Usage Scenario

If a dumb terminal that has no IP address configured initiates a control connection setup request to a remote server through the router, run the connect command on the router to establish a control connection between the dumb terminal and remote server.

Precautions

The dumb terminal must connect to the asynchronous serial interface of the router.

If -t interval is not specified, the local router does not automatically establish a control connection to the remoter server.

Usage Scenario

To prevent other users from modifying or deleting configured data, you can run the config lock command to lock the configuration management plane before data configuration. After completing data configuration, run the undo config lock command to unlock the configuration management plan so that other users can perform data configuration.

Precautions

The locked system configuration can be unlocked by only the user who locks it, the super administrator (run the user privilege command to set the user level to 15), or the network management system (NMS) user.

Usage Scenario

If the device configuration is clocked by the config lock command, other users cannot modify the configuration. In this case, the config unlock interval command can be used to configure the unlock interval, after which the device configuration is unlocked automatically.

Precautions

This command can be used by only the super administrator (run the user privilege command to set the user level to 15) and NMS user.

If you run the command multiple times, only the latest configuration takes effect.

The unlocking interval starts from the last time the current user configures the system.

If you cannot configure the device after logging in to it, you can run this command. After this command is executed successfully, the system displays the configured lock information, such as the lockout duration and whether the lock is enabled. If the current system configuration is locked, the command output includes the type, name, and IP address of the user who locks the configuration. If the IP address does not exist, no information is displayed.

If the current system configuration is locked by a user of a certain privilege level, only the user of the same or higher privilege level can query information about the user that locks the configuration. The user of a lower privilege level cannot query the information. If the user of a lower privilege level queries the information, the system displays a message indicating that the system configuration is locked by a user of a higher privilege level.

Usage Scenario

You can run the display ecc local-key-pair public command to check information about the public key in the local ECC key pair on a client and then copy the public key to the server. The public key enables a server to authenticate users and ensures the login of authorized users.

Pre-configuration Tasks

You must run the ecc local-key-pair create command to generate a local ECC host key pair before using the command.

Usage Scenario

You can run the display ecc peer-public-key command on a client to check information about the public key configured on the remote end. The public key enables a server to authenticate users and ensures the login of authorized users.

You can run this command on the client and configure the client public key in the command output to the SSH server, which ensures that the SSH client validity check by the SSH server is successful and enables the secure data exchange between the SSH server and client.

Usage Scenario

You can run this command to check detailed information about the RSA public key and whether the local and peer public keys are the same.

Precautions

You must complete the RSA public key configuration before running this command.

After configuring the SSH attributes, you can run this command to view the configuration or session connection information on the SSH server to verify that the SSH connection has been established.

This command displays the SSH user name, bound RSA public key name, and service type.

• You can run this command to check whether the device functions as a Telnet server.
• You can run this command to check the listening port number of the Telnet server if you have set the port number by running the telnet server port port-number command.

After setting source parameters of the Telnet client, you can run this command to check the setting result. If you have not set telnet client-source, the default source IP address is 0.0.0.0.

Usage Scenario

A local key pair is a prerequisite to a successful SSH login. Compared with the RSA algorithm used by the rsa local-key-pair create command, the ECC algorithm shortens the key length, accelerates the encryption, and improves security. The length of the ECC host key pair can be 256 bits, 384 bits and 521 bits. By default, the length of the ECC host key pair is 256 bits.

If you no longer need the local ECC key pair, run the ecc local-key-pair destroy command to delete it.

Configuration Impact

The ecc local-key-pair destroy command deletes the local ECC host key pair, from the files on the master and slave main control boards. Exercise caution when you run this command.

Usage Scenario

When you use an ECC public key for authentication, specify the public key on the server for the client of SSH users. When the client logs in to the server, the server uses the specified public key to authenticate the client.

After you enter the ECC public key view, run the public-key-code begin command, and copy the ECC public key to the server.

The public key on the client is randomly generated by the client software.

If an ECC public key has been assigned to an SSH user, delete the mapping between the ECC public key and the SSH user. If you do not delete the mapping, the undo ecc peer-public-key command cannot delete the ECC public key.

Follow-up Procedure

Precautions

A maximum of 20 ECC public keys can be configured.

The peer public key supports only PKCS#1. Other PKCS versions are not supported.

The device functions as a calling end to send a line break \r\n. When receiving the line break, the called end discards \n in the line break. As a result, data of the calling end differs from that of the called end. In this case, you can run the exline-breaker enable command to enable the function of adding a line break. After the function is enabled, the calling end adds a line break \n to \r\n when sending it. When the called end receives the data, it removes only one \n from the line break.

Usage Scenario

You can configure the character set so that the system just supports Chinese or supports Chinese and English input. The character set facilitates device identification and management, for example, Chinese interface description can be configured.

Currently, the system supports the following character sets: GBK, UTF-8, and ISO8859-1. GBK and UTF-8 support both English and Chinese input, whereas ISO8859-1 supports only English input. GBK is a Chinese character set and UTF-8 is an international character set. To enter Chinese characters on the device, configure GBK or UTF-8 according to the character set supported on the terminal login software.

Precaution

The character set supported by the terminal login software affects the display of Chinese characters. If the character sets in the system and on the terminal login software are different, Chinese characters may be displayed as garbled characters.

After the character set function is configured, the device cannot work together with eSight or iManager U2000. The web system only displays the UTF-8 character set and does not support Chinese input.

Usage Scenario

Lock the current user interface using this command to prevent other users from operating the interface. The user interfaces consist of console ports, and Virtual Type Terminals (VTYs).

After using the lock command, you are prompted to input the password twice. If you input the correct password for twice, the user interface is locked.

Precautions

• The passwords must meet the following requirements:

  • The password is a string of 8 to 128 case-sensitive characters.

    After user run the set password min-length command, the minimum length of the password is the password length set using the set password min-length command.

  • The password must contain at least two of the following characters: upper-case character, lower-case character, digit, and special character.

    The special characters include spaces and the following:

    `~!@#$%^&*()-_=+\|[{}];:'",<.>/?

• Password entered in interactive mode is not displayed on the screen.

• When you run the lock command to lock the user interface and set a locking password, you can press CTRL_C to cancel the operation.

• To unlock the user interface, press Enter, and then input the correct password as prompted by the system.

When you run the undo command in a view, which is not registered in the current view, the system searches for the command in the upper view if the system is allowed to search for the undo command in the upper view. If the system finds the same undo command, the system executes this command in the upper view. If the system does not find the same undo command in the upper view, the system continues to search for this command in other upper views till the system view.

Running this command brings security risks. For example, if you run the undo ftp server command in the interface view, while this command is not registered in the interface view, the system automatically searches for it in the upper view, that is, the system view. In this manner, the system disables the FTP function.

The matched upper-view command is valid only for current login users who run this command.

Usage Scenario

You must save the public key generated on the remote host to the local host, which ensures that the validity check on the remote end is successful. After editing a public key in the public key view, you can run this command to return to the system view.

Prerequisites

Before you run this command, the rsa peer-public-key command has been run to enter the RSA public key view or the ecc peer-public-key command has been run to enter the ECC public key view.

Usage Scenario

You must save the public key generated on the remote host to the local host, which ensures that the validity check on the remote end is successful. Run the public-key-code begin command to display the public key editing view, and enter the key data. The key characters can contain spaces. You can press Enter to enter data in another line.

Prerequisite

A key name has been specified by running the rsa peer-public-key, or ecc peer-public-key command.

Precautions

• The public keys displayed by running the display rsa local-key-pair public, or display ecc local-key-pair public command can be used as the key data to enter.
• You can successfully edit the public key in a public key pair by entering the public key in the server key pair or client key pair. In SSH application, only the public key in the client key pair can be entered as key data. If you enter the public key in the server key pair, authentication fails during SSH login.
• When entering the private key data that exceeds 225 characters in a single line, you need to press Enter to continue entering the extra part of the data.

Usage Scenario

Prerequisites

Before you run this command, the public-key-code begin command has been run to enter the public key edit view.

Precautions

• Generally, in the public key view, only the public-key-code end command can be used to exit. Thus, in this instance the quit command cannot be used.
• If the legal key coding is not input, the key cannot be generated after the public-key-code end command is used. The system prompts that generating the incorrect key fails.
• If the key is deleted in another window, the system prompts that the key does not exist and returns to the system view directly after you run the public-key-code end command.

Usage Scenario

By default, all users on public and private networks can log in to remote devices after the redirection function is enabled. To allow only users in a VPN to log in to a remote device, associate the redirection function with the VPN instance on the device.

Prerequisite

A VPN instance has been created on the router, and the user-side interface of the router has been bound to the VPN instance.

The redirection function has been enabled by using the redirect enable command.

Precautions

After the redirection function is associated with a VPN instance, only users in the VPN instance can use the redirection function to log in to the device remotely. Users on the public network or other private networks connected to the router are prevented from logging in to the device remotely.

Usage Scenario

The redirection function is used in the following scenarios:

• An electricity system or finance system usually uses serial port terminals to collect data. These terminals are connected to asynchronous serial ports of a device. The device receives data flows from the terminals and encapsulates received data into Ethernet frames to transmit the data on an Ethernet network. With the redirection function, users can manage and maintain the terminals remotely.
• Some devices can be managed only through their console ports. In this scenario, connect their console ports to asynchronous serial ports of a device. The device can function as a serial port server to manage these devices.

Precautions

If the modem function is enabled on a TTY user interface, the redirection function does not take effect.

Usage Scenario

If the default port number for the redirection function is used by another service, run the redirect listen-port command to set a new port number.

Prerequisite

The redirection function has been enabled using the redirect enable command.

Usage Scenario

To implement secure data exchange between the server and client, run this command to generate a local key pair.

Precautions

If the RSA key pair exists, the system prompts you to confirm whether to replace the original key pair.

After you run this command, the system prompts you to enter the number of bits in the host key. The difference between the bits in the server and host key pairs must be at least 128 bits.

Because a longer key pair provides higher security, you are advised to use key pairs of the largest length.

After you run this command, the generated key pair is saved in the device and will not be lost after the device restarts.

This command is not saved in a configuration file.

Usage Scenario

To delete the local key pair, run rsa local-key-pair destroy command. If the host key pair and the service key pair of an SSH server are deleted, run the rsa local-key-pair create command to create the new host key pair and service key pair for the SSH server.

After you run this command, verify that all local RSA keys are deleted. This command is not saved in a configuration file.

Prerequisite

The local RSA keys that can be deleted exist.

Usage Scenario

When you use an RSA public key for authentication, you must specify the public key of the corresponding client for an SSH user on the server. When the client logs in to the server, the server uses the specified public key to authenticate the client. You can also save the public key generated on the server to the client. Then the client can be successfully authenticated by the server when it logs in to the server for the first time.

Huawei data communications devices support the DER, OpenSSH and PEM formats for RSA keys. If you use an RSA key in non-DER/OpenSSH/PEM format, use a third-party tool to convert the key into a key in DER, OpenSSH or PEM format.

Because a third-party tool is not released with Huawei system software, RSA usability is unsatisfactory. In addition to DER, RSA keys need to support the privacy-enhanced mail (PEM) and OpenSSH formats to improve RSA usability.

OpenSSL is an open source software. You can download related documents at http://www.openssl.org/.

After you configure an encoding format for an RSA public key, Huawei data communications device automatically generates an RSA public key in the configured encoding format and enters the RSA public key view. Then you can run the public-key-code begin command and manually copy the RSA public key generated on the peer device to the local device.

Prerequisite

The public key on the remote host has been obtained and recorded.

Follow-up Procedure

Precautions

The public key on the client is randomly generated by the client software.

If an RSA public key has assigned to an SSH client, release the binding relationship between the public key and the SSH client. If you do not release the binding relationship between them, the undo rsa peer-public-key command will fail to delete the RSA public key.

The peer public key supports only PKCS#1. Other PKCS versions are not supported.

After you run the send command, the system prompts you to enter the message to send. After you confirm to send this message, the user who logs in to the system from the specified user interface can receive this message.

Usage Scenario

You can log in to a device using HTTPS, Telnet, and STelnet, and HTTP and Telnet belong to insecure management protocols. For security purposes, you can run the set insecure-protocol disable command to forbid the usage of insecure management protocols HTTP and Telnet.

Precautions

Before running the set insecure-protocol disable command, you need to check whether the Telnet and HTTP service functions are enabled using the display telnet server status and display http server commands, respectively. If the Telnet and HTTP service functions are enabled, run the undo telnet server enable and undo http server enable commands to disable the two functions. The set insecure-protocol disable command then can be successfully run. If the Telnet and HTTP service functions are disabled, directly run the set insecure-protocol disable command to forbid the usage of insecure management protocols HTTP and Telnet.

After the set insecure-protocol disable command is run, you can only run the set insecure-protocol enable command to allow the usage of insecure management protocols HTTP and Telnet.

Usage Scenario

If the SSH client connects to the SSH server for the first time and the first authentication is not enabled on the SSH client using the ssh client first-time enable command, the SSH client rejects the access from unauthorized SSH servers. You need to specify the host public key of the SSH server and the mapping between the key and SSH server on the SSH client. After that, the client will determine whether the server is reliable using the correct public key based on the mapping.

Precautions

The RSA or ECC public key to be assigned to the SSH server must have been configured on the SSH client using the rsa peer-public-key or ecc peer-public-key command. If the key has not been configured, the verification for the RSA or ECC public key of the SSH server on the SSH client fails.

Usage Scenario

When the SSH client accesses the SSH server for the first time and the public key of the SSH server is not configured on the SSH client, you can enable the first authentication for the SSH client to access the SSH server and save the public key on the SSH client. When the SSH client accesses the SSH server next time, the saved public key is used to authenticate the SSH server.

Precautions

You can run the ssh client assign command to pre-assign a public key to the SSH server. In this manner, you can log in to the SSH server successfully at the first time.

Usage Scenario

You can run this command to configure the maximum number of authentication retries for an SSH connection, which prevents server overload due to malicious access.

Precautions

The configured number of retries takes effect upon the next login.

The total number of RSA and password authentication retries on the SSH client cannot exceed the maximum number that is set using this command.

Usage Scenario

The SSH server's compatibility with earlier versions applies to the protocol version negotiation between the client and server. After a TCP connection is set up between the client and server, the client negotiates with the server on a version that both the client and server support.

The server compares its own version with that sent by the client and determines whether it can work with the client.

• If the protocol version on the client is earlier than 1.3 or later than 2.0, version negotiation fails and the server disconnects from the client.
• If the protocol version on the client is equal to or later than 1.3 and earlier than 1.99, the SSH1.5 server module is invoked and the SSH1.X process is performed when the SSH1.X-compatible mode is configured. When the SSH1.X-incompatible mode is configured, version negotiation fails and the server disconnects from the client.
• If the protocol version on the client is 1.99 or 2.0, the SSH2.0 server module is invoked and the SSH2.0 process is performed.

Precautions

• The configuration takes effect upon the next login.

• SSH2.0 has an extended structure and supports more authentication modes and key exchange methods than SSH1.X. SSH 2.0 can eliminate the security risks that SSH 1.X has. SSH 2.0 is more secure and therefore is recommended.

Usage Scenario

An SSH server and a client need to negotiate an encryption algorithm for the packets transmitted between them. You can run the ssh server cipher command to configure an encryption algorithm list for the SSH server. The server compares the encryption algorithm list sent by the client with its own encryption algorithm list, and selects the first encryption algorithm on the client's list that matches an encryption algorithm on its own list as the encryption algorithm for packet transmission. If no algorithm on the client's list matches an algorithm on the server's list, the negotiation fails.

For example, for security purposes, you can run the ssh server cipher { aes256_ctr | aes192_ctr | aes128_ctr } ^* command to configure an encryption algorithm list containing aes256_ctr, aes192_ctr, and aes128_ctr encryption algorithms with high security for an SSH server.

Precautions

3des_cbc, aes128_cbc, blowfish_cbc, and des_cbc are weak encryption algorithms. Therefore, it is recommended that you not add them to the encryption algorithm list of the SSH server.

Usage Scenario

The server and client negotiate the algorithm for checking packets transmitted between them. You can run the ssh server hmac command to configure the check algorithm list of the SSH server. The server compares the check algorithm list sent from the client with its own check algorithm list, and selects the first matched check algorithm for checking transmitted packets. If the check algorithm lists of the server and client have no common check algorithm, the check algorithm negotiation fails.

For example, run the ssh server hmac sha2_256 command to add the high-security sha2_256 check algorithm to the HMAC check algorithm list of the SSH server, improving device security.

Precautions

The following check algorithms are listed in descending order of priority: sha2_256, sha2_256_96, sha1, sha1_96, md5, and md5_96.

You are advised not to add the following HMAC check algorithms to the HMAC check algorithm list of the SSH server because they provide low security: sha2_256_96, sha1, sha1_96, md5, and md5_96.

Usage Scenario

An SSH user and a client need to negotiate a key exchange algorithm for the packets exchanged between them. You can run the ssh server key-exchange command to configure a key exchange algorithm list for the SSH server. After the server receives a packet from the client, the server matches the key exchange algorithm list of the client against its local list and selects the first matched key exchange algorithm. If no key exchange algorithm is matched, the negotiation fails.

Precautions

The key exchange algorithms are listed as follows in descending order of security levels: dh_group15_sha512, dh_group14_sha256, dh_group_exchange_sha1, dh_group14_sha1, and dh_group1_sha1. The dh_group14_sha256 algorithm is recommended.

You are advised not to add the dh_group_exchange_sha1, dh_group14_sha1, and dh_group1_sha1 algorithms to the key exchange algorithm list of the SSH server because they provide low security.

Usage Scenario

To prevent clients from connecting to the SSH server through unauthorized interfaces, you can run the ssh server permit interface command to specify interfaces on the SSH server to which clients can connect.

Precautions

• If no interface is specified on the SSH server to allow clients to connect to the server, the SSH service cannot be enabled. The undo ssh server permit interface command can be executed only after the SSH service is disabled.

• This command does not take effect on the MEth management interface. The SSH server always allows clients to connect to it through the MEth management interface. To allow clients to connect only through the MEth management interface, run the ssh server permit interface MEth 0/0/0 command.
• By default, clients can connect to all interfaces on the SSH server. Once a specific interface is specified using this command, a client cannot connect to the SSH server through any other interface.
• A maximum of five interfaces can be specified using the ssh server permit interface { interface-type interface-number } &<1-5> command. The latest configuration overrides the previous one. For example, before you run this command, clients can connect to three interfaces GigabitEthernet 1/0/0, GigabitEthernet 2/0/0, and GigabitEthernet 3/0/0 on the SSH server. After you run the command to specify the interface GigabitEthernet 1/0/0, clients can only connect to the interface GigabitEthernet 1/0/0.

Usage Scenario

Configure the listening port number of the SSH server to prevent from malicious access to the SSH service standard port and ensure security.

Precautions

The SSH client can log in successfully with no port specified only when the server is listening on port 22. If the server is listening on another port, the port number must be specified upon login.

Before changing the current port number, disconnect all devices from the port. After the port number is changed, the server starts to listen on the new port.

Usage Scenario

If the server key pair is not updated for a long time, the key is easy to decrypt and the server is insecure. After the interval for updating the SSH server key pair is set using this command, the system will automatically update the key pair at intervals.

Precautions

If the client is connected to the server, the server public key on the client is not updated immediately. This key is updated only when the client is reconnected to the server.

Usage Scenario

If you have not logged in successfully at the timeout interval for SSH connection authentication, the current connection is terminated to ensure security. You can run the display ssh server command to query the current timeout interval.

Precautions

The setting for the timeout interval takes effect upon next login.

Usage Scenario

If no source IP address is specified, the SSH server uses the source IP address specified by routes to send and receive packets. The source IP address must be configured for an interface with stable performance, such as the loopback interface. Using the loopback interface as the source IP address simplifies the ACL rule and security policy configuration. This shields the IP address differences and interface status impact, filters incoming and outgoing packets, and implements security authentication.

Precautions

• After the source IP address is specified for the SSH server, you must use the specified IP address to log in to the SSH server.
• If the configured source IP address does not exist on the SSH server, configure this IP address on the device and then restart the SSH service. Then you can log in to the device.
• If the SSH service has been enabled, the SSH service restarts after the ssh server-source command is executed.
• If the specified source interface has been bound to a VPN instance, the SSH server is automatically bound to the same VPN instance.

Usage Scenario

When an SSH client needs to log in to the SSH server in RSA or ECC mode, run this command to assign a public key to the client. If the client has been assigned keys, the latest assigned key takes effect.

Precautions

The newly configured public key takes effect upon next login.

If the user named user-name to whom a public key is assigned does not exist, the system automatically creates an SSH user named user-name and performs the configured authentication for the SSH user.

Usage Scenario

Table 4-35 describes the usage scenarios for different authentication modes.

Precautions

A new SSH user cannot log in to the SSH server unless being configured with an authentication mode. The newly configured authentication mode takes effect upon next login.

To change the default authentication mode for SSH users, run this command.

Usage Scenario

Logins through Telnet bring security risks because Telnet does not provide any authentication mechanism and data is transmitted using TCP in plain text. Compared with Telnet, SSH guarantees secure file transfer on a traditional insecure network by authenticating clients and encrypting data in bidirectional mode. The SSH protocol supports STelnet. You can run this command to use STelnet to log in to another device from the current device.

STelnet is a secure Telnet service. SSH users can use the STelnet service in the same way as the Telnet service.

When a fault occurs in the connection between the client and server, the client needs to detect the fault in real time and proactively release the connection. You need to set the interval for sending keepalive packets and the maximum number of times on the client that logs in to the server through STelnet.

• Interval for sending keepalive packets: If a client does not receive any packet within the specified interval, the client sends a keepalive packet to the server.
• Maximum number of times the server has no response: If the number of times that the server does not respond exceeds the specified value, the client proactively releases the connection.

Precautions

• Enable the STelnet service on the SSH server by stelnet server enable command, before connecting the SSH server by using the STelnet command.

• The SSH client can log in to the SSH server with no port specified only when the server is listening on port 22. If the server is listening on another port, the port number must be specified upon login.

• For security purposes, you are advised to use the AES128, AES128-CTR, AES192-CTR, AES256-CTR or SHA2_256 encryption algorithms instead.

Usage Scenario

To connect a client to the SSH server through STelnet, you must enable the STelnet service on the SSH server.

Prerequisites

The interfaces on the SSH server to which clients can connect have been specified by running the ssh server permit interface { { interface-type interface-number } &<1-5> | all } command. If no interface is specified, the STelnet service cannot be enabled.

Precautions

After you disable the STelnet service on the SSH server, all clients that have logged in through STelnet are disconnected.

Usage Scenario

Users are assigned one of 16 levels, and these levels correspond to command levels. After logging in to the device, users can use only the commands whose levels are equal to or lower than their user levels.

When a user is switched from a lower level to a higher level, the device requires the user to enter the authentication password for the higher user level to authenticate the user identity, preventing unauthorized users from logging in to the device. You can run the super password command to set an authentication password used to switch a user from a lower level to a higher level.

If the entered target user level is lower than or equal to the current user level, the system directly sets the entered user level as the target user level, and displays a message. If the target level is higher than the current user level, the system asks the user to enter the authentication password.

The password entered by a user is not displayed on the screen. If the user enters the correct password within three times, the system switches the user to the higher user level; otherwise, the user level remains unchanged.

Usage Scenario

If rights are reconfigured, you need to run the super command to switch a user from a lower level to a higher level. When a user is switched from a lower level to a higher level, the device authenticates the user identity to prevent unauthorized users from logging in to the device. Users at a higher level can run the super password command to set an authentication password used to switch a user from a lower level to a higher level, so that the device can authenticate the user identity.

Usage Scenario

If one or multiple devices on the network need to be configured and managed, you do not need to connect each device to your terminal for local maintenance. If you have learned the IP address of the device, you can run this command to log in to the device from your terminal for remote device configuration. By doing this, you can use one terminal to maintain multiple devices on the network.

You can press Ctrl_] to terminate an active connection between the local and remote devices.

Precautions

• Before you run the telnet command to connect to the Telnet server, the Telnet client and server must be able to communicate through Layer 3 and the Telnet service must be enabled on the Telnet server.

• Logins through Telnet bring security risks because Telnet does not provide any authentication mechanism and data is transmitted using TCP in plain text. The STelnet mode is recommended for the network that has the high security requirement.

Usage Scenario

If the source IP address and interface are not specified in the telnet command, use the default settings specified by telnet client-source. If the source IP address and interface are specified in the telnet command, use the specified settings. Check the current Telnet connection on the server. The IP address displayed is the specified source IP address or the primary IP address of the specified interface.

Precautions

If the specified source interface has been bound to a VPN instance, the client is automatically bound to the same VPN instance.

Usage Scenario

If no source IP address is specified, the Telnet server uses the source IP address specified by routes to send packets. The source IP address must be configured for an interface with stable performance, such as the loopback interface. Using the loopback interface as the source IP address simplifies the ACL rule and security policy configuration. This shields the IP address differences and interface status impact, filters incoming and outgoing packets, and implements security authentication.

Precautions

• After the source IP address is specified for the Telnet server, you must use the specified IP address to log in to the Telnet server.
• If the Telnet service has been enabled, the Telnet service restarts after the telnet server-source command is executed.
• If the specified source interface has been bound to a VPN instance, the server is automatically bound to the same VPN instance.

Usage Scenario

To prevent clients from connecting to the Telnet server through unauthorized interfaces, you can run the telnet server permit interface command to specify interfaces on the Telnet server to which clients can connect.

Precautions

• This command does not take effect on the MEth management interface. The Telnet server always allows clients to connect to it through the MEth management interface.
• By default, clients can connect to all interfaces on the Telnet server. Once a specific interface is specified using this command, a client cannot connect to the Telnet server through any other interface.
• A maximum of five interfaces can be specified using the telnet server permit interface { interface-type interface-number } &<1-5> command. The latest configuration overrides the previous one. For example, before you run this command, clients can connect to three interfaces GigabitEthernet 1/0/0, GigabitEthernet 2/0/0, and GigabitEthernet 3/0/0 on the Telnet server. After you run the command to specify the interface GigabitEthernet 1/0/0, clients can only connect to the interface GigabitEthernet 1/0/0.

• If no interface is specified on the Telnet server to allow clients to connect to the server, the Telnet service cannot be enabled.
• The undo telnet server permit interface command can be executed only after the Telnet service is disabled.

Usage Scenario

You can run this command to enable and disable the Telnet server function. A Telnet server can be connected only when the Telnet server function is enabled.

When the undo telnet [ ipv6 ] server enable command is executed to disable the Telnet server function, an online Telnet user goes offline because the Telnet service is disabled.

When the Telnet server function is disabled, you can log in to the device only through the console port or SSH.

STelnet V2 is more secure than Telnet, and is therefore recommended.

Prerequisites

The interfaces on the Telnet server to which clients can connect have been specified by running the telnet server permit interface { { interface-type interface-number } &<1-5> | all } command. If no interface is specified, the Telnet service cannot be enabled.

Usage Scenario

To protect the Telnet standard port against attacks and ensure network security, configure the listening port number of the Telnet server.

Precautions

A Telnet client can log in to the server with no port specified only when the server is listening on port 23. If the server is listening on another port, the port number must be specified upon login.

Before changing the current port number, disconnect all devices from the port. After the port number is changed, the server starts to listen on the new port.

Usage Scenario

By default, the device checks data redirected by a serial port and discards unidentifiable data, damaging the original data. You can run the transparent-mode enable command to ensure the original data integrity. The device will transparently transmit data without checking it.

Prerequisites

The redirection function has been enabled using the redirect enable command.

To ensure service security, the device locks the IP addresses of users who fail to log in to the device using SFTP, STelnet, Telnet, or FTP.

If a user enters an incorrect user name or password, the device adds the IP address of the user to the blacklist and locks the user for 5 seconds upon the first login failure, 10 seconds upon the second login failure, and 20 seconds upon the third login failure. If the user enters incorrect user names or passwords for five consecutive times, the device locks the user for 300 seconds upon the sixth login failures. When a user account is locked, the user's IP address cannot be used to set up a connection in a new window because it is in the blacklist. If the user enters the correct user name and password and logs in to the device successfully after the locking duration expires, the user's IP address will be removed from the blacklist and a recovery log is generated. If the login fails again, the user account will be locked for 300 seconds. A maximum of 32 IP addresses can be locked at the same time. If more than 32 IP addresses are added to the blacklist, a new IP address will overwrite the earliest one.

By default, the device locks a user's IP address after the user fails authentication. If you do not need to lock the IP address of a user after the user fails authentication, run the system lock type none command and delete the IP address from the blacklist as prompted. After the IP address locking function is disabled, if a user enters an incorrect user name and password when logging in to the device through Telnet, STelnet, FTP, or SFTP, the IP address of the user will not be added to the blacklist. That is, the IP address will not be locked.