CLI login:

Configuring CLI login

·     Console login

By default, console login is enabled and does not require authentication. The default user role is network-admin. To improve device security, configure password or scheme authentication for the AUX line immediately after you log in to the device for the first time.

Configuring console login

·     Telnet login

By default, Telnet login is disabled.

To enable Telnet login, perform the following tasks:

·     Enable the Telnet server feature.

·     Assign an IP address to a Layer 3 interface and make sure the interface and the Telnet client can reach each other.

·     Configure an authentication mode for VTY login users. By default, password authentication is used but no password is configured.

·     Assign a user role to VTY login users. By default, a VTY login user is assigned the network-operator user role.

Configuring Telnet login

·     SSH login

By default, SSH login is disabled.

To enable SSH login, perform the following tasks:

·     Enable the SSH server feature and configure SSH attributes.

·     Assign an IP address to a Layer 3 interface. Make sure the interface and the SSH client can reach each other.

·     Configure scheme authentication for VTY login users. By default, password authentication is used.

·     Assign a user role to VTY login users. By default, a VTY login user is assigned the network-operator user role.

Configuring SSH login

Web login

By default, Web login is disabled.

To enable Web login, perform the following tasks:

·     Assign an IP address to a Layer 3 interface. Make sure the interface and the Web user's host can reach each other.

·     Configure a local user account for Web login and assign a user role to the account. By default, the network-operator user role is assigned to the account.

·     Assign HTTP or HTTPS service to the user. By default, no service type is assigned to a local user.

Configuring Web login

SNMP access

By default, SNMP access is disabled.

To enable SNMP access, perform the following tasks:

·     Assign an IP address to a Layer 3 interface. Make sure the interface and the NMS can reach each other.

·     Configure SNMP basic parameters.

Accessing the device through SNMP

RESTful access

By default, RESTful access is disabled.

To enable RESTful access, perform the following tasks:

·     Assign an IP address to a Layer 3 interface. Make sure the interface and the RESTful access user's host can reach each other.

·     Enable RESTful access over HTTP or RESTful access over HTTPS.

·     Configure a local user account for RESTful access and assign a user role to the account. By default, the network-operator user role is assigned to the account.

·     Assign HTTP or HTTPS service to the user. By default, no service type is assigned to a local user.

Configuring RESTful access over HTTP

AUX line

Console port.

Virtual type terminal (VTY) line

Telnet or SSH.

None

Set the authentication mode to none.

Password

1.     Set the authentication mode to password.

2.     Set a password.

Scheme

1.     Set the authentication mode to scheme.

2.     Configure login authentication methods in ISP domain view. For more information, see Security Configuration Guide.

(Required.) Perform one of the following tasks:

·     Disabling authentication for console login

·     Configuring password authentication for console login

·     Configuring scheme authentication for console login

In FIPS mode, only the scheme authentication mode is supported.

(Optional.) Configuring common AUX line settings

N/A

1.     Enter system view.

system-view

N/A

2.     Enter AUX line view or class view.

·     Enter AUX line view:
line aux first-number [ last-number ]

·     Enter AUX line class view:
line class aux

A setting in user line view applies only to the user line. A setting in user line class view applies to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line class view does not take effect for current online users. It takes effect only for new login users.

3.     Disable authentication.

authentication-mode none

In non-FIPS mode, authentication is disabled for console login by default.

In FIPS mode, scheme authentication is enabled by default.

4.     Assign a user role.

user-role role-name

By default, a console user of the default MDC is assigned the network-admin user role. Non-default MDCs do not support console login.

1.     Enter system view.

system-view

N/A

2.     Enter AUX line view or class view.

·     Enter AUX line view:
line aux first-number [ last-number ]

·     Enter AUX line class view:
line class aux

A setting in user line view applies only to the user line. A setting in user line class view applies to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line class view does not take effect for current online users. It takes effect only for new login users.

3.     Enable password authentication.

authentication-mode password

In non-FIPS mode, authentication is disabled for console login by default.

In FIPS mode, scheme authentication is enabled by default.

4.     Set a password.

set authentication password { hash | simple } password

By default, no password is set.

5.     Assign a user role.

user-role role-name

By default, a console user of the default MDC is assigned the network-admin user role. Non-default MDCs do not support console login.

1.     Enter system view.

system-view

N/A

2.     Enter AUX line view or class view.

·     Enter AUX line view:
line aux first-number [ last-number ]

·     Enter AUX line class view:
line class aux

A setting in user line view applies only to the user line. A setting in user line class view applies to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line class view does not take effect for current online users. It takes effect only for new login users.

3.     Enable scheme authentication.

authentication-mode scheme

In non-FIPS mode, authentication is disabled for console login by default.

In FIPS mode, scheme authentication is enabled by default.

1.     Enter system view.

system-view

N/A

2.     Enter AUX line view or class view.

·     Enter AUX line view:
line aux first-number [ last-number ]

·     Enter AUX line class view:
line class aux

A setting in user line view applies only to the user line. A setting in user line class view applies to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line class view does not take effect for current online users. It takes effect only for new login users.

3.     Set the transmission rate.

speed speed-value

By default, the transmission rate is 9600 bps.

This command is not available in AUX or console line class view.

4.     Specify the parity.

parity { even | mark | none | odd | space }

By default, a user line does not use parity.

This command is not available in AUX line class view.

5.     Specify the number of stop bits for a character.

stopbits { 1 | 1.5 | 2 }

The default is 1.

Stop bits indicate the end of a character. The more the stop bits, the slower the transmission.

This command is not available in AUX line class view.

6.     Specify the number of data bits for a character.

databits { 5 | 6 | 7 | 8 }

The default is 8.

Configure this command depending on the character coding type. For example, set the number of data bits to 7 for standard ASCII characters. Set the number of data bits to 8 for extended ASCII characters.

Keywords 5 and 6 are not supported in the current software version.

This command is not available in AUX line class view.

7.     Specify the terminal session activation key.

activation-key character

By default, pressing Enter starts the terminal session.

8.     Specify the escape key.

escape-key { character | default }

By default, pressing Ctrl+C terminates a command.

9.     Set the user line locking key.

lock-key key-string

By default, no user line locking key is set.

10.     Configure the flow control mode.

flow-control { hardware | none | software }

By default, flow control is disabled.

This command is not available in AUX line class view.

11.     Specify the terminal display type.

terminal type { ansi | vt100 }

By default, the terminal display type is ANSI.

The device supports ANSI and VT100 terminal display types. As a best practice, specify VT100 type on both the device and the configuration terminal. If either side uses the ANSI type, a display problem might occur when a command line has more than 80 characters. For example, a cursor positioning error might occur.

12.     Set the maximum number of lines of command output to send to the terminal at a time.

screen-length screen-length

By default, the device sends up to 24 lines to the terminal at a time when pausing between screens of output is enabled.

To disable pausing between screens of output, set the value to 0.

13.     Set the size for the command history buffer.

history-command max-size value

By default, the buffer saves up to 10 history commands.

14.     Set the CLI connection idle-timeout timer.

idle-timeout minutes [ seconds ]

By default, the CLI connection idle-timeout timer is 10 minutes.

If no interaction occurs between the device and the user within the idle-timeout interval, the system automatically terminates the user connection on the user line.

If you set the timeout timer to 0, the connection will not be aged out.

15.     Enable the terminal service.

shell

Be default, the terminal service is enabled on all user lines.

The undo shell command is not supported in AUX line view.

(Required.) Enabling Telnet server

(Required.) Perform one of the following tasks:

·     Disabling authentication for Telnet login

·     Configuring password authentication for Telnet login

·     Configuring scheme authentication for Telnet login

(Optional.) Setting the maximum number of concurrent Telnet users

(Optional.) Setting the DSCP value for outgoing Telnet packets

(Optional.) Specifying the Telnet service port number

(Optional.) Configuring common VTY line settings

1.     Enter system view.

system-view

N/A

2.     Enable the Telnet server.

telnet server enable

By default, the Telnet server is disabled.

1.     Enter system view.

system-view

N/A

2.     Enter VTY line view or class view.

·     Enter VTY line view:
line vty first-number [ last-number ]

·     Enter VTY line class view:
line class vty

A setting in user line view applies only to the user line. A setting in user line class view applies to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line class view does not take effect for current online users. It takes effect only for new login users.

3.     Disable authentication.

authentication-mode none

In non-FIPS mode, password authentication is enabled for VTY lines by default.

In VTY line view, this command is associated with the protocol inbound command. If you specify a non-default value for one of the two commands, the other command uses the default setting, regardless of the setting in VTY line class view.

4.     (Optional.) Assign a user role.

user-role role-name

By default, a VTY line user of the default MDC is assigned the network-operator user role. A VTY line user of a non-default MDC is assigned the mdc-operator user role.

1.     Enter system view.

system-view

N/A

2.     Enter VTY line view or class view.

·     Enter VTY line view:
line vty first-number [ last-number ]

·     Enter VTY line class view:
line class vty

A setting in user line view applies only to the user line. A setting in user line class view applies to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line class view does not take effect for current online users. It takes effect only for new login users.

3.     Enable password authentication.

authentication-mode password

In non-FIPS mode, password authentication is enabled for VTY lines by default.

In VTY line view, this command is associated with the protocol inbound command. If you specify a non-default value for one of the two commands, the other command uses the default setting, regardless of the setting in VTY line class view.

4.     Set a password.

set authentication password { hash | simple } password

By default, no password is set.

5.     (Optional.) Assign a user role.

user-role role-name

By default, a VTY line user of the default MDC is assigned the network-operator user role. A VTY line user of a non-default MDC is assigned the mdc-operator user role.

1.     Enter system view.

system-view

N/A

2.     Enter VTY line view or class view.

·     Enter VTY line view:
line vty first-number [ last-number ]

·     Enter VTY line class view:
line class vty

A setting in user line view applies only to the user line. A setting in user line class view applies to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line class view does not take effect for current online users. It takes effect only for new login users.

3.     Enable scheme authentication.

authentication-mode scheme

In non-FIPS mode, password authentication is enabled for VTY lines by default.

In VTY line view, this command is associated with the protocol inbound command. If you specify a non-default value for one of the two commands, the other command uses the default setting, regardless of the setting in VTY line class view.

1.     Enter system view.

system-view

N/A

2.     Set the maximum number of concurrent Telnet users.

aaa session-limit telnet max-sessions

The default is 32.

Changing this setting does not affect users who are currently online. If the new limit is less than the number of online Telnet users, no additional users can Telnet in until the number drops below the new limit.

For more information about this command, see Security Command Reference.

1.     Enter system view.

system-view

N/A

2.     Set the DSCP value for outgoing Telnet packets.

·     For a Telnet server running IPv4:
telnet server dscp dscp-value

·     For a Telnet server running IPv6:
telnet server ipv6 dscp dscp-value

By default, the DSCP value is 48.

1.     Enter system view.

system-view

N/A

2.     Specify the Telnet service port number.

·     In an IPv4 network:
telnet server port port-number

·     In an IPv6 network:
telnet server ipv6 port port-number

By default, the Telnet service port number is 23.

1.     Enter system view.

system-view

N/A

2.     Enter VTY line view or class view.

·     Enter VTY line view:
line vty first-number [ last-number ]

·     Enter VTY line class view:
line class vty

A setting in user line view applies only to the user line. A setting in user line class view applies to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line class view does not take effect for current online users. It takes effect only for new login users.

3.     Enable the terminal service.

shell

By default, the terminal service is enabled on all user lines.

4.     Specify the supported protocols.

protocol inbound { all | ssh | telnet }

By default, Telnet and SSH are supported.

A protocol change does not take effect for current online users. It takes effect only for new login users.

In VTY line view, this command is associated with the authentication-mode command. If you specify a non-default value for one of the two commands, the other command uses the default setting, regardless of the setting in VTY line class view.

5.     Specify the shortcut key for terminating a task.

escape-key { character | default }

The default setting is Ctrl+C.

6.     Set the user line locking key.

lock-key key-string

By default, no user line locking key is set.

7.     Specify the terminal display type.

terminal type { ansi | vt100 }

The default terminal display type is ANSI.

8.     Set the maximum number of lines of command output to send to the terminal at a time.

screen-length screen-length

By default, the device sends up to 24 lines to the terminal at a time when pausing between screens of output is enabled.

To disable pausing between screens of output, set the value to 0.

9.     Set the size for the command history buffer.

history-command max-size value

The default size is 10 history commands.

10.     Set the CLI connection idle-timeout timer.

idle-timeout minutes [ seconds ]

By default, the CLI connection idle-timeout timer is 10 minutes.

If no interaction occurs between the device and the user within the idle-timeout interval, the system automatically terminates the user connection on the user line.

If you set the timeout timer to 0, the connection will not be aged out.

11.     Specify the command to be automatically executed for login users on the user lines.

auto-execute command command

By default, no command is specified for auto execution.

 IMPORTANT:

Before you configure this command and save the configuration, make sure you can access the CLI to modify the configuration through other VTY user lines or AUX user lines.

1.     Enter system view.

system-view

N/A

2.     (Optional.) Specify the source IPv4 address or source interface for outgoing Telnet packets.

telnet client source { interface interface-type interface-number | ip ip-address }

By default, no source IPv4 address or source interface is specified. The device uses the primary IPv4 address of the output interface as the source address for outgoing Telnet packets.

3.     Exit to user view.

quit

N/A

4.     Use the device to log in to a Telnet server.

·     Log in to an IPv4 Telnet server:
telnet remote-host [ service-port ] [ vpn-instance vpn-instance-name ] [ source { interface interface-type interface-number | ip ip-address } | dscp dscp-value ] *

·     Log in to an IPv6 Telnet server:
telnet ipv6 remote-host [ -i interface-type interface-number ] [ port-number ] [ vpn-instance vpn-instance-name ] [ source { interface interface-type interface-number | ipv6 ipv6-address } | dscp dscp-value ] *

N/A

1.     Enter system view.

system-view

N/A

2.     Create local key pairs.

·     In non-FIPS mode:
public-key local create { dsa | ecdsa [ secp192r1 | secp256r1 | secp384r1 ] | rsa } [ name key-name ]

·     In FIPS mode:
public-key local create { dsa | ecdsa [ secp256r1 | secp384r1 ] | rsa } [ name key-name ]

By default, no local key pairs are created.

3.     Enable the Stelnet server.

ssh server enable

By default, the Stelnet server is disabled.

4.     (Optional.) Create an SSH user and specify the authentication mode.

·     In non-FIPS mode:
ssh user username service-type stelnet authentication-type { password | { any | password-publickey | publickey } assign publickey keyname }

·     In FIPS mode:
ssh user username service-type stelnet authentication-type { password | password-publickey assign publickey keyname }

By default, no SSH user is configured on the device.

5.     Enter VTY line view or class view.

·     Enter VTY line view:
line vty first-number [ last-number ]

·     Enter VTY line class view:
line class vty

A setting in user line view applies only to the user line. A setting in user line class view applies to all user lines of the class.

A non-default setting in either view takes precedence over a default setting in the other view. A non-default setting in user line view takes precedence over a non-default setting in user line class view.

A setting in user line class view does not take effect for current online users. It takes effect only for new login users.

6.     Enable scheme authentication.

authentication-mode scheme

In non-FIPS mode, password authentication is enabled for VTY lines by default.

In FIPS mode, scheme authentication is enabled for VTY lines by default.

In VTY line view, this command is associated with the protocol inbound command. If you specify a non-default value for one of the two commands, the other command uses the default setting, regardless of the setting in VTY line class view.

7.     (Optional.) Specify the protocols for the user lines to support.

·     In non-FIPS mode:
protocol inbound { all | ssh | telnet }

·     In FIPS mode:
protocol inbound ssh

In non-FIPS mode, Telnet and SSH are supported by default.

In FIPS mode, SSH is supported by default.

A protocol change does not take effect for current online users. It takes effect only for new login users.

In VTY line view, this command is associated with the authentication-mode command. If you specify a non-default value for one of the two commands, the other command uses the default setting, regardless of the setting in VTY line class view.

8.     (Optional.) Set the maximum number of concurrent SSH users.

aaa session-limit ssh max-sessions

The default is 32.

Changing this setting does not affect users who are currently online. If the new limit is less than the number of online SSH users, no additional SSH users can log in until the number drops below the new limit.

For more information about this command, see Security Command Reference.

9.     Exit to system view.

quit

N/A

10.     (Optional.) Configure common settings for VTY lines.

See "Configuring common VTY line settings."

N/A

Log in to an IPv4 SSH server.

ssh2 server

Log in to an IPv6 SSH server.

ssh2 ipv6 server

Display online CLI users.

display users [ all ]

N/A

Display user line information.

display line [ num1 | { aux | vty } num2 ] [ summary ]

N/A

Display the packet source setting for the Telnet client.

display telnet client

N/A

Release a user line.

free line { num1 | { aux | vty } num2 }

Multiple users can log in to the device to simultaneously configure the device. When necessary, you can execute this command to release some connections.

You cannot use this command to release the connection you are using.

This command is available in user view.

Lock the current user line and set the password for unlocking the line.

lock

By default, the system does not lock any user lines.

This command is not supported in FIPS mode.

This command is available in user view.

Lock the current user line and enable unlocking authentication.

lock reauthentication

By default, the system does not lock any user lines or initiate reauthentication.

To unlock the locked user line, you must press Enter and provide the login password to pass reauthentication.

This command is available in any view.

Send messages to user lines.

send { all | num1 | { aux | vty } num2 }

This command is available in user view.

1.     (Optional.) Specify a fixed verification code for Web login.

web captcha verification-code

By default, no fixed verification code is configured. A Web user must enter the verification code displayed on the login page at login.

2.     Enter system view.

system-view

N/A

3.     Enable the HTTP service.

ip http enable

By default, the HTTP service is disabled.

4.     (Optional.) Specify the HTTP service port number.

ip http port port-number

The default HTTP service port number is 80.

5.     (Optional.) Set the Web connection idle-timeout timer.

web idle-timeout minutes

N/A

6.     (Optional.) Specify the maximum number of online HTTP users.

aaa session-limit http max-sessions

The default is 32.

Changing this setting does not affect users who are currently online. If the new setting is less than the number of online HTTP users, no additional HTTP users can log in until the number drops below the new limit.

For more information about this command, see Security Command Reference.

7.     (Optional.) Enable Web operation logging.

webui log enable

By default, Web operation logging is disabled.

8.     Create a local user and enter local user view.

local-user user-name [ class manage ]

By default, no local user is configured.

9.     Configure a password for the local user.

·     In non-FIPS mode:
password [ { hash | simple } password ]

·     In FIPS mode:
password

A password is saved in hashed form.

By default, no password is configured for a local user.

·     In non-FIPS mode, the local user can pass authentication after entering the correct username and passing attribute checks.

·     In FIPS mode, the local user cannot pass authentication.

For security purposes, configure a password for the local user.

10.     Assign a user role to the local user.

authorization-attribute user-role user-role

The default user role is network-operator for a Web user.

11.     Specify the HTTP service for the local user.

service-type http

By default, no service type is specified for a local user.

1.     (Optional.) Specify a fixed verification code for Web login.

web captcha verification-code

By default, no fixed verification code is configured. A Web user must enter the verification code displayed on the login page at login.

2.     Enter system view.

system-view

N/A

3.     (Optional.) Apply an SSL server policy to control HTTPS access.

ip https ssl-server-policy policy-name

By default, no SSL server policy is applied. The HTTP service uses a self-signed certificate.

Disabling the HTTPS service removes the SSL service policy application. To enable the HTTPS service again, you must reconfigure this command again.

If the HTTPS service has been enabled, any changes to the associated SSL server policy do not take effect. For the changes to take effect, you must disable HTTP and HTTPS, and then apply the policy and enable HTTP and HTTPS again.

4.     Enable the HTTPS service.

ip https enable

By default, HTTPS is disabled.

Enabling the HTTPS service triggers the SSL handshake negotiation process.

·     If the device has a local certificate, the SSL handshake negotiation succeeds and the HTTPS service starts up.

·     If the device does not have a local certificate, the certificate application process starts. Because the certificate application process takes a long time, the SSL handshake negotiation might fail and the HTTPS service might not be started. To solve the problem, execute this command again until the HTTPS service is enabled.

5.     (Optional.) Apply a certificate-based access control policy to control HTTPS access.

ip https certificate access-control-policy policy-name

By default, no certificate-based access control policy is applied for HTTPS access control.

For clients to log in through HTTPS, you must configure the client-verify enable command and a minimum of one permit rule in the associated SSL server policy.

For more information about certificate-based access control policies, see the chapter on PKI in Security Configuration Guide.

6.     (Optional.) Specify the HTTPS service port number.

ip https port port-number

The default HTTPS service port number is 443.

7.     (Optional.) Set the HTTPS login authentication mode.

web https-authorization mode { auto | manual }

By default, manual authentication mode is used for HTTPS login.

8.     (Optional.) Set the Web connection idle-timeout timer.

web idle-timeout minutes

N/A

9.     (Optional.) Specify the maximum number of online HTTPS users.

aaa session-limit https max-sessions

The default is 32.

Changing this setting does not affect users who are currently online. If the new setting is less than the number of online HTTPS users, no additional HTTPS users can log in until the number drops below the new limit.

For more information about this command, see Security Command Reference.

10.     (Optional.) Enable Web operation logging.

webui log enable

By default, Web operation logging is disabled.

11.     Create a local user and enter local user view.

local-user user-name [ class manage ]

By default, no local user is configured.

12.     Configure a password for the local user.

·     In non-FIPS mode:
password [ { hash | simple } password ]

·     In FIPS mode:
password

The password is saved in hashed form.

By default, no password is configured for a local user.

·     In non-FIPS mode, the local user can pass authentication after entering the correct username and passing attribute checks.

·     In FIPS mode, the local user cannot pass authentication.

For security purposes, configure a password for the local user.

13.     Assign a user role to the local user.

authorization-attribute user-role user-role

The default user role is network-operator for a Web user.

14.     Specify the HTTPS service for the local user.

service-type https

By default, no service type is specified for a local user.

Display online Web users.

display web users

Display Web interface navigation tree information.

display web menu [ chinese ]

Display HTTP service configuration and status information.

display ip http

Display HTTPS service configuration and status information.

display ip https

Log off online Web users.

free web users { all | user-id user-id | user-name user-name }

1.     Enter system view.

system-view

N/A

2.     Enable RESTful access over HTTP.

restful http enable

By default, RESTful access over HTTP is disabled.

3.     Create a local user and enter local user view.

local-user user-name [ class manage ]

By default, no local user is configured.

4.     Configure a password for the local user.

password [ { hash | simple } password ]

The password is saved in hashed form.

By default, no password is configured for a local user.

5.     (Optional.) Assign a user role to the local user.

authorization-attribute user-role user-role

The default user role is network-operator for a RESTful access user.

6.     Specify the HTTP service for the local user.

service-type http

By default, no service type is specified for a local user.

1.     Enter system view.

system-view

N/A

2.     Enable RESTful access over HTTPS.

restful https enable

By default, RESTful access over HTTPS is disabled.

3.     Create a local user and enter local user view.

local-user user-name [ class manage ]

By default, no local user is configured.

4.     Configure a password for the local user.

·     In non-FIPS mode:
password [ { hash | simple } password ]

·     In FIPS mode:
password

The password is saved in hashed form.

By default, no password is configured for a local user.

5.     (Optional.) Assign a user role to the local user.

authorization-attribute user-role user-role

The default user role is network-operator for a RESTful access user.

6.     Specify the HTTPS service for the local user.

service-type https

By default, no service type is specified for a local user.

1.     Enter system view.

system-view

N/A

2.     Apply an ACL to filter Telnet logins.

·     telnet server acl [ mac ] acl-number

·     telnet server ipv6 acl { ipv6 | mac } acl-number

By default, no ACL is used to filter Telnet logins.

3.     (Optional.) Enable logging for Telnet login attempts that are denied by the Telnet login control ACL.

telnet server acl-deny-log enable

By default, logging is disabled for Telnet login attempts that are denied by the Telnet login control ACL.

1.     Enter system view.

system-view

N/A

2.     Apply an ACL to filter SSH logins.

·     ssh server acl [ mac ] acl-number

·     ssh server ipv6 acl { ipv6 | mac } acl-number

By default, no ACL is used to filter SSH logins.

For more information about these two commands, see Security Command Reference.

3.     (Optional.) Enable logging for SSH login attempts that are denied by the SSH login control ACL.

ssh server acl-deny-log enable

By default, logging is disabled for SSH login attempts that are denied by the SSH login control ACL.

For more information about this command, see Security Command Reference.

1.     Enter system view.

system-view

N/A

2.     Apply a basic ACL for Web access control.

·     ip http acl { acl-number | name acl-name }

·     ip https acl { acl-number | name acl-name }

By default, no ACL is applied to the HTTP or HTTPS service.

Log off online Web users.

free web-users { all | user-id user-id | user-name user-name }