No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

NE20E-S2 V800R010C10SPC500 Configuration Guide - System Management 01

This is NE20E-S2 V800R010C10SPC500 Configuration Guide - System Management
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Example for Establishing Communication Between the NMS and a Device Using NETCONF

Example for Establishing Communication Between the NMS and a Device Using NETCONF

This section provides an example for logging in to the server from the client using the NMS to perform remote configuration management.

Networking Requirements

NETCONF ensures security and extensibility. When the NMS is used to manage network devices, you can use NETCONF to ensure communication between the NMS and the devices.

As shown in Figure 17-3, the NMS is deployed on the client that functions as the SSH client. The server functions as the SSH server that receives connection requests from and establishes the connection with the SSH client. SSH is a security protocol at the application layer, enhancing the reliability of NETCONF. In this networking, NETCONF is used to manage the configuration of the SSH server.

Figure 17-3 Using NETCONF to manage the configuration

NOTE:

Interfaces 1 in this example are GigabitEthernet0/0/0.

Precautions

An SSH user named client001 is used as an example. If the password authentication mode is used to authentication the SSH user, only the server needs to generate an Elliptic Curves Cryptography (ECC) key.

Configuration Roadmap

The configuration roadmap is as follows:

  1. Configure an IP address for the server port connecting to the NMS so that the Layer 3 route between the client and server is reachable.
  2. Configure virtual type terminal (VTY) user interfaces on the server to support SSH so that SSH users can be managed and monitored with better connection security.

  3. Deploy SSH on the server to improve NETCONF security.

    1. Create an SSH user with administrative rights.
    2. Create an ECC key pair.
    3. Configure an authentication mode for the SSH user.
    4. Configure a service type for the SSH user.
  4. Enable NETCONF so that the client can connect to the server.
  5. Deploy the NMS on the client to implement NMS-based network management on the client.
  6. Log in to the server using the NMS to manage the configuration remotely.

Data Preparation

To complete the configuration, you need the following data:

  • SSH user name and authentication mode

  • SSH user password

  • SSH server name

Procedure

  1. Configure an IP address for the server port connecting to the NMS.

    <HUAWEI> system-view
    [~HUAWEI] sysname netconf-agent
    [*HUAWEI] commit
    [~netconf-agent] interface gigabitethernet 0/0/0
    [~netconf-agent-GigabitEthernet0/0/0] ip address 10.1.1.1 24
    [*netconf-agent-GigabitEthernet0/0/0] commit
    [~netconf-agent-GigabitEthernet0/0/0] quit

  2. Configure VTY user interfaces on the server to support SSH.

    [~netconf-agent] user-interface vty 0 4
    [*netconf-agent-ui-vty0-4] authentication-mode aaa
    [*netconf-agent-ui-vty0-4] protocol inbound ssh
    [*netconf-agent-ui-vty0-4] commit
    [~netconf-agent-ui-vty0-4] quit
    NOTE:

    After SSH is configured, the NE20E automatically disables the Telnet function.

  3. Deploy SSH on the server.

    1. Create an SSH user.

      # Create an SSH user with the name client001 and set the user password to Hello-huawei123.

      [~netconf-agent] ssh user client001
      [*netconf-agent] aaa
      [*netconf-agent-aaa] local-user client001 password cipher Hello-huawei123
      [*netconf-agent-aaa] local-user client001 user-group manage-ug
      [*netconf-agent-aaa] local-user client001 service-type ssh
      [*netconf-agent-aaa] commit
      [~netconf-agent-aaa] quit
    2. Create ECC key pair.

      [~netconf-agent] ecc local-key-pair create
      The key name will be: HUAWEI_Host_ECC
      % ECC keys defined for HUAWEI_Host_ECC already exist.
      Confirm to replace them? Please select [Y/N]: Y
      The public key size should be (256/384/521).
      NOTE: If the key modulus is greater than 256,
            it will take a few minutes.
      Input the bits(256/384/521) in the modulus [default = 521] : 256
      [*netconf-agent] commit

      After the ECC key pair is created, run the display ecc local-key-pair public command to view information about the public key in the ECC key pair.

    3. Configure an authentication mode for the SSH user.

      [~netconf-agent] ssh user client001 authentication-type password
      [*netconf-agent] commit
    4. Configure a service type for the SSH user.

      [~netconf-agent] ssh user client001 service-type all
      [*netconf-agent] commit

  4. Enable NETCONF on the server.

    [~netconf-agent] snetconf server enable
    [*netconf-agent] commit

  5. Deploy the NMS on the client.

    For installation and maintenance of the NMS, see the relevant installation instruction and usage guidelines.

    NOTE:

    If the Huawei NMS is used, creating NEs will consume specific upgrade licenses or NE resource licenses. If there are no remaining NE resources or specific upgrade licenses, the system displays that an NE fails to be created. If this occurs, apply for NE resources or specific upgrade licenses.

  6. Log in to the server from the client using the NMS.

    For login to remote devices using the NMS, see the relevant usage guide of the NMS.

    If a Huawei NMS is used, contact Huawei technical personnel for the NMS operation manual.

  7. Verify the configuration.

    After the preceding configuration is complete, you can log in to the remote device using NETCONF to manage its configuration remotely.

    NOTE:

    All the following operations are performed on the server (SSH server).

    # Run the display users command to view information about users who have logged in to the server.

    [~netconf-agent] display users
      User-Intf    Delay    Type   Network Address     AuthenStatus    AuthorcmdFlag
      100 NCA 0   00:02:50  SSH    10.2.2.2            pass            yes          Username : client001

    # Run the display ssh user-information command to view SSH user information.

    [~netconf-agent] display ssh user-information
    --------------------------------------------------------------------------------
    User Name             : client001
    Authentication-Type   : password
    User-public-key-name  : -
    User-public-key-type  : -
    Sftp-directory        : -
    Service-type          : snetconf
    --------------------------------------------------------------------------------
    Total 1, 1 printed

    # Run the display local-user user-group manage-ug command to view information about local users in user group.

    [~netconf-agent] display local-user user-group manage-ug
    ---------------------------------------------------------------------
    Username                         State   Type   Access-limit   Online
    ---------------------------------------------------------------------
    client001                        Active  S                No        1
    ---------------------------------------------------------------------
    Total 1, 1 printed

    # Run the display ssh server status command to view global configuration of the SSH server.

    [~netconf-agent] display ssh server status
    SSH Version                                : 1.99
    SSH authentication timeout (Seconds)       : 60
    SSH authentication retries (Times)         : 3
    SSH server key generating interval (Hours) : 0
    SSH version 1.x compatibility              : Enable
    SSH server keepalive                       : Disable
    SFTP server                                : Disable
    STELNET server                             : Disable
    SNETCONF server                            : Enable
    SNETCONF server port(830)                  : Disable
    SSH server port                            : 22
    ACL name                                   :
    ACL number                                 :
    ACL6 name                                  :
    ACL6 number                                :
    SSH server source address                  : 0.0.0.0

    # Run the display netconf capability command to view the capabilities that the server supports.

    [~netconf-agent] display netconf capability
    --------------------------------------------------
    Capability                                        
    --------------------------------------------------
    urn:ietf:params:netconf:base:1.0                  
    urn:ietf:params:netconf:base:1.1                  
    urn:ietf:params:netconf:capability:writable-running:1.0
    urn:ietf:params:netconf:capability:candidate:1.0  
    urn:ietf:params:netconf:capability:confirmed-commit:1.0
    urn:ietf:params:netconf:capability:confirmed-commit:1.1
    urn:ietf:params:netconf:capability:rollback-on-error:1.0
    urn:ietf:params:netconf:capability:validate:1.0   
    urn:ietf:params:netconf:capability:validate:1.1   
    urn:ietf:params:netconf:capability:startup:1.0    
    urn:ietf:params:netconf:capability:url:1.0?scheme=file,ftp,sftp
    urn:ietf:params:netconf:capability:xpath:1.0      
    urn:ietf:params:netconf:capability:notification:1.0
    urn:ietf:params:netconf:capability:interleave:1.0 
    urn:ietf:params:netconf:capability:with-defaults:1.0?basic-mode=report-all&also-supported=report-all-tagged,trim
    urn:ietf:params:netconf:capability:yang-library:1.0?revision=2016-06-21&module-set-id=1903662584
    --------------------------------------------------

Configuration files

The following lists only the configuration file of the server.
#
sysname netconf-agent
#
aaa
 local-user client001 password cipher @%@%U|,(X4rFC)8izE%,QHz:$(|s@%@%
 local-user client001 service-type ssh
 local-user client001 user-group manage-ug
#
interface GigabitEthernet0/0/0
 undo shutdown
 ip address 10.1.1.1 255.255.255.255
#
snetconf server enable
ssh user client001
ssh user client001 authentication-type password
ssh user client001 service-type all
#
return
Translation
Download
Updated: 2019-01-02

Document ID: EDOC1100055400

Views: 14544

Downloads: 26

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next