Configuration Guide - Basic Configuration (V100R005C01 - 02)

Quidway S5300 Series Ethernet Switches
V100R005C01
Configuration Guide - Basic

Configuration
Issue 02
Date 2010-12-01
HUAWEI TECHNOLOGIES CO., LTD.

Copyright © Huawei Technologies Co., Ltd. 2010. All rights reserved.
No part of this document may be reproduced or transmitted in any form or by any means without prior written
consent of Huawei Technologies Co., Ltd.
Trademarks and Permissions
and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.
All other trademarks and trade names mentioned in this document are the property of their respective holders.
Notice
The purchased products, services and features are stipulated by the contract made between Huawei and the
customer. All or part of the products, services and features described in this document may not be within the
purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information,
and recommendations in this document are provided "AS IS" without warranties, guarantees or representations
of any kind, either express or implied.
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.
Huawei Technologies Co., Ltd.

Address: Huawei Industrial Base
Bantian, Longgang
Shenzhen 518129
People's Republic of China
Website: http://www.huawei.com
Email: [email protected]
Issue 02 (2010-12-01) Huawei Proprietary and Confidential i

Copyright © Huawei Technologies Co., Ltd.
Configuration Guide - Basic Configuration About This Document
About This Document
Intended Audience
This document provides the basic concepts, basic configuration procedures, and configuration
examples supported by the S5300.
This document is intended for:
l Data configuration engineers
l Commissioning engineers
l Network monitoring engineers
l System maintenance engineers
Symbol Conventions
The symbols that may be found in this document are defined as follows.
Symbol Description
Indicates a hazard with a high level of risk, which if not

avoided, will result in death or serious injury.
DANGER
Indicates a hazard with a medium or low level of risk, which

if not avoided, could result in minor or moderate injury.
WARNING
Indicates a potentially hazardous situation, which if not

avoided, could result in equipment damage, data loss,
CAUTION
performance degradation, or unexpected results.
TIP Indicates a tip that may help you solve a problem or save
time.
NOTE Provides additional information to emphasize or supplement

important points of the main text.
Issue 02 (2010-12-01) Huawei Proprietary and Confidential iii

About This Document Configuration Guide - Basic Configuration
Command Conventions
The command conventions that may be found in this document are defined as follows.
Convention Description
Boldface The keywords of a command line are in boldface.
Italic Command arguments are in italics.
[] Items (keywords or arguments) in brackets [ ] are optional.
{ x | y | ... } Optional items are grouped in braces and separated by

vertical bars. One item is selected.
[ x | y | ... ] Optional items are grouped in brackets and separated by

vertical bars. One item is selected or no item is selected.
{ x | y | ... }* Optional items are grouped in braces and separated by

vertical bars. A minimum of one item or a maximum of all
items can be selected.
[ x | y | ... ]* Optional items are grouped in brackets and separated by

vertical bars. Several items or no item can be selected.
&<1-n> The parameter before the & sign can be repeated 1 to n times.
# A line starting with the # sign is comments.
Change History
Updates between document issues are cumulative. Therefore, the latest document issue contains
all updates made in previous issues.
Changes in Issue 02 (2010-12-01)

Based on issue 01 (2010-08-15), the document is updated as follows:
The following information is added:
l 2.4 Shortcut Keys
The following information is modified:
l Parameter default values in the Web network management system
Changes in Issue 01 (2010-08-15)

Initial commercial release.
iv Huawei Proprietary and Confidential Issue 02 (2010-12-01)

Configuration Guide - Basic Configuration Contents
Contents
About This Document...................................................................................................................iii

1 Logging In to Switch.................................................................................................................1-1
1.1 Introduction.....................................................................................................................................................1-2
1.1.1 Login Through the Console....................................................................................................................1-2
1.1.2 Login Through Telnet............................................................................................................................1-2
1.2 Logging In to the Device Through the Console Port......................................................................................1-3
1.2.1 Establishing the Configuration Task......................................................................................................1-3
1.2.2 Establishing the Physical Connection....................................................................................................1-4
1.2.3 Configuring Terminals...........................................................................................................................1-4
1.2.4 Logging In to the Device........................................................................................................................1-5
1.3 Logging In to Device Through Telnet.............................................................................................................1-5
1.3.2 Establishing the Physical Connection....................................................................................................1-6
1.3.3 Configuring Login User Parameters......................................................................................................1-6
1.3.4 Logging In from the Telnet Client.........................................................................................................1-7
1.4 Configuration Examples..................................................................................................................................1-7
1.4.1 Example for Logging In Through the Console Port...............................................................................1-7
1.4.2 Example for Logging In Through Telnet.............................................................................................1-10
2 CLI Overview.............................................................................................................................. 2-1

2.1 CLI Introduction..............................................................................................................................................2-2
2.1.1 Command Line Interface........................................................................................................................2-2
2.1.2 Command Levels....................................................................................................................................2-3
2.1.3 Command Views....................................................................................................................................2-3
2.2 Online Help.....................................................................................................................................................2-6
2.2.1 Full Help.................................................................................................................................................2-6
2.2.2 Partial Help.............................................................................................................................................2-7
2.2.3 Error Messages of the Command Line Interface....................................................................................2-7
2.3 Features of Command Line Interface..............................................................................................................2-8
2.3.1 Editing....................................................................................................................................................2-8
2.3.2 Displaying..............................................................................................................................................2-9
2.3.3 Regular Expressions...............................................................................................................................2-9
2.3.4 History Commands...............................................................................................................................2-13
Issue 02 (2010-12-01) Huawei Proprietary and Confidential v

Contents Configuration Guide - Basic Configuration
2.4 Shortcut Keys................................................................................................................................................2-13

2.4.1 System hotkeys.....................................................................................................................................2-13
2.4.2 Using Hotkeys......................................................................................................................................2-15
2.5 Configuration Examples................................................................................................................................2-15
2.5.1 Example for Using the Tab Key...........................................................................................................2-15
3 How to Use Interfaces...............................................................................................................3-1

3.1 Introduction to Interfaces................................................................................................................................3-2
3.2 Setting Basic Parameters of an Interface.........................................................................................................3-4
3.2.2 Entering the Interface View................................................................................................................... 3-5
3.2.3 Viewing All the Commands in the Interface View................................................................................3-6
3.2.4 Configuring the Description for an Interface.........................................................................................3-6
3.2.5 Starting and Shutting Down an Interface...............................................................................................3-7
3.2.6 Further Configuration an Interface.........................................................................................................3-8
3.2.7 Checking the Configuration...................................................................................................................3-8
3.3 Configuring the Loopback Interface............................................................................................................... 3-8
3.3.2 Configuring IPv4 Parameters of the Loopback Interface.......................................................................3-9
3.3.3 Checking the Configuration.................................................................................................................3-10
3.4 Maintaining the Interface..............................................................................................................................3-10
3.4.1 Clearing Statistics Information on the Interface...................................................................................3-10
3.4.2 Debugging the Interface.......................................................................................................................3-10
4 Basic Configuration...................................................................................................................4-1
4.1 Basic Configuration Introduction....................................................................................................................4-2
4.2 Configuring the Basic System Environment...................................................................................................4-2
4.2.2 Configuring the Equipment Name......................................................................................................... 4-3
4.2.3 Setting the System Clock....................................................................................................................... 4-3
4.2.4 Configuring the Header Text..................................................................................................................4-4
4.2.5 Configuring Command Levels...............................................................................................................4-5
4.3 Configuring Basic User Environment.............................................................................................................4-6
4.3.2 Configuring the Password for Switching User Levels...........................................................................4-7
4.3.3 Switching User Levels........................................................................................................................... 4-7
4.3.4 Locking User Interfaces.........................................................................................................................4-8
4.4 Displaying System Status Messages...............................................................................................................4-8
4.4.1 Displaying System Configuration..........................................................................................................4-9
4.4.2 Displaying System Status.......................................................................................................................4-9
4.4.3 Collecting System Diagnostic Information..........................................................................................4-10
5 User Management......................................................................................................................5-1
5.1 User Management Introduction.......................................................................................................................5-2
vi Huawei Proprietary and Confidential Issue 02 (2010-12-01)

5.1.1 User Interface.........................................................................................................................................5-2

5.1.2 User Authentication................................................................................................................................5-3
5.2 Logging In to the S5300 Through the Console Interface................................................................................5-5
5.2.2 Logging In to the S5300 Through the Console Interface.......................................................................5-6
5.3 Configuring Console User Interface...............................................................................................................5-9
5.3.1 Establishing the Configuration Task....................................................................................................5-10
5.3.2 Configuring Console Interface Attributes............................................................................................5-10
5.3.3 Setting Console Terminal Attributes....................................................................................................5-11
5.3.4 Configuring User Priority.....................................................................................................................5-12
5.3.5 Configuring User Authentication.........................................................................................................5-13
5.4 Configuring VTY User Interface..................................................................................................................5-14
5.4.2 Configuring Maximum VTY User Interfaces......................................................................................5-16
5.4.3 (Optional)Configuring Limits for Incoming Calls and Outgoing Calls...............................................5-16
5.4.4 Configuring VTY Terminal Attributes................................................................................................5-17
5.4.5 Configuring User Authentication.........................................................................................................5-18
5.5 Managing User Interfaces.............................................................................................................................5-19
5.5.2 Sending Messages to Other User Interfaces.........................................................................................5-20
5.5.3 Clearing Online User............................................................................................................................5-21
5.6 Configuring User Management.....................................................................................................................5-21
5.6.2 Configuring Authentication Mode.......................................................................................................5-23
5.6.3 Configuring Authentication Password.................................................................................................5-23
5.6.4 Setting Username and Password for AAA Local Authentication........................................................5-24
5.6.5 Configuring Non-Authentication.........................................................................................................5-24
5.6.6 Configuring User Priority.....................................................................................................................5-25
5.7.1 Example for Configuring Logging In to the Switch Through Password.............................................5-26
5.7.2 Example for Logging In to the Device Through AAA........................................................................5-27
6 File System Management..........................................................................................................6-1

6.1 Overview of the File System...........................................................................................................................6-2
6.2 Managing a Storage Device............................................................................................................................6-2
6.2.2 (Optional) Formatting a Storage Device................................................................................................6-3
6.3 Managing the Directory..................................................................................................................................6-3
Issue 02 (2010-12-01) Huawei Proprietary and Confidential vii

6.3.2 Viewing the Current Directory...............................................................................................................6-4

6.3.3 Switching a Directory.............................................................................................................................6-4
6.3.4 Displaying a Directory or File................................................................................................................6-5
6.3.5 Creating a Directory...............................................................................................................................6-5
6.3.6 Deleting a Directory...............................................................................................................................6-5
6.4 Managing Files................................................................................................................................................6-6
6.4.2 Displaying Contents of Files..................................................................................................................6-7
6.4.3 Copying Files.........................................................................................................................................6-7
6.4.4 Moving Files..........................................................................................................................................6-8
6.4.5 Renaming Files.......................................................................................................................................6-8
6.4.6 Compressing Files..................................................................................................................................6-9
6.4.7 Deleting Files.........................................................................................................................................6-9
6.4.8 Deleting Files in the Recycle Bin...........................................................................................................6-9
6.4.9 Undeleting Files...................................................................................................................................6-10
6.4.10 Running Files in Batch.......................................................................................................................6-10
6.4.11 Configuring Prompt Modes................................................................................................................6-11
7 Management of Configuration Files......................................................................................7-1

7.1 Management of Configuration Files Introduction...........................................................................................7-2
7.1.1 Configuration Files.................................................................................................................................7-2
7.1.2 Configuration Files and Current Configurations....................................................................................7-2
7.2 Managing Configuration Files........................................................................................................................7-3
7.2.2 Configuring System Software for a switch to Load for the Next Startup..............................................7-4
7.2.3 Configuring the Configuration File for Switch to Load for the Next Startup........................................7-4
7.2.4 Saving Configuration File......................................................................................................................7-5
7.2.5 Clearing Configuration Files..................................................................................................................7-6
7.2.6 Comparing Configuration Files..............................................................................................................7-6
8 FTP and TFTP..............................................................................................................................8-1

8.1 FTP and TFTP Introduction............................................................................................................................8-2
8.1.1 FTP.........................................................................................................................................................8-2
8.1.2 TFTP.......................................................................................................................................................8-2
8.2 Configuring the Switch to be the FTP Server.................................................................................................8-3
8.2.2 (Optional)Specifying a Port Number for the FTP Server......................................................................8-4
8.2.3 Enabling the FTP Server........................................................................................................................8-4
8.2.4 (Optional) Configuring the Timeout Period...........................................................................................8-5
8.2.5 Configuring the Local Username and the Password..............................................................................8-5
8.2.6 Configuring the Service Type and Authorization Information..............................................................8-6
8.3 Configuring FTP ACL....................................................................................................................................8-7
viii Huawei Proprietary and Confidential Issue 02 (2010-12-01)


8.3.2 Enabling the FTP Server........................................................................................................................8-8
8.3.3 Configuring a Basic ACL.......................................................................................................................8-8
8.3.4 Configuring the Basic FTP ACL............................................................................................................8-9
8.4 Configuring the switch to Be the FTP Client................................................................................................8-10
8.4.2 Logging In to the FTP Server...............................................................................................................8-11
8.4.3 Configuring the Data Type and Transmission Mode for a File...........................................................8-12
8.4.4 Viewing Online Help of the FTP Command........................................................................................8-14
8.4.5 Uploading or Downloading Files.........................................................................................................8-15
8.4.6 Managing Directories...........................................................................................................................8-16
8.4.7 Managing Files.....................................................................................................................................8-17
8.4.8 Changing the Login User.....................................................................................................................8-18
8.4.9 Disconnecting from the FTP Server.....................................................................................................8-19
8.4.10 Checking the Configuration...............................................................................................................8-21
8.5 Configuring the switch to Be the TFTP Client.............................................................................................8-21
8.5.2 Downloading Files Through TFTP......................................................................................................8-22
8.5.3 Uploading Files Through TFTP...........................................................................................................8-22
8.6 Limiting the Access to the TFTP Server.......................................................................................................8-23
8.6.2 Configuring the Basic ACL..................................................................................................................8-24
8.6.3 Configuring the Basic TFTP ACL.......................................................................................................8-24
8.7.1 Example for Configuring the FTP Server............................................................................................8-25
8.7.2 Example for Configuring an ACL of the FTP Server..........................................................................8-27
8.7.3 Example for Configuring the FTP Client.............................................................................................8-29
8.7.4 Example for Configuring the TFTP Client..........................................................................................8-31
9 Telnet and SSH...........................................................................................................................9-1

9.1 Telnet and SSH Introduction...........................................................................................................................9-2
9.1.1 Overview of User Login.........................................................................................................................9-2
9.1.2 Telnet Terminal Services....................................................................................................................... 9-2
9.1.3 SSH Terminal Services.......................................................................................................................... 9-3
9.2 Configuring Telnet Terminal Services............................................................................................................9-4
9.2.2 Enabling the Telnet Service................................................................................................................... 9-5
9.2.3 Establishing a Telnet Connection...........................................................................................................9-6
9.2.4 (Optional) Scheduled Telnet Disconnection..........................................................................................9-7
9.3 Configuring SSH Users...................................................................................................................................9-8
Issue 02 (2010-12-01) Huawei Proprietary and Confidential ix

9.3.2 Creating SSH User.................................................................................................................................9-9

9.3.3 Configuring SSH for the VTY User Interface.....................................................................................9-10
9.3.4 Generating a Local RSA Key Pair.......................................................................................................9-11
9.3.5 Configuring the Authentication Mode for SSH Users.........................................................................9-11
9.3.6 (Optional) Configuring the Basic Authentication Information for SSH Users....................................9-13
9.3.7 (Optional) Authorizing SSH Users Through the Command Line........................................................9-13
9.3.8 Configuring the Service Type of SSH Users.......................................................................................9-14
9.3.9 (Optional) Configuring the Authorized Directory of the SFTP Service for SSH Users......................9-14
9.3.10 Checking the Configuration...............................................................................................................9-15
9.4 Configuring the SSH Server Function..........................................................................................................9-15
9.4.2 Enabling the STelnet Service...............................................................................................................9-17
9.4.3 Enabling the SFTP Service..................................................................................................................9-17
9.4.4 (Optional) Enabling the Earlier Version - Compatible Function.........................................................9-17
9.4.5 (Optional) Configuring the Number of the Port Monitored by the SSH Server..................................9-18
9.4.6 (Optional) Configuring the Interval for Updating the Key Pair on the SSH Server............................9-19
9.5 Configuring the STelnet Client Function......................................................................................................9-20
9.5.2 Enabling the First-Time Authentication on the SSH Client.................................................................9-21
9.5.3 (Optional) Assigning an RSA Public Key to the SSH Server..............................................................9-22
9.5.4 Enabling the STelnet Client.................................................................................................................9-23
9.6 Configuring the SFTP Client Function.........................................................................................................9-24
9.6.2 Configuring the First-Time Authentication on the SSH Client............................................................9-26
9.6.3 (Optional) Assigning an RSA Public Key to the SSH Server..............................................................9-27
9.6.4 Enabling the SFTP Client.....................................................................................................................9-28
9.6.5 (Optional) Managing the Directory......................................................................................................9-29
9.6.6 (Optional) Managing the File...............................................................................................................9-30
9.6.7 (Optional) Displaying the SFTP Client Command Help.....................................................................9-31
9.7.1 Example for Configuring the Telnet Terminal Service........................................................................9-33
9.7.2 Example for Configuring the PC as the STelnet Client to Connect to the SSH Server.......................9-35
9.7.3 Example for Configuring the Switch as the STelnet Client to Connect to the SSH Server ................9-38
9.7.4 Example for Connecting the SFTP Clinet and the SSH Server...........................................................9-45
9.7.5 Example for Configuring the SSH Server to Support the Access from Another Port.........................9-50
9.7.6 Example for Authenticating SSH Through RADIUS..........................................................................9-57
10 Web System Configuration..................................................................................................10-1

10.1 Overview of Web System...........................................................................................................................10-2
10.2 Starting Web System...................................................................................................................................10-2
x Huawei Proprietary and Confidential Issue 02 (2010-12-01)

10.2.1 Logging In to the S5300 Through the Console Interface...................................................................10-3

10.2.2 Setting the Management IP Address of the S5300.............................................................................10-6
10.2.3 Uploading Web Page Files.................................................................................................................10-7
10.2.4 Loading a Web Page File...................................................................................................................10-8
10.2.5 Creating a Web Account....................................................................................................................10-8
10.2.6 Logging In to the Web System...........................................................................................................10-9
Issue 02 (2010-12-01) Huawei Proprietary and Confidential xi

Configuration Guide - Basic Configuration Figures
Figures
Figure 1-1 Networking diagram of logging in through the console port.............................................................1-7

Figure 1-2 New connection..................................................................................................................................1-8
Figure 1-3 Setting the port....................................................................................................................................1-9
Figure 1-4 Setting the port communication parameters.......................................................................................1-9
Figure 1-5 Establishing the configuration environment through WAN.............................................................1-10
Figure 1-6 Running the Telnet program on the PC............................................................................................1-11
Figure 5-1 Numbering of user interfaces on the S5300.......................................................................................5-3
Figure 5-2 Logging in to the S5300 through the console interface......................................................................5-5
Figure 5-3 Setting up a new connection...............................................................................................................5-6
Figure 5-4 Setting the connection port.................................................................................................................5-7
Figure 5-5 Setting communication parameters for the port..................................................................................5-8
Figure 5-6 Selecting a terminal type....................................................................................................................5-9
Figure 8-1 Networking diagram of the Switch functioning as the FTP server..................................................8-26
Figure 8-2 Networking diagram for configuring an ACL of the FTP server.....................................................8-28
Figure 8-3 Networking diagram of the Switch functioning as the FTP client...................................................8-30
Figure 8-4 Networking diagram for configuring TFTP.....................................................................................8-32
Figure 9-1 Telnet client services..........................................................................................................................9-2
Figure 9-2 Establishing a local SSH connection between the PC and the S5300................................................9-3
Figure 9-3 Networking diagram of the remote login of the Ethernet user.........................................................9-33
Figure 9-4 Networking diagram of configuring the PC as the STelnet client to connect to the SSH server
.............................................................................................................................................................................9-36
Figure 9-5 Networking diagram of connecting the STelnet client and the SSH server.....................................9-39
Figure 9-6 Networking diagram for connecting the SFTP client and the SSH server.......................................9-45
Figure 9-7 Networking diagram for configuring the SSH server to support the access from another port.......9-51
Figure 9-8 Networking diagram of authenticating the SSH through RADIUS..................................................9-57
Figure 10-1 Running environment of the Web System......................................................................................10-2
Figure 10-2 Setting up a new connection...........................................................................................................10-3
Figure 10-3 Setting the connection port.............................................................................................................10-4
Figure 10-4 Setting communication parameters for the port..............................................................................10-5
Figure 10-5 Selecting a terminal type................................................................................................................10-6
Figure 10-6 Login.............................................................................................................................................10-10
Issue 02 (2010-12-01) Huawei Proprietary and Confidential xiii

Configuration Guide - Basic Configuration Tables
Tables
Table 2-1 Common error messages of the command line....................................................................................2-7

Table 2-2 Keys for editing....................................................................................................................................2-8
Table 2-3 Keys for displaying..............................................................................................................................2-9
Table 2-4 Description of particular characters...................................................................................................2-10
Table 2-5 Access the history commands............................................................................................................2-13
Table 2-6 System hotkeys...................................................................................................................................2-14
Table 3-1 Description of management interfaces.................................................................................................3-2
Table 3-2 Management interface numbers...........................................................................................................3-2
Table 3-3 Rules for numbering FE and GE interfaces.........................................................................................3-3
Table 5-1 Types of user interfaces.......................................................................................................................5-2
Table 5-2 Types of login users.............................................................................................................................5-4
Table 5-3 Authentication modes of login users....................................................................................................5-5
Table 5-4 Communication parameters.................................................................................................................5-8
Table 10-1 Communication parameters.............................................................................................................10-5
Issue 02 (2010-12-01) Huawei Proprietary and Confidential xv

Configuration Guide - Basic Configuration 1 Logging In to Switch
1 Logging In to Switch
About This Chapter
Before configuring switches, you need to log in to the switch.
1.1 Introduction
You can log in to switches through console port or Telnet.
1.2 Logging In to the Device Through the Console Port
This section describes how to connect a terminal to a switch through the console port to establish
the configuration environment.
1.3 Logging In to Device Through Telnet
This section describes how to connect a terminal to a switch through Telnet to establish the
configuration environment.
1.4 Configuration Examples
This section provides examples for configuring users to log in to the switch through the console
port or Telnet together with the configuration flowchart. The configuration examples explain
networking requirements, configuration notes, and configuration roadmap.
Issue 02 (2010-12-01) Huawei Proprietary and Confidential 1-1

1 Logging In to Switch Configuration Guide - Basic Configuration
1.1 Introduction
You can log in to switches through console port or Telnet.
1.1.1 Login Through the Console

When a switch is powered on for the first time or a switch needs to be locally configured, you
can log in to the switch through the console port.
1.1.2 Login Through Telnet
If you know the IP address of a switch, you can log in to the switch through Telnet to perform
local or remote configurations.
1.1.1 Login Through the Console

When a switch is powered on for the first time or a switch needs to be locally configured, you
can log in to the switch through the console port.
In the following cases, a switch can be configured only through the console port:
l The switch is powered on for the first time.

l The subscriber cannot login through Telnet.
1.1.2 Login Through Telnet

If you know the IP address of a switch, you can log in to the switch through Telnet to perform
local or remote configurations.
YYou need to pre-configure the IP addresses of interfaces, the user account, the authentication
mode, and the incoming and outgoing call restriction through the console interface on the
switch. Also, ensure that directly-connected or reachable switch exist between terminals and the
switch.
The destination switch authenticates the user based on the configured parameters in three modes:
l Password authentication: indicates that the login user should enter the correct password.
l AAA local authentication: indicates that the login user should enter the correct user name
and password.
l None authentication: indicates that the login user need not enter the user name or password.
If the login succeeds, a command line prompt such as <Quidway> appears on the Telnet client
interface.
Enter a command to check the running status of the switch or to configure the switch.
Enter "?" for help.
NOTE
Do not modify the IP address of the switch when you configure the switch through Telnet because the
modification may terminate Telnet connection. Otherwise, set up the connection again after entering a new
IP address.
1-2 Huawei Proprietary and Confidential Issue 02 (2010-12-01)

1.2 Logging In to the Device Through the Console Port

This section describes how to connect a terminal to a switch through the console port to establish
the configuration environment.
1.2.1 Establishing the Configuration Task

Before configuring login to the switch through the console port, familiarize yourself with the
applicable environment, complete the pre-configuration tasks, and obtain the required data. This
can help you complete the configuration task quickly and accurately.
1.2.2 Establishing the Physical Connection
This part describes how to physically connect a terminal to a switch before login to the switch
through the console port.
1.2.3 Configuring Terminals
This part describes how to configure the terminal before login to the switch through the console
port.
1.2.4 Logging In to the Device
This part describes how to log in to the switch through the console port.

Before configuring login to the switch through the console port, familiarize yourself with the
applicable environment, complete the pre-configuration tasks, and obtain the required data. This
can help you complete the configuration task quickly and accurately.
Applicable Environment
If you log in to the switch for the first time or perform the local configuration, you need to log
in to the switch through the console port.
NOTE
If you cannot log in to the switch through the telnet, you need to log in to the switch through the console
port.
Pre-configuration Tasks
Before configuring the switch through the console port, complete the following tasks:
l Preparing the PC/terminal (including serial port and RS-232 cable)

l Installing terminal emulation program on the PC (such as Windows XP HyperTerminal)
Data Preparation
To configure the switch through the console port, you need the following data.
NOTE
If the AAA authentication mode is configured for users to log in to the switch through the console interface,
the correct user name and password must be entered for a successful login.

No. Data
1 Terminal communication parameters

l Baud rate
l Data bit
l Parity
l Stop bit
l Flow-control mode
2 (Optional) User name and password to be entered for a successful login in AAA
authentication mode

through the console port.
Context
Do as follows on the switch:
Procedure
Step 1 Connect the COM port on the PC and the console port on the switch by a cable.
Step 2 Power on all devices to perform a self-check.
----End
1.2.3 Configuring Terminals

This part describes how to configure the terminal before login to the switch through the console
port.
Context
Do as follows on the PC:
Procedure
Step 1 Run the terminal emulation program on the PC, setting the communication parameters as
follows:
l Baud rate: 9600 bps
l Data bit: 8
l Stop bit: 1
l Parity: none
l Flow control: none
----End

1.2.4 Logging In to the Device

This part describes how to log in to the switch through the console port.
Context
Procedure
Step 1 Press Enter until a command line prompt such as <Quidway> appears. Now the user view is
displayed for you to configure the switch.
NOTE
If the AAA or Password authentication mode is configured for users to log in to the switch through the
console interface, the correct user name and password must be entered for a successful login.
----End
1.3 Logging In to Device Through Telnet

This section describes how to connect a terminal to a switch through Telnet to establish the

Before configuring login to the switch through Telnet, familiarize yourself with the applicable
environment, complete the pre-configuration tasks, and obtain the required data. This can help
you complete the configuration task quickly and accurately.
through Telnet.
1.3.3 Configuring Login User Parameters
This part describes how to configure user parameters for login to the switch through Telnet.
1.3.4 Logging In from the Telnet Client
This part describes how to log in to the switch through Telnet.

Before configuring login to the switch through Telnet, familiarize yourself with the applicable
If you know the IP address of the switch, you can log in to the switch through Telnet for local
or remote configuration.
Before configuring the switch through Telnet, complete the following tasks:

l Powering on devices and performing a self-check

l Preparing the PC (including the serial port and Ethernet crossover/direct cable)
Data Preparation
To log in to the switch through Telnet, you need the following data.
No. Data
1 IP address of the PC
2 IP address of the Ethernet interface on the switch
3 User information accessed through Telnet:

l User name
l Password
l Authentication mode

through Telnet.
Prerequisite
Establishing the Physical Connection are complete.
Procedure
Step 1 Connect the switch and the PC directly or connect the switch and the PC to the network through
cables.
----End
1.3.3 Configuring Login User Parameters

This part describes how to configure user parameters for login to the switch through Telnet.
Context
Procedure
Step 1 Configure the authentication mode of login users.
Step 2 Configure the authority limitation of login user.
For details, see 5.4 Configuring VTY User Interface and 5.6 Configuring User
Management.
----End

1.3.4 Logging In from the Telnet Client

This part describes how to log in to the switch through Telnet.
Context
Procedure
Step 1 Run the Telnet program on the PC that functions as a client, and enter the IP address of the
interface on the destination switch that provides the Telnet service.
Step 2 Enter the user name and password in the login window. After authentication, a command line
prompt such as <Quidway> appears. Now enter the configuration environment in the user view.
----End

This section provides examples for configuring users to log in to the switch through the console
port or Telnet together with the configuration flowchart. The configuration examples explain
networking requirements, configuration notes, and configuration roadmap.
1.4.1 Example for Logging In Through the Console Port

In this example, you can configure the PC so as to log in to the switch through the console port.
1.4.2 Example for Logging In Through Telnet
In this example, you can configure user parameters so as to log in to the switch from the PC or
other terminals through Telnet.
1.4.1 Example for Logging In Through the Console Port

In this example, you can configure the PC so as to log in to the switch through the console port.
Networking Requirements
Initialize the configuration of the switch when the switch is powered on for the first time.
Figure 1-1 Networking diagram of logging in through the console port
PC Switch
Configuration Roadmap
The configuration roadmap is as follows:

1. Connect the PC and the switch through the console port.

2. Configure the login on the PC end.
3. Log in to the switch.
Data Preparation
To complete the configuration, you need the terminal communication parameters (including
baud rate, data bit, parity, stop bit, and flow control).
Procedure
Step 1 Connect the serial port of the PC (or terminal) to the console port of the switch through a standard
RS-232 cable. The local configuration environment is established.
Step 2 Run the terminal emulation program on the PC. Set the terminal communication parameters to
be 9600 bps, data bit to be 8, stop bit to be 1. Specify no parity and no flow control as shown
from Figure 1-2 to Figure 1-4.
Figure 1-2 New connection

Figure 1-3 Setting the port
Figure 1-4 Setting the port communication parameters

Step 3 Power on the switch to perform a self-check and the system performs automatic configuration.
When the self-check ends, you are prompted to press Enter until a command line prompt such
as <Quidway> appears.
Enter the command to check the running status of the switch or configure the switch.
Enter "?" for help.
For details, refer to the following chapters.
----End
1.4.2 Example for Logging In Through Telnet

In this example, you can configure user parameters so as to log in to the switch from the PC or
other terminals through Telnet.
You can log in to the switch on other network segments through the PC or other terminals to
perform remote maintenance.
Figure 1-5 Establishing the configuration environment through WAN
IP
Network
PC Switch Target
Switch
1. Establish the physical connection.

2. Configure user login parameters.
3. Log in to the switch from the client side.
Data Preparation
To complete the configuration, you need the following data
l IP address of the PC
l IP address of the Ethernet interface on the switch
l User information accessed through Telnet (including the user name, password, and
authentication mode)

Procedure
Step 1 Connect the PC and the switch to the network.
Step 2 Configure login user parameters on the target switch.
# Configure the login address
<Quidway> system-view
[Quidway] vlan 10
[Quidway-vlan10] quit
[Quidway] interface gigabitethernet 0/0/1
[Quidway-GigabitEthernet0/0/1] port link-type hybrid
[Quidway-GigabitEthernet0/0/1] port hybrid untagged vlan 10
[Quidway-GigabitEthernet0/0/1] quit
[Quidway]interface vlanif 10
[Quidway-vlanif10] ip address 202.38.160.92 255.255.0.0
[Quidway-vlanif10] quit
# Configure login authentication mode

[Quidway] aaa
[Quidway-aaa] local-user huawei password cipher hello
[Quidway-aaa] local-user huawei service-type telnet
[Quidway-aaa] local-user huawei level 3
[Quidway-aaa] quit
[Quidway] user-interface vty 0 4
[Quidway-ui-vty0-14] authentication-mode aaa
Step 3 Configure the client login.

Run the Telnet on the PC, as shown in Figure 1-6.
Figure 1-6 Running the Telnet program on the PC
Click OK.
Enter the user name and password in the login window. After authentication, a command line
prompt such as <Quidway> appears. Now enter the configuration environment in the user view.
----End

Configuration Guide - Basic Configuration 2 CLI Overview
2 CLI Overview
About This Chapter
Users operate devices, that is, configure the device and perform routine maintenance, by entering
command lines.
2.1 CLI Introduction

The command line interface (CLI) is the common tool for running commands.
2.2 Online Help
When you enter command lines or configure services, online help offers real-time help in
addition to the configuration guide.
2.3 Features of Command Line Interface
You can edit command lines, display command lines, use the regular expression for command
lines, and invoke historical commands.
2.4 Shortcut Keys
This section describes the shortcut keys of the S5300.
This section provides several examples for using command lines.

2 CLI Overview Configuration Guide - Basic Configuration
2.1 CLI Introduction

The command line interface (CLI) is the common tool for running commands.
2.1.1 Command Line Interface

You can configure and manage a switch by using the CLI commands.
2.1.2 Command Levels
The system adopts a hierarchical protection mode that has 16 command levels.
2.1.3 Command Views
Command view is the interface where command line can be input. System are classified into
different command views. Each command is enrolled in one or more command views. The
commands can only run in the proper views.
2.1.1 Command Line Interface

You can configure and manage a switch by using the CLI commands.
When a prompt appears, you enter the command line interface (CLI) and interact with switch
through CLI.
The system provides a series of configuration commands. You can configure and manage the
switch by entering commands on CLI.
The characteristics of CLI are as follows:
l Local configuration through console port.
l Local or remote configuration through Telnet or Secure Shell (SSH).
l A user interface view for specific configuration management.
l Hierarchical command protection for users of different levels, that is, running the
commands of the corresponding level.
l None authentication, password authentication and Authentication, Authorization and
Accounting (AAA) to prevent the unauthorized user from accessing the switch.
l Entering "?" for online help at any time.
l Network testing commands such as tracert and ping for rapidly diagnosing a network.
l Abundant debugging information to help in diagnosing the network.
l The telnet command for directly logging in to and manage other switch.
l FTP service for file uploading and downloading.
l Running a history command, like DosKey.
l A command line interpreter provides intelligent command resolution methods such as key
word fuzzy match and context conjunction. These methods make it easy for users to enter
their commands.
NOTE
l The system supports the command with up to 512 characters. The command can be incomplete.
l The system saves the incomplete command to the configuration files in the complete form; therefore,
the command may have more than 512 characters. When the system is restarted, however, the
incomplete command cannot be restored. Therefore, pay attention to the length of the incomplete
command.

2.1.2 Command Levels

The system adopts a hierarchical protection mode that has 16 command levels.
The default command levels are as follows:
l Level 0-Visit level: Commands of this level include commands of network diagnosis tool
(such as ping and tracert) and commands that start from the local device and visit external
device (such as Telnet client side).
l Level 1-Monitoring level: Commands of this level, including the display commands, are
used for system maintenance and fault diagnosis.
l Level 2-Configuration level: Commands of this level are service configuration commands
that provide direct network service to the user, including routing and network layer
commands.
l Level 3-Management level: Commands of this level are commands that influence the basic
operation of the system and provide support to the service. They include file system
commands, FTP commands, TFTP commands, XModem downloading commands,
configuration file switching commands, power supply control commands, backup board
control commands, user management commands, level setting commands, system internal
parameter setting commands, and debugging commands that are used for fault diagnosis.
To implement efficient management, you can increase the command levels to 0-15. For the
increase in the command levels, refer to Chapter 4 "Basic Configuration" Configuring
Command Levels in the Quidway S5300 Series Configuration Guide - Basic Configurations.
NOTE
l The default command level may be higher than the command level defined according to the command
rules in application.
l Login users have the same 16 levels as the command levels. The login users can use only the command
of the levels that are equal to or lower than their own levels. For details of login user levels, refer to
User Management.
2.1.3 Command Views

Command view is the interface where command line can be input. System are classified into
different command views. Each command is enrolled in one or more command views. The
commands can only run in the proper views.
Basic Concepts of Command Views

# Establish connection with the switch. If the switch adopts the default configuration, you can
enter the user view with the prompt of <Quidway>.
<Quidway>
# Type system-view, and you can enter the system view.

[Quidway]
# Type aaa in the system view, and you can enter the AAA view.
[Quidway] aaa
[Quidway-aaa]

NOTE
The prompt <Quidway> indicates the default switch name. The prompt <> indicates the user view and the
prompt [] indicates other views.
Some commands that are implemented in the system view can also be implemented in the other
views; however, the functions that can be implemented are command view-specific.
Common Views
The S5300 provides various command line views. For the methods of entering the command
line views except the following views, see the Quidway S5300 Command Reference.
l User View
Item Description
Function Displays the operation status and statistics about the S5300.
Entry command Enters the user view after setting up a connection.
Prompt upon <Quidway>

entry
quit <Quidway> quit
Prompt upon None.

quit
l System View
Item Description
Function Sets the system parameters of the S5300. After entering the system
view, you can enter other views to configure the S5300.
Entry command <Quidway> system-view
Prompt upon [Quidway]

entry
quit [Quidway] quit
Prompt upon <Quidway>

quit
l Ethernet Interface Views

– GE interface view
Item Description
Function Set parameters of a Gigabit Ethernet interface and manage the

Gigabit Ethernet interface.
Entry [Quidway] interface GigabitEthernet X/Y/Z

command

Item Description
Prompt upon [Quidway- GigabitEthernetX/Y/Z]

entry
quit [Quidway- GigabitEthernetX/Y/Z] quit

quit
NOTE
X/Y/Z specifies the number of a Gigabit Ethernet interface to be configured. It is in the format of
slot number/subcard number/interface sequence number.
l VLAN Views
Item Description
Function Adds an interface to or deletes an interface from a VLAN, and enables

the multicast function in the VLAN.
Entry command [Quidway] vlan 10
Prompt upon [Quidway-vlan10]

entry
quit [Quidway-vlan10] quit

quit
l VLANIF Interface Views
Item Description
Function Assigns IP addresses to VLANIF interfaces and manages the

VLANIF interfaces.
Entry command [Quidway] interface vlanif 10
Prompt upon [Quidway-Vlanif10]

entry
quit [Quidway-Vlanif10] quit

quit
NOTE
The value 10 indicates the number of a VLANIF interface to be configured. You must create a VLAN
before entering the VLANIF interface view.

2.2 Online Help

When you enter command lines or configure services, online help offers real-time help in
addition to the configuration guide.
Context
The command line of S5300 provides three types of online help:
l Full help
l Partial help
l Error Messages of the Command Line Interface
2.2.1 Full Help
When you enter a command line, you can view the description of keywords or parameters in the
command line through the Full Help.
2.2.2 Partial Help
When you enter a command line, you can obtain prompts on the keywords or parameters at the
beginning of the string through the Partial Help.
2.2.3 Error Messages of the Command Line Interface
If an entered command passes the syntax check, the system executes it. Otherwise, the system
prompts an error message.
2.2.1 Full Help

When you enter a command line, you can view the description of keywords or parameters in the
command line through the Full Help.
You can obtain full help from a command view in the following methods:
l In a command view, enter ? to obtain all the commands in this command view and
descriptions of the commands.
<Quidway> ?
l Enter a command and a ? separated by a space. If a keyword is in place of the ?, all keywords
and their descriptions are listed. Here is an example.
[Quidway-ui-vty0] authentication-mode ?
aaa AAA authentication
none Login without checking
password Authentication through the password of a user terminal interface
[Quidway-ui-vty0] authentication-mode aaa ?
<cr>
[Quidway-ui-vty0] authentication-mode aaa
aaa, none and password are keywords. AAA authentication, Login without checking and
Authentication through the password of a user terminal interface are the descriptions of the
two keywords.
<cr> indicates that no key word or parameter is in this position and you can press Enter to
repeat the command in the next command line.
l Enter a command and a ? separated by a space. If a parameter is in place of the ?, all
parameters and their descriptions are listed. Here is an example.
[Quidway] sysname ?
TEXT Host name(1 to 246 characters)

TEXT is a parameter and Host name (1 to 246 characters) is the description.
2.2.2 Partial Help

When you enter a command line, you can obtain prompts on the keywords or parameters at the
beginning of the string through the Partial Help.
Context
You can obtain the partial help of the command line in the following ways.
Procedure
l Enter a character string with a "?" closely following it to display all commands that begin
with this character string.
<Quidway> d?
debugging delete
dir display
l Enter a command and a character string with "?" closely following it to display all the key
words that begin with this character string.
<Quidway> display b?
bfd bgp
bootrom bpdu
bpdu-tunnel buffer
l Enter the first several letters of a key word in the command and then press Tab to display
the complete key word on the condition that the letters uniquely identify the key word.
Otherwise, if you continue to press Tab, different key words are displayed. You can select
the needed key word.
----End
2.2.3 Error Messages of the Command Line Interface

If an entered command passes the syntax check, the system executes it. Otherwise, the system
prompts an error message.
All the commands entered by the user are run correctly, if the grammar check has been passed.
Otherwise, error messages are reported to the user. See Table 2-1 for the common error
messages.
Table 2-1 Common error messages of the command line
Error messages Cause of the error
Unrecognized command The command cannot be found
The key word cannot be found
Wrong parameter Parameter type error
The parameter value exceeds the limit
Incomplete command Incomplete command entered
Too many parameters Too many parameters entered

Error messages Cause of the error
Ambiguous command Indefinite parameters entered
2.3 Features of Command Line Interface

You can edit command lines, display command lines, use the regular expression for command
lines, and invoke historical commands.
2.3.1 Editing
The editing function of command lines helps you edit command lines or obtain help by using
certain keys.
2.3.2 Displaying
All command lines have the same displaying feature. You can construct the displaying mode as
required.
2.3.3 Regular Expressions
The regular expression is a mode matching tool. You can construct the matching mode based
on certain rules, and then match the mode with the target object.
2.3.4 History Commands
The command line interface provides a function similar to DosKey, which can automatically
save historical commands. You can invoke the historical commands saved on the command line
interface at any time and run them again.
2.3.1 Editing
The editing function of command lines helps you edit command lines or obtain help by using
certain keys.
The command line supports multi-line edition. The maximum length of each command is 512
characters.
Keys for editing that are often used are shown in Table 2-2.
Table 2-2 Keys for editing
Key Function
Common key Inserts a character in the current position of the cursor if the editing
buffer is not full and the cursor moves to the right. Otherwise, an
alarm is generated.
Backspace Deletes the character on the left of the cursor that moves to the
left. When the cursor reaches the head of the command, an alarm
is generated.
Left cursor key ← or Moves the cursor to the left by the space of a character. When the
Ctrl_B cursor reaches the head of the command, an alarm is generated.
Right cursor key → or Moves the cursor to the right by the space of a character. When
Ctrl_F the cursor reaches the end of the command, an alarm is generated.

Key Function
Tab Press Tab after typing the incomplete key word and the system
runs the partial help:
l If the matching key word is unique, the system replaces the
typed one with the complete key word and displays it in a new
line with the cursor a space behind.
l If there are several matches or no match at all, the system
displays the prefix first. Then you can press Tab to view the
matching key word one by one. In this case, the cursor closely
follows the end of the word and you can type a space to enter
the next word.
l If a wrong key word is entered, press Tab and the word is
displayed in a new line.
2.3.2 Displaying
All command lines have the same displaying feature. You can construct the displaying mode as
required.
You can control the display of information on CLI as follows:
l Display prompt and help information in both Chinese and English.

l When the information displayed exceeds a full screen, it provides the pause function. In
this case, the user has three choices as shown in Table 2-3.
Table 2-3 Keys for displaying
Key Function
Ctrl_C Stops the display and running of the command.

NOTE
You can also press any of the keys except the spacebar and Enter key
to stop the display and running of the command.
Space Continues to display the information on the next screen.
Enter Continues to display the information on the next line.
2.3.3 Regular Expressions

The regular expression is a mode matching tool. You can construct the matching mode based
on certain rules, and then match the mode with the target object.
The regular expression is an expression that describes a set of strings. It consists of common
characters (such as letters from "a" to "z") and particular characters (also named metacharacters).
The regular expression is a template according to which you can search for the required string.
A regular expression can provide the following functions:

l Searching for and obtaining a sub-string that matches a rule in the string.
l Substituting a string according to a certain matching rule.
Formal Language Theory of the Regular Expression

The regular expression consists of common characters and particular characters.
l Common characters
Common characters are used to match themselves in a string, including all upper-case and
lower-case letters, digits, punctuations, and special symbols. For example, a matches the
letter "a" in "abc", 202 matches the digit "202" in "202.113.25.155", and @ matches the
symbol "@" in "[email protected]".
l Particular characters
Particular characters are used together with common characters to match the complex or
particular string combination. Table 2-4 describes particular characters and their syntax.
Table 2-4 Description of particular characters

Particul Syntax Example
ar
characte
r
\ Defines an escape character, which \* matches "*".

is used to mark the next character
(common or particular) as the
common character.
^ Matches the starting position of the ^10 matches "10.10.10.1" instead of

string. "20.10.10.1".
$ Matches the ending position of the 1$ matches 10.10.10.1 instead of

string. 10.10.10.2.
* Matches the preceding element zero 10* matches "1", "10", "100", and
or more times. "1000".
(10)* matches "null", "10", "1010",
and "101010".
+ Matches the preceding element one 10+ matches "10", "100", and
or more times "1000".
(10)+ matches "10", "1010", and
"101010".
? Matches the preceding element zero 10? matches "1" and "10".
or one time. (10)? matches "null" and "10".
. Matches any single character. 0.0 matches "0x0" and "020".

.oo matches "book", "look", and
"tool".

Particul Syntax Example

ar
characte
r
() Defines a subexpression, which can 100(200)+ matches "100200" and

be null. Both the expression and the "100200200".
subexpression should be matched.
x|y Matches x or y. 100|200 matches "100" or "200".

1(2|3)4 matches "124" or "134",
instead of "1234", "14", "1224", and
"1334".
[xyz] Matches any single character in the [123] matches the character 2 in
regular expression. "255".
[^xyz] Matches any character that is not [^123] matches any character except
contained within the brackets. for "1", "2", and "3".
[a-z] Matches any character within the [0-9] matches any character ranging
specified range. from 0 to 9.
[^a-z] Matches any character beyond the [^0-9] matches all non-numeric
specified range. characters.
_ Matches a comma "," left brace "{", _2008_ matches "2008", "space
right brace "}", left parenthesis "(", 2008 space", "space 2008", "2008
and right parenthesis ")". space", ",2008,", "{2008}",
Matches the starting position of the "(2008)", "{2008", and "(2008}".
input string.
Matches the ending position of the
input string.
Matches a space.
NOTE
Unless otherwise specified, all characters in the preceding table are displayed on the screen.
l Degeneration of particular characters
Certain particular characters, when being placed at the following positions in the regular
expression, degenerate to common characters.
– The particular characters following "\" is transferred to match particular characters
themselves.
– The particular characters "*", "+", and "?" placed at the starting position of the regular
expression. For example, +45 matches "+45" and abc(*def) matches "abc*def".
– The particular character "^" placed at any position except for the start of the regular
expression. For example, abc^ matches "abc^".
– The particular character "$" placed at any position except for the end of the regular
expression. For example, 12$2 matches "12$2".

– The right bracket such as ")" or "]" being not paired with its corresponding left bracket
"(" or "[". For example, abc) matches "abc)" and 0-9] matches "0-9]".
NOTE
Unless otherwise specified, degeneration rules are applicable when preceding regular expressions
serve as subexpressions within parentheses.
l Combination of common and particular characters
In actual application, a regular expression combines multiple common and particular
characters to match certain strings.
Specifying a Filtering Mode in Command
CAUTION
The Quidway S5300 Series uses a regular expression to implement the filtering function of the
pipe character. A display command supports the pipe character only when there is excessive
output information.
When the output information is queried according to the filtering conditions, the first line of the
command output starts with the information containing the regular expression.
The command can carry the parameter | count to display the number of matching entries. The
parameter | count can be used together with other parameters.
For the commands supporting regular expressions, the three filtering methods are as follows:
l | begin regular-expression: displays the information that begins with the line that matches
regular expression.
l | exclude regular-expression: displays the information that excludes the lines that match
regular expression.
l | include regular-expression: displays the information that includes the lines that match
regular expression.
NOTE
The value of regular-expression is a string of 1 to 255 characters.
Specify a Filtering Mode when Information is Displayed

When a lot of information is displayed, you can specify a filtering mode in the prompt "---- More
----".
l /regular-expression: displays the information that begins with the line that matches regular
expression.
l -regular-expression: displays the information that excludes lines that match regular
expression.
l +regular-expression: displays the information that includes lines that match regular
expression.

2.3.4 History Commands

The command line interface provides a function similar to DosKey, which can automatically
save historical commands. You can invoke the historical commands saved on the command line
interface at any time and run them again.
By default, the system saves 10 history commands at most for each user. The operations are as
shown in Table 2-5.
Table 2-5 Access the history commands

Action Key or Command Result
Display the display history- Display the history commands entered by users.
history command
commands.
Access the last Up cursor key↑ or Display the last history command if there is an
history Ctrl_P earlier history command. Otherwise, an alarm is
command. generated.
Access the next Down cursor key ↓ Display the next history command if there is a later
history or Ctrl_N history command. Otherwise, the command is
command. cleared and an alarm is generated.
NOTE
On the HyperTerminal of Windows 9X, cursor key ↑ is invalid as the HyperTerminals of Windows 9X
define the keys differently. In this case, you can replace the cursor key ↑ with Ctrl_P.
When you use the history commands, note the following:

l The saved history commands are the same as that those entered by users. For example, if
the user enters an incomplete command, the saved command also is incomplete.
l If the user runs the same command several times, the earliest command is saved. If the
command is entered in different forms, they are considered as different commands.
For example, if the display ip routing-table command is run several times, only one history
command is saved. If the disp ip routing command and the display ip routing-table
command are run, two history commands are saved.
2.4 Shortcut Keys

This section describes the shortcut keys of the S5300.
2.4.1 System hotkeys
2.4.2 Using Hotkeys
2.4.1 System hotkeys

System hotkeys are not defined by users, and their functions are fixed. Table 2-6 describes
system hotkeys and their functions.

NOTE
Different terminal software defines hotkeys differently; therefore, the shortcut keys on the terminal may
be different from the hotkeys listed in this section.
Table 2-6 System hotkeys

Hotkeys Function
CTRL_A Moves the cursor to the beginning of the current

line.
CTRL_B Moves the cursor back one character.
CTRL_C Stops performing current functions.
CTRL_D Deletes the character where the cursor is located.
CTRL_E Moves the cursor to the end of the current line.
CTRL_F Moves the cursor one character right.
CTRL_H Deletes a character on the left side of the cursor.
CTRL_K Stops outgoing connections.
CTRL_N Displays the next command in the history

command buffer.
CTRL_P Displays the previous command in the history

command buffer.
CTRL_R Re-displays information about the current line.
CTRL_U Deletes all the characters on the left side of the

cursor.
CTRL_V Pastes the contents of the clipboard.
CTRL_W Deletes a word on the left side of the cursor.
CTRL_X Deletes all the characters on the left side of the

cursor.
CTRL_Y Deletes all the characters on the right side of the

cursor.
CTRL_Z Returns to the user view.
CTRL_ ] Stops incoming connections or redirects the

connections.
ESC_B Moves the cursor one word back.
ESC_D Deletes a word on the right side of the cursor.
ESC_F Moves the cursor one word forward.
ESC_N Moves the cursor downward a line.

Hotkeys Function
ESC_P Moves the cursor upward a line.
ESC_< Locates the cursor at the beginning of the text in

the clipboard.
ESC_> Locates the cursor at the end of the text in the

clipboard.
2.4.2 Using Hotkeys
l You can use hotkeys where a command can be run. When hotkeys are executed in the
system, the command assigned to the hotkeys is displayed the same as the complete
command is entered.
l After entering part of a command and before pressing Enter, the system deletes all the
input characters and displays the command assigned to the hotkeys by entering the hotkeys
that the command is assigned to. This is equivalent to deleting all the input characters and
entering the complete command.
l Using hotkeys is the same as running the command assigned to the hotkeys. After hotkeys
are used, the corresponding commands are recorded in the command buffer and log for
fault location and query.
NOTE
The terminals that you use may affect the functions of hotkeys. For example, the function of the hotkey
that is defined by the terminal used by a user varies with the function of the hotkey on the S5300. In this
case, after a user enters hotkeys, the command assigned to the hotkeys is not run.

This section provides several examples for using command lines.
2.5.1 Example for Using the Tab Key

You can obtain prompts on keywords or check whether the entered keywords are correct by
pressing Tab.
2.5.1 Example for Using the Tab Key

You can obtain prompts on keywords or check whether the entered keywords are correct by
pressing Tab.
Procedure
l If only one keyword contains the incomplete keyword,
do as follows on the S5300.
1. Enter an incomplete keyword.
[Quidway] info-
2. Press Tab.

The system replaces the incomplete keyword with a complete keyword and displays
the complete keyword in another line. There is only one space between the cursor and
the end of the keyword.
[Quidway] info-center
l If more than one keyword contains the incomplete keyword,

do as follows on the S5300.
# The keyword info-center can be followed by the following keywords.
[Quidway] info-center log?
logbuffer loghost
1. Enter an incomplete keyword.

[Quidway] info-center l
2. Press Tab.
The system displays the prefix of all the matched keywords. The prefix in this example
is log.
[Quidway] info-center log
3. Continue to press Tab to display all the keywords. There is no space between the
cursor and the end of the keywords.
[Quidway] info-center loghost
[Quidway] info-center logbuffer
Stop pressing Tab when you find the required keyword logbuffer.
4. Enter a space and enter the next keyword channel.
[Quidway] info-center logbuffer channel
----End

Configuration Guide - Basic Configuration 3 How to Use Interfaces
3 How to Use Interfaces
About This Chapter
This chapter describes the concept of the interface and the basic configuration about the interface.
3.1 Introduction to Interfaces

This section describes the concepts of interfaces. The interfaces are provided by the S5300 to
receive and send data.
3.2 Setting Basic Parameters of an Interface
This section describes how to set the basic parameters of an interface.
3.3 Configuring the Loopback Interface
This section describes how to configure the loopback interface.
3.4 Maintaining the Interface
This section describes how to maintain the interface.

3 How to Use Interfaces Configuration Guide - Basic Configuration
3.1 Introduction to Interfaces

This section describes the concepts of interfaces. The interfaces are provided by the S5300 to
receive and send data.
Interfaces are classified into management interfaces and service interfaces based on their
functions; interfaces are classified into physical interfaces and logical interfaces based on their
physical forms.
NOTE
A physical interface is sometimes called a port. Both physical interfaces and logical interfaces are called
interfaces in this document.
Management Interface
Management interfaces are used for managing and configuring the device. That is, you can log
in to the S5300 through a management interface to configure and manage the S5300.
Management interfaces do not transmit services.
The S5300 provides a console interface and an MEth interface as the management interface.
Table 3-1 Description of management interfaces

Name Description Usage
Console The console interface complies The console interface is connected to the
interface with the EIA/TIA-232 standard COM series interface of the configuration
and the interface type is DCE. terminal. It is used to set up the on-site
MEth The MEth interface complies with The MEth interface can be connected to
interface the 10/100BASE-TX standard. the network interface of the configuration
terminal or network management
workstation. It is used to set up the on-site
or remote configuration environment.
The rules for numbering management interfaces are as follows:
Table 3-2 Management interface numbers

Name Number
Console interface Console 0
MEth interface MEth 0/0/1

Classification of Service Interfaces

Service interfaces are used to transmit services. They are classified into 1-Gbit/s interfaces and
10-Gbit/s interfaces according to the rates of the interfaces; they are classified into electrical
interfaces and optical interfaces according to their electrical properties.
The rules for numbering service interfaces are as follows:
In a single S5300, the interface number is in the format slot ID/subcard ID/interface sequence
number.
l Slot ID: indicates the slot where an interface is located. The value is 0.
l Subcard ID: indicates the subcard where an interface is located. The value is 0 or 1.
The value 1 indicates that the subcard is a front card.
l Interface sequence number: indicates the sequence number of an interface.
In a stack system, the interface number is in the format stack ID/subcard ID/interface sequence
number.
l Stack ID: indicates the ID of the S5300 in the stack system. The value ranges from 0 to 8.
l Subcard ID: indicates the ID of a subcard. The value is 0 or 1.
The value 1 indicates that the subcard is a front card.
l Interface sequence number: indicates the sequence number of an interface on the S5300.
Table 3-3 Rules for numbering FE and GE interfaces

Figure Showing Interface Numbering Description
... The S5300 has two rows of service

2 4 6
interfaces with the lower-left interface
... numbered 1. The other interfaces are
1 3 5 ... numbered in ascending order from
bottom to up, and then from left to right.
For example, the upper-left interface
numbered 0/0/2.
Physical Interfaces
Physical interfaces exist on the S5300.
Physical interfaces include management interfaces and service interfaces.
The S5300 supports the following physical interfaces:
l Console interface
l Eth interface
l Gigabit Ethernet interface
l 10-Gigabit Ethernet interface
Logical Interfaces
Logical interfaces do not exist and are set up through configurations.

The S5300 supports the following logical interfaces:

l Eth-Trunk
An Eth-Trunk comprises only Ethernet links.
The Eth-Trunk technology has the following advantages:
– Increased bandwidth: The bandwidth of an Eth-Trunk is the total bandwidth of all
member interfaces.
– Improved reliability: When a link fails, traffic is automatically switched to other
available links. This ensures the reliability of the connection.
For details about the configuration, see the chapter "Configuring the Eth-Trunk" in the
Quidway S5300 Series Ethernet Switches Configuration Guide - Ethernet.
l Loopback interface
A loopback interface is a virtual interface. The TCP/IP protocol suite defines that the IP
address 127.0.0.0 is a loopback address. When the system starts, it automatically creates
an interface using the loopback address 127.0.0.1 to receive all data packets sent to the
local host. Some applications such as mutual access between Virtual Private Networks
(VPNs), however, need to be configured with a local interface with a specified IP address
when the configuration of a physical interface is not affected. In this case, the IP address
of the local interface is 32-bit mask, which saves IP addresses; the IP address can be
advertised by routing protocols.
The status of the loopback interface is always Up; therefore, the IP address of the loopback
interface can be used as the router ID, the label switching router (LSR) ID, or the tunnel.
For details, see 3.3 Configuring the Loopback Interface.
l Null interface
Null interfaces are similar to null devices supported by certain operating systems. Any data
packets sent to this interface are discarded. Null interfaces are mainly used for route
selection and policy-based routing (PBR). For example, if no route is matched during route
selection, the packet is sent to the null interface.
l Tunnel interface
A tunnel interface is a logical interface. It can be used as the backup interface of other
interfaces and used to set up Generic Routing Encapsulation (GRE) tunnels or
Multiprotocol Label Switching (MPLS) Traffic Engineering (TE) tunnels.
l VLANIF interface
When the S5300 needs to communicate with devices at the network layer, you can create
a logical interface of the Virtual Local Area Network (VLAN) on the S5300, namely, a
VLANIF interface. You can assign IP addresses to VLANIF interfaces because VLANIF
interfaces work at the network layer. The S5300 then communicates with devices at the
network layer through VLANIF interfaces.
For details about the configuration, see the chapter "Configuring the VLANIF Interface"
in the Quidway S5300 Series Ethernet Switches Configuration Guide - Ethernet.
3.2 Setting Basic Parameters of an Interface

This section describes how to set the basic parameters of an interface.

Before configuring advanced functions of an interface such as the working mode and routes,
you need to complete the basic configuration of the interface.

3.2.2 Entering the Interface View

To configure an interface, you need to enter the interface view.
3.2.3 Viewing All the Commands in the Interface View
After entering the interface view, you can view all the commands in the interface view.
3.2.4 Configuring the Description for an Interface
The description configured for an interface on the S5300 helps you identify and memorize the
usage of the interface, which facilitates the management.
3.2.5 Starting and Shutting Down an Interface
When a physical interface is idle and is not connected to a cable, shut down this interface to
protect the interface against interference. To use a shutdown interface, you need to start the
interface.
3.2.6 Further Configuration an Interface
After configuring basic parameters, configure the interface as required.
3.2.7 Checking the Configuration
After completing the basic configuration of an interface, you can use the display commands to
check the configuration.

Before configuring advanced functions of an interface such as the working mode and routes,
you need to complete the basic configuration of the interface.
To facilitate the configuration and maintenance of an interface, the S5300 provides interface
views. The commands related to the interface are valid only in the interface views.
The basic interface configurations include entering an interface view, configuring interface
description, enabling an interface, and disabling an interface.
Installing the LPU on the S5300
Data Preparation
To set parameters of an interface, you need the following data.
No. Data
1 Type and number of the interface to be configured
2 Description of the interface
3.2.2 Entering the Interface View

To configure an interface, you need to enter the interface view.

Context
Do as follows on the S5300.
Procedure
Step 1 Run:
system-view
The system view is displayed.

Step 2 Run:
interface interface-type interface-number
The view of a specified interface is displayed.

interface-type specifies the type of the interface and interface-number specifies the number of
the interface.
----End
3.2.3 Viewing All the Commands in the Interface View

After entering the interface view, you can view all the commands in the interface view.
Context
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
?
All the commands in the view of the specified interface are displayed.
----End
3.2.4 Configuring the Description for an Interface

The description configured for an interface on the S5300 helps you identify and memorize the
usage of the interface, which facilitates the management.
Procedure
Step 1 Run:
system-view


Step 2 Run:

Step 3 Run:
description description
The description is configured for the interface.
----End
3.2.5 Starting and Shutting Down an Interface

When a physical interface is idle and is not connected to a cable, shut down this interface to
protect the interface against interference. To use a shutdown interface, you need to start the
interface.
Context
NOTE
l A null interface is always Up and cannot be shut down by command.

l A loopback interface is always Up and cannot be shut down by command.
Procedure
l Shutting down the interface
1. Run:
system-view

2. Run:

3. Run:
shutdown
The interface is shut down.

NOTE
By default, an interface is enabled.

l Starting an interface
1. Run:
system-view

2. Run:


3. Run:
undo shutdown
The interface is started.

----End
3.2.6 Further Configuration an Interface

After configuring basic parameters, configure the interface as required.
Context
When you access a network through an interface, you need to further setting multiple parameters
of the interface based on the networking requirements in addition to performing basic
configurations on the interface.
Further configurations of an interface include:
l Configuring the operation mode of an interface
l Configuring routes
For the detailed Configuration, please see the other configuration manuals of S5300.
For the detailed Configuration, please see Quidway S5300 Series Ethernet Switches
Configuration Guide - Ethernet and Quidway S5300 Series Ethernet Switches Configuration
Guide - IP Routing.

After completing the basic configuration of an interface, you can use the display commands to
check the configuration.
Procedure
Step 1 Run the display interface [ interface-type [ interface-number ] ] command to check the running
status of the interface and the statistics on the interface.
Step 2 Run the display interface description command to check the brief information about the
interface
Step 3 Run the display ip interface [ interface-type interface-number ] command to check the main
configurations of the interface.
Step 4 Run the display ip interface brief [ interface-type interface-number ] command to check the
brief state of the interface.
----End
3.3 Configuring the Loopback Interface

This section describes how to configure the loopback interface.

The users can create or delete a loopback interface. When being created, the loopback interface
remains in the Up state until you delete it.
3.3.2 Configuring IPv4 Parameters of the Loopback Interface
A loopback interface can be assigned an IPv4 address, bound to a VPN instance, and configured
to check the source IPv4 addresses of packets.
After configuring a loopback interface, run the following commands to check the configuration.

The users can create or delete a loopback interface. When being created, the loopback interface
remains in the Up state until you delete it.
Some applications such as mutual access between VPNs need to be configured with a local
interface with a specified IP address when the configuration of a physical interface is not affected.
In this case, the IP address of the local interface needs to be advertised by routing protocols.
Loopback interfaces are used to improve the reliability of the configuration.
Before configuring the loopback interface, complete the following task:
l Switching on the S5300
Data Preparation
To configure the loopback interface, you need the following data.
No. Data
1 Number of the loopback interface
2 IP address of the loopback interface
3.3.2 Configuring IPv4 Parameters of the Loopback Interface

A loopback interface can be assigned an IPv4 address, bound to a VPN instance, and configured
to check the source IPv4 addresses of packets.
Procedure
Step 1 Run:
system-view

Step 2 Run:
interface loopback interface-number
A loopback interface is created.

The value of interface-number ranges from 0 to 1023. A maximum of 1024 loopback interfaces
can be created.
Step 3 Run:
ip address ip-address { mask | mask-length } [ sub ]
An IPv4 address is assigned to the loopback interface.
Step 4 (Optional) Run:

ip verify source-address
The loopback interface is configured to check the source IPv4 addresses of packets.
----End

After configuring a loopback interface, run the following commands to check the configuration.
Procedure
Step 1 Run the display interface loopback [ number ] command to check the status of the loopback
interface.
----End
3.4 Maintaining the Interface

This section describes how to maintain the interface.
3.4.1 Clearing Statistics Information on the Interface

The statistics on the interface cannot be restored after you clear them. So, confirm the action
before you use the command.
3.4.2 Debugging the Interface
When an interface works abnormally, you can debug the interface.
3.4.1 Clearing Statistics Information on the Interface

The statistics on the interface cannot be restored after you clear them. So, confirm the action
before you use the command.
Procedure
Step 1 Run the reset counters interface [ interface-type [ interface-number ] ] command in the user
view to clear the statistics on the interface.
----End
3.4.2 Debugging the Interface

When an interface works abnormally, you can debug the interface.

Context
CAUTION
Debugging affects the performance of the system. So, after debugging, run the undo debugging
all command to disable it immediately.
For the description about debugging commands, see the Quidway S5300 Series Ethernet
Switches Debugging Reference.
For details about debugging commands on an interface, see the following chapters.

Configuration Guide - Basic Configuration 4 Basic Configuration
4 Basic Configuration
About This Chapter
This chapter describes how to configure the basic system environment and the basic user
environment.
4.1 Basic Configuration Introduction

This section describes the meaning and scope of the basic configuration.
4.2 Configuring the Basic System Environment
This section describes how to configure the basic system environment according to user habits
or the requirements of the actual environment.
4.3 Configuring Basic User Environment
This section describes the configuration of the basic user environment for user level switching.
4.4 Displaying System Status Messages
This section describes the display commands that are used for displaying basic system
configurations.

4 Basic Configuration Configuration Guide - Basic Configuration
4.1 Basic Configuration Introduction

This section describes the meaning and scope of the basic configuration.
Before configuring services, users often need to perform basic configurations for actual
operation and maintenance.
The S5300 provides configurations of two kinds of basic environments:
l Basic system environment: includes the language mode, host name, system name, system
time, header text, and command level for actual environment.
l Basic user environment: includes password for changing levels and the terminal lock.
4.2 Configuring the Basic System Environment

This section describes how to configure the basic system environment according to user habits
or the requirements of the actual environment.

Before configuring the basic system environment, familiarize yourself with the applicable
4.2.2 Configuring the Equipment Name
You can change the equipment name as required. The new equipment name takes effect
immediately.
4.2.3 Setting the System Clock
To ensure that devices on the network work with the same clock, you need to set or change the
system clock.
4.2.4 Configuring the Header Text
If you need to warn or prompt login users, you can configure the header text that the system
prompts during the login or after the login.
4.2.5 Configuring Command Levels
By default, commands are registered in the sequence of Level 0 to Level 3. If refined rights
management is required, you can divide commands in to 16 levels, that is, from Level 0 to Level
15.

Before configuring the basic system environment, familiarize yourself with the applicable
Before configuring the services, you need to configure the basic system environments to meet
the requirements of the actual environments.
By default, the S5300 supports commands of Level 0 to Level 3, namely, visit level, monitoring
level, configuration level, and management level.

If the user needs to define more levels, or refine management privileges on the device, the user
can extend the range of command line level from the range of Level 0 to Level 3 to the range of
Level 0 to Level 15.
Before configuring basic system environment, complete the following task:
l Powering on the switch
Data Preparation
To configure basic system environment, you need the following data.
No. Data
1 System time
2 Host name
3 Login information
4 Command level
4.2.2 Configuring the Equipment Name

You can change the equipment name as required. The new equipment name takes effect
immediately.
Context
Procedure
Step 1 Run:
system-view

Step 2 Run:
sysname host-name
The equipment name is set.

You can change the name of the switch that appears in the command prompt.
By default, the host name of the switch is Quidway.
----End
4.2.3 Setting the System Clock

To ensure that devices on the network work with the same clock, you need to set or change the
system clock.

Context
You need to set the system time properly to ensure the cooperation between the S5300 and other
devices. The S5300 supports the configurations of the time zone and the daylight saving time.
NOTE
UTC indicates the Universal Time Coordinated.
Procedure
Step 1 Run:
clock datetime HH:MM:SS YYYY-MM-DD
The current date and time is set.
Step 2 Run:
clock timezone time-zone-name { add | minus } offset
The time zone is set.
l If add is configured, the current time is the UTC time plus the time offset. That is, the default
UTC time plus offset is equal to the time of time-zone-name.
l If minus is configured, the current time is the UTC time minus the time offset. That is, the
default UTC time minus offset is equal to the time of time-zone-name.
Step 3 Run:
clock daylight-saving-time time-zone-name one-year start-time start-date end-time
end-date offset
or
clock daylight-saving-time time-zone-name repeating start-time { { first | second
| third | fourth | last } weekday month | start-date } end-time { { first |
second | third | fourth | last } weekday month | end-date } offset [ start-year
[ end-year ] ]
The daylight saving time is set.
During the configuration of the daylight saving time, you can configure the start time and end
time in one of the following modes: date+date, week+week, date+week, and week+date. For
details, see clock daylight-saving-time.
----End
4.2.4 Configuring the Header Text

If you need to warn or prompt login users, you can configure the header text that the system
prompts during the login or after the login.
Context

Procedure
Step 1 Run:
system-view

Step 2 Run:
header login { information text | file file-name }
The header text is set during login.

Step 3 Run:
header shell { information text | file file-name }
The header text is set after the login.

Header text is the prompt displayed in the system when users connect to the switch, log in or
start interactive configuration. Configure the header text to provide detailed instruction.
----End
4.2.5 Configuring Command Levels

By default, commands are registered in the sequence of Level 0 to Level 3. If refined rights
management is required, you can divide commands in to 16 levels, that is, from Level 0 to Level
15.
Context
If the user does not adjust a command level separately, after the command level is updated, all
originally-registered command lines adjust automatically according to the following rules:
l The commands of Level 0 and Level 1 remain unchanged.
l The command Level 2 is updated to Level 10 and Level 3 is updated to Level 15.
l No command lines exist in Level 2 to Level 9 and Level 11 to Level 14. The user can adjust
the command lines to these levels separately to refine the management of privilege.
NOTE
The updation of command Level 2 to Level 10 and Level 3 to Level 15 is not a two-step process but one-
step by batch.
Procedure
Step 1 Run:
system-view

Step 2 Run:
command-privilege level rearrange
Update the command level in batch.

When no password is configured for a Level 15 user, the system prompts the user to set a super-
password for the level 15 user. At the same time, the system asks if the user wants to continue

to update the command line level. Then, just select "N" to set a password. If you select "Y", the
command level can be updated in batch directly. This results in the user not logging in through
the Console port and failing to update the level.
Step 3 Run:
command-privilege level level view view-name command-key
The command level is configured. With the command, you can specify the level and view
multiple commands at one time (command-key).
All commands have default command views and levels. You need not reconfigure them.
----End
4.3 Configuring Basic User Environment

This section describes the configuration of the basic user environment for user level switching.

Before configuring the basic user environment, familiarize yourself with the applicable
4.3.2 Configuring the Password for Switching User Levels
Passwords need to be set for users that are switched from lower levels to higher levels.
4.3.3 Switching User Levels
You need to enter the set password when being switched from a lower level to a higher level.
4.3.4 Locking User Interfaces
You can enter the set password to unlock the locked user interface.

Before configuring the basic user environment, familiarize yourself with the applicable
The user can log in to a switch with lower level to perform simple configurations or view
configurations. When the configuration is complicated, the user needs to switch to a high level.
Thus, it requires the user to configure the basic environment for switching levels.
Before configuring the basic environment for the user, complete the following task:
l Powering on the switch properly
Data Preparation
To configure the basic environment for the user, you need the following data:

No. Data
1 Password for the user level switching
4.3.2 Configuring the Password for Switching User Levels

Passwords need to be set for users that are switched from lower levels to higher levels.
Context
When users log in to the switch with a lower user level, they switch to a higher user level to
perform advanced operations by entering the corresponding password. The password needs to
be configured in advance.
CAUTION
When simple is used, the password is saved in the configuration files in simple text. Login users
with lower level can obtain the password by viewing the configuration. This may cause security
problems. Therefore, cipher is used to save the password in encrypted text.
If the pass word is set in cipher mode, the password cannot be resumed from the system. Save
the password to avoid oblivion or miss.
Procedure
Step 1 Run:
system-view
Step 2 Run:
super password [ level user-level ] { simple | cipher } password
The password for switching user levels is configured.
----End
4.3.3 Switching User Levels

You need to enter the set password when being switched from a lower level to a higher level.
Context
An accurate password must be entered when the user is switched from a lower level to a higher
level.

Procedure
Step 1 Run:
super [ level ]
User levels are switched.
Step 2 Follow the prompt and enter a password.
If the password entered is correct, the user can switch to a higher level. If the user enters a
password incorrectly for three consecutive times, the user remains at the current login level and
returns to the user view.
NOTE
When the login user of lower level is switched to the user of higher level through the super command, the
system automatically sends trap messages and records the switchover in a log. When the switched level
is lower than that of the current level, the system only records the switchover in a log.
----End
4.3.4 Locking User Interfaces

You can enter the set password to unlock the locked user interface.
Context
When you leave the operation terminals for a moment, you can lock the user interface to prevent
unauthorized users from operating the interface.
Procedure
Step 1 Run:
lock
The user interface is locked.
Step 2 Follow the system prompt and input an unlock password, and then confirm.
<Quidway> lock
Enter Password:
Confirm Password:
If the locking is successful, the system prompts that the user interface is locked.
You must enter a correct password to unlock the user interface.
----End
4.4 Displaying System Status Messages

This section describes the display commands that are used for displaying basic system
configurations.

Context
You can use the display commands to collect information about the system status. The display
commands are classified according to the following functions:
l Displays system configurations.
l Displays the running status of the system.
l Displays the diagnostic information about a system.
l Displays the restart information about the main control board.
See the related sections for display commands for protocols and interfaces. The following only
shows the system display commands.
Run the following commands in any view.
4.4.1 Displaying System Configuration
You can view information about the system version, system time, original configuration, and
current configuration.
4.4.2 Displaying System Status
You can view the debugging status and the configuration of the current view.
4.4.3 Collecting System Diagnostic Information
You can view the system diagnosis information.
4.4.1 Displaying System Configuration

You can view information about the system version, system time, original configuration, and
current configuration.
Prerequisite
Basic Configuration are complete.
Procedure
l Run the display version command to display the system version.
l Run the display clock command to display the system time.
l Run the display saved-configuration command to display the original configuration.
l Run the display current-configuration command to display the current configuration.
----End
4.4.2 Displaying System Status

You can view the debugging status and the configuration of the current view.
Prerequisite
Basic configuration are complete.
Procedure
l Run the display debugging [ interface interface-type interface-number ] [ module-
name ] command to display the debugging status.

l Run the display this command to display the configuration of the current view.
----End
4.4.3 Collecting System Diagnostic Information

You can view the system diagnosis information.
Context
Basic configuration is complete.
Procedure
Step 1 Run:
display diagnostic-information [ file-name ]
The system diagnosis information is displayed.

When the system fails or performs the routine maintenance, you need to collect a lot of
information to locate faults. Then, you have to run different display commands to collect all
information. In this case, you can use the display diagnostic-information command to collect
all information about the current running modules in the system.
The display diagnostic-information command collects all information collected by running
the following commands, including display clock, display version, display cpu-usage, display
interface, display current-configuration, display saved-configuration, display history-
command, and so on.
----End

Configuration Guide - Basic Configuration 5 User Management
5 User Management
About This Chapter
This chapter describes user interfaces and the configuration of users' login.
5.1 User Management Introduction

This section describes basic concepts of user interfaces and user management.
5.2 Logging In to the S5300 Through the Console Interface
This section describes how to log in to the S5300 through the console interface.
5.3 Configuring Console User Interface
You can configure the console user interface so as to maintain a switch on the local device.
5.4 Configuring VTY User Interface
You can configure the VTY user interface to maintain a remote switch.
5.5 Managing User Interfaces
You need to configure user management to ensure that the operator manages switchs safely.
5.6 Configuring User Management
Through user management, you can create users for switchs, set user passwords, and manage
users.
This section provides examples for configuring users to log in to a switch in different modes.
These configuration examples explain networking requirements, configuration roadmap, and
configuration notes.

5 User Management Configuration Guide - Basic Configuration
5.1 User Management Introduction

This section describes basic concepts of user interfaces and user management.
5.1.1 User Interface

A user interface (UI) enables users to log in to the S5300. Through a user interface, you can
configure the parameters on all physical and logical interfaces that work in asynchronous and
interactive modes. In this manner, you can manage, authenticate, and authorize the login users.
5.1.2 User Authentication
When a user logs in to the S5300, the S5300 authenticates the user according to the configuration
to ensure system security.
5.1.1 User Interface

A user interface (UI) enables users to log in to the S5300. Through a user interface, you can
configure the parameters on all physical and logical interfaces that work in asynchronous and
interactive modes. In this manner, you can manage, authenticate, and authorize the login users.
Types of User Interfaces

Table 5-1 describes the types of user interfaces supported by the S5300.
Table 5-1 Types of user interfaces
Type Purpose Description
CON Local login through the It is a linear interface conforming to the EIA/TIA-232
console interface standard. The type of the interface is DCE. Each
device provides a console interface.
VTY Local or remote login It is a virtual interface and indicates a logical terminal
through Telnet or SSH line. When you log in to the S5300 through Telnet,
FTP, or SSH, a VTY connection is set up.
Numbering of User Interfaces

You can number a user interface in the following ways:
l Relative numbering
Relative numbering indicates that the interfaces of the same type are numbered. The relative
numbering uniquely specifies a user interface of a specified type.
The format of the relative numbering is: user interface type + number. It must comply with
the following rules:
– Number of the CON interface: console0
– Default number of the VTY: vty0, vty1, vty2, vty3, and vty4
l Absolute numbering

The S5300 uniquely specifies the default numbers of 0, 34… 38 for the user interfaces of
CON and VTY. You can enter a specific user interface view by entering any of these
numbers.
l Mapping between relative numbering and absolute numbering
Figure 5-1 shows the mapping between relative and absolute numbering of a user interface.
Figure 5-1 Numbering of user interfaces on the S5300

Types ofset Relative Obsolute
interface numbering numbering
CON console0 0
……
vty0 34
vty1 35
VTY vty2 36
vty3 37
vty4 38
In the figure, console 0 and 0 indicate the same user interface; vty1 and 35 indicate the
same user interface.
NOTE
On the S5300, the absolute number can be 0 or 34 to 48.
5.1.2 User Authentication

When a user logs in to the S5300, the S5300 authenticates the user according to the configuration
to ensure system security.
When the S5300 is switched on for the first time, no authentication information for login is
available in the system. In this case, you can log in to the S5300 through the console interface
without being authenticated.
If a user logs in to the S5300 through Telnet on an Ethernet interface, the login user must be
authenticated for the sake of security. If the authentication succeeds, the user can log in to the
S5300 to configure and maintain the S5300.
To manage users that try to log in to the S5300, these users are assigned with passwords and
classified into different levels.
Classifying Login Users

Login users on the S5300 are classified according to service types and assigned rights assigned,
as shown in Table 5-2.

Table 5-2 Types of login users
User Type Description Authentication
Super users Logs in to the S5300 through the console interface Not authenticated for
and have all rights. the first login but
recommended later
Telnet users Logs in to the S5300 through the Ethernet interface Recommended
using Telnet and have limited rights. A Telnet
connection is set up between the user terminal and the
S5300.
SSH users Logs in to the S5300 through the Ethernet interface Recommended
using SSH and have limited rights. An SSH
connection is set up between the user terminal and the
S5300.
FTP users Logs in to the S5300 through FTP on the Ethernet Recommended
interface and have limited rights. An FTP connection
is set up between the user terminal and the S5300.
The rights that can be obtained by users logging in to the S5300 through Telnet, SSH, and FTP
depend on the priorities of the user interfaces through which they log in to. The S5300 provides
multiple services for a user. To ensure login convenience and security, login users must be
classified, and then assigned levels.
Priorities of Users
The system manages super users and Telnet users according to user levels.
Similar to the command levels, users are classified into 16 levels numbered 0 to 15. The greater
the number, the higher the user level.
NOTE
If the user levels are not set, the four default user levels are used, namely, levels 0 to 3.
The level of the command that a user can run is determined by the level of this user.
l In the case of non-authentication or password authentication, the level of the command that
the user can run depends on the level of the user interface.
l In the case of AAA authentication, the command that the user can run depends on the level
of the local user specified in AAA configuration.
Users of a level can access the commands of this level or lower levels.
Assuming that user levels 0 to 3 are used in the system, users of level 2 can access commands
of levels 0, 1, and 2, and users of level 3 can access commands at all levels.
Authenticating Login Users

After users are configured on the S5300, the system authenticates the users when they log in to
the S5300. The S5300 provides three authentication modes, as shown in Table 5-3.

Table 5-3 Authentication modes of login users
Authenticatio Description
n Mode
Non- Users can log in to the S5300 without entering the user name and password.
authentication There is a great potential security risk.
Password Users can log in to the S5300 by entering only the password. In this
authentication manner, security is ensured.
AAA Users need to enter both the user name and password to log in to the
authentication S5300. The S5300 then authenticates the users according to the configured
user information. This further improves security. It applies to the users
logging in to the S5300 through the console interface and Telnet users.
5.2 Logging In to the S5300 Through the Console Interface

This section describes how to log in to the S5300 through the console interface.

5.2.2 Logging In to the S5300 Through the Console Interface
You need to log in to the S5300 through the console interface, as shown in Figure 5-2. In the
figure, Switch is an S5300.
Figure 5-2 Logging in to the S5300 through the console interface

RS-232 serial interface Console interface
PC Switch
NOTE
If the S5300 is switched on for the first time and you need to manage and configure the S5300, you can
log in to the S5300 through the console interface only.
Before logging in to the S5300 through the console interface, complete the following tasks:
l Connecting the PC and the S5300 correctly

l Starting the S5300 normally
Data Preparation
None.
Context
When setting up a local configuration environment through the console interface, you can
connect the PC and the S5300 through the Windows HyperTerminal.
Procedure
Step 1 Enable the HyperTerminal on the PC.
Choose Start > All Programs > Accessories > Communications > HyperTerminal to start
the HyperTerminal.
Step 2 Set up a new connection.
As shown in Figure 5-3, enter the name of the new connection in the Name text box and choose
an icon. Click OK.
Figure 5-3 Setting up a new connection
Step 3 Set the connection port.
After entering the Connect window as shown in Figure 5-4, select a serial port from the
Connect drop-down list box according to the port used by the PC or the configuration terminal.
Select COM1 in this case, and click OK.

Figure 5-4 Setting the connection port
Step 4 Set communication parameters.

After entering the COM1 Properties window as shown in Figure 5-5, set the communication
parameters according to the description in Table 5-4.
NOTE
In other Windows operating systems, Bits per second may be described as Baud rate; Flow control may
be described as Traffic control.

Figure 5-5 Setting communication parameters for the port
Table 5-4 Communication parameters

Parameter Value
Bit per second (Baud rate) 9600
Data bit 8
Parity check None
Stop bit 1
Flow control (Traffic control) None
Step 5 After the HyperTerminal is started, select File Attributes to enter the Connect Properties
window as shown in Figure 5-6. Choose the Setting tab, select Auto detect or VT100 from the
Emulation drop-down list box. Click OK to complete the setting.

Figure 5-6 Selecting a terminal type
After the preceding steps are complete, press Enter. If the prompt <Quidway> is displayed, it
indicates that you have logged in to the S5300. At this time, you can enter the command to
configure and manage the S5300.
----End
5.3 Configuring Console User Interface

You can configure the console user interface so as to maintain a switch on the local device.

Before configuring the console user interface, familiarize yourself with the applicable
5.3.2 Configuring Console Interface Attributes
You can configure the rate, flow control mode, parity mode, stop bit, and data bit for the console
port.
5.3.3 Setting Console Terminal Attributes
You can configure the idle timeout period, one-screen length of the terminal screen, and the size
of historical command buffer for the console port.
5.3.4 Configuring User Priority
You can set the priority for a user who logs in through the console port.

5.3.5 Configuring User Authentication

The system provides three authentication modes, namely, AAA, password, and none.
After configuring the console user interface, you can view the usage information of the user
interface, physical attributes and configurations of the user interface, local user list, and online
users.

Before configuring the console user interface, familiarize yourself with the applicable
If you need to maintain a switch on a local device, the console user interface is required.
Before configuring a console user interface, complete the following tasks:

l Connecting the PC with the switch
Data Preparation
To configure a console user interface, you need the following data.
No. Data
1 Baud rate, flow-control mode, parity, stop bit, and data bit
2 Idle timeout period, screen length, and the size of history command buffer
3 User priority
4 User authentication method, user name, and password
NOTE
All the default values are stored on the switch and do not need additional configuration.
5.3.2 Configuring Console Interface Attributes

You can configure the rate, flow control mode, parity mode, stop bit, and data bit for the console
port.
Context
Do as follows on the switch that the user logs in to:

Procedure
Step 1 Run:
system-view

Step 2 Run:
user-interface console interface-number
The user interface view is displayed.

speed speed-value
The baud rate is set.

By default, the baud rate is 9600 bit/s.
flow-control { hardware | none | software }
The flow control mode is set. By default, the flow-control mode is none.
parity { even | mark | none | odd | space }
The parity mode is set.

By default, the value is none.
stopbits { 1.5 | 1 | 2 }
The stop bit is set.

By default, the value is 1 bit.
databits { 5 | 6 | 7 | 8 }
The data bit is set.

By default, the data bit is 8.
NOTE
When the user logs in to a switch through a console port, the configured attributes for the console port on
the HyperTerminal should be in accordance with the attributes of the interface on the switch. Otherwise,
the user cannot log in to the switch.
----End
5.3.3 Setting Console Terminal Attributes

of historical command buffer for the console port.
Context

Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
shell
The terminal service is started.

Step 4 Run:
idle-timeout minutes [ seconds ]
The timeout period is set.

By default, idle timeout period on the user interface is 10 minutes.
Step 5 Run:
screen-length screen-length
One-screen length of the terminal screen is set.

By default, the length of a terminal screen is 24 lines.
You can run the screen-length screen-length temporary command to specify the number of
lines temporarily displayed on the terminal screen.
Step 6 Run:
history-command max-size size-value
The buffer of the history command is set.

By default, the size of history command buffer on a user interface is 10 entries.
----End

You can set the priority for a user who logs in through the console port.
Context
Procedure
Step 1 Run:
system-view

Step 2 Run:


Step 3 Run:
user privilege level level
The priority of the user is set.

This process is to set the priority for a user who logs in through the console port. A user can only
use the command of the level corresponding to the user level.
For more information about the command priority, see "Command Level" in Chapter 3 "CLI
Overview".
----End

Procedure
l Configuring AAA Authentication
1. Run:
system-view

2. Run:
The console user interface view is displayed.

3. Run:
authentication-mode aaa
The authentication mode is set to AAA.

4. Run:
quit
Exit from the console user interface view.

5. Run:
aaa
The AAA view is displayed.

6. Run:
local-user user-name password { simple | cipher } password
Name and password of the local user are created.

l Configuring Password Authentication
1. Run:
system-view

2. Run:

3. Run:
authentication-mode password
You can set the authentication mode as password authentication.

4. Run:
set authentication password { cipher | simple } password
A password for authentication is set.

l Configuring Non-Authentication
1. Run:
system-view

2. Run:

3. Run:
authentication-mode none
The authentication mode is set to non-authentication.

----End

After configuring the console user interface, you can view the usage information of the user
interface, physical attributes and configurations of the user interface, local user list, and online
users.
Prerequisite
The configurations of the User Management function are complete.
Procedure
l Run the display users [ all ] command to check information about user interface.
l Run the display user-interface console ui-number1 [ summary ] command to check
physical attributes and configurations of the user interface.
l Run the display local-user command to check the local user list.
l Run the display access-user command to check online users.
----End
5.4 Configuring VTY User Interface

You can configure the VTY user interface to maintain a remote switch.

Before configuring the VTY user interface, familiarize yourself with the applicable environment,
complete the pre-configuration tasks, and obtain the required data. This can help you complete
the configuration task quickly and accurately.

5.4.2 Configuring Maximum VTY User Interfaces

You can configure the maximum number of VTY user interfaces through which users log in to
a switch.
5.4.3 (Optional)Configuring Limits for Incoming Calls and Outgoing Calls
You can set the limit on incoming and outgoing calls for VTY user interfaces.
5.4.4 Configuring VTY Terminal Attributes
of historical command buffer for the VTY interface.
After configuring the VTY user interface, you can view the usage information of the user
interface, the maximum number of VTY user interfaces, and physical attributes and
configurations of the user interface.

Before configuring the VTY user interface, familiarize yourself with the applicable environment,
If you want to configure and manage Telnet or log in to the switch through SSH, you need to
configure the VTY user interface.
Before configuring VTY user interface, complete the following tasks:
l Connecting PC and switch correctly
Data Preparation
To configure a VTY user interface, you need the following data.
No. Data
1 Maximum VTY user interfaces
2 (Optional) ACL code to limit VTY user interface to call in and out
3 Idle timeout period, screen length of terminal, and the size of history command buffer
4 User authentication method, user name, and password

5.4.2 Configuring Maximum VTY User Interfaces

You can configure the maximum number of VTY user interfaces through which users log in to
a switch.
Context
Procedure
Step 1 Run:
system-view
Step 2 Run:
user-interface maximum-vty number
The maximum VTY user interfaces that can log in to the switch is set.
NOTE
When the maximum number of VTY user interfaces is set to zero, any user including the NMS user cannot
log in to a switch.
If the maximum number of VTY user interfaces to be configured is smaller than the maximum
number of current interfaces, other parameters need not be configured.
If the maximum number of VTY user interfaces to be configured is larger than the maximum
number of current interfaces, the authentication mode and password need to be configured for
newly added user interfaces.
For newly added user interfaces, the system applies password authentication by default.
For example, a maximum of five users are allowed online. To allow 15 VTY users online at the
same time, you need to run the authentication-mode command and the set authentication
password command to configure authentication modes and passwords for user interfaces from
VTY 5 to VTY 14. The command is run as follows:
[Quidway] user-interface maximum-vty 15
[Quidway-ui-vty5-14] authentication-mode password
[Quidway-ui-vty5-14] set authentication password cipher huawei
----End
5.4.3 (Optional)Configuring Limits for Incoming Calls and

Outgoing Calls
You can set the limit on incoming and outgoing calls for VTY user interfaces.
Context

Procedure
Step 1 Run:
system-view

Step 2 Run:
user-interface [ ui-type ] first-ui-number [ last-ui-number ]

Step 3 Run:
acl acl-number { inbound | outbound }
The limits to calling in/out of VTY are configured.

When you need to prevent a user of certain address or segment address from logging in to the
switch, use the inbound command; when you need to prevent a user who logs in to a switch
from accessing other switchs, use the outbound command.
----End
5.4.4 Configuring VTY Terminal Attributes

of historical command buffer for the VTY interface.
Context
Procedure
Step 1 Run:
system-view

Step 2 Run:
user-interface vty number1 [ number2 ]
The VTY user interface view is displayed.

Step 3 Run:
shell
VTY terminal service is enabled.

Step 4 Run:
User disconnection after timeout is enabled.

Step 5 Run:
screen-length screen-length
The screen length of the terminal screen is set.

By default, the number of rows on one screen is 24.

You can run the screen-length screen-length temporary command to specify the number of
lines temporarily displayed on the terminal screen.
Step 6 Run:
history-command max-size size-value
Set the size of the history command buffer.
----End

Context
The switch supports user authentication of three types:
l AAA authentication: requires the user name and password.
l Password authentication: requires no user name but a password must be set. Otherwise, the
user can log in to the switch only through the console interface.
l None: requires neither user name nor password. No authentication is needed when the user
logs in to the switch.
Procedure
l Configuring AAA Authentication
1. Run:
system-view

2. Run:

3. Run:

4. Run:
quit
Exit from the VTY user interface view.

5. Run:
aaa

6. Run:

l Configuring Password Authentication
1. Run:
system-view


2. Run:

3. Run:
Set the authentication mode as password.

4. Run:
A password for this authentication mode is set.

l Configuring Non-Authentication
1. Do as follows on the switch, run:
system-view

2. Run:

3. Run:
The authentication mode is set to none.

----End

After configuring the VTY user interface, you can view the usage information of the user
interface, the maximum number of VTY user interfaces, and physical attributes and
configurations of the user interface.
Prerequisite
The configuration of VTY User Interface are complete.
Procedure
l Run the display users [ all ] command to check the usage information of the user interface.
l Run the display user-interface maximum-vty command to check the number of maximum
VTY user interfaces.
l Run the display user-interface [ [ ui-type ] ui-number1 | ui-number ] [ summary ]
command to check the physical attributes and configurations of the user interface.
----End
5.5 Managing User Interfaces

You need to configure user management to ensure that the operator manages switchs safely.


Before configuring user management interfaces, familiarize yourself with the applicable
5.5.2 Sending Messages to Other User Interfaces
You can configure messaging between user interfaces.
5.5.3 Clearing Online User
You can clear specified online users.
After configuring user management interfaces, you can view the usage information of user
interfaces.

Before configuring user management interfaces, familiarize yourself with the applicable
To ensure that the operator managesswitchs safely, you need to send messages between user
interfaces and clear designated user.
Before managing the user interface, complete the following tasks:

l Connecting the PC with the switch properly
Data Preparations
To manage the user interface, you need the following data:
No. Data
1 Type and number of the user interface
2 Contents of the message to be sent
5.5.2 Sending Messages to Other User Interfaces

You can configure messaging between user interfaces.
Context

Procedure
Step 1 Run:
send { all | ui-type ui-number | ui-number1 }
You can enable message sending between user interfaces.
Step 2 Following the prompt, you can enter the message to be sent. You can press Ctrl_Z or Enter to
end.
----End
5.5.3 Clearing Online User

You can clear specified online users.
Context
Procedure
Step 1 Run:
free user-interface { ui-number | ui-type ui-number1 }
Online users are cleared.
Step 2 On receiving the prompts, you can confirm whether the designated online users have to be
cleared.
----End

After configuring user management interfaces, you can view the usage information of user
interfaces.
Prerequisite
The configuration of User Interfaces are complete.
Procedure
Step 1 Run the display users [ all ] command to check the usage information of the user interface.
----End
5.6 Configuring User Management

Through user management, you can create users for switchs, set user passwords, and manage
users.

Before configuring user management, familiarize yourself with the applicable environment,
5.6.2 Configuring Authentication Mode
The system provides three authentication modes, namely, AAA local authentication, password
authentication, and none authentication.
5.6.3 Configuring Authentication Password
You can configure a plain or cipher text password for authentication.
5.6.4 Setting Username and Password for AAA Local Authentication
You can configure a plain or cipher text password for AAA local authentication.
5.6.5 Configuring Non-Authentication
You can configure users to log in to a switch without being authenticated.
You can configure the user priority.
After configuring user management, you can view the usage information of user interfaces, local
user list, and online users.

Before configuring user management, familiarize yourself with the applicable environment,
After the IP address is assigned to the main control board or the interface board, any remote user
can use Telnet to log in to the switch, or connect the switch through PPP to access networks.
This compromises the security. To ensure network security and ease user management, configure
a user name and the user password for the switch.
Before configuring a user, complete the following tasks:
l Connecting the PC with the switch properly
Data Preparation
To configure a user, you need the following data.
No. Data
1 Authentication mode
2 User name and password
3 User priority

5.6.2 Configuring Authentication Mode

The system provides three authentication modes, namely, AAA local authentication, password
authentication, and none authentication.
Context
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
authentication-mode { aaa | password | none }
The user authentication mode is configured.
----End
5.6.3 Configuring Authentication Password

You can configure a plain or cipher text password for authentication.
Context
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
The authentication mode is set to Password.

Step 4 Run:
The authentication password is configured.

NOTE
The default authentication mode is the password authentication.
----End
5.6.4 Setting Username and Password for AAA Local

Authentication
You can configure a plain or cipher text password for AAA local authentication.
Context
Procedure
Step 1 Run:
system-view
Step 2 Run:
Step 3 Run:
Step 4 Run:
quit
Return to the system view.
Step 5 Run:
aaa
Step 6 Run:
The local username and the password are configured.
----End
5.6.5 Configuring Non-Authentication

You can configure users to log in to a switch without being authenticated.

Context
CAUTION
Configuring the non-authentication mode may cause security problems of the switch.
Procedure
Step 1 Run:
system-view

Step 2 Run:

Step 3 Run:
The non-authentication mode is configured.
NOTE
l If the authentication mode is non-authentication or password authentication, the priority of the user-
interface determines the command level that the users can access.
l If the authentication mode needs the username and the password, the priority of the user determines
the command level that the users can access.
----End

You can configure the user priority.
Context
Refer to the Quidway S5300 Series Configuration Guide - Security.

After configuring user management, you can view the usage information of user interfaces, local
user list, and online users.
Prerequisite
The configuration of User Management are complete.
Procedure
l Run the display users [ all ] command to check the user information.

l Run the display local-user command to check the local user list.
l Run the display access-user command to check online users.
----End

This section provides examples for configuring users to log in to a switch in different modes.
These configuration examples explain networking requirements, configuration roadmap, and
configuration notes.
Context
CAUTION
After the first and second configuration examples are complete, the commands with priorities
higher than 2 cannot be run if the current user is VTY0. Ensure that users can log in to
theswitch in other methods to delete configurations.
5.7.1 Example for Configuring Logging In to the Switch Through Password

In this example, the VTY0 priority, authentication mode, and disconnection time are configured,
which enables users to log in to the switch through a password.
5.7.2 Example for Logging In to the Device Through AAA
In this example, the VTY0 priority and disconnection time are configured and the idle-out
function is enabled for local users, which enables users to log in to the switch through AAA
authentication.
5.7.1 Example for Configuring Logging In to the Switch Through

Password
In this example, the VTY0 priority, authentication mode, and disconnection time are configured,
which enables users to log in to the switch through a password.
The COM port of the PC is connected with the Console port. Set the priority of VTY0 to 2 and
authenticate the passwords of users. Users need to enter the password Huawei to log in
successfully.
After login, if the operations are not carried out in 30 minutes, it means that the user-interface
is disconnected from the switch.
1. Enter the user interface, and configure the priority of VTY0 as 2.

2. Configure the simple authentication and the disconnect time.

Data Preparation
To complete the configuration, you need the following data:
l The password of the authentication mode
l The disconnect time
Procedure
Step 1 Configure the priority of VTY0 to be 2 on the Switch.
[Quidway] user-interface vty0
[Quidway-ui-vty0] user privilege level 2
Step 2 Configuring password and disconnect time.

[Quidway-ui-vty0] authentication-mode password
[Quidway-ui-vty0] set authentication password simple huawei
[Quidway-ui-vty0] idle-timeout 30
----End
Configuration Files
#
sysname Quidway
#
aaa
authentication-scheme default
#
authorization-scheme default
#
accounting-scheme default
#
domain default
#
user-interface vty 0
user privilege level 2
set authentication password simple huawei
idle-timeout 30
#
return
5.7.2 Example for Logging In to the Device Through AAA

In this example, the VTY0 priority and disconnection time are configured and the idle-out
function is enabled for local users, which enables users to log in to the switch through AAA
authentication.
The COM port of the PC and the console port of the switch are connected.
Configure the priority of VTY0 to be 2, perform AAA authentication on the user that logs in
through VTY0. The login user must enter the username "huawei" and the password "huawei".
After login, if the user does not operate the switch within 30 minutes, the connection with the
switch is disabled.

1. Enter the user interface view to configure the priority of VTY0 to be 2 and the disconnection
time.
2. Enter the AAA view to configure the username, the password, and the user level.
3. Switch on the idle timeout for the local user in the AAA view.
Data Preparation
l Username and password for authentication
l Disconnect time
Procedure
Step 1 Configure the priority of VTY0 to be 2 and the disconnection time within 30 minutes.
[Quidway] user-interface vty0
[Quidway-ui-vty0] user privilege level 2
[Quidway-ui-vty0] authentication-mode aaa
[Quidway-ui-vty0] idle-timeout 30
[Quidway-ui-vty0] quit
Step 2 Configuring the local username, the password, and user level.
[Quidway] aaa
[Quidway-aaa] local-user huawei password cipher huawei
[Quidway-aaa] local-user huawei privilege level 2
----End
Configuration Files
#
sysname Quidway
#
aaa
local-user huawei password cipher N`C55QK<`=/Q=^Q`MAF4<1!!
local-user huawei privilege level 2
local-user huawei idle-cut
#
#
#
domain default
#
user-interface vty 0
user privilege level 2
idle-timeout 30
#
return

Configuration Guide - Basic Configuration 6 File System Management
6 File System Management
About This Chapter
This chapter describes the basic knowledge of the file system, including the methods of managing
files, directories, and storage devices.
6.1 Overview of the File System

This section describes the concepts of the file system.
6.2 Managing a Storage Device
This section describes how to format a storage device.
6.3 Managing the Directory
You can manage directories to logically store files in hierarchy.
6.4 Managing Files
You can view, create, delete, and rename files.

6 File System Management Configuration Guide - Basic Configuration
6.1 Overview of the File System

This section describes the concepts of the file system.
Basic Concepts of the File System

A file system allows you to manage files and directories on the storage devices. In the file system,
you can create, delete, modify, and rename a file or a directory, and view contents of a file.
The file system provides the following functions:

l Managing the files that are stored on the storage devices
l Managing the storage devices
Storage Device
A storage device is a hardware device used to store data.
Different products support different storage devices. Currently, the S5300 supports the flash
memory.
File
A file stores and manages information.
Directory
A directory collects and organizes files. It is a logical container of files.
6.2 Managing a Storage Device

This section describes how to format a storage device.

6.2.2 (Optional) Formatting a Storage Device
Before managing a storage device, complete the following tasks:
l Installing the S5300 and switching it on properly

l Client logging in to the S5300
Data Preparation
To manage a storage device, you need the following data.

No. Data
1 Device name
6.2.2 (Optional) Formatting a Storage Device
Context
NOTE
After the format flash: command is run, the files and directories in the Flash are cleared and cannot be
restored. So, confirm the action before you use the command.
Procedure
Step 1 Run the following command in the user view:
format flash:
The flash is formatted.
----End
6.3 Managing the Directory

You can manage directories to logically store files in hierarchy.

Before managing directories, familiarize yourself with the applicable environment, complete
the pre-configuration tasks, and obtain the required data. This can help you complete the
configuration task quickly and accurately.
6.3.2 Viewing the Current Directory
You can view the current directory to know its information.
6.3.3 Switching a Directory
You can switch the current directory to another directory.
6.3.4 Displaying a Directory or File
You can view a directory or files in the directory.
6.3.5 Creating a Directory
You can create a directory in the specified directory on a specified storage device.
6.3.6 Deleting a Directory
You can delete an unneeded directory.

Before managing directories, familiarize yourself with the applicable environment, complete

When you need to transfer files between the client and the server, configure the directory by
using the file system.
Before configuring the management directory, complete the following tasks:

l Connecting the client with the server correctly
Data Preparation
To configure a management directory, you need the following data.
No. Data
1 Directory name to be created
2 Directory name to be deleted
6.3.2 Viewing the Current Directory

You can view the current directory to know its information.
Context
Do as follows on the switch.
Procedure
Step 1 Run:
pwd
The current directory is displayed.
----End
6.3.3 Switching a Directory

You can switch the current directory to another directory.
Context
Procedure
Step 1 Run:
cd directory

A directory is specified.
Step 2 Run:
pwd
The current directory is displayed.
----End
6.3.4 Displaying a Directory or File

You can view a directory or files in the directory.
Context
Procedure
Step 1 Run:
cd directory
A directory is specified and the specified directory is displayed.

Step 2 Run:
dir [ /all ] [ filename | flash: ]
The file and sub-directory list in the directory is displayed.

Either the absolute path or relative path is applicable.
----End
6.3.5 Creating a Directory

You can create a directory in the specified directory on a specified storage device.
Context
Procedure
Step 1 Run:
cd directory
The parent directory of the directory to be created is displayed.

Step 2 Run:
mkdir directory
The directory is created.
----End
6.3.6 Deleting a Directory

You can delete an unneeded directory.

Context
Procedure
Step 1 Run:
cd directory
The parent directory of the directory to be deleted is displayed.

Step 2 Run:
rmdir directory
The directory is deleted.
----End
6.4 Managing Files

You can view, create, delete, and rename files.

Before managing files, familiarize yourself with the applicable environment, complete the pre-
configuration tasks, and obtain the required data. This can help you complete the configuration
task quickly and accurately.
6.4.2 Displaying Contents of Files
You can view the contents of a file, which are displayed in texts.
6.4.3 Copying Files
You can copy files.
6.4.4 Moving Files
You can move files to a specified directory.
6.4.5 Renaming Files
You can rename files.
6.4.6 Compressing Files
You can compress files to reduce the size of the files.
6.4.7 Deleting Files
You can delete unneeded files.
6.4.8 Deleting Files in the Recycle Bin
You can permanently delete files in the recycle bin.
6.4.9 Undeleting Files
You can undelete files.
6.4.10 Running Files in Batch
You can upload the files and then process the files in batches.
6.4.11 Configuring Prompt Modes
The system displays prompts or warning messages when you operate the device. If you need to
change the prompt mode for file operations, you can configure the prompt mode of the file
system.


Before managing files, familiarize yourself with the applicable environment, complete the pre-
configuration tasks, and obtain the required data. This can help you complete the configuration
task quickly and accurately.
To view, create, delete, or rename files on the switch, you need to configure files using the file
system.
Before configuring the file system, complete the following tasks:
l Connecting the client with the server correctly
Data Preparation
To configure a file system, you need the following data.
No. Data
1 File name to be created
2 File name to be deleted
6.4.2 Displaying Contents of Files

You can view the contents of a file, which are displayed in texts.
Context
Procedure
Step 1 Run:
cd directory
The directory of the file is displayed.

Step 2 Run:
more filename
The content of the file is displayed.
----End
6.4.3 Copying Files

You can copy files.

Context
Procedure
Step 1 Run:
cd directory

Step 2 Run:
copy source-filename destination-filename
The file is copied.
NOTE
The file to be copied must be larger than 0 bytes. Otherwise, the operation fails.
----End
6.4.4 Moving Files

You can move files to a specified directory.
Context
Procedure
Step 1 Run:
cd directory

Step 2 Run:
move source-filename destination-filename
The file is moved.
----End
6.4.5 Renaming Files

You can rename files.
Context
Procedure
Step 1 Run:
cd directory

Step 2 Run:
rename source-filename destination-filename
The file is renamed.
----End
6.4.6 Compressing Files

You can compress files to reduce the size of the files.
Context
Do as follows on the switch.
Procedure
Step 1 Run:
zip source-filename destination-filename
The file is compressed.
----End
6.4.7 Deleting Files

You can delete unneeded files.
Context
Procedure
Step 1 Run:
cd directory
Step 2 Run:
delete [ /unreserved ] filename
The file is deleted.
----End
6.4.8 Deleting Files in the Recycle Bin

You can permanently delete files in the recycle bin.
Context

Procedure
Step 1 Run:
reset recycle-bin [ filename ]
The file is deleted.
----End
6.4.9 Undeleting Files

You can undelete files.
Context
Procedure
Step 1 Run:
undelete filename
The deleted file is recovered.
NOTE
l If the current directory is not the parent directory, you must operate the file by using the absolute path.
l If you use the parameter [ /unreserved ] in the delete command, the file cannot be restored after being
deleted.
----End
6.4.10 Running Files in Batch

You can upload the files and then process the files in batches.
Prerequisite
Uploading the batched files on the client end to the switch.
Context
When the batch file is created, you can run the batch file to implement routine tasks
automatically.
Procedure
Step 1 Run:
system-view
Step 2 Run:
execute filename

The batched file is executed.
----End
6.4.11 Configuring Prompt Modes

The system displays prompts or warning messages when you operate the device. If you need to
change the prompt mode for file operations, you can configure the prompt mode of the file
system.
Prerequisite
Before configuring a file system, complete the following tasks:
l Logging in to the switchfrom the client end
Context
The data may be lost or damaged during the process, and the prompt is required.
Procedure
Step 1 Run:
system-view

Step 2 Run:
file prompt { alert | quiet }
The prompt mode of the file system is configured.

By default, the prompt mode is alert.
CAUTION
If the prompt is in the quiet mode, no prompt appears for data lossdue to maloperation.
----End

Configuration Guide - Basic Configuration 7 Management of Configuration Files
7 Management of Configuration Files
About This Chapter
This chapter describes current configurations, configuration files, detection of master/slave

configuration consistency, and configuration recovery.
7.1 Management of Configuration Files Introduction

The configuration file is the add-in configuration item when restarting the switch this time or
next time.
7.2 Managing Configuration Files
You can manage configuration files to ensure that the switch starts normally.

7 Management of Configuration Files Configuration Guide - Basic Configuration
7.1 Management of Configuration Files Introduction

next time.
7.1.1 Configuration Files

This part describes basic concepts of configuration files.
7.1.2 Configuration Files and Current Configurations
The part describes basic concepts of configuration files and current configurations.
7.1.1 Configuration Files

This part describes basic concepts of configuration files.
next time.
NOTE
l The configuration file format of V100R005 is different from that of V100R003 because the command
lines of V100R005 have been optimized.
l The configuration file of V100R005 must begin with the message like "!Software Version
V100R005C00SPC001."
l Before loading the configuration file to V100R005, check whether the configuration file contains the
preceding message. If not, the system processes the configuration file in the same way as a V100R003
configuration file. In this case, some configurations may not function properly.
The configuration file is a text file in the following formats:
V100R005C00SPC001."
l It is saved in the command format.
l To save space, default parameters are not saved. For the default values of the configuration
parameters, see following sections.
l Commands are organized on the basis of the command view. All commands of the identical
command view are grouped into a section. Every two command sections are separated by
one or several blank lines or comment lines (beginning with "#").
l The sequence of command sections is global configuration, physical interface
configuration, logic interface configuration, routing protocol configuration and so on.
NOTE
l The system can run the command with the maximum length of 512 characters, including the command
in an incomplete form.
l If the configuration is in the incomplete form, the command is saved in complete form. Therefore, the
command length in the configuration file may exceed 512 characters. When the system restarts, these
commands cannot be restored.
7.1.2 Configuration Files and Current Configurations

The part describes basic concepts of configuration files and current configurations.

l Initial configurations: On powering on, the switch retrieves the configuration files from a
default save path to initiate itself. If configuration files do not exist in the default save path,
the switch uses the default parameters.
l Current configurations: indicates the effective configurations of the currently running
switch.
l Users can modify the current configurations of the switch through the command line
interface. Use the save command to save the current configuration to the configuration file
of the default storage devices, and the current configuration becomes the initial
configuration of the switch when the switch is powered on next time.
7.2 Managing Configuration Files

You can manage configuration files to ensure that the switch starts normally.

Before managing configuration files, familiarize yourself with the applicable environment,
7.2.2 Configuring System Software for a switch to Load for the Next Startup
To upgrade the system software of a switch, you can specify the S5300 system software to be
loaded for the next startup.
7.2.3 Configuring the Configuration File for Switch to Load for the Next Startup
Before restarting a switch, you can specify the configuration files that are loaded for the next
startup.
7.2.4 Saving Configuration File
The system can save the configuration files in real-time to prevent data loss when the switch is
powered off or accidentally restarted.
7.2.5 Clearing Configuration Files
You can clear the contents of the configuration file loaded on the current device or clear the
inactive configuration of the specified board that is not in service.
7.2.6 Comparing Configuration Files
You can compare the current configuration with the initial configuration.
After managing configuration files, you can view the current configuration files, configuration
files for the next startup, information about files for device startup, and files in the storage device.

Before managing configuration files, familiarize yourself with the applicable environment,
In one of the following situations, you need to manage configuration files:
l To start the switch normally, you need to select the correct S5300 system software and
configuration file for the switch to load.

l After modifying current configurations, you need to save the modified contents.
l You need to view the configuration of the switch.
Before managing configuration files, complete the following task:
l Installing the switch and starting it properly
Data Preparation
To manage configuration files, you need the following data.
No. Data
1 S5300 System software and its file name
2 Configuration file and its name
3 The number of the start line from which the comparison of the configuration files
begins
7.2.2 Configuring System Software for a switch to Load for the Next
Startup
To upgrade the system software of a switch, you can specify the S5300 system software to be
loaded for the next startup.
Context
Procedure
Step 1 Run:
startup system-software system-filename [ slave-board ]
The S5300 system software for the switch to load next time when it starts is configured.
The system software package must use .cc as the extension and be saved to the root directory of
the flash memory.
If the BootROM version of next startup software that you specify is different from the current
BootROM version, the system prompts you to upgrade the BootRom.
----End
7.2.3 Configuring the Configuration File for Switch to Load for the
Next Startup
Before restarting a switch, you can specify the configuration files that are loaded for the next
startup.

Context
l The configuration file format of V100R005 is different from that of V100R003 because
the command lines of V100R005 have been optimized.
V100R005C00SPC001."
l Before loading the configuration file to V100R005, check whether the configuration file
contains the preceding message. If not, the system processes the configuration file in the
same way as a V100R003 configuration file. In this case, some configurations may not
function properly.
Procedure
Step 1 Run:
startup saved-configuration configuration-file
Configuration file is saved for the switch to load next time on startup.
The filename extension of the configuration file must be .cfg or .zip, and must be stored in the
root directory of a storage device.
When the switch turns on, it initiates by reading the configuration file from the flash memory
by default. Thus, the configuration in this configuration file is called initial configuration. If no
configuration file is saved in the flash, the switch initiates with default parameters.
The effective configuration when a switch is working is called current configuration.
----End
7.2.4 Saving Configuration File

The system can save the configuration files in real-time to prevent data loss when the switch is
powered off or accidentally restarted.
Procedure
l Run:
save [ all ] [ configuration-file ]
The current configurations are saved.

The filename extension of the configuration file must be .cfg or .zip. The system startup
configuration file must be saved in the root directory of a storage device.
The user can modify the current configuration through the command line interface. To set
the current configuration as initial configuration when the switch starts next time, you can
use the save command to save the current configuration in the flash memory.
You can use the save all command to save all the current configurations, including the
configurations of the boards that are not inserted, to the default directory.
NOTE
When saving the configuration file for the first time, if you do not specify the optional parameter
configuration-file, the switch asks you whether to save the file as "vrpcfg.zip" or not.
----End

7.2.5 Clearing Configuration Files

You can clear the contents of the configuration file loaded on the current device or clear the
inactive configuration of the specified board that is not in service.
Context
l After the software of the switch is upgraded, the software does not match the configuration
file.
l The configuration file is found damaged or the switch is loaded with incorrect configuration
files.
Do as follows on the switch to clear the configuration file:
Procedure
l In the user view, run:
reset saved-configuration
The configuration file loaded currently is cleared.
After the configuration file is cleared, if you neither use the startup saved-
configuration configuration-file command to specify a configuration file that contains
correct configuration, nor use the save command to save the configuration file, the
configuration file initiates with default parameters next time when the switch starts.
----End
7.2.6 Comparing Configuration Files

You can compare the current configuration with the initial configuration.
Context
Procedure
Step 1 Run:
compare configuration [ configuration-file ] [ current-line-number save-line-
number ]
The current configuration is compared with the configuration file for next startup.
If no parameter is set, the comparison begins with the first lines of configuration files. current-
line-number and save-line-number are used to continue the comparison by ignoring the
differences between the configuration files.
When comparing differences between the configuration files, the system displays the contents
of the current configuration file and saved configuration file from the first different line. By
default, 150 characters are displayed for each configuration file. If the number of characters from
the first different line to the end is less than 150, the contents after the first different line are all
displayed.

In comparing the current configurations with the configuration file for next startup, if the
configuration file for next startup is unavailable or its contents are null, the system prompts that
reading files fails.
----End

After managing configuration files, you can view the current configuration files, configuration
files for the next startup, information about files for device startup, and files in the storage device.
Prerequisite
The configuration of Managing Configuration Files are complete.
Procedure
l Run the display current-configuration command to check current configuration files.
l Run the display saved-configuration [ last ] command to check the configuration file that
the switch loads the next time when it starts.
l Run the display startup command to check the file information used by the device upon
start.
l Run the dir [ /all ] [ filename ] command to check check the file information in storage
device.
----End
Example
After the configurations succeed, run the preceding commands, and you can find the following
results:
l The current configuration of the switch is correct without any redundant configuration.
l The current configuration of the switch is saved in the storage device.
l The S5300 system software and configuration file that are to be loaded on the switch next
time are correct and they are saved in the root directory of the storage device.

Configuration Guide - Basic Configuration 8 FTP and TFTP
8 FTP and TFTP
About This Chapter
This chapter describes the fundamentals, configuration procedures and configuration examples
of FTP and TFTP.
8.1 FTP and TFTP Introduction

This section describes the basic concepts of FTP and TFTP.
8.2 Configuring the Switch to be the FTP Server
After a switch is configured with basic functions of the FTP server, you can run the FTP client
application to log in to the switch, and then access files on the switch.
8.3 Configuring FTP ACL
You can configure the FTP ACL on a switch to allow only specified users to log in to the
switch.
8.4 Configuring the switch to Be the FTP Client
You can configure a switch to be an FTP client and then log in to the FTP server.
8.5 Configuring the switch to Be the TFTP Client
8.6 Limiting the Access to the TFTP Server
You can configure the maximum number of TFTP servers that a TFTP client can access to
determine which TFTP servers the TFTP client can log in to.
This section provides several configuration examples for FTP and TFTP together with the
configuration flowchart. The configuration examples explain networking requirements,
configuration notes, and configuration roadmap.

8 FTP and TFTP Configuration Guide - Basic Configuration
8.1 FTP and TFTP Introduction

This section describes the basic concepts of FTP and TFTP.
8.1.1 FTP
You can transfer files between local and remote hosts through FTP. FTP is commonly used in
version upgrade, log downloading, file transfer, and configuration saving.
8.1.2 TFTP
TFTP does not have a complex interactive access interface and authentication control. TFTP is
applicable when there is no complex interaction between the client and server.
8.1.1 FTP
You can transfer files between local and remote hosts through FTP. FTP is commonly used in
version upgrade, log downloading, file transfer, and configuration saving.
File Transfer Protocol (FTP) is an application layer protocol in the TCP/IP protocol suite. It
implements file transfer between local and remote hosts based on related file systems. The FTP
protocol is implemented based on corresponding file system.
The switch provides the following FTP services:
l FTP server service. Users can run the FTP client program to log in to the switch and access
the files on the switch.
l FTP client service. Users can establish a connection with the switch by running a terminal
emulation program or a Telnet program on a PC. Enter an FTP command to connect with
the remote FTP server and access the files on the remote host.
8.1.2 TFTP
TFTP does not have a complex interactive access interface and authentication control. TFTP is
applicable when there is no complex interaction between the client and server.
The Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol.
Compared with FTP, TFTP does not have a complex interactive access interface and
authentication control. TFTP is applicable in an environment where there is no complex
interaction between the client and the server. For example, TFTP is used to obtain the memory
image of the system when the system starts up.
TFTP is implemented based on the User Datagram Protocol (UDP).
The client initiates the TFTP transfer. To download files, the client sends a read request packet
to the TFTP server, receives packets from the server, and sends acknowledgement to the server.
To upload files, the client sends a write request packet to the TFTP server, sends packets to the
server, and receives acknowledgement from the server.
TFTP transfers the files in two formats:
l The binary format: transfers program files.

l The ASCII format: transfers text files.
At present, the S5300 serves only as the TFTP client and transfers files in the binary format.

8.2 Configuring the Switch to be the FTP Server

After a switch is configured with basic functions of the FTP server, you can run the FTP client
application to log in to the switch, and then access files on the switch.

Before configuring a switch to be the FTP server, familiarize yourself with the applicable
8.2.2 (Optional)Specifying a Port Number for the FTP Server
You can configure or change the monitoring port number of the FTP server. After the port
number is changed, only the user knows the current port number, which guarantees the security.
8.2.3 Enabling the FTP Server
The FTP server is disabled by default. You need to enable the FTP server before using FTP
functions.
8.2.4 (Optional) Configuring the Timeout Period
You can configure the timeout period for FTP connections on the FTP server. When the timeout
period of an FTP connection expires, the system breaks the connection to release resources.
8.2.5 Configuring the Local Username and the Password
You can configure the authentication information for FTP users, which prevents unauthorized
users from performing operations on the device and thus guarantees the security.
8.2.6 Configuring the Service Type and Authorization Information
You can configure the authorization mode and authorization directory for FTP users. In this
case, unauthorized users cannot access the specific directory, which guarantees the security.
After configuring a switch to be the FTP server, you can view the configuration and status of
the FTP server as well as information about login FTP users.

Before configuring a switch to be the FTP server, familiarize yourself with the applicable
When the switch serves as the FTP server, after the client logs in to the switch through FTP, the
user can transfer files between the client and the server.
Before configuring the switch as the FTP server, complete the following tasks:

l Connecting the FTP client to the server

Data Preparation
To configure the switch as the FTP server, you need the following data.
No. Data
1 (Optional) Listening port number specified on the FTP server
2 (Optional) Timeout period of the disconnection from the FTP server
3 FTP username and password
4 File directory authorized to the FTP user
8.2.2 (Optional)Specifying a Port Number for the FTP Server

You can configure or change the monitoring port number of the FTP server. After the port
Context
If the FTP is not enabled, change the FTP port as required.
If the FTP service is enabled, run the undo ftp server command to disable the FTP service, and
then change the FTP port.
Procedure
Step 1 Run:
system-view
Step 2 Run:
ftp [ ipv6 ] server port port-number
The port number of the FTP server is configured.
If a new number of a monitored port is configured, the FTP server interrupts all the FTP
connections and monitors the port of the new number. By default, the number of the port
monitored by the FTP server is 21.
----End

functions.
Context
Do as follows on the switch that serves as the FTP server:

Procedure
Step 1 Run:
system-view
Step 2 Run:
ftp [ ipv6 ] server enable
The FTP server is started.
----End
8.2.4 (Optional) Configuring the Timeout Period

You can configure the timeout period for FTP connections on the FTP server. When the timeout
period of an FTP connection expires, the system breaks the connection to release resources.
Context
If an FTP connection remains idle during a specific period, the system automatically breaks the
FTP connection.
Procedure
Step 1 Run:
system-view
Step 2 Run:
ftp [ ipv6 ] timeout minutes
The timeout period of the FTP server is configured.
By default, timeout period is 30 minutes.
----End
8.2.5 Configuring the Local Username and the Password

You can configure the authentication information for FTP users, which prevents unauthorized
users from performing operations on the device and thus guarantees the security.
Context
Procedure
Step 1 Run:
system-view


Step 2 Run:
aaa

Step 3 Run:
The local username and the password are configured.
----End
8.2.6 Configuring the Service Type and Authorization Information

You can configure the authorization mode and authorization directory for FTP users. In this
case, unauthorized users cannot access the specific directory, which guarantees the security.
Context
Procedure
Step 1 Run:
system-view

set default ftp-directory directory
The default FTP working directory is configured.
NOTE
The configuration in this step is valid for only TACACS users.
Step 3 Run:
aaa

Step 4 Run:
local-user user-name service-type ftp
The FTP service type is configured.

Step 5 Run:
local-user user-name ftp-directory directory
The authorization directory about the FTP user is configured.
----End

After configuring a switch to be the FTP server, you can view the configuration and status of
the FTP server as well as information about login FTP users.

Prerequisite
The configuration of the Switch to be the FTP Server are complete.
Procedure
l Run the display [ ipv6 ] ftp-server the configuration and running information about the
FTP server.
l Run the display ftp-users command to check the login FTP user.
----End
Example
After configuring the FTP server, run the display [ ipv6 ] ftp-server command. You can view
that the FTP server is working.
<Quidway> display ftp-server
FTP server is running
Max user number 5
User count 0
Timeout value(in minute) 30
Listening Port 1080
Acl number 0
Run the display ftp-users command to view the user name, port number, authorization directory
of the FTP user configured presently.
<Quidway> display ftp-users
username host port idle topdir
zll 100.2.150.226 1383 3 flash:
8.3 Configuring FTP ACL

You can configure the FTP ACL on a switch to allow only specified users to log in to the
switch.

Before configuring the FTP ACL, familiarize yourself with the applicable environment,
functions.
8.3.3 Configuring a Basic ACL
You can configure a basic ACL and define rules by specifying the source IP address.
8.3.4 Configuring the Basic FTP ACL
You can configure the basic FTP ACL.
After configuring the FTP ACL, you can view the configuration and status of the FTP server as
well as information about login FTP users.


Before configuring the FTP ACL, familiarize yourself with the applicable environment,
When the switch serves as the FTP server, for security, you can configure the switch by the
access control list (ACL) to be accessed by only those clients that meet the matching conditions.
Before configuring the FTP ACL, complete the following tasks:
l Connecting the FTP client with the server
Data Preparation
To configure the FTP ACL, you need the following data.
No. Data
1 ACL number

functions.
Context
Procedure
Step 1 Run:
system-view

Step 2 Run:
ftp [ ipv6 ] server enable
The FTP server is started.
----End
8.3.3 Configuring a Basic ACL

You can configure a basic ACL and define rules by specifying the source IP address.

Context
Procedure
Step 1 Run:
system-view

Step 2 Run:
acl acl-number
The ACL view is displayed.

Step 3 Run:
rule [ rule-id ] { deny | permit } [ fragment | logging | source { source-address
source-wildcard | any } | time-range time-name ] *
The ACL rule is configured.
NOTE
FTP supports only the basic ACL.
----End
8.3.4 Configuring the Basic FTP ACL

You can configure the basic FTP ACL.
Context
Procedure
Step 1 Run:
system-view

Step 2 Run:
ftp [ ipv6 ] acl acl-number
The basic FTP ACL is configured.
----End

After configuring the FTP ACL, you can view the configuration and status of the FTP server as
well as information about login FTP users.
Prerequisite
The configuration of FTP ACL are complete.

Procedure
Step 1 Run the display [ ipv6 ] ftp-server command to check the configuration and status of the FTP
server.
----End
Example
After configuring an FTP server, you can run the display [ ipv6 ] ftp-server command and view
that the ACL number allocated for the FTP server is 2345.
<Quidway> display ftp-server
FTP server is running
Max user number 5
User count 0
Timeout value(in minute) 30
Listening Port 1080
Acl number 2345
8.4 Configuring the switch to Be the FTP Client


Before configuring a switch to be an FTP client, familiarize yourself with the applicable
8.4.2 Logging In to the FTP Server
You can log in to the FTP server in the user view or the FTP view.
8.4.3 Configuring the Data Type and Transmission Mode for a File
You can configure the data type and transmission mode for a file.
8.4.4 Viewing Online Help of the FTP Command
You can view the online help of FTP commands in the FTP client view.
8.4.5 Uploading or Downloading Files
You can upload local files to a remote FTP server, download files of the FTP server, and save
the files on the local device.
8.4.6 Managing Directories
You can perform management operations, such as creating and deleting directories, on the FTP
server.
8.4.7 Managing Files
You can view a specified directory or file on the remote FTP server or delete a specified file
from the FTP server.
8.4.8 Changing the Login User
You can change the current login user and then re-log in to the FTP server.
8.4.9 Disconnecting from the FTP Server
You can disconnect yourself with the FTP server and return to the user view or the FTP view.

After configuring a switch to be an FTP client, you can view the configuration and status of the
FTP server as well as information about login FTP users.

Before configuring a switch to be an FTP client, familiarize yourself with the applicable
When a switch serves as an FTP client, you can log in to the FTP server through the switch and
then transmit files or manage server directory.
Before configuring the switch as an FTP client, complete the following tasks:
l Connecting the FTP client to the server
Data Preparation
To configure the switch as an FTP client, you need the following data.
No. Data
1 Host name or IP address of the FTP server
2 Port number of connecting FTP
3 FTP protocol command
4 Local file name and file name on the remote FTP server
5 Working directory name of the remote FTP server, local working directory of the
FTP client, or directory name of the remote FTP server
6 Login username and password
8.4.2 Logging In to the FTP Server

You can log in to the FTP server in the user view or the FTP view.
Context
Do as follows on the switch that serves as the client:
Procedure
Step 1 Run the following commands according to types of the server IP address.
l If the IP address of the server is an IPv4 address, do as follows:

– In the user view, establish a connection to the FTP server.

Run:
ftp [ host [ port-number ] [ public-net | vpn-instance vpn-instance-name ]
The switch is connected to the FTP server.

– In the FTP view, establish a connection to the FTP server.
1. Run:
ftp
The FTP view is displayed.

2. Run:
open host [ port-number ] [ public-net | vpn-instance vpn-instance-name ]

NOTE
Before logging in to the FTP server, you can run the set net-manager vpn-instance
command to configure a default VPN instance. After that, the default VPN instance is used
in the FTP operation.
Run:
ftp ipv6 host [ port-number ]

1. Run:
ftp

2. Run:
open ipv6 host [ port-number ]
----End
8.4.3 Configuring the Data Type and Transmission Mode for a File
You can configure the data type and transmission mode for a file.
Context
Procedure
Run:


1. Run:
ftp

2. Run:

NOTE
Run:

1. Run:
ftp

2. Run:

Step 2 Run:
ascii
or
binary
The data type for the file to be transmitted is set to ASCII code or binary.
FTP supports the ASCII type and the binary type. Their differences are as follows:
l In ASCII transmission mode, ASCII characters are used to separate carriage returned from
line feeds.
l In binary transmission mode, characters can be transferred without format conversion or
formatting.
The selection of the FTP transmission mode is client-customized. The system defaults to the
ASCII transmission mode. The client can use a mode switch command to switch between the
ASCII mode and the binary mode. The ASCII mode is used to transmit .txt files and the binary
mode is used to transmit binary files.
Step 3 Run:
passive
The passive file transfer mode is configured.
----End

8.4.4 Viewing Online Help of the FTP Command

You can view the online help of FTP commands in the FTP client view.
Context
Procedure
Run:

1. Run:
ftp

2. Run:

NOTE
Run:

1. Run:
ftp

2. Run:
Step 2 Run:
remotehelp [ command ]
The online help of the FTP command is displayed.
----End

8.4.5 Uploading or Downloading Files

You can upload local files to a remote FTP server, download files of the FTP server, and save
the files on the local device.
Context
Procedure
Run:

1. Run:
ftp

2. Run:

NOTE
Run:

1. Run:
ftp

2. Run:

Step 2 Upload or download files.
l Run:
put local-filename [ remote-filename ]
The local file is uploaded to the remote FTP server.

l Run:
get remote-filename [ local-filename ]
The FTP file is downloaded from the FTP server and saved to the local file.
----End
8.4.6 Managing Directories

You can perform management operations, such as creating and deleting directories, on the FTP
server.
Context
Procedure
Run:

1. Run:
ftp

2. Run:

NOTE
Run:

1. Run:
ftp

2. Run:

Step 2 Run one or more commands in the following order to manage directories.
l Run:
cd pathname
The working path of the remote FTP server is specified.

l Run:
cdup
The working path of the FTP server is switched to the upper-level directory.
l Run:
pwd
The specified directory of the FTP server is displayed.

l Run:
lcd [ local-directory ]
The directory of the FTP client is displayed or changed.

l Run:
mkdir remote-directory
A directory is created on the FTP server.

l Run:
rmdir remote-directory
A directory is removed from the FTP server.

NOTE
l The directory to be created can comprise letters and digits, but not special characters such as <,
>, ?, \ and :.
l When running the mkdir /abc command, you create a sub-directory named "abc".
----End
8.4.7 Managing Files

You can view a specified directory or file on the remote FTP server or delete a specified file
from the FTP server.
Context
Procedure
Run:

1. Run:
ftp


2. Run:

NOTE
Run:

1. Run:
ftp

2. Run:
Step 2 Run one or more commands in the following to manage directories.

l Run:
ls [ remote-filename ] [ local-filename ]
The specified directory or file on the remote FTP server is displayed.

If the directory name is not specified when a specific remote file is selected, the system
searches the working directory for the specific file.
l Run:
dir [ remote-filename ] [ local-filename ]
The specified directory or file on the local FTP server is displayed.

l Run:
delete remote-filename
The specified file on the FTP server is deleted.

When local-filename is set, related information about the file can be downloaded locally.
----End
8.4.8 Changing the Login User

You can change the current login user and then re-log in to the FTP server.

Context
Procedure
Run:

1. Run:
ftp

2. Run:

NOTE
Run:

1. Run:
ftp

2. Run:

Step 2 Run:
user user-name [ password ]
The current login user is changed and the user logs in again.
When the current login user is changed, the original user connection will be broken.
----End
8.4.9 Disconnecting from the FTP Server

You can disconnect yourself with the FTP server and return to the user view or the FTP view.

Context
Do as follows on the switch that serves as the client.
Procedure
Run:

1. Run:
ftp

2. Run:

NOTE
Run:

1. Run:
ftp

2. Run:

Step 2 Run the following commands according to different configurations.
l Run:
bye
Or,
quit
The client switch is disconnected from the FTP server.

Return to the user view.
l Run:
close

Or,
disconnect
The client switch is disconnected from the FTP server.

Return to the FTP view.
NOTE
The configurations can be performed only in the FTP client view.
----End

After configuring a switch to be an FTP client, you can view the configuration and status of the
FTP server as well as information about login FTP users.
Prerequisite
The configuration of the Switch to Be the FTP Client are complete.
Procedure
Step 1 Run the display ftp-users command to check information about the FTP users that log in to the
FTP server.
----End
Example
Run the display ftp-users command, and you can view information about the FTP user that is
current configured, such as the user name, port number, and user authorized directory.
<Quidway> display ftp-users
username host port idle topdir
zll 100.2.150.226 1383 3 flash:
8.5 Configuring the switch to Be the TFTP Client


Before configuring TFTP, familiarize yourself with the applicable environment, complete the
pre-configuration tasks, and obtain the required data. This can help you complete the
8.5.2 Downloading Files Through TFTP
You can download files from the TFTP server to the TFTP client.
8.5.3 Uploading Files Through TFTP
You can upload files from the TFTP client to the TFTP server.

Before configuring TFTP, familiarize yourself with the applicable environment, complete the
pre-configuration tasks, and obtain the required data. This can help you complete the

You can transfer files through TFTP between the server and the client in a simple interaction
environment.
Before configuring TFTP, complete the following tasks:

l Connecting the TFTP client with the server
Data Preparation
To configure TFTP, you need the following data.
No. Data
1 IP address of the TFTP server
2 Name of the specific file in the TFTP server
3 File directory
8.5.2 Downloading Files Through TFTP

You can download files from the TFTP server to the TFTP client.
Context
Do as follows on the switch that serves as the TFTP client:
Procedure
Step 1 Run the following commands according to the type of the server IP addresses.
l The IP address of the server is IPv4 address, run:
tftp tftp-server [ public-net | vpn-instance vpn-instance-name ] get source-
filename [ destination-filename ]
The switch is configured to download files through TFTP.

tftp ipv6 tftp-server-ipv6 [ -i interface-type interface-number ] get source-
The switch is configured to download files through TFTP.
----End
8.5.3 Uploading Files Through TFTP

You can upload files from the TFTP client to the TFTP server.

Context
Procedure
Step 1 Run the following commands according to the type of the server IP addresses.
tftp tftp-server [ public-net | vpn-instance vpn-instance-name ] put source-
The switch is configured to upload files through TFTP.

tftp ipv6 tftp-server-ipv6 [ -i interface-type interface-number ] put source-
The switch is configured to upload files through TFTP.
----End
8.6 Limiting the Access to the TFTP Server

You can configure the maximum number of TFTP servers that a TFTP client can access to
determine which TFTP servers the TFTP client can log in to.

Before configuring a limit to access TFTP servers, familiarize yourself with the applicable
8.6.2 Configuring the Basic ACL
You can configure ACL rules.
8.6.3 Configuring the Basic TFTP ACL
You can configure the basic TFTP ACL.

Before configuring a limit to access TFTP servers, familiarize yourself with the applicable
When the switch serves as the TFTP client, you can configure the ACL on the switch. After the
configuration, you can control the TFTP server to which the device can log in through TFTP.
Before configuring a limit to access the TFTP server, complete the following tasks:

l Connecting the TFTP client to the server

Data Preparation
To configure a limit to access to the TFTP server, you need the following data.
No. Data
1 IP address of the TFTP server
2 ACL number
8.6.2 Configuring the Basic ACL

You can configure ACL rules.
Context
NOTE
TFTP supports only the basic ACL.
Procedure
Step 1 Run:
system-view
Step 2 Run:
acl acl-number
The ACL view is displayed.
Step 3 Run:
rule [ rule-id ] { deny | permit } [ fragment | logging | source { source-address
source-wildcard | any } | time-range time-name ] *
The ACL rule is configured.
----End
8.6.3 Configuring the Basic TFTP ACL

You can configure the basic TFTP ACL.
Context
Procedure
Step 1 Run:
system-view


Step 2 According to the address type of the TFTP server, select and run one of the following two
commands.
l For IPv4 addresses,
Run the tftp-server acl acl-number command. You can use the ACL to limit the access to
the TFTP server.
Run the tftp-server ipv6 acl acl6-number command. You can use the ACL to limit the access
to the TFTP server.
----End

This section provides several configuration examples for FTP and TFTP together with the
configuration flowchart. The configuration examples explain networking requirements,
configuration notes, and configuration roadmap.
8.7.1 Example for Configuring the FTP Server

In this example, a PC connected to a switch logs in to the FTP server by entering the correct
user name and password through FTP, and then downloads files to the memory of the switch.
8.7.2 Example for Configuring an ACL of the FTP Server
In this example, an ACL is configured to allow only a certain host to log in to the FTP server.
8.7.3 Example for Configuring the FTP Client
In this example, a switch is configured to be an FTP client. Then, the switch logs in to the FTP
server and downloads system software and configuration software.
8.7.4 Example for Configuring the TFTP Client
In this example, the TFTP application is run on the TFTP server and the location of the source
file on the server is set. After that, you can upload and download files.
8.7.1 Example for Configuring the FTP Server

In this example, a PC connected to a switch logs in to the FTP server by entering the correct
user name and password through FTP, and then downloads files to the memory of the switch.
As shown in Figure 8-1, the local PC functions as the FTP client of which the IP address is
10.1.1.1/24.
The Switch acts as the FTP server. VLAN 10 is created on the Switch and
GigabitEthernet0/0/1 is added to VLAN 10. The IP address 10.1.1.2/24 is assigned to VLANIF
10.
The PC uploads files to the Switch.

Figure 8-1 Networking diagram of the Switch functioning as the FTP server
VLAN10
FTP Client FTP Session FTP Server
Ethernet L2 Switch Ethernet Switch

PC
Switch Interface VLANIF interface IP address
FTP Server GigabitEthernet0/0/1 VLANIF 10 10.1.1.2/24
1. Set the correct FTP user name and password on the Switch that functions as the FTP server.
2. Log in to the Switch through FTP from the PC.
3. Upload files to the FTP server.
Data Preparation
l IP address of the FTP server

l Name of the FTP user set as u1 and the password set as ftppwd on the server
l Correct path of the source file on the PC
l Name of the destination file and position where the destination files are located on the
Switch
Procedure
Step 1 Create VLAN 10 on the Switch and assign the IP address 10.1.1.2/24 to VLANIF 10.
[Quidway] vlan 10
[Quidway-GigabitEthernet0/0/1] port hybrid pvid vlan 10
[Quidway] interface vlanif 10
[Quidway-Vlanif10] ip address 10.1.1.2 24
Step 2 Start the FTP server on the Switch, and set the FTP user name to u1 and password to ftpwd.
[Quidway] ftp server enable
[Quidway] aaa
[Quidway-aaa] local-user u1 password simple ftppwd
[Quidway-aaa] local-user u1 service-type ftp
Quidway-aaa] local-user u1 ftp-directory flash:/
[Quidway-aaa] return

Step 3 On the PC, initiate a connection to the Switch with the user name u1 and the password
ftppwd.
Use Windows XP on the FTP client to illustrate the preceding operations.

C:\WINDOWS\Desktop> ftp 10.1.1.2
Connected to 10.1.1.2.
220 FTP service ready
User (10.1.1.1:(none)): u1
331 Password required for u1.
Password:
230 User logged in.
ftp>
Step 4 Set the mode of transferring files to binary and the local directory on the PC.
ftp> binary
200 Type set to I.
ftp> lcd c:\temp
Local directory now C:\temp.
Step 5 Upload d006.cc and vrpcfg.cfg to the Switch on the PC.

ftp> put d006.cc d006.cc
ftp> put vrpcfg.cfg vrpcfg.cfg
ftp> quit
C:\WINDOWS\Desktop>
----End
Configuration Files
#
sysname Quidway
#
FTP server enable
#
vlan batch 10
#
interface Vlanif10
ip address 10.1.1.2 255.255.255.0
#
interface GigabitEthernet0/0/1
port hybrid pvid vlan 10
port hybrid untagged vlan 10
#
aaa
local-user u1 password simple ftppwd
local-user u1 service-type ftp
local-user u1 ftp-directory flash:/
#
Return
8.7.2 Example for Configuring an ACL of the FTP Server

In this example, an ACL is configured to allow only a certain host to log in to the FTP server.
As shown in Figure 8-2, the IP address of the FTP server is 172.16.104.110/24.
The routes between PC1, PC2, and FTP server are reachable. On the S5300 that functions as the
FTP server, it is required that the FTP server should permit only PC1 with the IP address as
172.16.104.111 to download and upload files through FTP, and PC2 should not connect to the
FTP server after the ACL is configured.

Figure 8-2 Networking diagram for configuring an ACL of the FTP server
FTP Server
172.16.104.110/24
172.16.104.111/24 172.16.105.111/24
PC1 PC2
1. Perform basic configurations on the FTP server.
2. Configure the ACL on the FTP server.
Data Preparation
l Name of the FTP user set as u1 and password set as huawei on the server
l Number of the ACL
Procedure
Step 1 Configure basic FTP functions.
For details, see 8.7.1 Example for Configuring the FTP Server.
Step 2 Configure an ACL.
[Quidway] acl number 2001
[Quidway-acl-basic-2001] rule permit source 172.16.104.111 0.0.0.0
[Quidway-acl-basic-2001] quit
Step 3 Configure the ACL supported by the FTP server.

[Quidway] ftp acl 2001
Step 4 Connect PC1 to the FTP server.

This step needs to be performed on the DOS of the PC.
c:\ ftp 172.16.104.110
Connected to 172.16.104.110
220 FTP service ready.
User (100.2.150.40:(none)):u1
331 Password required for u1
Password:
230 User logged in.
ftp>

Step 5 Connect PC2 to the FTP server.
This step needs to be performed on the DOS of the PC.

c:\ ftp 172.16.104.110
Connected to 172.16.104.110.
Info:Connection was denied by remote host according to ACL!
Connection closed by remote host.
----End
Configuration Files
Configuration file of the FTP server
#
sysname Quidway
#
FTP server enable
FTP acl 2001
#
acl number 2001
rule 5 permit source 172.16.104.111 0.0.0.0
#
vlan batch 10
#
interface Vlanif10
ip address 10.1.1.2 255.255.255.0
#
#
aaa
local-user u1 password simple huawei
local-user u1 service-type ftp
local-user u1 ftp-directory flash:/
authentication-scheme default
#
#
#
domain default
#
return
8.7.3 Example for Configuring the FTP Client

In this example, a switch is configured to be an FTP client. Then, the switch logs in to the FTP
server and downloads system software and configuration software.
As shown in Figure 8-3, the remote server at 10.1.1.2 serves as the FTP server. The Switch and
the FTP server are directly connected and on the same network segment. The Switch has a
reachable route to the FTP server.
The Switch acts as the FTP client. Interfaces ranging from GigabitEthernet0/0/1 to
GigabitEthernet0/0/4 can be used to set up FTP connections and they share the IP address
10.1.1.1.
The Switch downloads files from the FTP server.

Figure 8-3 Networking diagram of the Switch functioning as the FTP client
FTP session
configuration
PC cable FTP Client FTP Server
1. Log in to the FTP server from the FTP client.

2. Download files from the server to the storage device of the client.
Data Preparation
l IP address of the FTP server

l Name of the destination file and position where the destination files are located on the
Switch
l Name of the FTP user set as u1 and the password set as ftppwd on the client
Procedure
Step 1 Enable FTP on the remote FTP server. Add an FTP user named u1 and set the password to
ftppwd.
Step 2 Create VLAN 10 on the Switch and assign the IP address 10.1.1.1 to VLANIF10.
[Quidway] vlan 10
Step 3 On the Switch, initiate a connection to the FTP server with the user name tpuser and the password
ftppwd.
<Quidway> ftp 10.1.1.2

Trying 10.1.1.2 ...

Press CTRL+K to abort
User(10.1.1.2:(none)):u1
331 Password required for u1.
Enter password:
230 User logged in.
[ftp]
Step 4 On the Switch, set the mode of transferring files to binary and the flash directory.
[ftp] binary
200 Type set to I.
[ftp] lcd flash:/
The current local directory is flash:.
Step 5 Download the vrpcfg.cfg file from the remote FTP server on the Switch.
[ftp] get vrpcfg.cfg vrpcfg.cfg
200 Port command okay.
150 Opening BINARY mode data connection for vrpcfg.cfg.
226 Transfer complete.

FTP: 9124 byte(s) received in 3.100 second(s) 2.94Kbyte(s)/sec.
[ftp] quit
<Quidway>
----End
Configuration Files
#
sysname Quidway
#
vlan batch 10
#
interface Vlanif10
ip address 10.1.1.3 255.255.255.0
#
#
#
#
#
return
8.7.4 Example for Configuring the TFTP Client

In this example, the TFTP application is run on the TFTP server and the location of the source
file on the server is set. After that, you can upload and download files.
As shown in Figure 8-4, the Switch cannot function as the TFTP server. The remote server at
10.1.1.2 functions as the TFTP server.

The Switch acts as a TFTP client. VLAN 10 is created on the Switch, and
GigabitEthernet0/0/1 is added to VLAN 10. The IP address 10.1.1.1/24 is assigned to VLANIF
10.
The Switch downloads files from the TFTP server.
Figure 8-4 Networking diagram for configuring TFTP

TFTP session
configuration
PC cable TFTP Client TFTP Server
1. Run the TFTP software on the TFTP server and set the position where the source file is
located on the Switch.
2. Download files through TFTP commands on the Switch.
Data Preparation
l TFTP software installed on the TFTP server

l Path of the source file on the TFTP server
l Name of the destination file and position where the destination file is located on the Switch
Procedure
Step 1 Enable TFTP on the remote server to ensure that the TFTP application software is started.
Step 2 Create VLAN 10 on the Switch and assign the IP address 10.1.1.1/24 to VLANIF 10.
[Quidway] vlan 10
Step 3 On the Switch, initiate a connection to the TFTP server and download the 8031.cc file.
<Quidway> tftp 10.1.1.2 get 8031.cc 8031new.cc
Info: Transfer file in binary mode.
Downloading the file from the remote tftp server, please wait...
----End

Configuration Files
#
sysname Quidway
#
vlan batch 10
#
interface Vlanif10
ip address 10.1.1.1 255.255.255.0
#
#
Return

Configuration Guide - Basic Configuration 9 Telnet and SSH
9 Telnet and SSH
About This Chapter
Telnet or SSH enables a terminal to remotely log in and access to a server.
9.1 Telnet and SSH Introduction

This section describes basic concepts of user login, Telnet, and SSH.
9.2 Configuring Telnet Terminal Services
This section describes how to log in to a switch through Telnet and configure the switch.
9.3 Configuring SSH Users
You need to configure SSH users to ensure that STelnet or SFTP clients log in to SSH servers.
9.4 Configuring the SSH Server Function
This section describes how to configure the SSH server. You need to first enable STelnet or
SFTP on the SSH server.
9.5 Configuring the STelnet Client Function
This section describes how to configure the STelnet client. A secure connection can be set up
between the client and server through negotiation, and the client can log in to the server in the
same manner as using Telnet services.
9.6 Configuring the SFTP Client Function
This section describes how to configure the SFTP client. You can configure the authentication
and bidirectional data encryption of the SFTP client, which ensures secure file transmission on
the network.
This section provides configuration examples for Telnet and SSH together with the configuration
flowchart. The configuration examples explain networking requirements, configuration notes,
and configuration roadmap.

9 Telnet and SSH Configuration Guide - Basic Configuration
9.1 Telnet and SSH Introduction

This section describes basic concepts of user login, Telnet, and SSH.
9.1.1 Overview of User Login
You can locally or remotely log in to a switch through the console port, Telnet, or SSH.
9.1.2 Telnet Terminal Services
The S5300 provides Telnet services including Telnet server and Telnet client.
9.1.3 SSH Terminal Services
The S5300 supports the basic SSH protocol, client function, SFTP protocol, STelnet protocol.
9.1.1 Overview of User Login

You can locally or remotely log in to a switch through the console port, Telnet, or SSH.
To configure, monitor, and maintain the local or remote S5300, you need to configure the user
interface, the user management, and the terminal service.
The user interface provides a login plane. The user management guarantees the login security
and the terminal service provides related processes of login protocol.
The S5300 supports the following login methods:
l Login through the console port
l Local or remote login through Telnet or SSH
9.1.2 Telnet Terminal Services

The S5300 provides Telnet services including Telnet server and Telnet client.
Telnet Services
Telnet is an application layer protocol in the TCP/IP protocol suite. It provides remote login and
a virtual terminal service through the network.
The S5300 provides the following Telnet services:
l Telnet server: You can run the Telnet client program on a PC to log in to the switch,
configure and manage it. The switch acts as a Telnet server.
l Telnet client: You can run the terminal emulation program or the Telnet client program on
a PC to connect with the switch. With the telnet command, you can log in to other
switchs to configure and manage them. As shown in Figure 9-1, Switch A serves as both
the Telnet server and the Telnet client.
Figure 9-1 Telnet client services
Telnet Session 1 Telnet Session2
Telnet
Server
PC SwitchA SwitchB

9.1.3 SSH Terminal Services

The S5300 supports the basic SSH protocol, client function, SFTP protocol, STelnet protocol.
Introduction to SSH
SSH works at the application layer in the TCP/IP protocol suite. SSH provides remote login and
virtual terminal on the network where security is guaranteed. Based on TCP connections, SSH
guarantees security and provides authentication for transmitted information, preventing the
following attacks shown in Figure 9-2:
l IP spoofing
l Interception of the password in plain text
l Denial of Service (DoS)
In the figure, Switch is an S5300.
Figure 9-2 Establishing a local SSH connection between the PC and the S5300
VLAN1
SSH Telnet Session
SSH
Client Server
PC Ethernet L2 Switch Ethernet Switch
SSH adopts the client/server model and sets up multiple secure transmission channels. The
Switch, as the SSH server, can be connected to multiple PCs that function as SSH clients. A
Layer 2 switch may exist between the PC and the SSH server. In the actual networking, a route
is required to be reachable between the PC and the Switch.
Advantages of SSH
The applications of SSH include STelnet and SFTP.
Different from Telnet and FTP terminal services, SSH provides secure remote access on the
network without security guaranteed. The advantages of SSH are described as follows:
l STelnet client functions
There is a potential risk on security for login through Telnet because there is no
authentication and the data transmitted through TCP is in plain text. The insecure access
results in malicious attacks including DoS attacks, IP spoofing attacks, and route spoofing
attacks.
SSH provides secure remote access on an insecure network by supporting the following
functions:
– Supporting Revest-Shamir-Adleman Algorithm (RSA) authentication

– Supporting Data Encryption Standard (DES) and 3DES

– Supporting the encrypted transfer of the user name or password
– Supporting the encrypted transfer of interactive data
SSH adopts RSA. After the public key and the private key are generated according to the
encryption principle of the asymmetric encryption system, the following information is
transmitted with security between the SSH client and the SSH server:
– Key
– User name or password
– Interactive data
l SFTP client functions
SFTP provides the following types of applications:
– By using SFTP, you can securely log in to the S5300 to manage files from the remote
device. In this manner, the security of data transmission is improved when files need to
be transferred during the upgrade of the remote system.
– The S5300 can function as the client to log in to the remote device through FTP to
transfer files with security.
Setting Up an SSH Connection

The procedure for setting up an SSH connection is as follows:
1. Negotiating the SSH version
2. Negotiating the key
3. Authenticating the user identity
4. Initiating a session request
5. Performing the interactive session
For details, see the chapter in the Quidway S5300 Series Ethernet Switches Feature Description
- Basic Configuration.
9.2 Configuring Telnet Terminal Services

This section describes how to log in to a switch through Telnet and configure the switch.

Before configuring Telnet terminal services, familiarize yourself with the applicable
9.2.2 Enabling the Telnet Service
Before establishing a Telnet connection with the server, you need to enable the Telnet service.
9.2.3 Establishing a Telnet Connection
You can log in to and manage a switch through Telnet.
9.2.4 (Optional) Scheduled Telnet Disconnection
You can set the idle-timeout period for Telnet connections. In this manner, if the Telnet
connections keep idle during the specified period, the system automatically terminates the Telnet
connections.


After configuring Telnet terminal services, you can view the connection status of the current
user interface, connection status of each user interface, and status of all established TCP
connections.

Before configuring Telnet terminal services, familiarize yourself with the applicable
To remotely log in to the switch through the Telnet protocol for maintenance and management,
you need to configure Telnet terminal services.
Before configuring Telnet terminal services, complete the following tasks:
l Ensuring that the switch runs normally

l Ensuring that the IP addresses of interfaces on the switch are configured correctly
l Configuring the user account, correct login authentication mode, and call-in and call-out
restriction
l Ensuring that reachable routes exist between the terminal and the switch
Data Preparation
To configure Telnet terminal services, you need the following data.
No. Data
1 IP address of the switch
2 Name of the VPN instance
3 IPv4/IPv6 address or host name of the remote switch
4 Number of the TCP port that is used by the remote switch to provide Telnet services
5 (Optional) Timeout period after which the server terminates the connection with the
user interface
6 (Optional) Source IP address or source interface of the device functioning as an Telnet

client
9.2.2 Enabling the Telnet Service

Before establishing a Telnet connection with the server, you need to enable the Telnet service.

Context
Do as follows on the switch that serves as an Telnet server.
Select and perform one of the following two steps for IPv4 or IPv6.
Procedure
l For the IPv4 network
1. Run:
system-view

2. Run:
telnet server enable
The Telnet service is enabled.
NOTE
l By default, the function of the Telnet server is enabled.

l If the undo telnet server enable command is run when Telnet login is in progress, the
command does not take effect.
l After the Telnet server function is disabled, you can log in to the device only through SSH
or an asynchronous serial interface rather than through Telnet.
l For the IPv6 network
1. Run:
system-view

2. Run:
telnet ipv6 server enable
The Telnet service is enabled.
NOTE
l By default, the function of the Telnet server is enabled.

l If the telnet ipv6 server enable command is run when Telnet login is in progress, the
command does not take effect.
l After the Telnet server function is disabled, you can log in to the device only through SSH
or an asynchronous serial interface rather than through Telnet.
----End
9.2.3 Establishing a Telnet Connection

You can log in to and manage a switch through Telnet.
Context
Do as follows on the switch that serves as a Telnet client:
Select and perform one of the following two steps for IPv4 or IPv6.

Procedure
l Run:
telnet [ vpn-instance vpn-instance-name ] host-name [ port-number ]
Log in to the switch and manage other switchs.

l Run:
telnet ipv6 host-name [ port-number ]
Log in to the switch and manage other switchs.
----End
9.2.4 (Optional) Scheduled Telnet Disconnection

You can set the idle-timeout period for Telnet connections. In this manner, if the Telnet
connections keep idle during the specified period, the system automatically terminates the Telnet
connections.
Context
Do as follows on the switch that serves as a Telnet client:
Procedure
Step 1 Run:
system-view
Step 2 Run:
Step 3 Run:
The scheduled Telnet disconnection is enabled.
----End

After configuring Telnet terminal services, you can view the connection status of the current
user interface, connection status of each user interface, and status of all established TCP
connections.
Prerequisite
The configuration of Telnet Terminal Services are complete.
Procedure
l Run the display users command to check information about connected users.

l Run the display users all command to check information about all users, including
connected and disconnected users.
l Run the display tcp status command to check TCP connections.
----End
Example
Run the display tcp status command to view TCP connections. In the command output,
Established indicates that a TCP connection has been established.
<Quidway> display tcp status
TCPCB Tid/Soid Local Add:port Foreign Add:port VPNID State
39952df8 36 /1509 0.0.0.0:0 0.0.0.0:0 0
Closed
32af9074 59 /1 0.0.0.0:21 0.0.0.0:0 14849
Listening
34042c80 73 /17 10.164.39.99:23 10.164.6.13:1147 0
Established
9.3 Configuring SSH Users

You need to configure SSH users to ensure that STelnet or SFTP clients log in to SSH servers.

Before configuring SSH users, familiarize yourself with the applicable environment, complete
9.3.2 Creating SSH User
AAA does not support RSA authentication. Therefore, when RSA authentication or password-
rsa authentication is adopted, you need to create an SSH user. When password authentication is
adopted, you can use the local user name created in the AAA view.
9.3.3 Configuring SSH for the VTY User Interface
You can configure SSH for the VTY user interface.
9.3.4 Generating a Local RSA Key Pair
You need to create an RSA key before configuring SSH.
9.3.5 Configuring the Authentication Mode for SSH Users
You can configure the password or RSA authentication mode for SSH users.
9.3.6 (Optional) Configuring the Basic Authentication Information for SSH Users
You can configure the interval for updating the server key pair, timeout period of the SSH
authentication, and retry times of the SSH authentication.
9.3.7 (Optional) Authorizing SSH Users Through the Command Line
If RSA authentication is adopted, you need to configure command line authorization for SSH
users.
9.3.8 Configuring the Service Type of SSH Users
You can set the service type of SSH users to SFTP, STelnet, or all.
9.3.9 (Optional) Configuring the Authorized Directory of the SFTP Service for SSH Users
You can configure a directory as an authorized directory to allow SSH users to use SFTP services.

After configuring SSH users, you can view SSH user information.

Before configuring SSH users, familiarize yourself with the applicable environment, complete
The STelnet or SFTP client can log in to the SSH server to perform operations only after SSH
users are correctly configured on the SSH server.
Before configuring SSH users, complete the following tasks:
l Creating a local user

l Configuring an RSA public key for the SSH client on the SSH server
Data Preparation
To configure SSH users, you need the following data.
No. Data
1 Name and password of SSH users
2 Authentication mode of SSH users
3 Service type of SSH users
4 Name of the peer RSA public key assigned to SSH users
5 Operating directory of the SFTP service for SSH users
9.3.2 Creating SSH User

AAA does not support RSA authentication. Therefore, when RSA authentication or password-
rsa authentication is adopted, you need to create an SSH user. When password authentication is
adopted, you can use the local user name created in the AAA view.
Context
NOTE
Besides creating an SSH user separately, you can also create an SSH user when you configure the following.
l Configuring the Authentication Mode for SSH Users
l Configuring the Service Type of SSH Users
Do as follows on the switch that serves as an SSH server:

Procedure
Step 1 Run:
system-view

Step 2 Run:
ssh user user-name
If you want to create an SSH user in the password or password-rsa authentication mode, you
need to create a local user with the same name in the AAA view.
1. Run:
aaa

2. Run:
----End
9.3.3 Configuring SSH for the VTY User Interface

You can configure SSH for the VTY user interface.
Context
Procedure
Step 1 Run:
system-view

Step 2 Run:
user-interface [ vty ] first-ui-number [ last-ui-number ]
The VTY user interface is displayed.

Step 3 Run:
The AAA authentication mode is configured.

Step 4 Run:
protocol inbound ssh
The VTY is configured to support SSH.
NOTE
The authentication mode of the VTY user interface must be set to AAA. Otherwise, the protocol
inbound ssh command cannot be configured successfully.
----End

9.3.4 Generating a Local RSA Key Pair

You need to create an RSA key before configuring SSH.
Context
Do as follows on the switchs that serve as a client or a server:
Procedure
Step 1 Run:
system-view

Step 2 Run:
rsa local-key-pair create
A local RSA key pair is generated.
NOTE
To log in to an SSH server, the local RSA key pair must be configured and generated first. Before performing
the other SSH configurations, you must configure the rsa local-key-pair create command to generate a
local key pair.
----End
9.3.5 Configuring the Authentication Mode for SSH Users

You can configure the password or RSA authentication mode for SSH users.
Context
Procedure
Step 1 Run:
system-view

Step 2 Run:
ssh user user-name authentication-type { password | rsa | password-rsa | all }
The authentication mode for SSH users is configured.

Perform the following as required:
l Authenticate the SSH user through the password.
– Run:
ssh user user-name authentication-type password
The password authentication is configured for the SSH user.

– Run:
ssh authentication-type default password

The default password authentication is configured for the SSH user.

For the local authentication or HWTACACS authentication, if the number of SSH users
is small, you can adopt the former command; if the number of SSH users is large, adoptthe
later command to simplify the configuration.
l Authenticate the SSH user through RSA.
1. Run:
ssh user user-name authentication-type rsa
The RSA authentication is configured for the SSH user.

2. Run:
rsa peer-public-key key-name
The public key view is displayed.

3. Run:
public-key-code begin
The public key editing view is displayed.

4. Run:
hex-data
The public key is edited.
The public key must be a string of hexadecimal alphanumeric characters. It is automatically

generated by an SSH client. You can run the display rsa local-key-pair public command
to view a generated public key.
5. Run:
public-key-code end
Quit the public key editing view.
If the specified hex-data is invalid, the public key cannot be generated after the peer-public-
key end command is run; If the specified key-name is deleted in other views, the system
prompts that the key does not exist after the peer-public-key end command is run and the
system view is displayed.
6. Run:
peer-public-key end
Return to the system view from the public key view.

7. Run:
ssh user user-name assign rsa-key key-name
The public key is assigned to the SSH user.

NOTE
l After the public key editing view is displayed, the RSA public key generated on the client can be sent
to the server. Copy the RSA public key to the switch that serves as the SSH server.
l Before the peer RSA public key is assigned to the SSH users, the SSH server must be configured and
the peer RSA public key must be the RSA public key of the SSH client.
----End

9.3.6 (Optional) Configuring the Basic Authentication Information

for SSH Users
You can configure the interval for updating the server key pair, timeout period of the SSH
authentication, and retry times of the SSH authentication.
Context
Procedure
Step 1 Run:
system-view
Step 2 Run:
ssh server rekey-interval interval
The interval for updating the server key pair is configured.
By default, the interval for updating the key pair of the SSH server is 0 that indicates no updating.
Step 3 Run:
ssh server timeout seconds
The timeout period of the SSH authentication is set.
By default, the timeout period is 60 seconds.
Step 4 Run:
ssh server authentication-retries times
The number of retry times of the SSH authentication is set.
By default, the retry times is 3.
----End
9.3.7 (Optional) Authorizing SSH Users Through the Command

Line
If RSA authentication is adopted, you need to configure command line authorization for SSH
users.
Context
NOTE
There are four authentication modes for an SSH user, namely, password, rsa, password-rsa, and all. For
details of the configuration of the command line authorization for password authentication, refer to the
chapter "AAA and User Management" in the Quidway S5300 Series Configuration Guide - Security. This
section describes how to configure the command line authorization for RSA authentication.

Procedure
Step 1 Run:
system-view
Step 2 Run:
ssh user user-name authorization-cmd aaa
The command line authorization is configured for the specified SSH user.
----End
Follow-up Procedure
After configuring the authorization through command lines for the SSH user to perform RSA
authentication, you have to configure the AAA authorization. Otherwise, the command line
authorization for the SSH user does not take effect.
9.3.8 Configuring the Service Type of SSH Users

You can set the service type of SSH users to SFTP, STelnet, or all.
Context
Do as follows on the switch that functions as an SSH server:
Procedure
Step 1 Run:
system-view
Step 2 Run:
ssh user username service-type { sftp | stelnet | all }
The service type for the SSH user is configured.
By default, the service type of the SSH user is not configured.
----End
9.3.9 (Optional) Configuring the Authorized Directory of the SFTP

Service for SSH Users
You can configure a directory as an authorized directory to allow SSH users to use SFTP services.
Context

Procedure
Step 1 Run:
system-view

Step 2 Run:
ssh user username sftp-directory directoryname
The authorized directory of the SFTP service for SSH users is configured.
By default, the authorized directory of the SFTP service for SSH users is Flash.
----End

After configuring SSH users, you can view SSH user information.
Prerequisite
The configuration of SSH Users are complete.
Procedure
l Run the display ssh user-information command to check the information about the SSH
client on the SSH server.
l Run the display ssh user-information username command to check the information about
the specified SSH client on the SSH server.
----End
Example
Run the display ssh user-information username command. It shows that the SSH user named
clinet001 is authenticated by password, and its service type is sftp.
[Quidway] display ssh user-information client001
User Name : client001
Authentication-type : password
User-public-key-name : -
Sftp-directory : -
Service-type : sftp
Authorization-cmd : No
9.4 Configuring the SSH Server Function

This section describes how to configure the SSH server. You need to first enable STelnet or
SFTP on the SSH server.

Before configuring an SSH server, familiarize yourself with the applicable environment,
9.4.2 Enabling the STelnet Service

Before enjoying the STelnet service, you need to enable it.

9.4.3 Enabling the SFTP Service
9.4.4 (Optional) Enabling the Earlier Version - Compatible Function
You can configure whether SSH of earlier versions are compatible.
9.4.5 (Optional) Configuring the Number of the Port Monitored by the SSH Server
You can configure or change the monitoring port number of the SSH server. After the port
9.4.6 (Optional) Configuring the Interval for Updating the Key Pair on the SSH Server
You can configure the interval for updating the key pair of the SSH server, which can guarantee
the security.
After configuring the SSH server, you can view the global configuration of the SSH server.

Before configuring an SSH server, familiarize yourself with the applicable environment,
You must enable STelnet or SFTP on the SSH server to perform the operation. You can set the
number of the port monitored by the SSH server to other port numbers. As the attacker is unaware
of the changed port number, this can prevent the attacker's access to the standard port of the SSH
server and the consumption of the bandwidth and system resources.
Before configuring SSH servers, complete the following tasks:
l Connecting the SSH client and the SSH server correctly

l Configuring reachable switch between the SSH client and the SSH server
l Configuring the VTY user interface on the SSH server to support SSH
l Configuring the SSH client on the SSH server
l Creating the local RSA key pair on the SSH server
Data Preparation
To configure SSH servers, you need the following data.
No. Data
1 Number of the port monitored by the SSH server

9.4.2 Enabling the STelnet Service

Context
Procedure
Step 1 Run:
system-view
Step 2 Run:
stelnet server enable
The STelnet service is enabled.
By default, STelnet services are disabled.
----End
9.4.3 Enabling the SFTP Service

Context
Procedure
Step 1 Run:
system-view
Step 2 Run:
sftp server enable
The SFTP service is enabled.
By default, the SFTP service is disabled.
----End
9.4.4 (Optional) Enabling the Earlier Version - Compatible Function

You can configure whether SSH of earlier versions are compatible.
Context

Procedure
Step 1 Run:
system-view
Step 2 Run:
ssh server compatible-ssh1x enable
The earlier version-compatible function is enabled.
By default, the server configured with the SSH2.0 protocol is compatible with the server
configured with SSH1.X. If the client of SSH1.3 to SSH1.99 (protocol version ranges from 1.3
to 1.99) is denied access to log in, you can run the undo ssh server compatible-ssh1x enable
command to disable the switch to be compatible with the earlier protocol version.
NOTE
l Compared with SSH1.X, SSH2.0 is extended in structure to more authentication modes and key
exchange modes with higher service capability, such as SFTP.
l The S5300 supports the SSH protocol of version 1.3 to version 2.0.
----End
9.4.5 (Optional) Configuring the Number of the Port Monitored by

the SSH Server
You can configure or change the monitoring port number of the SSH server. After the port
Context
Procedure
Step 1 Run:
system-view
Step 2 Run:
ssh server port port-number
The number of the port monitored by the SSH server is configured.
If a new number of a monitored port is configured, the SSH server interrupts all the STelnet and
SFTP connections and monitors the port of the new number. By default, the number of the port
monitored by the SSH server is 22.
----End

9.4.6 (Optional) Configuring the Interval for Updating the Key Pair
on the SSH Server
You can configure the interval for updating the key pair of the SSH server, which can guarantee
the security.
Context
Procedure
Step 1 Run:
system-view

Step 2 Run:
ssh server rekey-interval interval
The interval for updating the key pair is set.

By default, the interval for updating the key pair of the SSH server is 0, which means that the
key pair is never updated.
----End

After configuring the SSH server, you can view the global configuration of the SSH server.
Prerequisite
The configuration of the SSH Server are complete.
Procedure
Step 1 Run the display ssh server status command to check the global configuration of the SSH server.
----End
Example
When running the display ssh server status command, you can view that the SSH version of
the SSH session is 1.99, and the times for retrying the SSH session is 5.
<Quidway> display ssh server status
SSH version : 1.99
SSH connection timeout : 60 seconds
SSH server key generating interval : 2 hours
SSH Authentication retries : 5 times
SFTP server : Enable
Stelnet server : Enable
SSH server port : 55535
NOTE
If the number of the monitored port is the default number, information about the currently monitored port
is not displayed.

9.5 Configuring the STelnet Client Function

This section describes how to configure the STelnet client. A secure connection can be set up
between the client and server through negotiation, and the client can log in to the server in the
same manner as using Telnet services.

Before configuring an STelnet client, familiarize yourself with the applicable environment,
9.5.2 Enabling the First-Time Authentication on the SSH Client
After the first-time authentication on the SSH client is enabled, the STelnet client does not check
the validity of the RSA public key when logging in to the SSH server for the first time.
9.5.3 (Optional) Assigning an RSA Public Key to the SSH Server
You can assign an RSA public key to the SSH server.
9.5.4 Enabling the STelnet Client
You can log in to the SSH server from the SSH client through STelnet.
After configuring the STelnet client, you can view the global configuration of the SSH server.

Before configuring an STelnet client, familiarize yourself with the applicable environment,
STelnet is a secure Telnet protocol. The SSH user can use the STelnet service in the same manner
as using the Telnet service.
Before connecting the STelnet client to the SSH server, complete the following tasks:
l Generating the local RSA key pair on the SSH server

l Configuring the STelnet user on the SSH server
l Enabling the STelnet service on the SSH server
Data Preparation
To connect the STelnet client to the SSH server, you need the following data:
No. Data
1 Name of the SSH server

No. Data
3 Preferred encrypted algorithm from the STelnet client to the SSH server
4 Preferred encrypted algorithm from the SSH server to the STelnet client
5 Preferred HMAC algorithm from the STelnet client to the SSH server
6 Preferred HMAC algorithm from the SSH server to the STelnet client
7 Preferred algorithm of key exchange
8 Name of the outgoing interface
9 Source address
9.5.2 Enabling the First-Time Authentication on the SSH Client

Context
If the first-time authentication on the SSH client is enabled, the STelnet client does not check
the validity of the RSA public key when logging in to the SSH server for the first time. After
the login, the system automatically allocates the RSA public key and saves it for authentication
in next login.
To simplify user operations, you are recommended to enable the first-time authentication on the
SSH client.
Do as follows on the switch that serves as an SSH client:
Procedure
Step 1 Run:
system-view

Step 2 Run:
ssh client first-time enable
The first-time authentication on the SSH client is enabled.

By default, the first-time authentication on the SSH client is disabled.
NOTE
l The purpose of enabling the first-time authentication on the SSH client is to skip checking the validity
of the RSA public key of the SSH server when the STelnet client logs in to the SSH server for the first
time. The check is skipped because the STelnet server has not saved the RSA public key of the SSH
server.
l If the first-time authentication is not enabled on the SSH client, when the STelnet client logs in to the
SSH server for the first time, the STelnet client fails to pass the check on the RSA public key validity
and cannot log in to the server.

TIP
To ensure that the STelnet client can log in to the SSH server at the first attempt, you can assign the RSA
public key in advance to the SSH server on the SSH client in addition to enabling the first-time
authentication on the SSH client.
----End

You can assign an RSA public key to the SSH server.
Context
If the first-time authentication on the SSH client is disabled, you need to allocate an RSA public
key to the SSH server before the STelnet client logs in to the SSH server.
Procedure
Step 1 Run:
system-view
Step 2 Run:
Step 3 Run:
Step 4 Run:
hex-data

generated by an SSH client. You can run the display rsa local-key-pair public command to
view a generated public key.
Step 5 Run:
public-key-code end
key end command is run; If the specified key-name is deleted in other views, the system prompts
that the key does not exist after the peer-public-key end command is run and the system view
is displayed.
Step 6 Run:
peer-public-key end

Step 7 Run:
ssh client servername assign rsa-key keyname
The RSA public key is assigned to the SSH server.
NOTE
l Before being assigned to the SSH server, the assigned peer RSA public key must be obtained from the
SSH server and must be configured on the SSH client. Then, the STelnet client client can successfully
undergo the validity check on the RSA public key of the SSH server.
l If the RSA public key stored on the SSH client becomes invalid, run the undo ssh client servername
assign rsa-key command to cancel the association between the SSH client and the SSH server. Then,
run the ssh client servername assign rsa-key keyname command to allocate a new RSA public key to
the SSH server.
----End
9.5.4 Enabling the STelnet Client

You can log in to the SSH server from the SSH client through STelnet.
Context
NOTE
When accessing an SSH server, the STelnet client can carry the source address and the VPN instance name
and choose the key exchange algorithm, encryption algorithm, or HMAC algorithm, and configure the
keepalive function..
Procedure
Step 1 Run:
system-view

Step 2 According to the address type of the SSH server, select and run one of the following two
commands.
Run the stelnet host-ipv4 [ port ] [ [ -vpn-instance vpn-instance-name ] | [ prefer_kex
{ dh_group1 | dh_exchange_group } ] | [ prefer_ctos_cipher { des | 3des | aes128 } ] |
[ prefer_stoc_cipher { des | 3des | aes128 } ] | [ prefer_ctos_hmac { sha1 | sha1_96 |
md5 | md5_96 } ] | [ prefer_stoc_hmac { sha1 | sha1_96 | md5 | md5_96 } ] ] * [ -ki
aliveinterval [ -kc alivecountmax ] ] command. You can log in to the SSH server through
STelnet.
Run the stelnet ipv6 host-ipv6 [ -i interface-type interface-number ] [ port ] [ [ prefer_kex
{ dh_group1 | dh_exchange_group } ] | [ prefer_ctos_cipher { des | 3des | aes128 } ] |
[ prefer_stoc_cipher { des | 3des | aes128 } ] | [ prefer_ctos_hmac { sha1 | sha1_96 |
md5 | md5_96 } ] | [ prefer_stoc_hmac { sha1 | sha1_96 | md5 | md5_96 } ] ] * [ -ki
aliveinterval [ -kc alivecountmax ] ]command. You can log in to the SSH server through
STelnet.
----End


After configuring the STelnet client, you can view the global configuration of the SSH server.
Prerequisite
The configuration of the STelnet Client Function are complete.
Procedure
l Run the display ssh server-info command to check the mapping between the RSA public
key and the SSH client on the SSH client.
l Run the display ssh server session command to check the session of the SSH client on the
SSH server.
----End
Example
When running the display ssh server session command, you can view that the client logs in
from VTY3, with Stelent service by password authentication.
<Quidway> display ssh server session
Session 1:
Conn : VTY 3
Version : 2.0
State : started
Username : client001
Retry : 1
CTOS Cipher : aes128-cbc
STOC Cipher : aes128-cbc
CTOS Hmac : hmac-sha1-96
STOC Hmac : hmac-sha1-96
Kex : diffie-hellman-group1-sha1
Service Type : stelnet
Authentication Type : password
9.6 Configuring the SFTP Client Function

This section describes how to configure the SFTP client. You can configure the authentication
and bidirectional data encryption of the SFTP client, which ensures secure file transmission on
the network.

Before configuring the SFTP client, familiarize yourself with the applicable environment,
9.6.2 Configuring the First-Time Authentication on the SSH Client
You can assign an RSA public key on the SSH client to the SSH server.
9.6.4 Enabling the SFTP Client
You can log in to the SSH server from the SSH client through SFTP.

9.6.5 (Optional) Managing the Directory

On the SFTP client, you can log in to the SSH server to create or delete directories on the SSH
server.
9.6.6 (Optional) Managing the File
On the SFTP client, you can view specified remote directories or files on the SFTP server or
delete specified files on the SFTP server.
9.6.7 (Optional) Displaying the SFTP Client Command Help
You can view the SFTP client command help.
After configuring the SFTP client, you can view the global configuration of the SSH server.

Before configuring the SFTP client, familiarize yourself with the applicable environment,
SFTP enables users to log in to the device from a secure remote end to manage files. This
improves the security of data transmission for the remote end to update its system. The SFTP
client function also enables you to log in to the remote device through SFTP for the secure file
transmission.
Before connecting the SFTP client to the SSH server, complete the following tasks:
l Creating a local RSA key pair on an SSH server
l Configuring an SFTP client on the SSH server
l Enabling the SFTP service on the SSH server
Data Preparation
To connect an SFTP client to an SSH server, you need the following data.
No. Data
1 Name of the SSH server
3 Preferred encrypted algorithm from the SFTP client to the SSH server
4 Preferred encrypted algorithm from the SFTP server to the SSH client
5 Preferred HMAC algorithm from the SFTP client to the SSH server
6 Preferred HMAC algorithm from the SFTP server to the SSH client
7 Preferred algorithm of key exchange
8 Name of the outgoing interface

No. Data
9 Directory name
10 File name
9.6.2 Configuring the First-Time Authentication on the SSH Client

Context
If the first-time authentication on the SSH client is enabled, the STelnet client does not check
the validity of the RSA public key when logging in to the SSH server for the first time. After
the login, the system automatically allocates the RSA public key and saves it for authentication
in next login.
To simplify user operations, you are recommended to enable the first-time authentication on the
SSH client.
Procedure
Step 1 Run:
system-view
Step 2 Run:
Enable the SSH client with the first authentication.
By default, first-time authentication is disabled on SSH clients.
NOTE
l The purpose of enabling the first-time authentication on the SSH client is to skip checking the validity
of the RSA public key of the SSH server when the SFTP client logs in to the SSH server for the first
time. The check is skipped because the SFTP server has not saved the RSA public key of the SSH
server.
l If the first-time authentication is not enabled on the SSH client, when the SFTP client logs in to the
SSH server for the first time, the SFTP client fails to pass the check on the RSA public key validity
and cannot log in to the server.
TIP
Except for enabling the first-time authentication on the SSH client, the SFTP client can assign the RSA
public key in advance to the SSH server on the SSH client to log in to the server successfully for the first
time.
----End


You can assign an RSA public key on the SSH client to the SSH server.
Context
If the first-time authentication on the SSH client is disabled, you need to assign an RSA public
key to the SSH server before the STelnet client logs in to the SSH server.
Procedure
Step 1 Run:
system-view
Step 2 Run:
Step 3 Run:
Step 4 Run:
hex-data

generated by an SSH client. You can run the display rsa local-key-pair public command to
view a generated public key.
Step 5 Run:
public-key-code end
key end command is run; If the specified key-name is deleted in other views, the system prompts
that the key does not exist after the peer-public-key end command is run and the system view
is displayed.
Step 6 Run:
peer-public-key end
Step 7 Run:
ssh client servername assign rsa-key keyname
Assign a public key to the SSH server.

NOTE
l Before being assigned to the SSH server, the assigned peer RSA public key must be obtained from the
SSH server and must be configured on the SSH client. Then, the SFTP client can successfully undergo
the validity check on the RSA public key of the SSH server.
l If the RSA public key stored on the SSH client becomes invalid, run the undo ssh client servername
assign rsa-key command to cancel the association between the SSH client and the SSH server. Then,
run the ssh client servername assign rsa-key keyname command to allocate a new RSA public key to
the SSH server.
----End
9.6.4 Enabling the SFTP Client

You can log in to the SSH server from the SSH client through SFTP.
Context
NOTE
The command of enabling the SFTP client is similar to that of the STelnet. When accessing the SSH server,
the SFTP can carry the source address and the name of the VPN instance and choose the key exchange
algorithm, encrypted algorithm and HMAC algorithm, and configure the keepalive function.
Do as follows on the switch that serves as an SSH client.
Procedure
Step 1 Run:
system-view
Step 2 According to the address type of the SSH server, select and perform one of the two configurations
below.
Run:
sftp [ -a source-address | -i interface-type interface-number ] host-ipv4
[ port ] [ [ public-net | -vpn-instance vpn-instance-name ] | [ prefer_kex
{ dh_group1 | dh_exchange_group } ] | [ prefer_ctos_cipher { des | 3des |
aes128 } ] | [ prefer_stoc_cipher { des | 3des | aes128 } ] |
[ prefer_ctos_hmac { sha1 | sha1_96 | md5 | md5_96 } ] | [ prefer_stoc_hmac
{ sha1 | sha1_96 | md5 | md5_96 } ] ] * [ -ki aliveinterval [ -kc
alivecountmax ] ]
You can log in to the SSH server through SFTP.

Run:
sftp ipv6 [ -a source-address ] host-ipv6 [ -i interface-type interface-
number ] [ port ] [ [ prefer_kex { dh_group1 | dh_exchange_group } ] |
[ prefer_ctos_cipher { des | 3des | aes128 } ] | [ prefer_stoc_cipher { des |
3des | aes128 } ] | [ prefer_ctos_hmac { sha1 | sha1_96 | md5 | md5_96 } ] |
[ prefer_stoc_hmac { sha1 | sha1_96 | md5 | md5_96 } ] ] * [ -ki aliveinterval
[ -kc alivecountmax ] ]
----End

9.6.5 (Optional) Managing the Directory

On the SFTP client, you can log in to the SSH server to create or delete directories on the SSH
server.
Context
NOTE
After the SFTP client logs in to the SSH server, the SFTP client can create or delete the directory on the
SSH server, display the current operating directory and information about a specified directory and its files.
Procedure
Step 1 Run:
system-view

below.
Run:
alivecountmax ] ]

Run:
Step 3 Perform the following as required:

l Run:
cd [ remote-directory ]
The current operating directory of users is changed.

l Run:
cdup
The operating directory of users is switched to the upper-level directory.

l Run:
pwd
The current operating directory of users is displayed.

l Run:
dir / ls [ remote-directory ]

The file list in the specified directory is displayed.

l Run:
rmdir remote-directory & <1-10>
l The directory on the server is deleted.

l Run:
mkdir remote-directory
A directory is created on the server.
----End
9.6.6 (Optional) Managing the File

On the SFTP client, you can view specified remote directories or files on the SFTP server or
delete specified files on the SFTP server.
Context
NOTE
After the SFTP client logs in to the SSH server, SFTP client can change file names, delete files, display
the file list, upload and download files on the SFTP server.
Do as follows on the login switch.
Procedure
Step 1 Run:
system-view

below.
Run:
alivecountmax ] ]

Run:
Step 3 Run the command.

l Run:
rename old-name new-name

The name of the specified file on the server is changed.

l Run:
get remote-filename [local-filename]
The file on the remote server is downloaded.

l Run:
put local-filename [remote-filename]
The local file is uploaded to the remote server.

l Run:
remove remote-filename
The file on the server is removed.
----End
9.6.7 (Optional) Displaying the SFTP Client Command Help

You can view the SFTP client command help.
Context
Do as follows on the login switch:
Procedure
Step 1 Run:
system-view
below.
Run:
alivecountmax ] ]

Run:
Step 3 Run:
help [all | command-name ]

The SFTP client command help is displayed.
----End

After configuring the SFTP client, you can view the global configuration of the SSH server.
Prerequisite
The configuration of the SFTP Client Function are complete.
Procedure
l Run the display ssh server-info command to check the mapping between the SSH server
and the RSA public key on the SSH client.
l Run the display ssh server session command to check the session of the SSH client on the
SSH server.
----End
Example
Run the display ssh server session command, and you can view that the client logs in from the
VTY4 through the sftp service in rsa authentication mode.
[Quidway] display ssh server session
Session 2:
Conn : VTY 4
Version : 2.0
State : started
Username : client002
Retry : 1
Service Type : sftp
Authentication Type : rsa

This section provides configuration examples for Telnet and SSH together with the configuration
flowchart. The configuration examples explain networking requirements, configuration notes,
and configuration roadmap.
9.7.1 Example for Configuring the Telnet Terminal Service

In this example, the authentication mode and password are configured for users to log in to the
switch through Telnet.
9.7.2 Example for Configuring the PC as the STelnet Client to Connect to the SSH Server
This part provides an example for configuring the PC as the STelnet client to connect to the SSH
server. In this example, after generating the local key pair on the SSH server, configuring the
name and password of the SSH user on the SSH server, and enabling the STelnet service on the
SSH server, you can connect the Stelnet client to the SSH server.
9.7.3 Example for Configuring the Switch as the STelnet Client to Connect to the SSH Server

In this example, the local key pairs are generated on the STelnet client and the SSH server; the
public RSA key is generated on the SSH server and then bound to the STelnet client. In this
manner, the STelnet client can connect to the SSH server.
9.7.4 Example for Connecting the SFTP Clinet and the SSH Server
In this example, the local key pairs are generated on the SFTP client and the SSH server
respectively; the public RSA key is generated on the SSH server and bind the RSA public key
to the SFTP client. In this manner, the SFTP client can connect to the SSH server.
9.7.5 Example for Configuring the SSH Server to Support the Access from Another Port
In this example, the monitoring port number of the SSH server is set to a port number other than
the standard monitoring port number so that only valid users can set up connections with the
SSH server.
9.7.6 Example for Authenticating SSH Through RADIUS
In this example, a user that attempts to access the SSH server is authenticated by the RADIUS
server, and the SSH server determines whether to set up a connection with the user according
to the authentication result.
9.7.1 Example for Configuring the Telnet Terminal Service

In this example, the authentication mode and password are configured for users to log in to the
switch through Telnet.
As shown in Figure 9-3, after logging in to Switch A, the user logs in to Switch B through Telnet
by using the default interface 23.
Figure 9-3 Networking diagram of the remote login of the Ethernet user
PC SwitchA SwitchB
10.10.10.8/24 10.10.10.9/24
SwitchA GigabitEthernet0/0/1 VLANIF 2 10.10.10.8/24
SwitchB GigabitEthernet0/0/1 VLANIF 2 10.10.10.9/24
1. Assign IP addresses to Switch A and Switch B.

2. Configure an authentication mode and password on Switch B.
3. Log in to Switch B from Switch A.

Data Preparation
l ID of the VLAN
l IP address and number of the interface on the Switch A that functions as the Telnet client
l IP address and number of the interface on the Switch B that functions as the Telnet server
l Authentication mode and the password for a user to log in to Switch B through Telnet
Procedure
Step 1 Assign IP addresses.
# Assign IP address to Switch A that functions as the Telnet client.
<SwitchA> system-view
[SwitchA] vlan 2
[SwitchA-vlan2] quit
[SwitchA] interface GigabitEthernet 0/0/1
[SwitchA-GigabitEthernet0/0/1] port hybrid pvid vlan 2
[SwitchA-GigabitEthernet0/0/1] port hybrid untagged vlan 2
[SwitchA-GigabitEthernet0/0/1] quit
[SwitchA] interface vlanif 2
[SwitchA-Vlanif2] ip address 10.10.10.8 255.255.255.0
[SwitchA-Vlanif2] quit
[SwitchA]
# Assign an IP address to Switch B that functions as the Telnet server.

<SwitchB> system-view
[SwitchB] vlan 2
[SwitchB-vlan2] quit
[SwitchB] interface GigabitEthernet 0/0/1
[SwitchB-GigabitEthernet0/0/1] port hybrid pvid vlan 2
[SwitchB-GigabitEthernet0/0/1] port hybrid untagged vlan 2
[SwitchB-GigabitEthernet0/0/1] quit
[SwitchB] interface vlanif 2
[SwitchB-Vlanif2] ip address 10.10.10.9 255.255.255.0
[SwitchB-Vlanif2] quit
[SwitchB]
Step 2 Configure the authentication mode and password for Switch B.

[SwitchB] user-interface vty 0 4
[SwitchB-ui-vty0-4] authentication-mode password
[SwitchB-ui-vty0-4] set authentication password simple 123456
[SwitchB-ui-vty0-4] quit
[SwitchB]
Step 3 Verify the configuration.

# Log in to Switch B on Switch A through Telnet.
<SwitchA> telnet 10.10.10.9
Trying 10.10.10.9 ...
Connected to 10.10.10.9 ...
Login authentication
Password:
info: The max number of VTY users is 20, and the current number
of VTY users on line is 1.
<SwitchB>
----End

Configuration Files
l Configuration file of Switch A
#
sysname SwitchA
#
vlan batch 2
#
interface Vlanif2
ip address 10.10.10.8 255.255.255.0
#
#
return
l Configuration file of Switch B

#
sysname SwitchB
#
vlan batch 2
#
interface Vlanif2
ip address 10.10.10.9 255.255.255.0
#
#
user-interface vty 0 4
set authentication password simple 123456
#
return
9.7.2 Example for Configuring the PC as the STelnet Client to

Connect to the SSH Server
This part provides an example for configuring the PC as the STelnet client to connect to the SSH
server. In this example, after generating the local key pair on the SSH server, configuring the
name and password of the SSH user on the SSH server, and enabling the STelnet service on the
SSH server, you can connect the Stelnet client to the SSH server.
As shown in Figure 9-4, after the STelnet service is enabled on the SSH server, the STelnet
client can log in to the SSH server with the password, RSA, password-rsa, or all authentication
mode.
Configure Client001 with the password as huawei and adopt the password authentication.
The IP address of the SSH server is 192.168.1.1.
The user interface supports only SSH.

Figure 9-4 Networking diagram of configuring the PC as the STelnet client to connect to the
SSH server
IP Network
SSH Client SSH Server
1. Configure Client001 on the SSH server.
2. Enable STelnet service on the SSH server.
3. Configure password authentication as the default authentication mode on the SSH server.
Data Preparation
l Name and the authentication mode of the SSH user
l Password of the SSH user
l Name of the SSH server
Procedure
Step 1 Generate a local key pair on the server.
[Quidway] sysname SSH Server
[SSH Server] rsa local-key-pair create
The key name will be: Quidway_Host
The range of public key size is (512 ~ 2048).
NOTES: If the key modulus is greater than 512,
It will take a few minutes.
Input the bits in the modulus[default = 512]: 768
Generating keys...
.......++++++++++++
..........++++++++++++
...................................++++++++
......++++++++
Step 2 Configure the VTY user interface.

[SSH Server] user-interface vty 0 4
[SSH Server-ui-vty0-4] authentication-mode aaa
[SSH Server-ui-vty0-4] protocol inbound ssh
[SSH Server-ui-vty0-4] quit
NOTE
If SSH is configured as the login protocol, the S5300 automatically disables Telnet.
Step 3 Configure the password of the SSH user Client001 to huawei.

[SSH Server] aaa
[SSH Server-aaa] local-user client001 password cipher huawei

[SSH Server-aaa] local-user client001 privilege level 3

[SSH Server-aaa] local-user client001 service-type ssh
[SSH Server-aaa] quit
Step 4 Enable the STelnet service on the SSH server.

[SSH Server] stelnet server enable
[SSH Server] ssh authentication-type default password

# Log in to the device through the software putty, and specify the IP address of the device being
192.168.1.1 and the login protocol being SSH.
# Log in to the device through the software putty, and enter the user name client001 and the
password huawei.

----End
Configuration Files
l Configuration file of the SSH server
#
sysname SSH Server
#
aaa
local-user client001 password cipher huawei
local-user client001 privilege level 3
local-user client001 service-type ssh
#
ssh authentication-type default password
#
#
return
9.7.3 Example for Configuring the Switch as the STelnet Client to

Connect to the SSH Server
In this example, the local key pairs are generated on the STelnet client and the SSH server; the
public RSA key is generated on the SSH server and then bound to the STelnet client. In this
manner, the STelnet client can connect to the SSH server.

When you need to log in from a switch to other switches to configure the switches, you can
configure the switch as an STelnet client.
As shown in Figure 9-5, after the STelnet service is enabled on the SSH server, the STelnet
client can log in to the SSH server in the authentication mode of password, RSA, password-rsa,
or all.
The following login users need to be configured.
l Client001, with the password as huawei and the authentication mode as password
l Client002, with the password as rsakey001 and the authentication mode as RSA
The user interface supports only the SSH protocol.
Figure 9-5 Networking diagram of connecting the STelnet client and the SSH server
SSH Server
10.164.39.222/24
10.164.39.220/24 10.164.39.221/24
Client001 Client002
SSH server GigabitEthernet0/0/1 VLANIF 10 10.164.39.222/24
Client001 GigabitEthernet0/0/1 VLANIF 10 10.164.39.220/24
1. Create a VLAN that each interface belongs to and assign an IP address to each VLANIF
interface.
2. Configure Client001 and Client002 on the SSH server.
3. Create a local key pair on the STelnet client and SSH server separately.
4. Generate an RSA public key on the SSH server and bind the RSA public key of the SSH
client to Client002.
5. Enable the STelnet service on the SSH server.
6. Client001 and Client002 log in to the SSH server through STelnet.
Data Preparation

l IP addresses of the FTP server and client, as shown in Figure 9-5

l SSH user name and authentication mode
l Password or RSA public key
l SSH server name
Procedure
Step 1 Create a VLAN that each interface belongs to and assign an IP address to each VLANIF interface.
Create VLAN 10 on the Switch that functions as the server and assign IP address
10.164.39.222/24 to interface VLANIF10.
[Quidway]sysname Quidway
[Quidway] vlan 10
[Quidway] quit
[Quidway] interface GigabitEthernet 0/0/1
Assigning an IP address to the Switch that functions as Client001 or Client002 is the same as
assigning an IP address to VLANIF 10, and is not mentioned here.
Step 2 Create a local key pair on the SSH server.
[Quidway] rsa local-key-pair create
info: If the key modulus is greater than 512,
Input the bits in the modulus[default = 512]:
Generating keys...
.......++++++++++++
..........++++++++++++
...................................++++++++
......++++++++
Step 3 Create an SSH user on the server.

NOTE
SSH users can be authenticated in four modes: password, RSA, password-rsa, and all.
l Before configuring the authentication mode of password or password-rsa, you must configure a local
user.
l Before configuring the authentication mode of RSA, password-rsa, or all, you must copy the RSA
public key of the SSH client to the server.
# Configure a VTY user interface.

[Quidway-ui-vty0-4] protocol inbound ssh
[Quidway-ui-vty0-4] quit
l Create an SSH user named Client001.

# Create an SSH user named Client001 and configure the authentication mode as
password for the user.
[Quidway] ssh user client001
[Quidway] ssh user client001 authentication-type password

# Set the password of Client001 to huawei.

[Quidway] aaa
[Quidway-aaa] local-user client001 password simple huawei
[Quidway-aaa] local-user client001 service-type ssh
l # Create an SSH user named Client002 and configure the authentication mode as RSA for
the user.
[Quidway] ssh user client002 authentication-type rsa
Step 4 Configure the RSA public key on the server.

# Create a local key pair on the client.
[Quidway] sysname client002
[client002] rsa local-key-pair create
# Check the RSA public key generated on the client.

[client002] display rsa local-key-pair public
=====================================================
Time of Key pair created: 16:38:51 2007/5/25
Key name: client002_Host
Key type: RSA encryption Key
=====================================================
Key code:
3047
0240
BFF35E4B C61BD786 F907B5DE 7D6770C3 E5FD17AB
203C8FCB BBC8FDF2 F7CB674E 519E8419 0F6B97A8
EA91FC4B B9E18836 5E74BFD5 4C687767 A89C6B43
1D7E3E1B
0203
010001
Host public key for PEM format code:
---- BEGIN SSH2 PUBLIC KEY ----
AAAAB3NzaC1yc2EAAAADAQABAAAAQQC/815LxhvXhvkHtd59Z3DD5f0XqyA8j8u7
yP3y98tnTlGehBkPa5eo6pH8S7nhiDZedL/VTGh3Z6ica0Mdfj4b
---- END SSH2 PUBLIC KEY ----
Public key code for pasting into OpenSSH authorized_keys file :
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAQQC/815LxhvXhvkHtd59Z3DD5f0XqyA8j8u7yP3y98tn
TlGehBkPa5eo6pH8S7nhiDZedL/VTGh3Z6ica0Mdfj4b rsa-key
=====================================================
Key name: client002_Server
=====================================================
Key code:
3067
0260
BCFAC085 49A2E70E 1284F901 937D7B63 D7A077AB
D2797280 4BCA86C0 4CD18B70 5DFAC9D3 9A3F3E74
9B2AF4CB 69FA6483 E87DA590 7B47721A 16391E27
1C76ABAB 743C568B 1B35EC7A 8572A096 BCA9DF0E
BC89D3DB 5A83698C 9063DB39 A279DD89
0203
010001
[client002]
# Send the RSA public key generated on the client to the server.
[Quidway] rsa peer-public-key RsaKey001
Enter "RSA public key" view, return system view with "peer-public-key end".
[Quidway-rsa-public-key] public-key-code begin
Enter "RSA key code" view, return last view with "public-key-code end".
[Quidway-rsa-key-code] 3047
[Quidway-rsa-key-code] BFF35E4B C61BD786 F907B5DE 7D6770C3 E5FD17AB

[Quidway-rsa-key-code] 203C8FCB BBC8FDF2 F7CB674E 519E8419 0F6B97A8

[Quidway-rsa-key-code] EA91FC4B B9E18836 5E74BFD5 4C687767 A89C6B43
[Quidway-rsa-key-code] 1D7E3E1B
[Quidway-rsa-key-code] public-key-code end
[Quidway-rsa-public-key] peer-public-key end
Step 5 Bind the RSA public key of the SSH client to Client002.
[Quidway] ssh user client002 assign rsa-key RsaKey001
Step 6 Enable the STelnet service on the SSH server.

# Enable the STelnet service.
[Quidway] stelnet server enable
Step 7 Set the service type of Client001 and Client002 to STelnet.

[Quidway] ssh user client001 service-type stelnet
Step 8 Connect the STelnet and the SSH server.

# You must enable the initial authentication on the SSH client for the first login.
[client001] ssh client first-time enable
# Client001 logs in to the SSH server in password authentication mode by entering the user
name and password.
<client001> system-view
[client001] stelnet 10.164.39.222
Please input the username:client001
Trying 10.164.39.222 ...
Connected to 10.164.39.222 ...
The server is not authenticated. Continue to access it?(Y/N):y
Save the server's public key?(Y/N):y
The server's public key will be saved with the name: 10.164.39.222. Please wait...
Enter password:
Enter the password huawei, and information indicating that the login succeeds is displayed as
follows:
<Quidway>
# Client002 logs in to the SSH server in RSA authentication mode.

[client002] stelnet 10.164.39.222
Please input the username: client002
Trying 10.164.39.222 ...
Connected to 10.164.39.222 ...
***********************************************************
<Quidway>

After the configuration, run the commands of display ssh server status and display ssh server
session on the SSH server. You can view that the STelnet service is enabled, and that the STelnet
client logs in to the server successfully.

# Check the status of the SSH server.

[Quidway] display ssh server status
SSH version : 1.99
SFTP server: Disable
STELNET server: Enable
# Check the connection of the SSH server.

Session 1:
Conn: VTY 3
Version: 2.0
State: started
Username: client001
Retry: 1
CTOS Cipher: aes128-cbc
STOC Cipher: aes128-cbc
CTOS Hmac: hmac-sha1-96
STOC Hmac: hmac-sha1-96
Kex: diffie-hellman-group1-sha1
Service Type: stelnet
Authentication Type: password
Session 1:
Conn: VTY 4
Version: 2.0
State: started
Username: client002
Retry: 1
Authentication Type: rsa
# Check information about the SSH user.

[Quidway] display ssh user-information
User 1:
User Name: client001
Authentication-type: password
User-public-key-name: -
Sftp-directory: -
Service-type: stelnet
Authorization-cmd: No
User 2:
Authentication-type: rsa
User-public-key-name: RsaKey001
Sftp-directory: -
Service-type: stelnet
----End
Configuration Files
l Configuration file of the Quidway, the SSH server
#
sysname Quidway
#
vlan batch 10
#

interface Vlanif10
ip address 10.164.39.222 255.255.255.0
#
rsa peer-public-key rsakey001
3047
0240
BFF35E4B C61BD786 F907B5DE 7D6770C3 E5FD17AB 203C8FCB BBC8FDF2 F7CB674E
519E8419 0F6B97A8 EA91FC4B B9E18836 5E74BFD5 4C687767 A89C6B43
1D7E3E1B 0203
010001
public-key-code end
peer-public-key end
#
aaa
local-user client001 password simple huawei
#
ssh user client001
ssh user client002
ssh user client001 authentication-type password
ssh user client002 authentication-type rsa
ssh user client002 assign rsa-key RsaKey001
ssh user client001 service-type stelnet
#
#
#
return
l Configuration file of Client001, the SSH client

#
sysname client001
#
vlan batch 10
#
interface Vlanif10
ip address 10.164.39.220 255.255.255.0
#
#
#
return

#
sysname client002
#
vlan batch 10
#
interface Vlanif10
ip address 10.164.39.221 255.255.255.0
#
#

#
return
9.7.4 Example for Connecting the SFTP Clinet and the SSH Server
In this example, the local key pairs are generated on the SFTP client and the SSH server
respectively; the public RSA key is generated on the SSH server and bind the RSA public key
to the SFTP client. In this manner, the SFTP client can connect to the SSH server.
As shown in Figure 9-6, after the SFTP service is enabled on the SSH server, the SFTP client
can log in to the SSH server in the authentication mode of password, RSA, password-rsa, or all.
Figure 9-6 Networking diagram for connecting the SFTP client and the SSH server
SSH Server
10.164.39.222/24
10.164.39.220/24 10.164.39.221/24
Client001 Client002
interface.
3. Create a local key pair on the SFTP client and SSH server separately.
4. Create an RSA public key on the SSH server and bind the RSA public key of the SSH client
to Client002.
5. Enable the SFTP service on the SSH server.
6. Configure the type of service and authenticated directory for the SSH user.
7. Client001 and Client002 log in to the SSH server through SFTP.
Data Preparation


l Password or RSA public key of the SSH user
l SSH server name
Procedure
Create VLAN 10 on the S5300 that functions as the server and assign IP address
10.164.39.222/24 to VLANIF 10.
[Quidway] vlan 10
[Quidway] quit
Assigning an IP address to the S5300 that functions as Client001 or Client002 is the same as
Step 2 Create a local key pair on the SSH server.
Generating keys...
...........++++++++++++
..................++++++++++++
...++++++++
...........++++++++

NOTE
l In password or password-rsa authentication mode, you must configure a local user.
l In RSA or all authentication mode, you must copy the RSA public key of the SSH client to the server.

l Create an SSH user named Client001.

# Create an SSH user named Client001 and configure the authentication mode as
password for the user.

[Quidway] aaa

l # Create an SSH user named Client002 and configure the authentication mode as RSA for
the user.

# Check the RSA public key created on the client.

=====================================================
=====================================================
Key code:
3047
0240
1D7E3E1B
0203
010001
=====================================================
=====================================================
Key code:
3067
0260
9B2AF4CB 69FA6483 E87DA590 7B47721A 16391E27
BC89D3DB 5A83698C 9063DB39 A279DD89
0203
010001
[client]
# Send the RSA public key created on the client to the server.

Step 5 Bind the RSA public key of the SSH client to Client002.
Step 6 Enable the SFTP service on the SSH server.
# Enable the SFTP service.

[Quidway] sftp server enable
Step 7 On the SSH server, set the type of service for the SSH user and the authorized directory.
Two SSH users are configured on the SSH server: Client001 in the password authentication
mode and Client002 in the RSA authentication mode.
[Quidway] ssh user client001 service-type sftp
[Quidway] ssh user client001 sftp-directory flash:/
Step 8 Connect the SFTP client and the SSH server.
# Client001 logs in to the SSH server in password authentication mode.

[client001] sftp 10.164.39.222
Input Username:client001
Trying 10.164.39.222 ...
Enter password:
sftp-client>
# Client002 logs in to the SSH server in RSA authentication mode.

[client002] sftp 10.164.39.222
Input Username: client002
Trying 10.164.39.222 ...
sftp-client>
After the configuration, run the display ssh server status and display ssh server session
commands on the SSH server. You can view that the SFTP service is enabled, and that the SFTP
client logs in to the server successfully.

SSH version : 1.99
SFTP server: Enable
STELNET server: Disable


Session 1:
Conn: VTY 3
Version: 2.0
State: started
Username: client001
Retry: 1
Service Type: sftp
Session 2:
Conn: VTY 4
Version: 2.0
State: started
Username: client002
Retry: 1
Service Type: sftp
# Check information about the SSH user.

[Quidway] display ssh user-information
User 1:
Authentication-type: password
User-public-key-name: -
Sftp-directory: flash:
Service-type: sftp
User 2:
Authentication-type: rsa
User-public-key-name: RsaKey001
Sftp-directory: flash:
Service-type: sftp
----End
Configuration Files
#
sysname Quidway
#
vlan batch 10
#
interface Vlanif10
ip address 10.164.39.222 255.255.255.0
#
3047
0240
C4989BF0 416DA8F2 2675910D 7F2997E8 5573A35D 0163FD4A FAC39A6E 0F45F325
A4E3AA1D 54692B04 C6A28D3D C58DE2E8 E0D58D65 7A25CF92 A74D21F9 E917182B
0203
010001
public-key-code end

peer-public-key end
#
aaa
#
sftp server enable
ssh user client001
ssh user client002
ssh user client002 authentication-type rsa
ssh user client001 service-type sftp
ssh user client001 sftp-directory flash:/
#
#
#
return

#
sysname client001
#
vlan batch 10
#
interface Vlanif10
ip address 10.164.39.220 255.255.255.0
#
#
#
return

#
sysname client002
#
vlan batch 10
#
interface Vlanif10
ip address 10.164.39.221 255.255.255.0
#
#
#
return
9.7.5 Example for Configuring the SSH Server to Support the Access
from Another Port
In this example, the monitoring port number of the SSH server is set to a port number other than
the standard monitoring port number so that only valid users can set up connections with the
SSH server.

The standard listening port is numbered 22, as defined in the SSH protocol. If attackers access
the standard port continuously, the bandwidth is consumed and the performance of the server is
degraded. As a result, other valid users cannot access the port.
If the listening port on the SSH server is changed to a non-default one, attackers will not aware
of this change and continue to send a request for the socket connection to port 22. In this case,
the SSH server detects that it is not the listening port, and then denies the the request for
establishing the socket connection.
Therefore, only valid users can use the specified listening port to set up a socket connection
through the following procedures:
l Negotiating the version of the SSH protocol
l Negotiating the algorithm
l Generating the session key
l Authenticating
l Sending a request for a session
l Performing the interactive session
Figure 9-7 Networking diagram for configuring the SSH server to support the access from
another port
SSH Server
10.164.39.222/24
10.164.39.220/24 10.164.39.221/24
Client001 Client002
interface.
3. Create a local key pair on the SFTP client and SSH server separately.

4. Generate an RSA public key on the SSH server and bind the RSA public key of the SSH
client to Client002.
5. Enable the STelnet and SFTP services on the SSH server.
6. Configure the type of the service and authenticated directory for the SSH user.
7. Set the listening port number on the SSH server.
8. Client001 and Client002 log in to the SSH server through STelnet and SFTP separately.
Data Preparation
l Password or RSA public key of the SSH user
l Server name
l Listening port number on the SSH server
Procedure
Create VLAN 10 on the Switch that functions as the server and assign IP address
10.164.39.222/24 to VLANIF 10.
[Quidway] vlan 10
Assigning an IP address to theSwitch that functions as Client001 or Client002 is the same as

Step 2 A local key pair generated on the SSH server
info: If the key modulus is greater than 512,
Generating keys...
...........++++++++++++
..................++++++++++++
...++++++++
...........++++++++

# Check the RSA public key generated on the client.


=====================================================
=====================================================
Key code:
3047
0240
1D7E3E1B
0203
010001
=====================================================
=====================================================
Key code:
3067
0260
9B2AF4CB 69FA6483 E87DA590 7B47721A 16391E27
BC89D3DB 5A83698C 9063DB39 A279DD89
0203
010001
[client002]
NOTE
l Before configuring the authentication mode of password or password-rsa, you must configure a local
user.
l Before configuring the authentication mode of RSA, password-rsa, or all, you must copy the RSA
public key of the SSH client to the server.


# Create an SSH user named Client001, and configure the authentication mode as password
for the user.

[Quidway] aaa
[Quidway-aaa] quit
# Set the type of service of Client001 to STelnet.

# Create an SSH user named Client002, and configure the authentication mode as RSA for the
user. Bind the RSA public key of the SSH client to Client002.
# Set the type of service of Client002 to SFTP and the authorized directory as flash:/.
Step 5 Enable the STelnet and SFTP services on the SSH server.
Step 6 Configure the new listening port number on the SSH server.
[Quidway] ssh server port 1025
Step 7 Connect the SSH client and the SSH server.

# The STelnet client logs in to the SSH server by using the new listening port.
[client001] stelnet 10.164.39.222 1025
Please input the username:client001
Trying 10.164.39.222 ...
Connected to 10.164.39.222 ...
The server is not authenticated. Do you continue to access it?(Y/N):y
Do you want to save the server's public key?(Y/N):y
The server's public key will be saved with the name: 10.164.39.222. Please wait...
Enter password:
Enter the password huawei, and information indicating that the login succeeds is displayed as
follows:
<Quidway>
# The SFTP client logs in to the SSH server by using the new listening port.

[client002]sftp 10.164.39.222 1025

Trying 10.164.39.222 ...
The server's public key does not match the one we cached.
The server is not authenticated. Do you continue to access it?(Y/N):y
Do you want to update the server's public key we cached?(Y/N):y
sftp-client>

Attackers fail to log in to the SSH server by using port 22.
[client002] sftp 10.164.39.222
Trying 10.164.39.222 ...
Can't establish tcp connection to server
After the configuration, run the commands of display ssh server status and display ssh server
session on the SSH server. You can check the current listening port number on the SSH server,
and that the STelnet or SFTP client logs in to the server successfully.
SSH version : 1.99
SFTP server: Enable
STELNET server: Enable
SSH server port: 1025

Session 1:
Conn: VTY 3
Version: 2.0
State: started
Username: client001
Retry: 1
Session 2:
Conn: VTY 4
Version: 2.0
State: started
Username: client002
Retry: 1
Service Type: sftp
----End

Configuration Files
#
sysname Quidway
#
vlan batch 10
#
interface Vlanif10
ip address 10.164.39.222 255.255.255.0
#
3047
0240
0203
010001
public-key-code end
peer-public-key end
#
aaa
#
sftp server enable
ssh server port 1025
ssh user client001
ssh user client002
ssh user client002 authentication-type RSA
#
#
#
return

#
sysname client001
#
vlan batch 10
#
interface Vlanif10
ip address 10.164.39.220 255.255.255.0
#
#
#
return

#
sysname client002
#

vlan batch 10
#
interface Vlanif10
ip address 10.164.39.221 255.255.255.0
#
#
#
return
9.7.6 Example for Authenticating SSH Through RADIUS

In this example, a user that attempts to access the SSH server is authenticated by the RADIUS
server, and the SSH server determines whether to set up a connection with the user according
to the authentication result.
When an RADIUS user is connected to an SSH server, the SSH server sends the user name and
password of the SSH client to the RADIUS server (compatible with the TACACS server) for
authentication.
The RADIUS server authenticates the user and sends the result (passed or failed) back to the
SSH server. If the authentication is successful, the user level is sent along with the result. The
SSH server determines whether the SSH client is allowed to set up a connection according to
the authentication result.
Figure 9-8 shows the networking diagram.
Figure 9-8 Networking diagram of authenticating the SSH through RADIUS
10.164.39.221/24 10.164.39.222/24 10.164.6.49/24

SSH Client SSH Server Radius Server
1. Configure the RADIUS template on the SSH server.

2. Configure a domain on the SSH server.
3. Create a user on the RADIUS server.
4. Generate the local key pair on STelnet client and SSH server respectively. The SSH server
monitors the port number.
5. Generate the local key pair on the client and SSH server .

6. Generate the RSA public key on SSH server and bind the RSA public key of the SSH client
to [email protected].
7. Enable the STelnet and SFTP services on the SSH server.
8. Configure the service mode and authorization directory of the SSH user.
9. Users [email protected] and [email protected] log in to the SSH server through STelnet and
SFTP respectively.
Data Preparation
l Configure the password authentication for the two SSH users .
l RADIUS authentication
l Name of the RADIUS template
l Name of the RADIUS domain
l Name and password of the RADIUS user
Procedure
Step 1 Generate a local key pair on the SSH server.
Input the bits in the modulus[default = 512]: 768
Generating keys...
.......++++++++++++
..........++++++++++++
...................................++++++++
......++++++++
Step 2 Configure the RSA public key of the server.

# Generate a local key pair of client on the client.
[Quidway] sysname client
[client] rsa local-key-pair create
# View the RSA public key generated on the client.

[client] display rsa local-key-pair public
=====================================================
Key name: Quidway_Host
=====================================================
Key code:
3047
0240
1D7E3E1B
0203
010001

=====================================================
Key name: Quidway_Server
=====================================================
Key code:
3067
0260
9B2AF4CB 69FA6483 E87DA590 7B47721A 16391E27
BC89D3DB 5A83698C 9063DB39 A279DD89
0203
010001
[client]
Step 3 Create the SSH user.

On the RADIUS server, add two users named [email protected] and [email protected] ; in addition,
designate the NAS address 10.164.39.222 and the key huawei. The NAS address refers to the
address of the SSH server that connects to the RADIUS server.
# Configure the VTY user interface on the SSH server.
# Create SSH users [email protected] and [email protected] on the SSH server.

[Quidway] ssh user [email protected]
[Quidway] ssh user [email protected] authentication-type password
[Quidway] ssh user [email protected] service-type stelnet
[Quidway] ssh user [email protected]
[Quidway] ssh user [email protected] authentication-type password
[Quidway] ssh user [email protected] service-type sftp
Step 4 Configure the RADIUS template.

# Configure the authentication scheme newscheme and authentication mode RADIUS.
[Quidway] aaa
[Quidway-aaa] authentication-scheme newscheme
[Quidway-aaa-authen-newscheme] authentication-mode radius
[Quidway-aaa-authen-newscheme] quit

# Configure the RADIUS template of SSH server as ssh.

[Quidway] radius-server template ssh
# Configure the IP address as 10.164.6.49 and port of the RADIUS authentication server as 1812.
[Quidway-radius-ssh] radius-server authentication 10.164.6.49 1812
# Configure the key of RADIUS server as huawei.

[Quidway-radius-ssh] radius-server shared-key huawei
[Quidway-radius-ssh] quit
Step 5 Configure RADIUS domain name.
# Configure the RADIUS domain of SSH server as ssh.com, applying authentication scheme
newscheme and RADIUS template ssh.
[Quidway] aaa
[Quidway-aaa] domain ssh.com
[Quidway-aaa-domain-ssh.com] authentication-scheme newscheme
[Quidway-aaa-domain-ssh.com] radius-server ssh
[Quidway-aaa-domain-ssh.com] quit
[Quidway-aaa] quit
Step 6 Connect the SSH client and the SSH server.
# Enable STelnet and SFTP services on the SSH server.

# For the first login, you need to enable the first authentication on SSH client.
[client] ssh client first-time enable
[client] quit
# Connect the STelnet client to the SSH server in the RADIUS authentication.
<client> system-view
[client] stelnet 10.164.39.222
Please input the username: [email protected]
Trying 10.164.39.222 ...
Connected to 10.164.39.222 ...
he server is not authenticated. Do you continue to access it?(Y/N):y
Do you want to save the server's public key?(Y/N):y
he server's public key will be saved with the name: 10.164.39.222. Please wait...
Enter password:
Enter the password Huawei and view as follows:

Info: The max number of VTY users is 10, and the current number
<Quidway>
# Connect the SFTP client to the SSH server in the RADIUS authentication.
<client> system-view
[client] sftp 10.164.39.222
Please input the username: [email protected]
Trying 10.164.39.222 ...
Connected to 10.164.39.222 ...
Enter password:
sftp-client>

After the configuration, run the display radius-server configuration and display ssh server
session commands on the SSH server. You can view the configuration of the RADIUS server
on the SSH server. You can also view that the STelnet or SFTP client is connected to the SSH
server successfully with RADIUS authentication.
# Display the configuration of the RADIUS server.

[Quidway-aaa] display radius-server configuration
-------------------------------------------------------------------
Server-template-name : ssh
Protocol-version : standard
Traffic-unit : B
Shared-secret-key : huawei
Timeout-interval(in second) : 5
Primary-authentication-server : 10.164.6.49:1812:LoopBack-1
Primary-accounting-server : 0.0.0.0:0:LoopBack0
Secondary-authentication-server : 0.0.0.0:0:LoopBack0
Secondary-accounting-server : 0.0.0.0:0:LoopBack0
Retransmission : 3
Domain-included : YES
-------------------------------------------------------------------
# Display the connection of the SSH server.

Session 1:
Conn : VTY 0
Version : 2.0
State : started
Username : [email protected]
Retry : 1
Service Type : stelnet
Session 2:
Conn : VTY 1
Version : 2.0
State : started
Username : [email protected]
Retry : 1
Service Type : sftp
----End
Configuration Files
Configuration file of the SSH server
#
sysname Quidway
#
radius-server template ssh
radius-server authentication 10.164.6.49 1812
#
3047

0240
0203
010001
public-key-code end
peer-public-key end
#
aaa
authentication-scheme newscheme
authentication-mode radius
#
domain ssh.com
authentication-scheme newscheme
radius-server ssh
#
#
sftp server enable
ssh user [email protected]
ssh user [email protected]
ssh user [email protected] authentication-type password
ssh user [email protected] authentication-type password
ssh user [email protected] assign rsa-key RsaKey001
ssh user [email protected] service-type stelnet
ssh user [email protected] service-type sftp
#
#
Return

Configuration Guide - Basic Configuration 10 Web System Configuration
10 Web System Configuration
About This Chapter
Before configuring the S5300 in Web mode, you need to configure the S5300 as the Web server.
10.1 Overview of Web System

Through the Web system, users can manage and maintain the S5300 series Ethernet switches in
the graphical user interface (GUI).
10.2 Starting Web System
This topic describes how to load the Web system and create an account of the Web system.

10 Web System Configuration Configuration Guide - Basic Configuration
10.1 Overview of Web System

Through the Web system, users can manage and maintain the S5300 series Ethernet switches in
the graphical user interface (GUI).
To facilitates the use and maintenance of the S5300 series Ethernet switches, Huawei develops
the Web system for these switches.
The S5300 is installed with a built-in Web server. Thus, the terminal (such as a PC) connected
to the S5300 can access the S5300 through the Web browser.
Figure 10-1 shows the running environment of the Web system.
Figure 10-1 Running environment of the Web System

Switch
HTTP
Connection
PC
10.2 Starting Web System

This topic describes how to load the Web system and create an account of the Web system.

10.2.2 Setting the Management IP Address of the S5300
This section describes how to configure the management IP address of the S5300.
10.2.3 Uploading Web Page Files
This section describes how to obtain the Web page files and upload them to the S5300 through
FTP.
10.2.4 Loading a Web Page File
This section describes how to load a Web file.
10.2.5 Creating a Web Account
Before logging in to the S5300 in Web mode, you need to create a Web account on the S5300.

10.2.6 Logging In to the Web System

This section describes how to log in to the S5300 in Web mode.
Context
When setting up a local configuration environment through the console interface, you can
connect the PC and the S5300 through the Windows HyperTerminal.
Procedure
Step 1 Enable the HyperTerminal on the PC.
Choose Start > All Programs > Accessories > Communications > HyperTerminal to start
the HyperTerminal.
Step 2 Set up a new connection.
As shown in Figure 10-2, enter the name of the new connection in the Name text box and choose
an icon. Click OK.
Figure 10-2 Setting up a new connection
Step 3 Set the connection port.
After entering the Connect window as shown in Figure 10-3, select a serial port from the
Connect drop-down list box according to the port used by the PC or the configuration terminal.
Select COM1 in this case, and click OK.

Figure 10-3 Setting the connection port
Step 4 Set communication parameters.

After entering the COM1 Properties window as shown in Figure 10-4, set the communication
parameters according to the description in Table 10-1.
NOTE
In other Windows operating systems, Bits per second may be described as Baud rate; Flow control may
be described as Traffic control.

Figure 10-4 Setting communication parameters for the port
Table 10-1 Communication parameters

Parameter Value
Bit per second (Baud rate) 9600
Data bit 8
Parity check None
Stop bit 1
Flow control (Traffic control) None
Step 5 After the HyperTerminal is started, select File Attributes to enter the Connect Properties
window as shown in Figure 10-5. Choose the Setting tab, select Auto detect or VT100 from
the Emulation drop-down list box. Click OK to complete the setting.

Figure 10-5 Selecting a terminal type
After the preceding steps are complete, press Enter. If the prompt <Quidway> is displayed, it
indicates that you have logged in to the S5300. At this time, you can enter the command to
configure and manage the S5300.
----End
10.2.2 Setting the Management IP Address of the S5300

This section describes how to configure the management IP address of the S5300.
Procedure
Step 1 Run:
system-view
Step 2 Run:
interface meth 0/0/1
The MEth interface view is displayed.
Step 3 Run:
ip address ip-address { mask | mask-length } [ sub ]

The IP address of the interface is configured.
----End
10.2.3 Uploading Web Page Files

This section describes how to obtain the Web page files and upload them to the S5300 through
FTP.
Prerequisite
To obtain the Web page file of the S5300, log in to www.support.huawei.com, and then choose
Software > Version Software > Data Communication Product Line > Ethernet Switch >
S23&33&53&CX200D Series. Download the software package of the current version. The
Web page file is contained in the software package. The file name is Product Name + the
Version of Software.web.zip, for example, S5300-V100R005C00SPC100.web.zip.
Before uploading the Web page file, copy the Web page file to the client from which you log in
to the S5300.
Context
NOTE
You can also download Web files through TFTP. In this case, the S5300 functions as the TFTP client, and
the terminal that stores the Web files functions as the TFTP server. For details, see 8.5.2 Downloading
Files Through TFTP.
Procedure
Step 1 Run:
system-view

Step 2 Run:
ftp server enable
The FTP server is enabled.

Step 3 Run:
aaa

Step 4 Run:
An FTP client is configured and the password is set to huawei.

Step 5 Run:
local-user user-name ftp-directory directory
The directory is set for the FTP client.

Step 6 Run:
local-user user-name service-type ftp
The service type of an FTP login user is set.

Step 7 Run the following command in the cmd view of the PC:
ftp ip-address
The user name and password are displayed. The PC can log in to the S5300.
C:\>ftp 10.1.1.132
User (10.1.1.132:(none)): client
331 Password required for client.
Password:
230 User logged in.
ftp>
Step 8 Run the following command in the FTP view:

put local-filename
The web.zip file is uploaded from the PC to the S5300.

ftp> put web.zip
200 Port command okay.
150 Opening ASCII mode data connection for web.zip.
226 Transfer complete.
ftp: 251047 bytes sent in 3.36Seconds 74.74Kbytes/sec.
ftp>
----End
10.2.4 Loading a Web Page File

This section describes how to load a Web file.
Context
Before loading the Web page file, upload it to the S5300.
Procedure
Step 1 Run:
system-view

Step 2 Run:
http server load file-name
The Web page file is loaded to the S5300.
----End
10.2.5 Creating a Web Account

Before logging in to the S5300 in Web mode, you need to create a Web account on the S5300.
Procedure
Step 1 Run:
system-view

Step 2 Run:
http server enable
The HTTP server is enabled.

Step 3 Run:
aaa

Step 4 Run:
An HTTP client is configured and the password of the client is set.
NOTE
You are recommended to set the password in the cipher text. Simple user name and password should not
be used for the sake of security.
Step 5 Run:
local-user user-name service-type http
The access type of the user named admin is set to HTTP.

Step 6 Run:
quit
Return to the system view.

http timeout timeout
The timeout period of an HTTP connection is set.

By default, the timeout period of an HTTP connection is 30 minutes.
----End
10.2.6 Logging In to the Web System

This section describes how to log in to the S5300 in Web mode.
Procedure
Step 1 Open the Web browser on the PC, and then enter the management address of the S5300 in the
address bar (the PC and the S5300 have reachable routes to each other). Then, press Enter to
display the Login dialog box. As shown in Figure 10-6, enter the pre-set Web user name,
password and verify code, and then choice the language.

Figure 10-6 Login
NOTE
If you select Save my password before clicking Login, you do not need to enter the password at next
login.
Step 2 Click Login or press enter to display the homepage of the Web system.
You can configure the S5300 after logging in to the Web system. For details on how to configure
the S5300 on the Web system, see the Quidway S5300 Series Ethernet Switches Web Network
Management System Client Operation Guide.
----End


Configuration Guide - Basic Configuration (V100R005C01 - 02)

Uploaded by

Copyright:

Available Formats

Configuration Guide - Basic Configuration (V100R005C01 - 02)

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Configuration Guide - Basic Configuration (V100R005C01 - 02)

Uploaded by

Copyright:

Available Formats

Quidway S5300 Series Ethernet Switches

Configuration Guide - Basic

HUAWEI TECHNOLOGIES CO., LTD.

Trademarks and Permissions

Huawei Technologies Co., Ltd.

Issue 02 (2010-12-01) Huawei Proprietary and Confidential i

About This Document

Indicates a hazard with a high level of risk, which if not

Indicates a hazard with a medium or low level of risk, which

Indicates a potentially hazardous situation, which if not

NOTE Provides additional information to emphasize or supplement

Issue 02 (2010-12-01) Huawei Proprietary and Confidential iii

Boldface The keywords of a command line are in boldface.

Italic Command arguments are in italics.

[] Items (keywords or arguments) in brackets [ ] are optional.

{ x | y | ... } Optional items are grouped in braces and separated by

[ x | y | ... ] Optional items are grouped in brackets and separated by

{ x | y | ... }* Optional items are grouped in braces and separated by

[ x | y | ... ]* Optional items are grouped in brackets and separated by

# A line starting with the # sign is comments.

Changes in Issue 02 (2010-12-01)

The following information is added:

l 2.4 Shortcut Keys

The following information is modified:

l Parameter default values in the Web network management system

Changes in Issue 01 (2010-08-15)

iv Huawei Proprietary and Confidential Issue 02 (2010-12-01)

About This Document...................................................................................................................iii

2 CLI Overview.............................................................................................................................. 2-1

Issue 02 (2010-12-01) Huawei Proprietary and Confidential v

2.4 Shortcut Keys................................................................................................................................................2-13

3 How to Use Interfaces...............................................................................................................3-1

vi Huawei Proprietary and Confidential Issue 02 (2010-12-01)

5.1.1 User Interface.........................................................................................................................................5-2

6 File System Management..........................................................................................................6-1

Issue 02 (2010-12-01) Huawei Proprietary and Confidential vii

6.3.2 Viewing the Current Directory...............................................................................................................6-4

7 Management of Configuration Files......................................................................................7-1

8 FTP and TFTP..............................................................................................................................8-1

viii Huawei Proprietary and Confidential Issue 02 (2010-12-01)

8.3.1 Establishing the Configuration Task......................................................................................................8-8

9 Telnet and SSH...........................................................................................................................9-1

Issue 02 (2010-12-01) Huawei Proprietary and Confidential ix

9.3.2 Creating SSH User.................................................................................................................................9-9

10 Web System Configuration..................................................................................................10-1

x Huawei Proprietary and Confidential Issue 02 (2010-12-01)

10.2.1 Logging In to the S5300 Through the Console Interface...................................................................10-3

Issue 02 (2010-12-01) Huawei Proprietary and Confidential xi

Figure 1-1 Networking diagram of logging in through the console port.............................................................1-7

Issue 02 (2010-12-01) Huawei Proprietary and Confidential xiii

Table 2-1 Common error messages of the command line....................................................................................2-7

Issue 02 (2010-12-01) Huawei Proprietary and Confidential xv

About This Chapter

Before configuring switches, you need to log in to the switch.

Issue 02 (2010-12-01) Huawei Proprietary and Confidential 1-1

1.1.1 Login Through the Console

1.1.1 Login Through the Console

l The switch is powered on for the first time.

1.1.2 Login Through Telnet