applicable Environment
Some applications need to be configured with a local interface with a specified IP address when the configuration of a physical interface is not affected. In this case, the IP address of the local interface needs to be advertised by routing protocols. Loopback interfaces are used to improve the reliability of the configuration.
Pre-configuration Tasks
Before configuring the loopback interface, complete the following task: l Switching on the S2300
Data Preparation
To configure the loopback interface, you need the following data. No. 1 2 Data Number of the loopback interface IP address of the loopback interface
Procedure
Step 1 Run:
system-view
A loopback interface is created. The value of interface-number ranges from 0 to 1023. A maximum of 1024 loopback interfaces can be created. Step 3 Run:
ip address ip-address { mask | mask-length } [ sub ]
The loopback interface is configured to check the source IPv4 addresses of packets. ----End
Procedure
Step 1 Run the display interface loopback [ number ] command to check the status of the loopback interface. ----End
Procedure
Step 1 Run the reset counters interface [ interface-type [ interface-number ] ] command in the user view to clear the statistics on the interface. ----End
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 34
Context
CAUTION
Debugging affects the performance of the system. So, after debugging, run the undo debugging all command to disable it immediately. For the description about debugging commands, see the Quidway S2300 Series Ethernet Switches Debugging Reference. For details about debugging commands on an interface, see the following chapters.
Issue 02 (2011-07-15)
35
4 Basic Configuration
4
About This Chapter
Basic Configuration
This chapter describes how to configure the basic system environment and the basic user environment. 4.1 Basic Configuration Introduction This section describes the meaning and scope of the basic configuration. 4.2 Configuring the Basic System Environment This section describes how to configure the basic system environment according to user habits or the requirements of the actual environment. 4.3 Configuring Basic User Environment This section describes the configuration of the basic user environment for user level switching. 4.4 Displaying System Status Messages This section describes the display commands that are used for displaying basic system configurations.
Issue 02 (2011-07-15)
36
4 Basic Configuration
Applicable Environment
Before configuring the services, you need to configure the basic system environments to meet the requirements of the actual environments. By default, the S2300 supports commands of Level 0 to Level 3, namely, visit level, monitoring level, configuration level, and management level. If the user needs to define more levels, or refine management privileges on the device, the user can extend the range of command line level from the range of Level 0 to Level 3 to the range of Level 0 to Level 15.
Pre-configuration Tasks
Before configuring basic system environment, complete the following task: l Powering on the switch
Data Preparation
To configure basic system environment, you need the following data. No. 1 2
Issue 02 (2011-07-15)
4 Basic Configuration
No. 3 4
Context
Do as follows on the switch:
Procedure
Step 1 Run:
system-view
The equipment name is set. You can change the name of the switch that appears in the command prompt. By default, the host name of the switch is Quidway. ----End
Context
You need to set the system time properly to ensure the cooperation between the S2300 and other devices. The S2300 supports the configurations of the time zone and the daylight saving time.
NOTE
Procedure
Step 1 Run:
clock datetime HH:MM:SS YYYY-MM-DD
Issue 02 (2011-07-15)
38
4 Basic Configuration
The time zone is set. l If add is configured, the current time is the UTC time plus the time offset. That is, the default UTC time plus offset is equal to the time of time-zone-name. l If minus is configured, the current time is the UTC time minus the time offset. That is, the default UTC time minus offset is equal to the time of time-zone-name. Step 3 Run:
clock daylight-saving-time time-zone-name one-year start-time start-date end-time end-date offset
or
clock daylight-saving-time time-zone-name repeating start-time { { first | second | third | fourth | last } weekday month | start-date } end-time { { first | second | third | fourth | last } weekday month | end-date } offset [ start-year [ end-year ] ]
The daylight saving time is set. During the configuration of the daylight saving time, you can configure the start time and end time in one of the following modes: date+date, week+week, date+week, and week+date. For details, see clock daylight-saving-time.
NOTE
When the current time is within the daylight saving time, running the clock timezone time-zone-name { add | minus } offset command can successfully set the time zone name. If the display clock command is run to view the time zone name at the moment, the time zone name, however, is displayed as the name of the daylight saving time. After the daylight saving time ends, the set time zone name can be displayed.
----End
Context
Do as follows on the switch:
Procedure
Step 1 Run:
system-view
4 Basic Configuration
The header displayed after login is set. A header is a system prompt displayed when a user logs in to the switch or starts interactive configuration with the switch. The header provides detailed instruction.
NOTE
l If a user logs in to the switch by using SSH1.X, the login header is not displayed during login, but the shell header is displayed after login. l If a user logs in to the switch by using SSH2.0, both login and shell headers are displayed.
----End
Context
If the user does not adjust a command level separately, after the command level is updated, all originally-registered command lines adjust automatically according to the following rules: l l l The commands of Level 0 and Level 1 remain unchanged. The command Level 2 is updated to Level 10 and Level 3 is updated to Level 15. No command lines exist in Level 2 to Level 9 and Level 11 to Level 14. The user can adjust the command lines to these levels separately to refine the management of privilege.
NOTE
The updation of command Level 2 to Level 10 and Level 3 to Level 15 is not a two-step process but onestep by batch.
Procedure
Step 1 Run:
system-view
Update the command level in batch. When no password is configured for a Level 15 user, the system prompts the user to set a superpassword for the level 15 user. At the same time, the system asks if the user wants to continue to update the command line level. Then, just select "N" to set a password. If you select "Y", the command level can be updated in batch directly. This results in the user not logging in through the Console port and failing to update the level. Step 3 Run:
command-privilege level level view view-name command-key
Issue 02 (2011-07-15)
40
4 Basic Configuration
The command level is configured. With the command, you can specify the level and view multiple commands at one time (command-key). All commands have default command views and levels. You need not reconfigure them. ----End
Applicable Environment
The user can log in to a switch with lower level to perform simple configurations or view configurations. When the configuration is complicated, the user needs to switch to a high level. Thus, it requires the user to configure the basic environment for switching levels.
Pre-configuration Tasks
Before configuring the basic environment for the user, complete the following task: l Powering on the switch properly
Data Preparation
To configure the basic environment for the user, you need the following data: No. 1 Data Password for the user level switching
Context
When users log in to the switch with a lower user level, they switch to a higher user level to perform advanced operations by entering the corresponding password. The password needs to be configured in advance.
Issue 02 (2011-07-15)
41
4 Basic Configuration
CAUTION
When simple is used, the password is saved in the configuration files in simple text. Login users with lower level can obtain the password by viewing the configuration. This may cause security problems. Therefore, cipher is used to save the password in encrypted text. If the pass word is set in cipher mode, the password cannot be resumed from the system. Save the password to avoid oblivion or miss. Do as follows on the switch:
Procedure
Step 1 Run:
system-view
Context
An accurate password must be entered when the user is switched from a lower level to a higher level. Do as follows on the switch:
Procedure
Step 1 Run:
super [ level ]
User levels are switched. Step 2 Follow the prompt and enter a password. If the password entered is correct, the user can switch to a higher level. If the user enters a password incorrectly for three consecutive times, the user remains at the current login level and returns to the user view.
NOTE
When the login user of lower level is switched to the user of higher level through the super command, the system automatically sends trap messages and records the switchover in a log. When the switched level is lower than that of the current level, the system only records the switchover in a log.
----End
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 42
4 Basic Configuration
Context
When you leave the operation terminals for a moment, you can lock the user interface to prevent unauthorized users from operating the interface. Do as follows on the switch:
Procedure
Step 1 Run:
lock
The user interface is locked. Step 2 Follow the system prompt and input an unlock password, and then confirm.
<Quidway> lock Enter Password: Confirm Password:
If the locking is successful, the system prompts that the user interface is locked. You must enter a correct password to unlock the user interface. ----End
Context
You can use the display commands to collect information about the system status. The display commands are classified according to the following functions: l l l l Displays system configurations. Displays the running status of the system. Displays the diagnostic information about a system. Displays the restart information about the main control board.
See the related sections for display commands for protocols and interfaces. The following only shows the system display commands. Run the following commands in any view.
4 Basic Configuration
Prerequisite
Basic Configuration are complete.
Procedure
l l l l Run the display version command to display the system version. Run the display clock command to display the system time. Run the display saved-configuration command to display the original configuration. Run the display current-configuration command to display the current configuration.
----End
Prerequisite
Basic configuration are complete.
Procedure
l Run the display this command to display the configuration of the current view. ----End
Context
Basic configuration is complete.
Procedure
Step 1 Run:
display diagnostic-information [ file-name ]
The system diagnosis information is displayed. When the system fails or performs the routine maintenance, you need to collect a lot of information to locate faults. Then, you have to run different display commands to collect all information. In this case, you can use the display diagnostic-information command to collect all information about the current running modules in the system. The display diagnostic-information command collects all information collected by running the following commands, including display clock, display version, display cpu-usage, display interface, display current-configuration, display saved-configuration, display historycommand, and so on. ----End
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 44
5 User Management
5
About This Chapter
User Management
This chapter describes user interfaces and the configuration of users' login. 5.1 User Management Introduction This section describes basic concepts of user interfaces and user management. 5.2 Logging In to the S2300 Through the Console Port This section describes how to log in to the S2300 through the console port. 5.3 Configuring Console User Interface You can configure the console user interface so as to maintain a switch on the local device. 5.4 Configuring VTY User Interface You can configure the VTY user interface to maintain a remote switch. 5.5 Managing User Interfaces You need to configure user management to ensure that the operator manages switchs safely. 5.6 Configuring User Management Through user management, you can create users for switchs, set user passwords, and manage users. 5.7 Configuration Examples This section provides examples for configuring users to log in to a switch in different modes. These configuration examples explain networking requirements, configuration roadmap, and configuration notes.
Issue 02 (2011-07-15)
45
5 User Management
VTY
Issue 02 (2011-07-15)
46
5 User Management
In the figure, console 0 and 0 indicate the same user interface; vty1 and 35 indicate the same user interface.
NOTE
Issue 02 (2011-07-15)
47
5 User Management
Description Logs in to the S2300 through the Ethernet interface using Telnet and have limited rights. A Telnet connection is set up between the user terminal and the S2300. Logs in to the S2300 through the Ethernet interface using SSH and have limited rights. An SSH connection is set up between the user terminal and the S2300. Logs in to the S2300 through FTP on the Ethernet interface and have limited rights. An FTP connection is set up between the user terminal and the S2300.
Authentication Recommended
SSH users
Recommended
FTP users
Recommended
The rights that can be obtained by users logging in to the S2300 through Telnet, SSH, and FTP depend on the priorities of the user interfaces through which they log in to. The S2300 provides multiple services for a user. To ensure login convenience and security, login users must be classified, and then assigned levels.
Priorities of Users
The system manages super users and Telnet users according to user levels. Similar to the command levels, users are classified into 16 levels numbered 0 to 15. The greater the number, the higher the user level.
NOTE
If the user levels are not set, the four default user levels are used, namely, levels 0 to 3.
The level of the command that a user can run is determined by the level of this user. l l In the case of non-authentication or password authentication, the level of the command that the user can run depends on the level of the user interface. In the case of AAA authentication, the command that the user can run depends on the level of the local user specified in AAA configuration.
Users of a level can access the commands of this level or lower levels. Assuming that user levels 0 to 3 are used in the system, users of level 2 can access commands of levels 0, 1, and 2, and users of level 3 can access commands at all levels.
Issue 02 (2011-07-15)
48
5 User Management
Table 5-3 Authentication modes of login users Authenticatio n Mode Nonauthentication Password authentication AAA authentication Description Users can log in to the S2300 without entering the user name and password. There is a great potential security risk. Users can log in to the S2300 by entering only the password. In this manner, security is ensured. Users need to enter both the user name and password to log in to the S2300. The S2300 then authenticates the users according to the configured user information. This further improves security. It applies to the users logging in to the S2300 through the console interface and Telnet users.
Console interface
PC
Switch
NOTE
If the S2300 is switched on for the first time and you need to manage and configure the S2300, you can log in to the S2300 through the console interface only.
Pre-configuration Tasks
Before logging in to the S2300 through the console interface, complete the following tasks: l l Connecting the PC and the S2300 correctly Starting the S2300 normally
Data Preparation
None.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 49
5 User Management
Procedure
Step 1 Enable the HyperTerminal on the PC. Choose Start > All Programs > Accessories > Communications > HyperTerminal to start the HyperTerminal. Step 2 Set up a new connection. As shown in Figure 5-3, enter the name of the new connection in the Name text box and choose an icon. Click OK. Figure 5-3 Setting up a new connection
Step 3 Set the connection port. After entering the Connect window as shown in Figure 5-4, select a serial port from the Connect drop-down list box according to the port used by the PC or the configuration terminal. Select COM1 in this case, and click OK.
Issue 02 (2011-07-15)
50
5 User Management
Step 4 Set communication parameters. After entering the COM1 Properties window as shown in Figure 5-5, set the communication parameters according to the description in Table 5-4.
NOTE
In other Windows operating systems, Bits per second may be described as Baud rate; Flow control may be described as Traffic control.
Issue 02 (2011-07-15)
51
5 User Management
Table 5-4 Communication parameters Parameter Bit per second (Baud rate) Data bit Parity check Stop bit Flow control (Traffic control) Value 9600 8 None 1 None
Step 5 After the HyperTerminal is started, select File Attributes to enter the Connect Properties window as shown in Figure 5-6. Choose the Setting tab, select Auto detect or VT100 from the Emulation drop-down list box. Click OK to complete the setting.
Issue 02 (2011-07-15)
52
5 User Management
After the preceding steps are complete, press Enter. If the prompt <Quidway> is displayed, it indicates that you have logged in to the S2300. At this time, you can enter the command to configure and manage the S2300. ----End
Applicable Environment
A console user interface is required for maintaining the local switch.
Pre-configuration Tasks
Before configuring a console interface, complete the following tasks:
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 53
5 User Management
l l
Data Preparation
To configure a console interface, you need the following data. No. 1 2 Data Baud rate, flow-control mode, parity, stop bit, and data bit Idle timeout period, number of lines displayed in a terminal screen, number of characters in each line displayed in a terminal screen,and the size of history command buffer User priority User authentication method, user name, and password
3 4
NOTE
All the configuration items of the switch, excluding the user name and password, have default values and do not need to be configured additionally.
Context
Do as follows on the switch that the user logs in to:
Procedure
Step 1 Run:
system-view
The baud rate is set. By default, the baud rate is 9600 bit/s. Step 4 (Optional) Run:
flow-control { hardware | none | software }
Issue 02 (2011-07-15)
54
5 User Management
The flow control mode is set. By default, the flow-control mode is none. Step 5 (Optional) Run:
parity { even | mark | none | odd | space }
The parity mode is set. By default, the value is none. Step 6 (Optional) Run:
stopbits { 1.5 | 1 | 2 }
The stop bit is set. By default, the value is 1 bit. Step 7 (Optional) Run:
databits { 5 | 6 | 7 | 8 }
When the user logs in to a switch through a console port, the configured attributes for the console port on the HyperTerminal should be in accordance with the attributes of the interface on the switch. Otherwise, the user cannot log in to the switch.
----End
Context
Do as follows on the switch to which a user logs in:
Procedure
Step 1 Run:
system-view
Issue 02 (2011-07-15)
55
5 User Management
The timeout period for idle users is set. By default, the timeout period for idle users is 10 minutes. Step 5 Run:
screen-length screen-length
The number of lines to be displayed on each screen is set. By default, a terminal displays 24 lines on each screen. You can run the screen-length screen-length temporary command to specify the number of lines that a terminal displays on each screen. Step 6 Run:
screen-width screen-width
The maximum number of characters in each line displayed on a terminal screen is set. By default, each line displayed on a terminal screen has a maximum of 80 characters. Step 7 Run:
history-command max-size size-value
The buffer of the history command is set. By default,the history command buffer on a user interface can cache a maximum of 10 commands. ----End
Context
Do as follows on the switch that the user logs in to:
Procedure
Step 1 Run:
system-view
The priority of the user is set. This process is to set the priority for a user who logs in through the console port. A user can only use the command of the level corresponding to the user level.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 56
5 User Management
For more information about the command priority, see "Command Level" in Chapter 3 "CLI Overview". ----End
Procedure
l Configuring AAA Authentication 1. Run:
system-view
Name and password of the local user are created. l Configuring Password Authentication 1. Run:
system-view
5 User Management
Prerequisite
The configurations of the User Management function are complete.
Procedure
l l l l Run the display users [ all ] command to check information about user interface. Run the display user-interface console ui-number1 [ summary ] command to check physical attributes and configurations of the user interface. Run the display local-user command to check the local user list. Run the display access-user command to check online users.
----End
Applicable Environment
If you want to log in to the switch using Telnet or SSH to perform management or configuration operations, .a VTY interface is required.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 58
5 User Management
Pre-configuration Tasks
Before configuring a VTY user interface, complete the following tasks: l l Powering on the switch Connecting a PC to the switch correctly
Data Preparation
To configure a VTY user interface, you need the following data. No. 1 2 3 Data Maximum VTY user interfaces (Optional) Number of the ACL for limiting incoming and outgoing calls of users logging in using VTY user interfaces Timeout period for idle users, maximum number of lines to be displayed on each screen , maximum number of characters in each line, and the size of the history command buffer User authentication mode, user name, and password
Context
Do as follows on the switch that the user logs in to:
Procedure
Step 1 Run:
system-view
The maximum VTY user interfaces that can log in to the switch is set.
NOTE
When the maximum number of VTY user interfaces is set to zero, any user including the NMS user cannot log in to a switch.
If the maximum number of VTY user interfaces to be configured is smaller than the maximum number of current interfaces, other parameters need not be configured.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 59
5 User Management
If the maximum number of VTY user interfaces to be configured is larger than the maximum number of current interfaces, the authentication mode and password need to be configured for newly added user interfaces. For newly added user interfaces, the system applies password authentication by default. For example, a maximum of five users are allowed online. To allow 15 VTY users online at the same time, you need to run the authentication-mode command and the set authentication password command to configure authentication modes and passwords for user interfaces from VTY 5 to VTY 14. The command is run as follows:
<Quidway> system-view [Quidway] user-interface maximum-vty 15 [Quidway] user-interface vty 5 14 [Quidway-ui-vty5-14] authentication-mode password [Quidway-ui-vty5-14] set authentication password cipher huawei
----End
Context
Do as follows on the switch that the user logs in to:
Procedure
Step 1 Run:
system-view
The limits to calling in/out of VTY are configured. When you need to prevent a user of certain address or segment address from logging in to the switch, use the inbound command; when you need to prevent a user who logs in to a switch from accessing other switchs, use the outbound command. ----End
5 User Management
Context
Do as follows on the switch:
Procedure
Step 1 Run:
system-view
The maximum number of lines to be displayed on each screen is set. By default, a maximum of 24 lines are displayed on each screen. You can run the screen-length screen-length temporary command to specify the maximum number of lines to be temporarily displayed on each terminal screen. Step 6 Run:
screen-width screen-width
The maximum number of characters in each line displayed on a terminal screen is set. By default, each line displayed on a terminal screen has a maximum of 80 characters. Step 7 Run:
history-command max-size size-value
The size of the history command buffer is set. By default, the history command buffer on a user interface can cache a maximum of 10 commands. ----End
Context
The switch supports user authentication of three types:
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 61
5 User Management
l l l
AAA authentication: requires the user name and password. Password authentication: requires no user name but a password must be set. Otherwise, the user can log in to the switch only through the console interface. None: requires neither user name nor password. No authentication is needed when the user logs in to the switch.
Procedure
l Configuring AAA Authentication 1. Run:
system-view
Name and password of the local user are created. l Configuring Password Authentication 1. Run:
system-view
5 User Management
Prerequisite
The configuration of VTY User Interface are complete.
Procedure
l l l Run the display users [ all ] command to check the usage information of the user interface. Run the display user-interface maximum-vty command to check the number of maximum VTY user interfaces. Run the display user-interface [ [ ui-type ] ui-number1 | ui-number ] [ summary ] command to check the physical attributes and configurations of the user interface.
----End
Applicable Environment
To ensure that the operator managesswitchs safely, you need to send messages between user interfaces and clear designated user.
Pre-configuration Tasks
Before managing the user interface, complete the following tasks:
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 63
5 User Management
l l
Data Preparations
To manage the user interface, you need the following data: No. 1 2 Data Type and number of the user interface Contents of the message to be sent
Context
Do as follows on the switch:
Procedure
Step 1 Run:
send { all | ui-type ui-number | ui-number1 }
You can enable message sending between user interfaces. Step 2 Following the prompt, you can enter the message to be sent. You can press Ctrl_Z or Enter to end, and press Ctrl_C to abort. ----End
Context
Do as follows on the switch:
Procedure
Step 1 Run:
free user-interface { ui-number | ui-type ui-number1 }
Online users are cleared. Step 2 On receiving the prompts, you can confirm whether the designated online users have to be cleared. ----End
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 64
5 User Management
Prerequisite
The configuration of User Interfaces are complete.
Procedure
Step 1 Run the display users [ all ] command to check the usage information of the user interface. ----End
Applicable Environment
After the IP address is assigned to the main control board or the interface board, any remote user can use Telnet to log in to the switch, or connect the switch through PPP to access networks. This compromises the security. To ensure network security and ease user management, configure a user name and the user password for the switch.
Pre-configuration Tasks
Before configuring a user, complete the following tasks: l l Powering on the switch Connecting the PC with the switch properly
Data Preparation
To configure a user, you need the following data. No. 1 2 3 Data Authentication mode User name and password User priority
Issue 02 (2011-07-15)
65
5 User Management
Context
Do as follows on the switch that the user logs in to:
Procedure
Step 1 Run:
system-view
Context
Do as follows on the switch that the user logs in to:
Procedure
Step 1 Run:
system-view
5 User Management
----End
Context
Do as follows on the switch that the user logs in to:
Procedure
Step 1 Run:
system-view
Issue 02 (2011-07-15)
67
5 User Management
Context
CAUTION
Configuring the non-authentication mode may cause security problems of the switch. Do as follows on the switch that the user logs in to:
Procedure
Step 1 Run:
system-view
l If the authentication mode is non-authentication or password authentication, the priority of the userinterface determines the command level that the users can access. l If the authentication mode needs the username and the password, the priority of the user determines the command level that the users can access.
----End
Context
Refer to the Quidway S2300 Series Configuration Guide - Security.
Prerequisite
The configuration of User Management are complete.
Procedure
l
Issue 02 (2011-07-15)
Run the display users [ all ] command to check the user information.
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 68
5 User Management
l l
Run the display local-user command to check the local user list. Run the display access-user command to check online users.
----End
Context
CAUTION
After the first and second configuration examples are complete, the commands with priorities higher than 2 cannot be run if the current user is VTY0. Ensure that users can log in to theswitch in other methods to delete configurations.
Networking Requirements
The COM port of the PC is connected with the Console port. Set the priority of VTY0 to 2 and authenticate the passwords of users. Users need to enter the password Huawei to log in successfully. After login, if the operations are not carried out in 30 minutes, it means that the user-interface is disconnected from the switch.
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. Enter the user interface, and configure the priority of VTY0 as 2. Configure the simple authentication and the disconnect time.
Data Preparation
To complete the configuration, you need the following data: l l
Issue 02 (2011-07-15)
5 User Management
Procedure
Step 1 Configure the priority of VTY0 to be 2 on the Switch.
<Quidway> system-view [Quidway] user-interface vty0 [Quidway-ui-vty0] user privilege level 2
----End
Configuration Files
# sysname Quidway # aaa authentication-scheme default authorization-scheme default accounting-scheme default domain default # user-interface vty 0 user privilege level 2 set authentication password simple huawei idle-timeout 30 # return
Networking Requirements
The COM port of the PC and the console port of the switch are connected. Configure the priority of VTY0 to be 2, perform AAA authentication on the user that logs in through VTY0. The login user must enter the username "huawei" and the password "huawei". After login, if the user does not operate the switch within 30 minutes, the connection with the switch is disabled.
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. 3. Enter the user interface view to configure the priority of VTY0 to be 2 and the disconnection time. Enter the AAA view to configure the username, the password, and the user level. Switch on the idle timeout for the local user in the AAA view.
Data Preparation
To complete the configuration, you need the following data:
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 70
5 User Management
l l
Procedure
Step 1 Configure the priority of VTY0 to be 2 and the disconnection time within 30 minutes.
<Quidway> system-view [Quidway] user-interface vty0 [Quidway-ui-vty0] user privilege level 2 [Quidway-ui-vty0] authentication-mode aaa [Quidway-ui-vty0] idle-timeout 30 [Quidway-ui-vty0] quit
Step 2 Configuring the local username, the password, and user level.
[Quidway] aaa [Quidway-aaa] local-user huawei password cipher huawei [Quidway-aaa] local-user huawei privilege level 2
----End
Configuration Files
# sysname Quidway # aaa local-user huawei password cipher N`C55QK<`=/Q=^Q`MAF4<1!! local-user huawei privilege level 2 local-user huawei idle-cut # authorization-scheme default # accounting-scheme default # domain default # user-interface vty 0 authentication-mode aaa user privilege level 2 idle-timeout 30 # return
Issue 02 (2011-07-15)
71
6
About This Chapter
This chapter describes the basic knowledge of the file system, including the methods of managing files, directories, and storage devices. 6.1 Overview of the File System This section describes the concepts of the file system. 6.2 Managing a Storage Device This section describes how to format a storage device. 6.3 Managing the Directory You can manage directories to logically store files in hierarchy. 6.4 Managing Files You can view, create, delete, and rename files.
Issue 02 (2011-07-15)
72
Storage Device
A storage device is a hardware device used to store data. Different products support different storage devices. Currently, the S2300 supports the flash memory.
File
A file stores and manages information.
Directory
A directory collects and organizes files. It is a logical container of files.
Data Preparation
To manage a storage device, you need the following data. No. 1 Data Device name
Issue 02 (2011-07-15)
73
Context
Do as follows on the switch:
Procedure
Step 1 Run:
fixdisk device-name
After this command is run, if the prompt that the system should be repaired is still received, it indicates that the physical medium may be damaged.
----End
CAUTION
After the format flash: command is run, the files and directories in the Flash are cleared and cannot be restored. So, confirm the action before you use the command.
Procedure
Step 1 Run the following command in the user view:
format flash:
Applicable Environment
When you need to transfer files between the client and the server, configure the directory by using the file system.
Pre-configuration Tasks
Before configuring the management directory, complete the following tasks: l l Powering on the switch Connecting the client with the server correctly
Data Preparation
To configure a management directory, you need the following data. No. 1 2 Data Directory name to be created Directory name to be deleted
Context
Do as follows on the switch.
Procedure
Step 1 Run:
pwd
Context
Do as follows on the switch:
Procedure
Step 1 Run:
cd directory
Issue 02 (2011-07-15)
75
Context
Do as follows on the switch:
Procedure
Step 1 Run:
cd directory
The file and sub-directory list in the directory is displayed. Either the absolute path or relative path is applicable. ----End
Context
Do as follows on the switch:
Procedure
Step 1 Run:
cd directory
Context
Do as follows on the switch:
Procedure
Step 1 Run:
cd directory
Applicable Environment
To view, delete, or rename files on the switch, you need to configure files using the file system.
Pre-configuration Tasks
Before configuring the file system, complete the following tasks: l l Powering on the switch Connecting the client with the server correctly
Data Preparation
To configure a file system, you need the following data. No. 1 2 3 Data File name to be viewed File name to be deleted File name to be renamed
Issue 02 (2011-07-15)
77
Context
Do as follows on the switch:
Procedure
Step 1 Run:
cd directory
Context
Do as follows on the switch:
Procedure
Step 1 Run:
cd directory
The file to be copied must be larger than 0 bytes. Otherwise, the operation fails.
----End
Context
Do as follows on the switch:
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 78
Procedure
Step 1 Run:
cd directory
Context
Do as follows on the switch:
Procedure
Step 1 Run:
cd directory
Context
Do as follows on the switch.
Procedure
Step 1 Run:
zip source-filename destination-filename
Context
Do as follows on the switch:
Procedure
Step 1 Run:
cd directory
Context
Do as follows on the switch:
Procedure
Step 1 Run:
reset recycle-bin [ filename ]
Context
Do as follows on the switch:
Procedure
Step 1 Run:
undelete filename
l If the current directory is not the parent directory, you must operate the file by using the absolute path. l If you use the parameter [ /unreserved ] in the delete command, the file cannot be restored after being deleted.
----End
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 80
Prerequisite
Uploading the batched files on the client end to the switch.
Context
When the batch file is created, you can run the batch file to implement routine tasks automatically.
Procedure
Step 1 Run:
system-view
Prerequisite
Before configuring a file system, complete the following tasks: l l Powering on the switch Logging in to the switchfrom the client end
Context
The data may be lost or damaged during the process, and the prompt is required.
Procedure
Step 1 Run:
system-view
CAUTION
If the prompt is in the quiet mode, no prompt appears for data lossdue to maloperation. ----End
Issue 02 (2011-07-15)
82
Issue 02 (2011-07-15)
83
l Before loading the configuration file to V200R006C00, check whether the configuration file contains the preceding message. If not, the system processes the configuration file in the same way as earlier configuration file. In this case, some configurations may not function properly.
The configuration file is a text file in the following formats: l l l l The configuration file of V200R006C00 must begin with the message like "!Software Version V200R006C00." It is saved in the command format. To save space, default parameters are not saved. For the default values of the configuration parameters, see following sections. Commands are organized on the basis of the command view. All commands of the identical command view are grouped into a section. Every two command sections are separated by one or several blank lines or comment lines (beginning with "#"). The sequence of command sections is global configuration, logic interface configuration, physical interface configuration, routing protocol configuration and so on.
NOTE
l The system can run the command with the maximum length of 512 characters, including the command in an incomplete form. l If the configuration is in the incomplete form, the command is saved in complete form. Therefore, the command length in the configuration file may exceed 512 characters. When the system restarts, these commands cannot be restored.
l l
Issue 02 (2011-07-15)
Applicable Environment
In one of the following situations, you need to manage configuration files: l l l To start the switch normally, you need to select the correct S2300 system software and configuration file for the switch to load. After modifying current configurations, you need to save the modified contents. You need to view the configuration of the switch.
Pre-configuration Tasks
Before managing configuration files, complete the following task: l Installing the switch and starting it properly
Data Preparation
To manage configuration files, you need the following data. No. 1 2 3 Data S2300 System software and its file name Configuration file and its name The number of the start line from which the comparison of the configuration files begins
7.2.2 Configuring System Software for a switch to Load for the Next Startup
To upgrade the system software of a switch, you can specify the S2300 system software to be loaded for the next startup.
Context
Do as follows on the switch:
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 85
Procedure
Step 1 Run:
startup system-software system-file [ slave-board ]
The S2300 system software for the switch to load next time when it starts is configured. The system software package must use .cc as the extension and be saved to the root directory of the flash memory. If the BootROM version of next startup software that you specify is different from the current BootROM version, the system prompts you to upgrade the BootRom. ----End
7.2.3 Configuring the Configuration File for Switch to Load for the Next Startup
Before restarting a switch, you can specify the configuration files that are loaded for the next startup.
Context
Do as follows on the switch:
Procedure
Step 1 Run:
startup saved-configuration configuration-file
Configuration file is saved for the switch to load next time on startup. The filename extension of the configuration file must be .cfg or .zip, and must be stored in the root directory of a storage device. When the switch turns on, it initiates by reading the configuration file from the flash memory by default. Thus, the configuration in this configuration file is called initial configuration. If no configuration file is saved in the flash, the switch initiates with default parameters. The effective configuration when a switch is working is called current configuration. ----End
Procedure
l Run:
save [ all ] [ configuration-file ]
The current configurations are saved. The filename extension of the configuration file must be .cfg or .zip. The system startup configuration file must be saved in the root directory of a storage device.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 86
The user can modify the current configuration through the command line interface. To set the current configuration as initial configuration when the switch starts next time, you can use the save command to save the current configuration in the flash memory. You can use the save all command to save all the current configurations, including the configurations of the boards that are not inserted, to the default directory.
NOTE
When saving the configuration file for the first time, if you do not specify the optional parameter configuration-file, the switch asks you whether to save the file as "vrpcfg.zip" or not.
----End
Context
The configuration file stored in the flash memory needs to be cleared in the following cases: l l The system software does not match the configuration file after the switch has been upgraded. The configuration file is destroyed or an incorrect configuration file has been loaded.
Procedure
l Clear the currently loaded configuration file. Run the reset saved-configuration command to clear the currently loaded configuration file. If the configuration file of the switch used for the current startup is the same as that used for the next startup, running the reset saved-configuration command will clear both the configuration files. The switch will uses the default configuration file for the next startup. If the configuration file of the switch used for the current startup is different from that used at the next startup, running the reset saved-configuration command will clear the configuration file used for the current startup. If the configuration file of the switch used for the current startup is empty, the system will prompt you that the configuration file does not exist after you run the reset savedconfiguration command. If you do not run the startup saved-configuration configuration-file command to specify a new correct configuration file, or do not run the save command to save the configuration file after the configuration file is cleared, the switch will use the default configuration file at the next startup. ----End
Context
Do as follows on the switch:
Procedure
Step 1 Run:
compare configuration [ configuration-file ] [ current-line-number save-linenumber ]
The current configuration is compared with the configuration file for next startup. If no parameter is set, the comparison begins with the first lines of configuration files. currentline-number and save-line-number are used to continue the comparison by ignoring the differences between the configuration files. When comparing differences between the configuration files, the system displays the contents of the current configuration file and saved configuration file from the first different line. By default, 150 characters are displayed for each configuration file. If the number of characters from the first different line to the end is less than 150, the contents after the first different line are all displayed. In comparing the current configurations with the configuration file for next startup, if the configuration file for next startup is unavailable or its contents are null, the system prompts that reading files fails. ----End
Prerequisite
The configuration of Managing Configuration Files are complete.
Procedure
l l l l Run the display current-configuration command to check current configuration files. Run the display saved-configuration [ last ] command to check the configuration file that the switch loads the next time when it starts. Run the display startup command to check the file information used by the device upon start. Run the dir [ /all ] [ filename ] command to check check the file information in storage device.
----End
Example
After the configurations succeed, run the preceding commands, and you can find the following results: l
Issue 02 (2011-07-15)
The current configuration of the switch is correct without any redundant configuration.
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 88
l l
The current configuration of the switch is saved in the storage device. The S2300 system software and configuration file that are to be loaded on the switch next time are correct and they are saved in the root directory of the storage device.
Issue 02 (2011-07-15)
89
8
About This Chapter
8.1 FTP and TFTP Introduction This section describes the basic concepts of FTP and TFTP.
This chapter describes the fundamentals, configuration procedures and configuration examples of FTP and TFTP.
8.2 Configuring the Switch to be the FTP Server After a switch is configured with basic functions of the FTP server, you can run the FTP client application to log in to the switch, and then access files on the switch. 8.3 Configuring FTP ACL You can configure the FTP ACL on a switch to allow only specified users to log in to the switch. 8.4 Configuring the Switch to Be the FTP Client You can configure a switch to be an FTP client and then log in to the FTP server. 8.5 Configuring the Switch to Be the TFTP Client You can configure a switch to be an FTP client and then log in to the FTP server. 8.6 Limiting the Access to the TFTP Server You can configure the maximum number of TFTP servers that a TFTP client can access to determine which TFTP servers the TFTP client can log in to. 8.7 Configuration Examples This section provides several configuration examples for FTP and TFTP together with the configuration flowchart. The configuration examples explain networking requirements, configuration notes, and configuration roadmap.
Issue 02 (2011-07-15)
90
8.1.1 FTP
You can transfer files between local and remote hosts through FTP. FTP is commonly used in version upgrade, log downloading, file transfer, and configuration saving. File Transfer Protocol (FTP) is an application layer protocol in the TCP/IP protocol suite. It implements file transfer between local and remote hosts based on related file systems. The FTP protocol is implemented based on corresponding file system. The switch provides the following FTP services: l l FTP server service. Users can run the FTP client program to log in to the switch and access the files on the switch. FTP client service. Users can establish a connection with the switch by running a terminal emulation program or a Telnet program on a PC. Enter an FTP command to connect with the remote FTP server and access the files on the remote host.
8.1.2 TFTP
TFTP does not have a complex interactive access interface and authentication control. TFTP is applicable when there is no complex interaction between the client and server. The Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol. Compared with FTP, TFTP does not have a complex interactive access interface and authentication control. TFTP is applicable in an environment where there is no complex interaction between the client and the server. For example, TFTP is used to obtain the memory image of the system when the system starts up. TFTP is implemented based on the User Datagram Protocol (UDP). The client initiates the TFTP transfer. To download files, the client sends a read request packet to the TFTP server, receives packets from the server, and sends acknowledgement to the server. To upload files, the client sends a write request packet to the TFTP server, sends packets to the server, and receives acknowledgement from the server. TFTP transfers the files in two formats: l l The binary format: transfers program files. The ASCII format: transfers text files.
At present, the S2300 serves only as the TFTP client and transfers files in the binary format.
Issue 02 (2011-07-15)
91
Applicable Environment
When the switch serves as the FTP server, after the client logs in to the switch through FTP, the user can transfer files between the client and the server.
Pre-configuration Tasks
Before configuring the switch as the FTP server, complete the following tasks: l l Powering on the switch Connecting the FTP client to the server
Data Preparation
To configure the switch as the FTP server, you need the following data.
NOTE
No. 1 2 3 4
Data (Optional) Listening port number specified on the FTP server (Optional) Timeout period of the disconnection from the FTP server FTP username and password File directory authorized to the FTP user
Context
If the FTP is not enabled, change the FTP port as required. If the FTP service is enabled, run the undo ftp server command to disable the FTP service, and then change the FTP port.
Procedure
Step 1 Run:
system-view
Issue 02 (2011-07-15)
92
The port number of the FTP server is configured. If a new number of a monitored port is configured, the FTP server interrupts all the FTP connections and monitors the port of the new number. By default, the number of the port monitored by the FTP server is 21. ----End
Procedure
Step 1 Run:
system-view
When the file operation between clients and the switch ends, run the undo ftp [ ipv6 ] server command to disable the FTP server function. This ensures the security of the switch.
----End
Context
If the client is idle for the configured time, the connection is removed from the FTP server. By default, the timeout value is 10 minutes.
Procedure
Step 1 Run:
system-view
Context
Do as follows on the switch that serves as the FTP server:
Procedure
Step 1 Run:
system-view
Context
Do as follows on the switch that serves as the FTP server:
Procedure
Step 1 Run:
system-view
Issue 02 (2011-07-15)
94
Prerequisite
The configuration of the Switch to be the FTP Server are complete.
Procedure
l l Run the display [ ipv6 ] ftp-server the configuration and running information about the FTP server. Run the display ftp-users command to check the login FTP user.
----End
Example
After configuring the FTP server, run the display [ ipv6 ] ftp-server command. You can view that the parameters of the current FTP server.
<Quidway> display ftp-server FTP server is running Max user number User count Timeout value(in minute) Listening Port Acl number
5 0 30 1080 0
Run the display ftp-users command to view the user name, port number, authorization directory of the FTP user configured presently.
<Quidway> display ftp-users username host zll 100.2.150.226 port 1383 idle 3 topdir flash:
Applicable Environment
When the switch serves as the FTP server, for security, you can configure the switch by the access control list (ACL) to be accessed by only those clients that meet the matching conditions.
Pre-configuration Tasks
Before configuring the FTP ACL, complete the following tasks: l l Powering on the switch Connecting the FTP client with the server
Data Preparation
To configure the FTP ACL, you need the following data. No. 1 Data ACL number
Context
Do as follows on the switch that serves as the FTP server:
Procedure
Step 1 Run:
system-view
Context
Do as follows on the switch that serves as the FTP server:
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 96
Procedure
Step 1 Run:
system-view
----End
Context
Do as follows on the switch that serves as the FTP server:
Procedure
Step 1 Run:
system-view
Prerequisite
The configuration of FTP ACL are complete.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 97
Procedure
l Run the display ftp-server [ ] command to check the configuration and status of the FTP server.
----End
Example
After configuring an FTP server, you can run the display ftp-server command and view that the ACL number allocated for the FTP server is 2345.
<Quidway> display ftp-server FTP server is running Max user number User count Timeout value(in minute) Listening Port Acl number SSL security status
Applicable Environment
When a switch serves as an FTP client, you can log in to the FTP server through the switch and then transmit files or manage server directory.
Pre-configuration Tasks
Before configuring the switch as an FTP client, complete the following tasks: l l Powering on the switch Connecting the FTP client to the server
Data Preparation
To configure the switch as an FTP client, you need the following data.
NOTE
No. 1 2
Issue 02 (2011-07-15)
Data Host name or IP address of the FTP server Port number of connecting FTP
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 98
No. 3 4 5 6
Data FTP protocol command Local file name and file name on the remote FTP server Working directory name of the remote FTP server, local working directory of the FTP client, or directory name of the remote FTP server Login username and password
Context
Do as follows on the switch that serves as the client:
Procedure
Step 1 Run the following commands according to types of the server IP address. l If the IP address of the server is an IPv4 address, do as follows: In the user view, establish a connection to the FTP server. Run:
ftp [ host [ port-number ]
The switch is connected to the FTP server. In the FTP view, establish a connection to the FTP server. 1. Run:
ftp
The switch is connected to the FTP server. l If the IP address of the server is an IPv6 address, do as follows: In the user view, establish a connection to the FTP server. Run:
ftp ipv6 host [ port-number ]
The switch is connected to the FTP server. In the FTP view, establish a connection to the FTP server. 1. Run:
ftp
Issue 02 (2011-07-15)
99
8.4.3 Configuring Data Type and Transmission Mode for the File
This section describes how to configure the data type and transmission mode for the file.
Context
Do as follows on the switch that serves as the client:
Procedure
Step 1 Run:
ascii | binary
FTP server supports ascii mode for data transmission. But in Quidway S2300 Series, user has to switch to binary mode for data transfer.
Step 2 Run:
passive
The verbose mode for FTP is enabled. When verbose is enabled, all FTP responses are displayed. After file transmission, the statistics about transmission efficiency will be displayed. ----End
Context
This configuration provides help information for protocol commands.
Procedure
Step 1 Run:
remotehelp command
Context
Do as follows on the switch that serves as the client:
Procedure
Step 1 Upload or download files. l Run:
put local-filename [ remote-filename ]
The FTP file is downloaded from the FTP server and saved to the local file. ----End
Context
Do as follows on the switch that serves as the client:
Procedure
Step 1 Run one or more commands in the following order to manage directories. l Run:
cd pathname
The working path of the FTP server is switched to the upper-level directory. l Run:
pwd
l Run:
rmdir remote-directory
l The directory to be created can comprise letters and digits, but not special characters such as <, >, ?, \ and :. l When running the mkdir /abc command, you create a sub-directory named "abc".
----End
Context
Do as follows on the switch that serves as the client:
Procedure
Step 1 Run one or more commands in the following to manage directories. l Run:
ls [ remote-filename ] [ local-filename ]
The specified directory or file on the remote FTP server is displayed. If the directory name is not specified when a specific remote file is selected, the system searches the working directory for the specific file. l Run:
dir [ remote-filename ] [ local-filename ]
The specified directory or file on the local FTP server is displayed. If the directory name is not specified when a specific remote file is selected, the system searches the working directory for the specific file. l Run:
delete remote-filename
The specified file on the FTP server is deleted. If the directory name is not specified when a specific remote file is selected, the system searches the working directory for the specific file. When local-filename is set, related information about the file can be downloaded locally. ----End
Prerequisite
This configuration must be performed in FTP view.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 102
Context
The username and password are of string data type. The string length for username must be in the range of 1 to 85 case-insensitive characters and password must be in the range of 1 to 16 case-insensitive characters.
Procedure
Step 1 Run:
user username [ password ]
The current login user is changed and the user logs in again. ----End
Prerequisite
The configurations must be performed in the FTP view.
Procedure
Step 1 Run:
bye
or
quit
The client switch is disconnected from the FTP server. Return to the user view. Step 2 Run:
close
or
disconnect
The client switch is disconnected from the FTP server. This command terminates the FTP session. ----End
Issue 02 (2011-07-15)
103
Applicable Environment
You can transfer files through TFTP between the server and the client in a simple interaction environment.
Pre-configuration Tasks
Before configuring TFTP, complete the following tasks: l l Powering on the switch Connecting the TFTP client with the server
Data Preparation
To configure TFTP, you need the following data. No. 1 2 3 Data IP address of the TFTP server Name of the specific file in the TFTP server File directory
Context
Do as follows on a switch that functions as a TFTP client.
Procedure
Step 1 Run:
system-view
After the configuration, the source IP address of the TFTP client displayed on the TFTP server must be the same as the configured one. ----End
Context
Do as follows on the switch that serves as the TFTP client:
Procedure
Step 1 Run the following commands according to the type of the server IP addresses. l The IP address of the server is IPv4 address, run:
tftp [ -a source-ip-address | -i interface-type interface-number ] tftp-server get source-filename [ destination-filename ]
The switch is configured to download files through TFTP. l The IP address of the server is IPv6 address, run:
tftp ipv6 [ -a source-ip-address ] tftp-server-ipv6 [ -i interface-type interface-number ] get source-filename [ destination-filename ]
Context
Do as follows on the switch that serves as the TFTP client:
Procedure
Step 1 Run the following commands according to the type of the server IP addresses. l The IP address of the server is IPv4 address, run:
tftp [ -a source-ip-address | -i interface-type interface-number ] tftp-server put source-filename [ destination-filename ]
The switch is configured to upload files through TFTP. l The IP address of the server is IPv6 address, run:
tftp ipv6 [ -a source-ip-address ] tftp-server-ipv6 [ -i interface-type interface-number ] put source-filename [ destination-filename ]
Applicable Environment
When the switch serves as the TFTP client, you can configure the ACL on the switch. After the configuration, you can control the TFTP server to which the device can log in through TFTP.
Pre-configuration Tasks
Before configuring a limit to access the TFTP server, complete the following tasks: l l Powering on the switch Connecting the TFTP client to the server
Data Preparation
To configure a limit to access to the TFTP server, you need the following data. No. 1 2 Data IP address of the TFTP server ACL number
Context
NOTE
Procedure
Step 1 Run:
system-view
Issue 02 (2011-07-15)
106
Context
Do as follows on the switch that serves as the TFTP client:
Procedure
Step 1 Run:
system-view
The system view is displayed. Step 2 According to the address type of the TFTP server, select and run one of the following two commands. l For IPv4 addresses, Run the tftp-server acl acl-number command. You can use the ACL to limit the access to the TFTP server. l For IPv6 addresses, Run the tftp-server ipv6 acl acl6-number command. You can use the ACL to limit the access to the TFTP server. ----End
Networking Requirements
As shown in Figure 8-1, the local PC functions as the FTP client of which the IP address is 10.1.1.1/24. The Switch acts as the FTP server. VLAN 10 is created on the Switch and Ethernet0/0/1 is added to VLAN 10. The IP address 10.1.1.2/24 is assigned to VLANIF 10. The PC uploads files to the Switch. Figure 8-1 Networking diagram of the Switch functioning as the FTP server
PC
Switch FTP Server
Ethernet
Interface Ethernet0/0/1
L2 Switch
Ethernet
Switch
IP address 10.1.1.2/24
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. 3. Set the correct FTP user name and password on the Switch that functions as the FTP server. Log in to the Switch through FTP from the PC. Upload files to the FTP server.
Data Preparation
To complete the configuration, you need the following data: l l l l IP address of the FTP server Name of the FTP user set as u1 and the password set as ftppwd on the server Correct path of the source file on the PC Name of the destination file and position where the destination files are located on the Switch
Procedure
Step 1 Create VLAN 10 on the Switch and assign the IP address 10.1.1.2/24 to VLANIF 10.
<Quidway> system-view [Quidway] vlan 10 [Quidway-vlan10] quit [Quidway] interface ethernet 0/0/1 [Quidway-Ethernet0/0/1] port hybrid pvid vlan 10 [Quidway-Ethernet0/0/1] port hybrid untagged vlan 10 [Quidway-Ethernet0/0/1] quit
Issue 02 (2011-07-15)
108
Step 2 Start the FTP server on the Switch, and set the FTP user name to u1 and password to ftpwd.
[Quidway] ftp [Quidway] aaa [Quidway-aaa] [Quidway-aaa] [Quidway-aaa] [Quidway-aaa] server enable local-user u1 password simple ftppwd local-user u1 service-type ftp local-user u1 ftp-directory flash:/ return
Step 3 On the PC, initiate a connection to the Switch with the user name u1 and the password ftppwd. Use Windows XP on the FTP client to illustrate the preceding operations.
C:\WINDOWS\Desktop> ftp 10.1.1.2 Connected to 10.1.1.2. 220 FTP service ready. User (10.1.1.1:(none)): u1 331 Password required for u1 Password: 230 User logged in. ftp>
Step 4 Set the mode of transferring files to binary and the local directory on the PC.
ftp> binary 200 Type set to I. ftp> lcd c:\temp Local directory now C:\temp.
----End
Configuration Files
# sysname Quidway # FTP server enable # vlan batch 10 # interface Vlanif10 ip address 10.1.1.2 255.255.255.0 # interface Ethernet0/0/1 port hybrid pvid vlan 10 port hybrid untagged vlan 10 # aaa local-user u1 password simple ftppwd local-user u1 ftp-directory flash:/ local-user u1 service-type ftp # Return
Issue 02 (2011-07-15)
109
Networking Requirements
As shown in Figure 8-2, the IP address of the FTP server is 172.16.104.110/24. The routes between PC1, PC2, and FTP server are reachable. On the S2300 that functions as the FTP server, it is required that the FTP server should permit only PC1 with the IP address as 172.16.104.111 to download and upload files through FTP, and PC2 should not connect to the FTP server after the ACL is configured. Figure 8-2 Networking diagram for configuring an ACL of the FTP server
172.16.105.111/24
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. Perform basic configurations on the FTP server. Configure the ACL on the FTP server.
Data Preparation
To complete the configuration, you need the following data: l l Name of the FTP user set as u1 and password set as huawei on the server Number of the ACL
Procedure
Step 1 Configure basic FTP functions. For details, see 8.7.1 Example for Configuring the FTP Server. Step 2 Configure an ACL.
<Quidway> system-view [Quidway] acl number 2001 [Quidway-acl-basic-2001] rule permit source 172.16.104.111 0.0.0.0
Issue 02 (2011-07-15)
110
Step 4 Connect PC1 to the FTP server. This step needs to be performed on the DOS of the PC.
c:\ ftp 172.16.104.110 Connected to 172.16.104.110. 220 FTP service ready. User (100.2.150.40:(none)):u1 331 Password required for u1 Password: 230 User logged in. ftp>
Step 5 Connect PC2 to the FTP server. This step needs to be performed on the DOS of the PC.
c:\ ftp 172.16.104.110 Connected to 172.16.104.110. Info:Connection was denied by remote host according to ACL! Connection closed by remote host.
----End
Configuration Files
Configuration file of the FTP server
# sysname Quidway # FTP server enable FTP acl 2001 # acl number 2001 rule 5 permit source 172.16.104.111 0 # vlan batch 10 # interface Vlanif10 ip address 10.1.1.2 255.255.255.0 # interface Ethernet0/0/1 port hybrid pvid vlan 10 port hybrid untagged vlan 10 # aaa authentication-scheme default authorization-scheme default accounting-scheme default domain default local-user u1 password simple huawei local-user u1 ftp-directory flash:/ local-user u1 service-type ftp # return
Networking Requirements
As shown in Figure 8-3, the remote server at 10.1.1.2 serves as the FTP server. The Switch and the FTP server are directly connected and on the same network segment. The Switch has a reachable route to the FTP server. The Switch acts as the FTP client. Interfaces ranging from Ethernet0/0/1 to Ethernet0/0/4 can be used to set up FTP connections and they share the IP address 10.1.1.1. The Switch downloads files from the FTP server. Figure 8-3 Networking diagram of the Switch functioning as the FTP client
FTP session
PC
FTP Server
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. Log in to the FTP server from the FTP client. Download files from the server to the storage device of the client.
Data Preparation
To complete the configuration, you need the following data: l l l IP address of the FTP server Name of the destination file and position where the destination files are located on the Switch Name of the FTP user set as u1 and the password set as ftppwd on the client
Procedure
Step 1 Enable FTP on the remote FTP server. Add an FTP user named u1 and set the password to ftppwd. Step 2 Create VLAN 10 on the Switch and assign the IP address 10.1.1.1 to VLANIF10.
<Quidway> system-view [Quidway] vlan 10 [Quidway-vlan10] quit [Quidway] interface ethernet [Quidway-Ethernet0/0/1] port [Quidway-Ethernet0/0/1] port [Quidway-Ethernet0/0/1] quit [Quidway] interface ethernet [Quidway-Ethernet0/0/2] port [Quidway-Ethernet0/0/2] port [Quidway-Ethernet0/0/2] quit [Quidway] interface ethernet [Quidway-Ethernet0/0/3] port
0/0/1 hybrid pvid vlan 10 hybrid untagged vlan 10 0/0/2 hybrid pvid vlan 10 hybrid untagged vlan 10 0/0/3 hybrid pvid vlan 10
Issue 02 (2011-07-15)
112
Step 3 On the Switch, initiate a connection to the FTP server with the user name tpuser and the password ftppwd.
<Quidway> ftp 10.1.1.2 Trying 10.1.1.2 ... Press CTRL+K to abort Connected to 10.1.1.2. 220 FTP service ready. User(10.1.1.2:(none)):u1 331 Password required for u1. Enter password: 230 User logged in. [ftp]
Step 4 On the Switch, set the mode of transferring files to binary and the flash directory.
[ftp] binary 200 Type set to I. [ftp] lcd flash:/ The current local directory is flash:.
Step 5 Download the vrpcfg.cfg file from the remote FTP server on the Switch.
[ftp] get vrpcfg.cfg vrpcfg.cfg 200 Port command okay. 150 Opening BINARY mode data connection for vrpcfg.cfg. 226 Transfer complete. FTP: 9124 byte(s) received in 3.100 second(s) 2.94Kbyte(s)/sec. [ftp] quit <Quidway>
----End
Configuration Files
# sysname Quidway # vlan batch 10 # interface Vlanif10 ip address 10.1.1.3 255.255.255.0 # interface Ethernet0/0/1 port hybrid pvid vlan 10 port hybrid untagged vlan 10 # interface Ethernet0/0/2 port hybrid pvid vlan 10 port hybrid untagged vlan 10 # interface Ethernet0/0/3 port hybrid pvid vlan 10 port hybrid untagged vlan 10 # interface Ethernet0/0/4 port hybrid pvid vlan 10 port hybrid untagged vlan 10 #
Issue 02 (2011-07-15)
113
Networking Requirements
As shown in Figure 8-4, the Switch cannot function as the TFTP server. The remote server at 10.1.1.2 functions as the TFTP server. The Switch acts as a TFTP client. VLAN 10 is created on the Switch, and Ethernet0/0/1 is added to VLAN 10. The IP address 10.1.1.1/24 is assigned to VLANIF 10. The Switch downloads files from the TFTP server. Figure 8-4 Networking diagram for configuring TFTP
TFTP session
PC
TFTP Server
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. Run the TFTP software on the TFTP server and set the position where the source file is located on the Switch. Download files through TFTP commands on the Switch.
Data Preparation
To complete the configuration, you need the following data: l l l TFTP software installed on the TFTP server Path of the source file on the TFTP server Name of the destination file and position where the destination file is located on the Switch
Procedure
Step 1 Enable TFTP on the remote server to ensure that the TFTP application software is started. Step 2 Create VLAN 10 on the Switch and assign the IP address 10.1.1.1/24 to VLANIF 10.
<Quidway> system-view [Quidway] vlan 10 [Quidway-vlan10] quit [Quidway] interface ethernet 0/0/1 [Quidway-Ethernet0/0/1] port hybrid pvid vlan 10 [Quidway-Ethernet0/0/1] port hybrid untagged vlan 10
Issue 02 (2011-07-15)
114
Step 3 On the Switch, initiate a connection to the TFTP server and download the 8031.cc file.
<Quidway> tftp 10.1.1.2 get 8031.cc 8031new.cc Info: Transfer file in binary mode. Downloading the file from the remote tftp server, please wait...
----End
Configuration Files
# sysname Quidway # vlan batch 10 # interface Vlanif10 ip address 10.1.1.1 255.255.255.0 # interface Ethernet0/0/1 port hybrid pvid vlan 10 port hybrid untagged vlan 10 # Return
Issue 02 (2011-07-15)
115
9
About This Chapter
Telnet and SSH can provide a terminal which enables users to remotely log in to and access a server. 9.1 Telnet and SSH Introduction This section explains basic concepts of user login by means of Telnet and SSH. 9.2 Configuring Telnet Terminal Services This section explains how to log in to a switch by means of Telnet and configure the switch. 9.3 Configuring SSH Users SSH users must be configured to ensure that STelnet or SFTP clients are able to log in to SSH servers. 9.4 Configuring the SSH Server Function This section describes how to configure the SSH server. STelnet or SFTP must first be enabled on the SSH server. 9.5 Configuring the STelnet Client Function This section describes how to configure the STelnet client. A secure connection between the client and server can be established through negotiation, and the client will be able to log in to the server similarly to using Telnet services. 9.6 Configuring the SFTP Client Function This section explains how to configure the SFTP client. The authentication and bidirectional data encryption of the SFTP client can be manually configured, which will ensure secure file transmission on the network. 9.7 Configuring the SCP Client This section describes how to configure the SCP client. The SCP client sets up a secure connection with the SCP server so that the client can upload files to the server or download files from the server. 9.8 Configuration Examples This section provides configuration examples for Telnet and SSH along with a configuration flowchart. The configuration examples explain networking requirements, configuration notes, and configuration roadmap.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 116
Telnet Services
Telnet is an application layer protocol in the TCP/IP protocol suite. It provides remote login and a virtual terminal service through the network. The S2300 provides the following Telnet services: l l Telnet server: You can run the Telnet client program on a PC to log in to the switch, configure and manage it. The switch acts as a Telnet server. Telnet client: You can run the terminal emulation program or the Telnet client program on a PC to connect with the switch. With the telnet command, you can log in to other switchs to configure and manage them. As shown in Figure 9-1, Switch A serves as both the Telnet server and the Telnet client. Figure 9-1 Telnet client services
Telnet Session 1 Telnet Session2
Telnet Server
PC
SwitchA
SwitchB
Issue 02 (2011-07-15)
117
Introduction to SSH
SSH works at the application layer in the TCP/IP protocol suite. SSH provides remote login and virtual terminal on the network where security is guaranteed. Based on TCP connections, SSH guarantees security and provides authentication for transmitted information, preventing the following attacks shown in Figure 9-2: l l l IP spoofing Interception of the password in plain text Denial of Service (DoS)
In the figure, Switch is an S2300. Figure 9-2 Establishing a local SSH connection between the PC and the S2300
PC
Ethernet
L2 Switch Ethernet
Switch
SSH adopts the client/server model and sets up multiple secure transmission channels. The Switch, as the SSH server, can be connected to multiple PCs that function as SSH clients. A Layer 2 switch may exist between the PC and the SSH server. In the actual networking, a route is required to be reachable between the PC and the Switch.
Advantages of SSH
The applications of SSH include STelnet and SFTP. Different from Telnet and FTP terminal services, SSH provides secure remote access on the network without security guaranteed. The advantages of SSH are described as follows: l STelnet client functions There is a potential risk on security for login through Telnet because there is no authentication and the data transmitted through TCP is in plain text. The insecure access results in malicious attacks including DoS attacks, IP spoofing attacks, and route spoofing attacks. SSH provides secure remote access on an insecure network by supporting the following functions: Supporting Revest-Shamir-Adleman Algorithm (RSA) authentication
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 118
Supporting Data Encryption Standard (DES) and 3DES Supporting the encrypted transfer of the user name or password Supporting the encrypted transfer of interactive data SSH adopts RSA. After the public key and the private key are generated according to the encryption principle of the asymmetric encryption system, the following information is transmitted with security between the SSH client and the SSH server: Key User name or password Interactive data l SFTP client functions SFTP provides the following types of applications: By using SFTP, you can securely log in to the S2300 to manage files from the remote device. In this manner, the security of data transmission is improved when files need to be transferred during the upgrade of the remote system. The S2300 can function as the client to log in to the remote device through FTP to transfer files with security. l SCP client SCP enables you to log in to the device securely from a remote device to upload or download files. Data transfer in this mode is much safer for remote system update. In addition, SCP provides the client function so that a local device can log in to a remote device for secure data transfer. Unlike SFTP, SCP simplifies the file transfer process by combing user authentication and file transfer, thus improving the configuration efficiency.
Issue 02 (2011-07-15)
119
Applicable Environment
To remotely log in to the switch through the Telnet protocol for maintenance and management, you need to configure Telnet terminal services.
Pre-configuration Tasks
Before configuring Telnet terminal services, complete the following tasks: l l l l Ensuring that the switch runs normally Ensuring that the IP addresses of interfaces on the switch are configured correctly Configuring the user account, correct login authentication mode, and call-in and call-out restriction Ensuring that reachable routes exist between the terminal and the switch
Data Preparation
To configure Telnet terminal services, you need the following data. No. 1 3 4 5 6 Data IP address of the switch IPv4/IPv6 address or host name of the remote switch Number of the TCP port that is used by the remote switch to provide Telnet services (Optional) Timeout period after which the server terminates the connection with the user interface (Optional) Source IP address or source interface of the device functioning as an Telnet client
Context
Do as follows on the switch that serves as an Telnet server. Select and perform one of the following two steps for IPv4 or IPv6.
Procedure
l For the IPv4 network 1. Run:
system-view
Issue 02 (2011-07-15)
120
l By default, the function of the Telnet server is enabled. l If the undo telnet server enable command is run when Telnet login is in progress, the command does not take effect. l After the Telnet server function is disabled, you can log in to the device only through SSH or an asynchronous serial interface rather than through Telnet.
l By default, the function of the Telnet server is enabled. l If the telnet ipv6 server enable command is run when Telnet login is in progress, the command does not take effect. l After the Telnet server function is disabled, you can log in to the device only through SSH or an asynchronous serial interface rather than through Telnet.
----End
Context
Do as follows on the switch that serves as a Telnet client: Select and perform one of the following two steps for IPv4 or IPv6.
Procedure
l Run:
telnet host-name [ port-number ]
Context
Do as follows on the switch that functions as a Telnet server:
Procedure
Step 1 Run:
system-view
A Telnet server port number is set. If a new port number is set, the Telnet server terminates all established Telnet connections, and then uses the new port number to listen to new requests for Telnet connections. By default, the Telnet server port number is 23. ----End
Context
Do as follows on the switch that serves as a Telnet client:
Procedure
Step 1 Run:
system-view
Prerequisite
The configuration of Telnet Terminal Services are complete.
Procedure
l l l l Run the display users command to check information about connected users. Run the display users all command to check information about all users, including connected and disconnected users. Run the display tcp status command to check TCP connections. Run the display telnet server status command to check the configuration and status of the Telnet server.
----End
Example
Run the display tcp status command to view TCP connections. In the command output, Established indicates that a TCP connection has been established.
<Quidway> display tcp status TCPCB Tid/Soid Local Add:port 39952df8 36 /1509 0.0.0.0:0 Closed 32af9074 59 /1 0.0.0.0:21 Listening 34042c80 73 /17 10.164.39.99:23 Established Foreign Add:port 0.0.0.0:0 0.0.0.0:0 10.164.6.13:1147 VPNID 0 14849 0 State
Run the display telnet server status command to view the configuration and status of the Telnet server.
<Quidway> display telnet server status TELNET IPV4 server TELNET IPV6 server TELNET server port :Enable :Enable :23
Applicable Environment
The STelnet or SFTP client can log in to the SSH server to perform operations only after SSH users are correctly configured on the SSH server.
Pre-configuration Tasks
Before configuring SSH users, complete the following tasks:
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 123
l l
Creating a local user Configuring an RSA public key for the SSH client on the SSH server
Data Preparation
To configure SSH users, you need the following data. No. 1 2 3 4 5 Data Name and password of SSH users Authentication mode of SSH users Service type of SSH users Name of the peer RSA public key assigned to SSH users Operating directory of the SFTP service for SSH users
Context
NOTE
Besides creating an SSH user separately, you can also create an SSH user when you configure the following. l Configuring the Authentication Mode for SSH Users l Configuring the Service Type of SSH Users
Procedure
Step 1 Run:
system-view
If you want to create an SSH user in the password authentication mode, you need to create a local user with the same name in the AAA view. 1. Run:
aaa
Issue 02 (2011-07-15)
124
Context
Do as follows on the switch that serves as an SSH server:
Procedure
Step 1 Run:
system-view
The authentication mode of the VTY user interface must be set to AAA. Otherwise, the protocol inbound ssh command cannot be configured successfully.
----End
Context
Do as follows on the switchs that serve as a client or a server:
Procedure
Step 1 Run:
system-view
Issue 02 (2011-07-15)
125
To log in to an SSH server, the local RSA key pair must be configured and generated first. Before performing the other SSH configurations, you must configure the rsa local-key-pair create command to generate a local key pair.
----End
Context
Do as follows on the switch that serves as an SSH server:
Procedure
Step 1 Run:
system-view
The authentication mode for SSH users is configured. Perform the following as required: l Authenticate the SSH user through the password. Run:
ssh user user-name authentication-type password
The default password authentication is configured for the SSH user. For the local authentication or HWTACACS authentication, if the number of SSH users is small, you can adopt the former command; if the number of SSH users is large, adoptthe later command to simplify the configuration. l Authenticate the SSH user through RSA. 1. Run:
ssh user user-name authentication-type rsa
Issue 02 (2011-07-15)
126
The public key is edited. The public key must be a string of hexadecimal alphanumeric characters. It is automatically generated by an SSH client. You can run the display rsa local-key-pair public command to view a generated public key. 5. Run:
public-key-code end
Quit the public key editing view. If the specified hex-data is invalid, the public key cannot be generated after the peer-publickey end command is run; If the specified key-name is deleted in other views, the system prompts that the key does not exist after the peer-public-key end command is run and the system view is displayed. 6. Run:
peer-public-key end
Return to the system view from the public key view. 7. Run:
ssh user user-name assign rsa-key key-name
l After the public key editing view is displayed, the RSA public key generated on the client can be sent to the server. Copy the RSA public key to the switch that serves as the SSH server. l Before the peer RSA public key is assigned to the SSH users, the SSH server must be configured and the peer RSA public key must be the RSA public key of the SSH client.
----End
9.3.6 (Optional) Configuring the Basic Authentication Information for SSH Users
You can configure the interval for updating the server key pair, timeout period of the SSH authentication, and retry times of the SSH authentication.
Context
Do as follows on the switch that serves as an SSH server:
Procedure
Step 1 Run:
system-view
By default, the interval for updating the key pair of the SSH server is 0 that indicates no updating. Step 3 Run:
ssh server timeout seconds
The timeout period of the SSH authentication is set. By default, the timeout period is 60 seconds. Step 4 Run:
ssh server authentication-retries times
The number of retry times of the SSH authentication is set. By default, the retry times is 3. ----End
Context
NOTE
There are four authentication modes for an SSH user, namely, password, rsa, password-rsa, and all. For details of the configuration of the command line authorization for password authentication, refer to the chapter "AAA and User Management" in the Quidway S2300 Series Configuration Guide - Security. This section describes how to configure the command line authorization for RSA authentication.
Procedure
Step 1 Run:
system-view
The command line authorization is configured for the specified SSH user. ----End
Follow-up Procedure
After configuring the authorization through command lines for the SSH user to perform RSA authentication, you have to configure the AAA authorization. Otherwise, the command line authorization for the SSH user does not take effect.
Context
Do as follows on the switch that functions as an SSH server:
Procedure
Step 1 Run:
system-view
The service type for the SSH user is configured. By default, the service type of the SSH user is not configured. ----End
9.3.9 (Optional) Configuring the Authorized Directory of the SFTP Service for SSH Users
You can configure a directory as an authorized directory to allow SSH users to use SFTP services.
Context
Do as follows on the switch that serves as an SSH server:
Procedure
Step 1 Run:
system-view
The authorized directory of the SFTP service for SSH users is configured. By default, the authorized directory of the SFTP service for SSH users is Flash. ----End
Prerequisite
The configuration of SSH Users are complete.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 129
Procedure
l l Run the display ssh user-information command to check the information about the SSH client on the SSH server. Run the display ssh user-information username command to check the information about the specified SSH client on the SSH server.
----End
Example
Run the display ssh user-information username command. It shows that the SSH user named clinet001 is authenticated by password, and its service type is sftp.
[Quidway] display ssh user-information client001 User Name : client001 Authentication-type : password User-public-key-name : Sftp-directory : Service-type : sftp Authorization-cmd : No
Applicable Environment
Before configuring the SSH server, you must enable STelnet, SFTP, or SCP on the SSH server. You can change the number of the port monitored by the SSH server to other port numbers. This can prevent attackers from accessing standard ports of the SSH server and thus save bandwidth and system resources.
Pre-configuration Tasks
Before configuring the SSH server, complete the following tasks: l l l l l Connecting the SSH client to the SSH server correctly Ensuring that the SSH client and the SSH server are routable Configuring the VTY interface on the SSH server to support SSH Configuring the SSH client on the SSH server Creating the local RSA key pair on the SSH server
Data Preparation
To configure the SSH server, you need the following data.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 130
No. 1
Context
Do as follows on the switch that serves as an SSH server:
Procedure
Step 1 Run:
system-view
The STelnet service is enabled. By default, STelnet services are disabled. ----End
Context
Do as follows on the switch that serves as an SSH server:
Procedure
Step 1 Run:
system-view
The SFTP service is enabled. By default, the SFTP service is disabled. ----End
Context
Do as follows on the S2300 functioning as the SCP server:
Procedure
Step 1 Run:
system-view
SCP services are enabled. By default, SCP services are disabled. ----End
Context
Do as follows on the switch that serves as an SSH server:
Procedure
Step 1 Run:
system-view
The earlier version-compatible function is enabled. By default, the server configured with the SSH2.0 protocol is compatible with the server configured with SSH1.X. If the client of SSH1.3 to SSH1.99 (protocol version ranges from 1.3 to 1.99) is denied access to log in, you can run the undo ssh server compatible-ssh1x enable command to disable the switch to be compatible with the earlier protocol version.
NOTE
l Compared with SSH1.X, SSH2.0 is extended in structure to more authentication modes and key exchange modes with higher service capability, such as SFTP. l The S2300 supports the SSH protocol of version 1.3 to version 2.0.
----End
9.4.6 (Optional) Configuring the Number of the Port Monitored by the SSH Server
You can configure or change the monitoring port number of the SSH server. After the port number is changed, only the user knows the current port number, which guarantees the security.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 132
Context
Do as follows on the switch that serves as an SSH server:
Procedure
Step 1 Run:
system-view
The number of the port monitored by the SSH server is configured. If a new number of a monitored port is configured, the SSH server interrupts all the STelnet and SFTP connections and monitors the port of the new number. By default, the number of the port monitored by the SSH server is 22. ----End
9.4.7 (Optional) Configuring the Interval for Updating the Key Pair on the SSH Server
You can configure the interval for updating the key pair of the SSH server, which can guarantee the security.
Context
Do as follows on the switch that serves as an SSH server:
Procedure
Step 1 Run:
system-view
The interval for updating the key pair is set. By default, the interval for updating the key pair of the SSH server is 0, which means that the key pair is never updated. ----End
Prerequisite
The configurations of the SSH server are complete.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 133
Procedure
Step 1 Run the display ssh server status command to view the global configuration of the SSH server. ----End
Example
Run the display ssh server status command, and you can view that the SSH version of the SSH session is 1.99, and the times for re-establishing the SSH session is 5.
<Quidway> display ssh server status SSH version SSH connection timeout SSH server key generating interval SSH Authentication retries SFTP server Stelnet server Scp server SSH server port
NOTE
: : : : : : : :
If the number of the monitored port is the default number, information about the currently monitored port will not be displayed.
Applicable Environment
STelnet is a secure Telnet protocol. The SSH user can use the STelnet service in the same manner as using the Telnet service.
Pre-configuration Tasks
Before connecting the STelnet client to the SSH server, complete the following tasks: l l l Generating the local RSA key pair on the SSH server Configuring the STelnet user on the SSH server Enabling the STelnet service on the SSH server
Data Preparation
To connect the STelnet client to the SSH server, you need the following data:
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 134
No. 1 2 3 4 5 6 7 8 9
Data Name of the SSH server Number of the port monitored by the SSH server Preferred encrypted algorithm from the STelnet client to the SSH server Preferred encrypted algorithm from the SSH server to the STelnet client Preferred HMAC algorithm from the STelnet client to the SSH server Preferred HMAC algorithm from the SSH server to the STelnet client Preferred algorithm of key exchange Name of the outgoing interface Source address
Context
If the first-time authentication on the SSH client is enabled, the STelnet client does not check the validity of the RSA public key when logging in to the SSH server for the first time. After the login, the system automatically allocates the RSA public key and saves it for authentication in next login. To simplify user operations, you are recommended to enable the first-time authentication on the SSH client. Do as follows on the switch that serves as an SSH client:
Procedure
Step 1 Run:
system-view
The first-time authentication on the SSH client is enabled. By default, the first-time authentication on the SSH client is disabled.
Issue 02 (2011-07-15)
135
l The purpose of enabling the first-time authentication on the SSH client is to skip checking the validity of the RSA public key of the SSH server when the STelnet client logs in to the SSH server for the first time. The check is skipped because the STelnet server has not saved the RSA public key of the SSH server. l If the first-time authentication is not enabled on the SSH client, when the STelnet client logs in to the SSH server for the first time, the STelnet client fails to pass the check on the RSA public key validity and cannot log in to the server.
TIP
To ensure that the STelnet client can log in to the SSH server at the first attempt, you can assign the RSA public key in advance to the SSH server on the SSH client in addition to enabling the first-time authentication on the SSH client.
----End
Context
If the first-time authentication on the SSH client is disabled, you need to allocate an RSA public key to the SSH server before the STelnet client logs in to the SSH server. Do as follows on the switch that serves as an SSH client:
Procedure
Step 1 Run:
system-view
The public key is edited. The public key must be a string of hexadecimal alphanumeric characters. It is automatically generated by an SSH client. You can run the display rsa local-key-pair public command to view a generated public key. Step 5 Run:
public-key-code end
Quit the public key editing view. If the specified hex-data is invalid, the public key cannot be generated after the peer-publickey end command is run; If the specified key-name is deleted in other views, the system prompts
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 136
that the key does not exist after the peer-public-key end command is run and the system view is displayed. Step 6 Run:
peer-public-key end
Return to the system view from the public key view. Step 7 Run:
ssh client servername assign rsa-key keyname
l Before being assigned to the SSH server, the assigned peer RSA public key must be obtained from the SSH server and must be configured on the SSH client. Then, the STelnet client client can successfully undergo the validity check on the RSA public key of the SSH server. l If the RSA public key stored on the SSH client becomes invalid, run the undo ssh client servername assign rsa-key command to cancel the association between the SSH client and the SSH server. Then, run the ssh client servername assign rsa-key keyname command to allocate a new RSA public key to the SSH server.
----End
Context
NOTE
When accessing an SSH server, the STelnet client can carry the source address and choose the key exchange algorithm, encryption algorithm, or HMAC algorithm, and configure the keepalive function..
Procedure
Step 1 Run:
system-view
The system view is displayed. Step 2 According to the address type of the SSH server, select and run one of the following two commands. l For IPv4 addresses, Run the stelnet host-ipv4 [ port ] [ [ prefer_kex { dh_group1 | dh_exchange_group } ] | [ prefer_ctos_cipher { des | 3des | aes128 } ] | [ prefer_stoc_cipher { des | 3des | aes128 } ] | [ prefer_ctos_hmac { sha1 | sha1_96 | md5 | md5_96 } ] | [ prefer_stoc_hmac { sha1 | sha1_96 | md5 | md5_96 } ] ] * [ -ki aliveinterval [ -kc alivecountmax ] ] command. You can log in to the SSH server through STelnet. l For IPv6 addresses, Run the stelnet ipv6 host-ipv6 [ -i interface-type interface-number ] [ port ] [ [ prefer_kex { dh_group1 | dh_exchange_group } ] | [ prefer_ctos_cipher { des | 3des | aes128 } ] | [ prefer_stoc_cipher { des | 3des | aes128 } ] | [ prefer_ctos_hmac { sha1 | sha1_96 |
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 137
md5 | md5_96 } ] | [ prefer_stoc_hmac { sha1 | sha1_96 | md5 | md5_96 } ] ] * [ -ki aliveinterval [ -kc alivecountmax ] ]command. You can log in to the SSH server through STelnet. ----End
Prerequisite
The configuration of the STelnet Client Function are complete.
Procedure
l l Run the display ssh server-info command to check the mapping between the RSA public key and the SSH client on the SSH client. Run the display ssh server session command to check the session of the SSH client on the SSH server.
----End
Example
When running the display ssh server session command, you can view that the client logs in from VTY3, with Stelent service by password authentication.
<Quidway> display ssh server session Session 1: Conn : VTY 3 Version : 2.0 State : started Username : client001 Retry : 1 CTOS Cipher : aes128-cbc STOC Cipher : aes128-cbc CTOS Hmac : hmac-sha1-96 STOC Hmac : hmac-sha1-96 Kex : diffie-hellman-group1-sha1 Service Type : stelnet Authentication Type : password
Applicable Environment
SFTP enables users to log in to the device from a secure remote end to manage files. This improves the security of data transmission for the remote end to update its system. The SFTP client function also enables you to log in to the remote device through SFTP for the secure file transmission.
Pre-configuration Tasks
Before connecting the SFTP client to the SSH server, complete the following tasks: l l l Creating a local RSA key pair on an SSH server Configuring an SFTP client on the SSH server Enabling the SFTP service on the SSH server
Data Preparation
To connect an SFTP client to an SSH server, you need the following data. No. 1 2 3 4 5 6 7 8 9 10 Data Name of the SSH server Number of the port monitored by the SSH server Preferred encrypted algorithm from the SFTP client to the SSH server Preferred encrypted algorithm from the SFTP server to the SSH client Preferred HMAC algorithm from the SFTP client to the SSH server Preferred HMAC algorithm from the SFTP server to the SSH client Preferred algorithm of key exchange Name of the outgoing interface Directory name File name
Context
If the first-time authentication on the SSH client is enabled, the STelnet client does not check the validity of the RSA public key when logging in to the SSH server for the first time. After the login, the system automatically allocates the RSA public key and saves it for authentication in next login.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 139
To simplify user operations, you are recommended to enable the first-time authentication on the SSH client. Do as follows on the switch that serves as an SSH client:
Procedure
Step 1 Run:
system-view
Enable the SSH client with the first authentication. By default, first-time authentication is disabled on SSH clients.
NOTE
l The purpose of enabling the first-time authentication on the SSH client is to skip checking the validity of the RSA public key of the SSH server when the SFTP client logs in to the SSH server for the first time. The check is skipped because the SFTP server has not saved the RSA public key of the SSH server. l If the first-time authentication is not enabled on the SSH client, when the SFTP client logs in to the SSH server for the first time, the SFTP client fails to pass the check on the RSA public key validity and cannot log in to the server.
TIP
Except for enabling the first-time authentication on the SSH client, the SFTP client can assign the RSA public key in advance to the SSH server on the SSH client to log in to the server successfully for the first time.
----End
Context
If the first-time authentication on the SSH client is disabled, you need to assign an RSA public key to the SSH server before the STelnet client logs in to the SSH server. Do as follows on the switch that serves as an SSH client:
Procedure
Step 1 Run:
system-view
Step 3 Run:
public-key-code begin
The public key is edited. The public key must be a string of hexadecimal alphanumeric characters. It is automatically generated by an SSH client. You can run the display rsa local-key-pair public command to view a generated public key. Step 5 Run:
public-key-code end
Quit the public key editing view. If the specified hex-data is invalid, the public key cannot be generated after the peer-publickey end command is run; If the specified key-name is deleted in other views, the system prompts that the key does not exist after the peer-public-key end command is run and the system view is displayed. Step 6 Run:
peer-public-key end
Return to the system view from the public key view. Step 7 Run:
ssh client servername assign rsa-key keyname
l Before being assigned to the SSH server, the assigned peer RSA public key must be obtained from the SSH server and must be configured on the SSH client. Then, the SFTP client can successfully undergo the validity check on the RSA public key of the SSH server. l If the RSA public key stored on the SSH client becomes invalid, run the undo ssh client servername assign rsa-key command to cancel the association between the SSH client and the SSH server. Then, run the ssh client servername assign rsa-key keyname command to allocate a new RSA public key to the SSH server.
----End
Context
NOTE
The command of enabling the SFTP client is similar to that of the STelnet. When accessing the SSH server, the SFTP can carry the source address and choose the key exchange algorithm, encrypted algorithm and HMAC algorithm, and configure the keepalive function.
Procedure
Step 1 Run:
system-view
The system view is displayed. Step 2 According to the address type of the SSH server, select and perform one of the two configurations below. l For IPv4 addresses, Run:
sftp [ -a source-address ] host-ipv4 [ port ] [ [ prefer_kex { dh_group1 | dh_exchange_group } ] | [ prefer_ctos_cipher { des | 3des | aes128 } ] | [ prefer_stoc_cipher { des | 3des | aes128 } ] | [ prefer_ctos_hmac { sha1 | sha1_96 | md5 | md5_96 } ] | [ prefer_stoc_hmac { sha1 | sha1_96 | md5 | md5_96 } ] ] * [ -ki aliveinterval [ -kc alivecountmax ] ]
You can log in to the SSH server through SFTP. l For IPv6 addresses, Run:
sftp ipv6 [ -a source-address ] host-ipv6 [ -i interface-type interfacenumber ] [ port ] [ [ prefer_kex { dh_group1 | dh_exchange_group } ] | [ prefer_ctos_cipher { des | 3des | aes128 } ] | [ prefer_stoc_cipher { des | 3des | aes128 } ] | [ prefer_ctos_hmac { sha1 | sha1_96 | md5 | md5_96 } ] | [ prefer_stoc_hmac { sha1 | sha1_96 | md5 | md5_96 } ] ] * [ -ki aliveinterval [ -kc alivecountmax ] ]
----End
Context
NOTE
After the SFTP client logs in to the SSH server, the SFTP client can create or delete the directory on the SSH server, display the current operating directory and information about a specified directory and its files.
Procedure
Step 1 Run:
system-view
The system view is displayed. Step 2 According to the address type of the SSH server, select and perform one of the two configurations below. l For IPv4 addresses, Run:
sftp [ -a source-address ] host-ipv4 [ port ] [ [ prefer_kex { dh_group1 | dh_exchange_group } ] | [ prefer_ctos_cipher { des | 3des | aes128 } ] | [ prefer_stoc_cipher { des | 3des | aes128 } ] | [ prefer_ctos_hmac { sha1 |
Issue 02 (2011-07-15)
142
sha1_96 | md5 | md5_96 } ] | [ prefer_stoc_hmac { sha1 | sha1_96 | md5 | md5_96 } ] ] * [ -ki aliveinterval [ -kc alivecountmax ] ]
You can log in to the SSH server through SFTP. l For IPv6 addresses, Run:
sftp ipv6 [ -a source-address ] host-ipv6 [ -i interface-type interfacenumber ] [ port ] [ [ prefer_kex { dh_group1 | dh_exchange_group } ] | [ prefer_ctos_cipher { des | 3des | aes128 } ] | [ prefer_stoc_cipher { des | 3des | aes128 } ] | [ prefer_ctos_hmac { sha1 | sha1_96 | md5 | md5_96 } ] | [ prefer_stoc_hmac { sha1 | sha1_96 | md5 | md5_96 } ] ] * [ -ki aliveinterval [ -kc alivecountmax ] ]
Context
NOTE
After the SFTP client logs in to the SSH server, SFTP client can change file names, delete files, display the file list, upload and download files on the SFTP server.
Procedure
Step 1 Run:
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 143
The system view is displayed. Step 2 According to the address type of the SSH server, select and perform one of the two configurations below. l For IPv4 addresses, Run:
sftp [ -a source-address ] host-ipv4 [ port ] [ [ prefer_kex { dh_group1 | dh_exchange_group } ] | [ prefer_ctos_cipher { des | 3des | aes128 } ] | [ prefer_stoc_cipher { des | 3des | aes128 } ] | [ prefer_ctos_hmac { sha1 | sha1_96 | md5 | md5_96 } ] | [ prefer_stoc_hmac { sha1 | sha1_96 | md5 | md5_96 } ] ] * [ -ki aliveinterval [ -kc alivecountmax ] ]
You can log in to the SSH server through SFTP. l For IPv6 addresses, Run:
sftp ipv6 [ -a source-address ] host-ipv6 [ -i interface-type interfacenumber ] [ port ] [ [ prefer_kex { dh_group1 | dh_exchange_group } ] | [ prefer_ctos_cipher { des | 3des | aes128 } ] | [ prefer_stoc_cipher { des | 3des | aes128 } ] | [ prefer_ctos_hmac { sha1 | sha1_96 | md5 | md5_96 } ] | [ prefer_stoc_hmac { sha1 | sha1_96 | md5 | md5_96 } ] ] * [ -ki aliveinterval [ -kc alivecountmax ] ]
Context
Do as follows on the login switch:
Procedure
Step 1 Run:
system-view
Issue 02 (2011-07-15)
144
The system view is displayed. Step 2 According to the address type of the SSH server, select and perform one of the two configurations below. l For IPv4 addresses, Run:
sftp [ -a source-address ] host-ipv4 [ port ] [ [ prefer_kex { dh_group1 | dh_exchange_group } ] | [ prefer_ctos_cipher { des | 3des | aes128 } ] | [ prefer_stoc_cipher { des | 3des | aes128 } ] | [ prefer_ctos_hmac { sha1 | sha1_96 | md5 | md5_96 } ] | [ prefer_stoc_hmac { sha1 | sha1_96 | md5 | md5_96 } ] ] * [ -ki aliveinterval [ -kc alivecountmax ] ]
You can log in to the SSH server through SFTP. l For IPv6 addresses, Run:
sftp ipv6 [ -a source-address ] host-ipv6 [ -i interface-type interfacenumber ] [ port ] [ [ prefer_kex { dh_group1 | dh_exchange_group } ] | [ prefer_ctos_cipher { des | 3des | aes128 } ] | [ prefer_stoc_cipher { des | 3des | aes128 } ] | [ prefer_ctos_hmac { sha1 | sha1_96 | md5 | md5_96 } ] | [ prefer_stoc_hmac { sha1 | sha1_96 | md5 | md5_96 } ] ] * [ -ki aliveinterval [ -kc alivecountmax ] ]
Step 3 Run:
help [all | command-name ]
Prerequisite
The configuration of the SFTP Client Function are complete.
Procedure
l l Run the display ssh server-info command to check the mapping between the SSH server and the RSA public key on the SSH client. Run the display ssh server session command to check the session of the SSH client on the SSH server.
----End
Example
Run the display ssh server session command, and you can view that the client logs in from the VTY4 through the sftp service in rsa authentication mode.
[Quidway] display ssh server session Session 2: Conn : VTY 4 Version : 2.0 State : started Username : client002 Retry : 1 CTOS Cipher : aes128-cbc
Issue 02 (2011-07-15)
145
Applicable Environment
SCP is a secure file transfer method based on SSH2.0. Unlike SFTP, SCP allows file uploading or downloading without user authentication and public key assignment, and also supports file uploading or downloading in batches.
Pre-configuration Tasks
Before configuring the SCP client, complete the following tasks: l l l Generating a local RSA key pair on the SCP server Configuring SCP users on the SCP server Enabling SCP services on the SCP server
Data Preparation
To configure the SCP client, you need the following data. No. 1 2 Data (Optional) Source IPv4 or IPv6 address and source interface of the local switch Port number of the remote SCP server, encryption algorithm for uploading or downloading files, source files to be uploaded or downloaded, and destination files to be uploaded or downloaded
Context
Do as follows on the switch functioning as the SCP client:
Procedure
Step 1 Run:
system-view
A source IP address or a source interface is configured for the SCP client. At present, the available source interface must be a loobpack interface. A loopback interface is recommended to improve network security. ----End
Context
NOTE
When logging in to the SCP server, the SCP client can carry source IP address, and select an encryption algorithm.
Procedure
Step 1 Run:
system-view
The system view is displayed. Step 2 Files are uploaded from the SCP client to the remote SCP server or downloaded from the remote SCP server to the SCP client. l Basing on IPv4 address scp [ -port port-number | -a sourceaddress | -i interface-type interface-number | -r | cipher { des | 3des | aes128 } | -c ]* sourcefile destinationfile l Basing on IPv6 address scp ipv6 [ -port port-number | -a sourceipv6address | -r | -cipher { des | 3des | aes128 } | c ]* sourcefile destinationfile [ -i interface-type interface-number ] ----End
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 147
Prerequisite
The configurations of the SCP client are complete.
Context
l Run the display scp-client command to view the source IP address or source interface of the SCP client.
Example
Run the display scp-client command, and you can view the source IP address of the SCP client.
<Quidway> display scp-client The source of SCP ipv4 client: 1.1.1.1 The source of SCP ipv6 client: --
Networking Requirements
As shown in Figure 9-3, after logging in to Switch A, the user logs in to Switch B through Telnet by using the default interface 23. Figure 9-3 Networking diagram of the remote login of the Ethernet user
PC
SwitchA 10.10.10.8/24
Interface Ethernet0/0/1 Ethernet0/0/1
SwitchB 10.10.10.9/24
VLANIF interface VLANIF 2 VLANIF 2 IP address 10.10.10.8/24 10.10.10.9/24
Issue 02 (2011-07-15)
148
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. 3. Assign IP addresses to Switch A and Switch B. Configure an authentication mode and password on Switch B. Log in to Switch B from Switch A.
Data Preparation
To complete the configuration, you need the following data: l l l l ID of the VLAN IP address and number of the interface on the Switch A that functions as the Telnet client IP address and number of the interface on the Switch B that functions as the Telnet server Authentication mode and the password for a user to log in to Switch B through Telnet
Procedure
Step 1 Assign IP addresses. # Assign IP address to Switch A that functions as the Telnet client.
<SwitchA> system-view [SwitchA] vlan 2 [SwitchA-vlan2] quit [SwitchA] interface ethernet [SwitchA-Ethernet0/0/1] port [SwitchA-Ethernet0/0/1] port [SwitchA-Ethernet0/0/1] quit [SwitchA] interface vlanif 2 [SwitchA-Vlanif2] ip address [SwitchA-Vlanif2] quit [SwitchA]
----End
Configuration Files
l Configuration file of Switch A
# sysname SwitchA # vlan batch 2 # interface Vlanif2 ip address 10.10.10.8 255.255.255.0 # interface Ethernet0/0/1 port hybrid pvid vlan 2 port hybrid untagged vlan 2 # return
9.8.2 Example for Configuring the PC as the STelnet Client to Connect to the SSH Server
This part provides an example for configuring the PC as the STelnet client to connect to the SSH server. In this example, after generating the local key pair on the SSH server, configuring the name and password of the SSH user on the SSH server, and enabling the STelnet service on the SSH server, you can connect the Stelnet client to the SSH server.
Networking Requirements
As shown in Figure 9-4, after the STelnet service is enabled on the SSH server, the STelnet client can log in to the SSH server with the password, RSA, password-rsa, or all authentication mode. Configure Client001 with the password as huawei and adopt the password authentication.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 150
The IP address of the SSH server is 192.168.1.1. The user interface supports only SSH. Figure 9-4 Networking diagram of configuring the PC as the STelnet client to connect to the SSH server
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. 3. Configure Client001 on the SSH server. Enable STelnet service on the SSH server. Configure password authentication as the default authentication mode on the SSH server.
Data Preparation
To complete the configuration, you need the following data: l l l Name and the authentication mode of the SSH user Password of the SSH user Name of the SSH server
Procedure
Step 1 Generate a local key pair on the server.
<Quidway> system-view [Quidway] sysname SSH Server [SSH Server] rsa local-key-pair create The key name will be: Quidway_Host The range of public key size is (512 ~ 2048). NOTES: If the key modulus is greater than 512, It will take a few minutes. Input the bits in the modulus[default = 512]: 768 Generating keys... .......++++++++++++ ..........++++++++++++ ...................................++++++++ ......++++++++
Issue 02 (2011-07-15)
151
If SSH is configured as the login protocol, the S2300 automatically disables Telnet.
Step 5 Verify the configuration. # Log in to the device through the software putty, and specify the IP address of the device being 192.168.1.1 and the login protocol being SSH.
# Log in to the device through the software putty, and enter the user name client001 and the password huawei.
Issue 02 (2011-07-15)
152
----End
Configuration Files
l Configuration file of the SSH server
# sysname SSH Server # aaa local-user client001 password cipher N`C55QK<`=/Q=^Q`MAF4<1!! local-user client001 privilege level 3 local-user client001 service-type ssh # stelnet server enable ssh authentication-type default password # user-interface vty 0 4 authentication-mode aaa protocol inbound ssh # return
9.8.3 Example for Configuring the Switch as the STelnet Client to Connect to the SSH Server
In this example, the local key pairs are generated on the STelnet client and the SSH server; the public RSA key is generated on the SSH server and then bound to the STelnet client. In this manner, the STelnet client can connect to the SSH server.
Issue 02 (2011-07-15)
153
Networking Requirements
When you need to log in from a switch to other switches to configure the switches, you can configure the switch as an STelnet client. As shown in Figure 9-5, after the STelnet service is enabled on the SSH server, the STelnet client can log in to the SSH server in the authentication mode of password, RSA, password-rsa, or all. The following login users need to be configured. l l Client001, with the password as huawei and the authentication mode as password Client002, with the password as rsakey001 and the authentication mode as RSA
The user interface supports only the SSH protocol. Figure 9-5 Networking diagram of connecting the STelnet client and the SSH server
10.164.39.220/24
10.164.39.221/24
Client001 Client002
Switch SSH server Client001 Client002 Interface Ethernet0/0/1 Ethernet0/0/1 Ethernet0/0/1 VLANIF interface IP address VLANIF 10 VLANIF 10 VLANIF 10 10.164.39.222/24 10.164.39.220/24 10.164.39.221/24
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. 3. 4. 5. 6. Create a VLAN that each interface belongs to and assign an IP address to each VLANIF interface. Configure Client001 and Client002 on the SSH server. Create a local key pair on the STelnet client and SSH server separately. Generate an RSA public key on the SSH server and bind the RSA public key of the SSH client to Client002. Enable the STelnet service on the SSH server. Client001 and Client002 log in to the SSH server through STelnet.
Data Preparation
To complete the configuration, you need the following data:
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 154
l l l l
IP addresses of the FTP server and client, as shown in Figure 9-5 SSH user name and authentication mode Password or RSA public key SSH server name
Procedure
Step 1 Create a VLAN that each interface belongs to and assign an IP address to each VLANIF interface. Create VLAN 10 on the Switch that functions as the server and assign IP address 10.164.39.222/24 to interface VLANIF10.
<Quidway> system-view [Quidway] vlan 10 [Quidway-vlan10] quit [Quidway] interface ethernet 0/0/1 [Quidway-Ethernet0/0/1] port hybrid pvid vlan 10 [Quidway-Ethernet0/0/1] port hybrid untagged vlan 10 [Quidway-Ethernet0/0/1] quit [Quidway] interface vlanif 10 [Quidway-Vlanif10] ip address 10.164.39.222 24
Assigning an IP address to the Switch that functions as Client001 or Client002 is the same as assigning an IP address to VLANIF 10, and is not mentioned here. Step 2 Create a local key pair on the SSH server.
<Quidway> system-view [Quidway] rsa local-key-pair create The key name will be: Quidway_Host The range of public key size is (512 ~ 2048). NOTES:If the key modulus is greater than 512, It will take a few minutes. Input the bits in the modulus[default = 512]: Generating keys... .......++++++++++++ ..........++++++++++++ ...................................++++++++ ......++++++++
SSH users can be authenticated in four modes: password, RSA, password-rsa, and all. l Before configuring the authentication mode of password or password-rsa, you must configure a local user. l Before configuring the authentication mode of RSA, password-rsa, or all, you must copy the RSA public key of the SSH client to the server.
l Create an SSH user named Client001. # Create an SSH user named Client001 and configure the authentication mode as password for the user.
[Quidway] ssh user client001 [Quidway] ssh user client001 authentication-type password
l # Create an SSH user named Client002 and configure the authentication mode as RSA for the user.
[Quidway] ssh user client002 [Quidway] ssh user client002 authentication-type rsa
Step 4 Configure the RSA public key on the server. # Create a local key pair on the client.
<Quidway> system-view [Quidway] sysname client002 [client002] rsa local-key-pair create
# Send the RSA public key generated on the client to the server.
[Quidway] rsa peer-public-key RsaKey001 Enter "RSA public key" view, return system view with "peer-public-key end". [Quidway-rsa-public-key] public-key-code begin Enter "RSA key code" view, return last view with "public-key-code end". [Quidway-rsa-key-code] 3047 [Quidway-rsa-key-code] 0240
Issue 02 (2011-07-15)
156
Step 5 Bind the RSA public key of the SSH client to Client002.
[Quidway] ssh user client002 assign rsa-key RsaKey001
Step 6 Enable the STelnet service on the SSH server. # Enable the STelnet service.
[Quidway] stelnet server enable
Step 8 Connect the STelnet and the SSH server. # You must enable the initial authentication on the SSH client for the first login.
[client001] ssh client first-time enable [client002] ssh client first-time enable
# Client001 logs in to the SSH server in password authentication mode by entering the user name and password.
<client001> system-view [client001] stelnet 10.164.39.222 Please input the username:client001 Trying 10.164.39.222 ... Press CTRL+K to abort Connected to 10.164.39.222 ... The server is not authenticated. Continue to access it?(Y/N):y Save the server's public key?(Y/N):y The server's public key will be saved with the name: 10.164.39.222. Please wait... Enter password:
Enter the password huawei, and information indicating that the login succeeds is displayed as follows:
info: The max number of VTY users is 20, and the current number of VTY users on line is 1. <Quidway>
Step 9 Verify the configuration. After the configuration, run the commands of display ssh server status and display ssh server session on the SSH server. You can view that the STelnet service is enabled, and that the STelnet client logs in to the server successfully.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 157
----End
Configuration Files
l Configuration file of the Quidway, the SSH server
# sysname Quidway # vlan batch 10
Issue 02 (2011-07-15)
158
# interface Vlanif10 ip address 10.164.39.222 255.255.255.0 # rsa peer-public-key rsakey001 public-key-code begin 3047 0240 BFF35E4B C61BD786 F907B5DE 7D6770C3 E5FD17AB 203C8FCB BBC8FDF2 F7CB674E 519E8419 0F6B97A8 EA91FC4B B9E18836 5E74BFD5 4C687767 A89C6B43 1D7E3E1B 0203 010001 public-key-code end peer-public-key end # aaa local-user client001 password simple huawei local-user client001 service-type ssh # stelnet server enable ssh user client001 ssh user client002 ssh user client001 authentication-type password ssh user client002 authentication-type rsa ssh user client002 assign rsa-key RsaKey001 ssh user client001 service-type stelnet ssh user client002 service-type stelnet # interface Ethernet0/0/1 port hybrid pvid vlan 10 port hybrid untagged vlan 10 # user-interface vty 0 4 authentication-mode aaa protocol inbound ssh # return
Issue 02 (2011-07-15)
159
9.8.4 Example for Connecting the SFTP Clinet and the SSH Server
In this example, the local key pairs are generated on the SFTP client and the SSH server respectively; the public RSA key is generated on the SSH server and bind the RSA public key to the SFTP client. In this manner, the SFTP client can connect to the SSH server.
Networking Requirements
As shown in Figure 9-6, after the SFTP service is enabled on the SSH server, the SFTP client can log in to the SSH server in the authentication mode of password, RSA, password-rsa, or all. Figure 9-6 Networking diagram for connecting the SFTP client and the SSH server
10.164.39.220/24
10.164.39.221/24
Client001 Client002
Switch SSH server Client001 Client002 Interface Ethernet0/0/1 Ethernet0/0/1 Ethernet0/0/1 VLANIF interface VLANIF 10 VLANIF 10 VLANIF 10 IP address 10.164.39.222/24 10.164.39.220/24 10.164.39.221/24
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. 3. 4. 5. 6. 7. Create a VLAN that each interface belongs to and assign an IP address to each VLANIF interface. Configure Client001 and Client002 on the SSH server. Create a local key pair on the SFTP client and SSH server separately. Create an RSA public key on the SSH server and bind the RSA public key of the SSH client to Client002. Enable the SFTP service on the SSH server. Configure the type of service and authenticated directory for the SSH user. Client001 and Client002 log in to the SSH server through SFTP.
Data Preparation
To complete the configuration, you need the following data:
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 160
l l l l
IP addresses of the FTP server and client, as shown in Figure 9-6 SSH user name and authentication mode Password or RSA public key of the SSH user SSH server name
Procedure
Step 1 Create a VLAN that each interface belongs to and assign an IP address to each VLANIF interface. Create VLAN 10 on the S2300 that functions as the server and assign IP address 10.164.39.222/24 to VLANIF 10.
<Quidway> system-view [Quidway] vlan 10 [Quidway] quit [Quidway] interface ethernet 0/0/1 [Quidway-Ethernet0/0/1] port hybrid pvid vlan 10 [Quidway-Ethernet0/0/1] port hybrid untagged vlan 10 [Quidway-Ethernet0/0/1] quit [Quidway] interface vlanif 10 [Quidway-Vlanif10] ip address 10.164.39.222 24
Assigning an IP address to the S2300 that functions as Client001 or Client002 is the same as assigning an IP address to VLANIF 10, and is not mentioned here. Step 2 Create a local key pair on the SSH server.
<Quidway> system-view [Quidway] rsa local-key-pair create The key name will be: Quidway_Host The range of public key size is (512 ~ 2048). NOTES: If the key modulus is greater than 512, It will take a few minutes. Input the bits in the modulus[default = 512]: Generating keys... ...........++++++++++++ ..................++++++++++++ ...++++++++ ...........++++++++
SSH users can be authenticated in four modes: password, RSA, password-rsa, and all. l In password or password-rsa authentication mode, you must configure a local user. l In RSA or all authentication mode, you must copy the RSA public key of the SSH client to the server.
l Create an SSH user named Client001. # Create an SSH user named Client001 and configure the authentication mode as password for the user.
[Quidway] ssh user client001 [Quidway] ssh user client001 authentication-type password
Issue 02 (2011-07-15)
161
l # Create an SSH user named Client002 and configure the authentication mode as RSA for the user.
[Quidway] ssh user client002 [Quidway] ssh user client002 authentication-type rsa
Step 4 Configure the RSA public key on the server. # Create a local key pair on the client.
<Quidway> system-view [Quidway] sysname client002 [client002] rsa local-key-pair create
# Send the RSA public key created on the client to the server.
[Quidway] rsa peer-public-key RsaKey001 Enter "RSA public key" view, return system view with "peer-public-key end". [Quidway-rsa-public-key] public-key-code begin Enter "RSA key code" view, return last view with "public-key-code end". [Quidway-rsa-key-code] 3047 [Quidway-rsa-key-code] 0240 [Quidway-rsa-key-code] BFF35E4B C61BD786 F907B5DE 7D6770C3 E5FD17AB [Quidway-rsa-key-code] 203C8FCB BBC8FDF2 F7CB674E 519E8419 0F6B97A8 [Quidway-rsa-key-code] EA91FC4B B9E18836 5E74BFD5 4C687767 A89C6B43 [Quidway-rsa-key-code] 1D7E3E1B
Issue 02 (2011-07-15)
162
Step 5 Bind the RSA public key of the SSH client to Client002.
[Quidway] ssh user client002 assign rsa-key RsaKey001
Step 6 Enable the SFTP service on the SSH server. # Enable the SFTP service.
[Quidway] sftp server enable
Step 7 On the SSH server, set the type of service for the SSH user and the authorized directory. Two SSH users are configured on the SSH server: Client001 in the password authentication mode and Client002 in the RSA authentication mode.
[Quidway] [Quidway] [Quidway] [Quidway] ssh ssh ssh ssh user user user user client001 client001 client002 client002 service-type sftp sftp-directory flash:/ service-type sftp sftp-directory flash:/
Step 8 Connect the SFTP client and the SSH server. # You must enable the initial authentication on the SSH client for the first login.
[client001] ssh client first-time enable [client002] ssh client first-time enable
Step 9 Verify the configuration. After the configuration, run the display ssh server status and display ssh server session commands on the SSH server. You can view that the SFTP service is enabled, and that the SFTP client logs in to the server successfully. # Check the status of the SSH server.
[Quidway] display ssh server status SSH version SSH connection timeout SSH server key generating interval SSH Authentication retries SFTP server Stelnet server Scp server :1.99 :60 seconds :0 hours :3 times :Enable :Disable :Disable
----End
Configuration Files
l Configuration file of the Quidway, the SSH server
# sysname Quidway # vlan batch 10 # interface Vlanif10 ip address 10.164.39.222 255.255.255.0 # rsa peer-public-key rsakey001 public-key-code begin 3047 0240 C4989BF0 416DA8F2 2675910D 7F2997E8 5573A35D 0163FD4A FAC39A6E 0F45F325 A4E3AA1D 54692B04 C6A28D3D C58DE2E8 E0D58D65 7A25CF92 A74D21F9 E917182B 0203 010001 public-key-code end
Issue 02 (2011-07-15)
164
9.8.5 Example for Configuring the SSH Server to Support the Access from Another Port
In this example, the monitoring port number of the SSH server is set to a port number other than the standard monitoring port number so that only valid users can set up connections with the SSH server.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 165
Networking Requirements
The standard listening port is numbered 22, as defined in the SSH protocol. If attackers access the standard port continuously, the bandwidth is consumed and the performance of the server is degraded. As a result, other valid users cannot access the port. If the listening port on the SSH server is changed to a non-default one, attackers will not aware of this change and continue to send a request for the socket connection to port 22. In this case, the SSH server detects that it is not the listening port, and then denies the the request for establishing the socket connection. Therefore, only valid users can use the specified listening port to set up a socket connection through the following procedures: l l l l l l Negotiating the version of the SSH protocol Negotiating the algorithm Generating the session key Authenticating Sending a request for a session Performing the interactive session
Figure 9-7 Networking diagram for configuring the SSH server to support the access from another port
10.164.39.220/24
10.164.39.221/24
Client001 Client002
Switch SSH server Client001 Client002 Interface Ethernet0/0/1 Ethernet0/0/1 Ethernet0/0/1 VLANIF interface VLANIF 10 VLANIF 10 VLANIF 10 IP address 10.164.39.222/24 10.164.39.220/24 10.164.39.221/24
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. 3.
Issue 02 (2011-07-15)
Create a VLAN that each interface belongs to and assign an IP address to each VLANIF interface. Configure Client001 and Client002 on the SSH server. Create a local key pair on the SFTP client and SSH server separately.
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 166
4. 5. 6. 7. 8.
Generate an RSA public key on the SSH server and bind the RSA public key of the SSH client to Client002. Enable the STelnet and SFTP services on the SSH server. Configure the type of the service and authenticated directory for the SSH user. Set the listening port number on the SSH server. Client001 and Client002 log in to the SSH server through STelnet and SFTP separately.
Data Preparation
To complete the configuration, you need the following data: l l l l l IP addresses of the FTP server and client, as shown in Figure 9-7 SSH user name and authentication mode Password or RSA public key of the SSH user Server name Listening port number on the SSH server
Procedure
Step 1 Create a VLAN that each interface belongs to and assign an IP address to each VLANIF interface. Create VLAN 10 on the Switch that functions as the server and assign IP address 10.164.39.222/24 to VLANIF 10.
<Quidway> system-view [Quidway] vlan 10 [Quidway-vlan10] quit [Quidway] interface ethernet 0/0/1 [Quidway-Ethernet0/0/1] port hybrid pvid vlan 10 [Quidway-Ethernet0/0/1] port hybrid untagged vlan 10 [Quidway-Ethernet0/0/1] quit [Quidway] interface vlanif 10 [Quidway-Vlanif10] ip address 10.164.39.222 24
Assigning an IP address to theSwitch that functions as Client001 or Client002 is the same as assigning an IP address to VLANIF 10, and is not mentioned here. Step 2 A local key pair generated on the SSH server
<Quidway> system-view [Quidway] rsa local-key-pair create The key name will be: Quidway_Host The range of public key size is (512 ~ 2048). NOTES: If the key modulus is greater than 512, It will take a few minutes. Input the bits in the modulus[default = 512]: Generating keys... ...........++++++++++++ ..................++++++++++++ ...++++++++ ...........++++++++
Step 3 Configure the RSA public key on the server. # Create a local key pair on the client.
<Quidway> system-view [Quidway] sysname client002 [client002] rsa local-key-pair create
Public key code for pasting into OpenSSH authorized_keys file : ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAQQC/815LxhvXhvkHtd59Z3DD5f0XqyA8j8u7yP3y98tn TlGehBkPa5eo6pH8S7nhiDZedL/VTGh3Z6ica0Mdfj4b rsa-key ===================================================== Time of Key pair created: 16:38:51 2007/5/25 Key name: client002_Server Key type: RSA encryption Key ===================================================== Key code: 3067 0260 BCFAC085 49A2E70E 1284F901 937D7B63 D7A077AB D2797280 4BCA86C0 4CD18B70 5DFAC9D3 9A3F3E74 9B2AF4CB 69FA6483 E87DA590 7B47721A 16391E27 1C76ABAB 743C568B 1B35EC7A 8572A096 BCA9DF0E BC89D3DB 5A83698C 9063DB39 A279DD89 0203 010001 [client002]
# Send the RSA public key generated on the client to the server.
[Quidway] rsa peer-public-key RsaKey001 Enter "RSA public key" view, return system view with "peer-public-key end". [Quidway-rsa-public-key] public-key-code begin Enter "RSA key code" view, return last view with "public-key-code end". [Quidway-rsa-key-code] 3047 [Quidway-rsa-key-code] 0240 [Quidway-rsa-key-code] BFF35E4B C61BD786 F907B5DE 7D6770C3 E5FD17AB [Quidway-rsa-key-code] 203C8FCB BBC8FDF2 F7CB674E 519E8419 0F6B97A8 [Quidway-rsa-key-code] EA91FC4B B9E18836 5E74BFD5 4C687767 A89C6B43 [Quidway-rsa-key-code] 1D7E3E1B [Quidway-rsa-key-code] 0203 [Quidway-rsa-key-code] 010001 [Quidway-rsa-key-code] public-key-code end [Quidway-rsa-public-key] peer-public-key end
SSH users can be authenticated in four modes: password, RSA, password-rsa, and all. l Before configuring the authentication mode of password or password-rsa, you must configure a local user. l Before configuring the authentication mode of RSA, password-rsa, or all, you must copy the RSA public key of the SSH client to the server.
Issue 02 (2011-07-15)
168
# Create an SSH user named Client001, and configure the authentication mode as password for the user.
[Quidway] ssh user client001 [Quidway] ssh user client001 authentication-type password
# Create an SSH user named Client002, and configure the authentication mode as RSA for the user. Bind the RSA public key of the SSH client to Client002.
[Quidway] ssh user client002 [Quidway] ssh user client002 authentication-type rsa [Quidway] ssh user client002 assign rsa-key RsaKey001
# Set the type of service of Client002 to SFTP and the authorized directory as flash:/.
[Quidway] ssh user client002 service-type sftp [Quidway] ssh user client002 sftp-directory flash:/
Step 5 Enable the STelnet and SFTP services on the SSH server.
[Quidway] stelnet server enable [Quidway] sftp server enable
Step 6 Configure the new listening port number on the SSH server.
[Quidway] ssh server port 1025
Step 7 Connect the SSH client and the SSH server. # You must enable the initial authentication on the SSH client for the first login.
[client001] ssh client first-time enable [client002] ssh client first-time enable
# The STelnet client logs in to the SSH server by using the new listening port.
[client001] stelnet 10.164.39.222 1025 Please input the username:client001 Trying 10.164.39.222 ... Press CTRL+K to abort Connected to 10.164.39.222 ... The server is not authenticated. Do you continue to access it?(Y/N):y Do you want to save the server's public key?(Y/N):y The server's public key will be saved with the name: 10.164.39.222. Please wait... Enter password:
Enter the password huawei, and information indicating that the login succeeds is displayed as follows:
info: The max number of VTY users is 20, and the current number of VTY users on line is 1. <Quidway>
Issue 02 (2011-07-15)
169
# The SFTP client logs in to the SSH server by using the new listening port.
[client002]sftp 10.164.39.222 1025 Please input the username:client002 Trying 10.164.39.222 ... Press CTRL+K to abort The server's public key does not match the one we cached. The server is not authenticated. Do you continue to access it?(Y/N):y Do you want to update the server's public key we cached?(Y/N):y sftp-client>
Step 8 Verify the configuration. Attackers fail to log in to the SSH server by using port 22.
[client002] sftp 10.164.39.222 Please input the username:client002 Trying 10.164.39.222 ... Press CTRL+K to abort Can't establish tcp connection to server
After the configuration, run the commands of display ssh server status and display ssh server session on the SSH server. You can check the current listening port number on the SSH server, and that the STelnet or SFTP client logs in to the server successfully. # Check the status of the SSH server.
[Quidway] display ssh server status SSH version SSH connection timeout SSH server key generating interval SSH Authentication retries SFTP server Stelnet server Scp server SSH server port :1.99 :60 seconds :0 hours :3 times :Enable :Enable :Disable :1025
----End
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 170
Configuration Files
l Configuration file of the Quidway, the SSH server
# sysname Quidway # vlan batch 10 # interface Vlanif10 ip address 10.164.39.222 255.255.255.0 # rsa peer-public-key rsakey001 public-key-code begin 3047 0240 C4989BF0 416DA8F2 2675910D 7F2997E8 5573A35D 0163FD4A FAC39A6E 0F45F325 A4E3AA1D 54692B04 C6A28D3D C58DE2E8 E0D58D65 7A25CF92 A74D21F9 E917182B 0203 010001 public-key-code end peer-public-key end # aaa local-user client001 password simple huawei local-user client001 service-type ssh # sftp server enable stelnet server enable ssh server port 1025 ssh user client001 ssh user client002 ssh user client001 authentication-type password ssh user client002 authentication-type rsa ssh user client002 assign rsa-key RsaKey001 ssh user client001 service-type stelnet ssh user client002 service-type sftp ssh user client002 sftp-directory flash:/ # interface Ethernet0/0/1 port hybrid pvid vlan 10 port hybrid untagged vlan 10 # user-interface vty 0 4 authentication-mode aaa protocol inbound ssh # return
Issue 02 (2011-07-15)
171
Networking Requirements
When an RADIUS user is connected to an SSH server, the SSH server sends the user name and password of the SSH client to the RADIUS server (compatible with the TACACS server) for authentication. The RADIUS server authenticates the user and sends the result (passed or failed) back to the SSH server. If the authentication is successful, the user level is sent along with the result. The SSH server determines whether the SSH client is allowed to set up a connection according to the authentication result. Figure 9-8 shows the networking diagram. Figure 9-8 Networking diagram of authenticating the SSH through RADIUS
10.164.39.221/24
10.164.39.222/24
10.164.6.49/24
SSH Client
SSH Server
Radius Server
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. 3. 4. 5.
Issue 02 (2011-07-15)
Configure the RADIUS template on the SSH server. Configure a domain on the SSH server. Create a user on the RADIUS server. Generate the local key pair on STelnet client and SSH server respectively. The SSH server monitors the port number. Generate the local key pair on the client and SSH server .
Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 172
6. 7. 8. 9.
Generate the RSA public key on SSH server and bind the RSA public key of the SSH client to ssh2@ssh.com. Enable the STelnet and SFTP services on the SSH server. Configure the service mode and authorization directory of the SSH user. Users ssh1@ssh.com and ssh2@ssh.com log in to the SSH server through STelnet and SFTP respectively.
Data Preparation
To complete the configuration, you need the following data: l l l l l Configure the password authentication for the two SSH users . RADIUS authentication Name of the RADIUS template Name of the RADIUS domain Name and password of the RADIUS user
Procedure
Step 1 Generate a local key pair on the SSH server.
<Quidway> system-view [Quidway] rsa local-key-pair create The key name will be: Quidway_Host The range of public key size is (512 ~ 2048). NOTES: If the key modulus is greater than 512, It will take a few minutes. Input the bits in the modulus[default = 512]: 768 Generating keys... .......++++++++++++ ..........++++++++++++ ...................................++++++++ ......++++++++
Step 2 Configure the RSA public key of the server. # Generate a local key pair of client on the client.
<Quidway> system-view [Quidway] sysname client [client] rsa local-key-pair create
Issue 02 (2011-07-15)
173
yP3y98tnTlGehBkPa5eo6pH8S7nhiDZedL/VTGh3Z6ica0Mdfj4b ---- END SSH2 PUBLIC KEY ---Public key code for pasting into OpenSSH authorized_keys file : ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAQQC/815LxhvXhvkHtd59Z3DD5f0XqyA8j8u7yP3y98tn TlGehBkPa5eo6pH8S7nhiDZedL/VTGh3Z6ica0Mdfj4b rsa-key ===================================================== Time of Key pair created: 16:38:51 2007/5/25 Key name: Quidway_Server Key type: RSA encryption Key ===================================================== Key code: 3067 0260 BCFAC085 49A2E70E 1284F901 937D7B63 D7A077AB D2797280 4BCA86C0 4CD18B70 5DFAC9D3 9A3F3E74 9B2AF4CB 69FA6483 E87DA590 7B47721A 16391E27 1C76ABAB 743C568B 1B35EC7A 8572A096 BCA9DF0E BC89D3DB 5A83698C 9063DB39 A279DD89 0203 010001 [client]
# Send the RSA public key generated on the client to the server.
[Quidway] rsa peer-public-key RsaKey001 Enter "RSA public key" view, return system view with "peer-public-key end". [Quidway-rsa-public-key] public-key-code begin Enter "RSA key code" view, return last view with "public-key-code end". [Quidway-rsa-key-code] 3047 [Quidway-rsa-key-code] 0240 [Quidway-rsa-key-code] BFF35E4B C61BD786 F907B5DE 7D6770C3 E5FD17AB [Quidway-rsa-key-code] 203C8FCB BBC8FDF2 F7CB674E 519E8419 0F6B97A8 [Quidway-rsa-key-code] EA91FC4B B9E18836 5E74BFD5 4C687767 A89C6B43 [Quidway-rsa-key-code] 1D7E3E1B [Quidway-rsa-key-code] 0203 [Quidway-rsa-key-code] 010001 [Quidway-rsa-key-code] public-key-code end [Quidway-rsa-public-key] peer-public-key end
Step 3 Create the SSH user. On the RADIUS server, add two users named ssh1@ssh.com and ssh2@ssh.com ; in addition, designate the NAS address 10.164.39.222 and the key huawei. The NAS address refers to the address of the SSH server that connects to the RADIUS server. # Configure the VTY user interface on the SSH server.
[Quidway] user-interface vty 0 4 [Quidway-ui-vty0-4] authentication-mode aaa [Quidway-ui-vty0-4] protocol inbound ssh [Quidway-ui-vty0-4] quit
Step 4 Configure the RADIUS template. # Configure the authentication scheme newscheme and authentication mode RADIUS.
[Quidway] aaa [Quidway-aaa] authentication-scheme newscheme [Quidway-aaa-authen-newscheme] authentication-mode radius
Issue 02 (2011-07-15)
174
# Configure the IP address as 10.164.6.49 and port of the RADIUS authentication server as 1812.
[Quidway-radius-ssh] radius-server authentication 10.164.6.49 1812
Step 5 Configure RADIUS domain name. # Configure the RADIUS domain of SSH server as ssh.com, applying authentication scheme newscheme and RADIUS template ssh.
[Quidway] aaa [Quidway-aaa] domain ssh.com [Quidway-aaa-domain-ssh.com] authentication-scheme newscheme [Quidway-aaa-domain-ssh.com] radius-server ssh [Quidway-aaa-domain-ssh.com] quit [Quidway-aaa] quit
Step 6 Connect the SSH client and the SSH server. # Enable STelnet and SFTP services on the SSH server.
[Quidway] stelnet server enable [Quidway] sftp server enable
# For the first login, you need to enable the first authentication on SSH client.
[client] ssh client first-time enable [client] quit
# Connect the STelnet client to the SSH server in the RADIUS authentication.
<client> system-view [client] stelnet 10.164.39.222 Please input the username: ssh1@ssh.com Trying 10.164.39.222 ... Press CTRL+K to abort Connected to 10.164.39.222 ... he server is not authenticated. Do you continue to access it?(Y/N):y Do you want to save the server's public key?(Y/N):y he server's public key will be saved with the name: 10.164.39.222. Please wait... Enter password:
# Connect the SFTP client to the SSH server in the RADIUS authentication.
<client> system-view [client] sftp 10.164.39.222 Please input the username: ssh2@ssh.com Trying 10.164.39.222 ... Press CTRL+K to abort Connected to 10.164.39.222 ... Enter password: sftp-client>
Issue 02 (2011-07-15)
175
Step 7 Verify the configuration. After the configuration, run the display radius-server configuration and display ssh server session commands on the SSH server. You can view the configuration of the RADIUS server on the SSH server. You can also view that the STelnet or SFTP client is connected to the SSH server successfully with RADIUS authentication. # Display the configuration of the RADIUS server.
[Quidway-aaa] display radius-server configuration ------------------------------------------------------------------Server-template-name : ssh Protocol-version : standard Traffic-unit : B Shared-secret-key : huawei Timeout-interval(in second) : 5 Primary-authentication-server : 10.164.6.49 :1812 LoopBack:NULL Primary-accounting-server : 0.0.0.0 :0 LoopBack:NULL Secondary-authentication-server : 0.0.0.0 :0 LoopBack:NULL Secondary-accounting-server : 0.0.0.0 :0 LoopBack:NULL Retransmission : 3 Domain-included : YES Calling-station-id MAC-format : xxxx-xxxx-xxxx ------------------------------------------------------------------Total of radius template :1
----End
Configuration Files
Configuration file of the SSH server
# sysname Quidway # radius-server template ssh radius-server authentication 10.164.6.49 1812
Issue 02 (2011-07-15)
176
# rsa peer-public-key rsakey001 public-key-code begin 3047 0240 C4989BF0 416DA8F2 2675910D 7F2997E8 5573A35D 0163FD4A FAC39A6E 0F45F325 A4E3AA1D 54692B04 C6A28D3D C58DE2E8 E0D58D65 7A25CF92 A74D21F9 E917182B 0203 010001 public-key-code end peer-public-key end # aaa authentication-scheme newscheme authentication-mode radius # domain ssh.com authentication-scheme newscheme radius-server ssh # # sftp server enable stelnet server enable ssh user ssh1@ssh.com ssh user ssh2@ssh.com ssh user ssh1@ssh.com authentication-type password ssh user ssh2@ssh.com authentication-type password ssh user ssh2@ssh.com assign rsa-key RsaKey001 ssh user ssh1@ssh.com service-type stelnet ssh user ssh2@ssh.com service-type sftp ssh user client001 sftp-directory flash:/ # user-interface vty 0 4 authentication-mode aaa protocol inbound ssh # Return
Networking Requirements
As shown in Figure 9-9, the switch functioning as the SCP client has a reachable route to the SCP server, and can download files from the SCP server. Figure 9-9 Networking diagram of the SCP client
Configuration Roadmap
The configuration roadmap is as follows: 1. 2. 3. 4. 5. 6. Create a local RSA key pair on the SSH server. Create an SSH user on the SSH server. Enable SCP services on the SSH server. Enable first-time authentication on the SSH client. Configure an IP address of the source interface on the SCP client. Download files from the SSH server to the SCP client.
Data Preparation
To complete the configuration, you need the following data: l l l SSH user name, authentication mode, and authentication password IP address of the source interface on the SCP client The name and path of the destination files and the source files.
Procedure
Step 1 Create a local RSA key pair on the SSH server.
<Quidway> system-view [Quidway] sysname SSH Server [SSH Server] rsa local-key-pair create The key name will be: SSH Server_Host The range of public key size is (512 ~ 2048). NOTES: If the key modulus is greater than 512, It will take a few minutes. Input the bits in the modulus[default = 512]: 512 Generating keys... .....++++++++++++ ....++++++++++++ ......++++++++ ................................++++++++
Step 2 Create an SSH user on the SCP server. # Configure the VTY user interface.
[SSH [SSH [SSH [SSH Server] user-interface vty 0 4 Server-ui-vty0-4] authentication-mode aaa Server-ui-vty0-4] protocol inbound ssh Server-ui-vty0-4] quit
# Configure the service type for the SSH users Client001 to all.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 178
Step 4 Download files from the SCP server to the SCP client. # For the first login, you need to enable the first authentication on SSH client.
<Quidway> system-view [Quidway] sysname SCP Client [SCP Client] ssh client first-time enable
# Configure the IP address 1.1.1.1 of a loopback interface as the source IP address for the SCP client.
[SCP Client] scp client-source -a 1.1.1.1
# Use 3des to encrypt the file license.txt, and then download the file to the local working directory from the remote SCP server with the IP address of 172.16.104.110.
[SCP Client] scp -a 1.1.1.1 -cipher 3des client001@172.16.104.110:license.txt license.txt
Step 5 Verify the configuration. Run the display scp-client command on the SCP client. The command output is as follows:
<Quidway> display scp-client The source of SCP ipv4 client: 1.1.1.1
The IP address of the source interface on the SCP client is 1.1.1.1. ----End
Configuration Files
l Configuration file of the SCP server
# sysname SSH Server # aaa local-user client001 password simple huawei local-user client001 service-type ssh # scp server enable ssh user client001 ssh user client001 authentication-type password ssh user client001 service-type all # user-interface vty 0 4 authentication-mode aaa protocol inbound ssh # return
Issue 02 (2011-07-15)
179
10
About This Chapter
Before configuring the S2300 in Web mode, you need to configure the S2300 as the Web server. 10.1 Overview of Web System Through the Web system, users can manage and maintain the S2300 in the graphical user interface (GUI). 10.2 Starting Web System This topic describes how to load the Web system and create an account of the Web system.
Issue 02 (2011-07-15)
180
Switch
HTTP Connection
PC
Procedure
Step 1 Enable the HyperTerminal on the PC.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 181
Choose Start > All Programs > Accessories > Communications > HyperTerminal to start the HyperTerminal. Step 2 Set up a new connection. As shown in Figure 10-2, enter the name of the new connection in the Name text box and choose an icon. Click OK. Figure 10-2 Setting up a new connection
Step 3 Set the connection port. After entering the Connect window as shown in Figure 10-3, select a serial port from the Connect drop-down list box according to the port used by the PC or the configuration terminal. Select COM1 in this case, and click OK.
Issue 02 (2011-07-15)
182
Step 4 Set communication parameters. After entering the COM1 Properties window as shown in Figure 10-4, set the communication parameters according to the description in Table 10-1.
NOTE
In other Windows operating systems, Bits per second may be described as Baud rate; Flow control may be described as Traffic control.
Issue 02 (2011-07-15)
183
Table 10-1 Communication parameters Parameter Bit per second (Baud rate) Data bit Parity check Stop bit Flow control (Traffic control) Value 9600 8 None 1 None
Step 5 After the HyperTerminal is started, select File Attributes to enter the Connect Properties window as shown in Figure 10-5. Choose the Setting tab, select Auto detect or VT100 from the Emulation drop-down list box. Click OK to complete the setting.
Issue 02 (2011-07-15)
184
After the preceding steps are complete, press Enter. If the prompt <Quidway> is displayed, it indicates that you have logged in to the S2300. At this time, you can enter the command to configure and manage the S2300. ----End
Procedure
Step 1 Run: system-view The system view is displayed. Step 2 Run:
interface vlanif interface-number
The view of the interface of the management VLAN is displayed. Step 3 Run:
ip address ip-address { mask | mask-length } [ sub ]
Issue 02 (2011-07-15)
185
Prerequisite
To obtain the Web page file of the S2300, log in to http://support.huawei.com, and then choose Software Center > Version Software > Data Communication Product Line > Ethernet Switch > S23&33&53&CX200D Series. Download the software package of the current version. The Web page file is contained in the software package. The file name is Product Name + the Version of Software.web.zip. Before uploading the Web page file, copy the Web page file to the client from which you log in to the S2300.
Context
NOTE
You can also download Web files through TFTP. In this case, the S2300 functions as the TFTP client, and the terminal that stores the Web files functions as the TFTP server. For details, see 8.5.3 Downloading Files Through TFTP.
Procedure
Step 1 Run:
system-view
An FTP client is configured and the password is set to huawei. Step 5 Run:
local-user user-name ftp-directory directory
Step 7 Run the following command in the cmd view of the PC:
ftp ip-address
The user name and password are displayed. The PC can log in to the S2300.
C:\>ftp 10.1.1.132 Connected to 10.1.1.132. 220 FTP service ready. User (10.1.1.132:(none)): client 331 Password required for client. Password: 230 User logged in. ftp>
----End
Context
Before loading the Web page file, upload it to the S2300.
Procedure
Step 1 Run:
system-view
Context
Before enabling the HTTP server,load the Web Page File to S2300.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 187
Procedure
Step 1 Run:
system-view
You are recommended to set the password in the cipher text. Simple user name and password should not be used for the sake of security.
Step 5 Run:
local-user user-name service-type http
The access type of the user named admin is set to HTTP. Step 6 Run:
quit
The timeout period of an HTTP connection is set. By default, the timeout period of an HTTP connection is 20 minutes. ----End
Procedure
Step 1 Open the Web browser on the PC, and then enter the management address of the S2300 in the address bar (the PC and the S2300 have reachable routes to each other). Then, press Enter to display the Login dialog box. As shown in Figure 10-6, enter the pre-set Web user name, password and verify code, and then choice the language.
Issue 02 (2011-07-15) Huawei Proprietary and Confidential Copyright Huawei Technologies Co., Ltd. 188
NOTE
If you select Save my password before clicking Login, you do not need to enter the password at next login.
Step 2 Click Login or press enter to display the homepage of the Web system. You can configure the S2300 after logging in to the Web system. For details on how to configure the S2300 on the Web system, see the Quidway S2300 Series Ethernet Switches Web Network Management System Client Operation Guide. ----End
Issue 02 (2011-07-15)
189