H3C S5500-EI & S5500-SI Switch SeriesSecurity Configuration GuideHangzhou H3C Technologies Co., Ltd.http://www.h3c.comSoftware version: Release 2220Document version: 6W100-20130527

H3C S5500-EI Series Security Configuration Manual

Chapter 1 SSH Configuration

Asymmetric Key Algorithm

Configuring the Device as an SSH Server

Configuring RSA and DSA Keys

Configuring a Client Public Key

Configuring an SSH User

Setting the SSH Management Parameters

Configuring the Device as an SSH Client

Establishing a Connection Between the SSH Client and the Server

SSH Server Configuration Examples

When Using Publickey Authentication

SSH Client Configuration Examples

Chapter 2 SFTP Service

Configuring the SFTP Connection Idle Timeout Period

Establishing a Connection to the SFTP Server

Working with SFTP Files

Displaying Help Information

Terminating the Connection to the Remote SFTP Server

S5500-EI series

about this manual

chapter 1 obtaining the documentation

software version release

chapter 2 documentation and product version

chapter 3 product overview

chapter 4 networking applications

chapter 1 logging in to an ethernet switch

common user interface configuration

chapter 2 logging in through the console port

console port login configuration

console port login configurations for different authentication modes

console port login configuration with authentication mode being none

configuration example

console port login configuration with authentication mode being password

console port login configuration with authentication mode being scheme

chapter 3 logging in through telnet

telnet configurations for different authentication modes

telnet configuration with authentication mode being none

telnet configuration with authentication mode being password

telnet configuration with authentication mode being scheme

telnet connection establishment

telnetting to another switch from the current switch

chapter 4 logging in using modem

switch configuration

modem connection establishment

http connection establishment

web server shutdown/startup

displaying web users

chapter 6 logging in through nms

configuring source ip address for telnet service packets

displaying the source ip address/interface specified for telnet packets

chapter 8 controlling login users

controlling telnet users by source and destination ip addresses

controlling telnet users by source mac addresses

controlling network management users by source ip addresses

controlling web users by source ip address

disconnecting a web user by force

chapter 1 vlan configuration

vlan fundamental

vlan classification

basic vlan interface configuration

port-based vlan configuration

configuring an access-port-based vlan

configuring a trunk-port-based vlan

configuring a hybrid-port-based vlan

mac address-based vlan configuration

configuring a mac address-based vlan

protocol-based vlan configuration

configuring ip-subnet-based vlan

displaying and maintaining vlan

vlan configuration example

chapter 2 voice vlan configuration

voice vlan modes on a port

security mode and normal mode for the voice vlan

configuring voice vlan

configuring voice vlan mode on a port to manual mode

displaying and maintaining voice vlan

voice vlan configuration examples

manual voice vlan mode configuration example

chapter 3 gvrp configuration

protocols and standards

configuring garp timers

displaying and maintaining gvrp

gvrp configuration examples

gvrp configuration example ii

gvrp configuration example iii

chapter 1 ip addressing configuration

special case ip addresses

configuring ip addresses

assigning an ip address to an interface

ip addressing configuration example

displaying and maintaining ip addressing

chapter 2 ip performance configuration

enabling forwarding of directed broadcasts to a directly connected network

configuring tcp attributes

displaying and maintaining ip performance

chapter 1 qinq configuration

implementations of qinq

modification of tpid value of qinq frames

configuring basic qinq

configuring the tpid value to be carried in vlan tags

qinq configuration example

chapter 2 bpdu tunneling configuration

configuring bpdu isolation

configuring destination multicast mac address for bpdu tunnel frames

bpdu tunneling configuration example

chapter 1 port correlation configuration

command conventions

obtaining documentation

documentation feedback

IP routing basics

load sharing

Static routing configuration

configuring a static route

configuring bfd for static routes

BFD echo packet mode

Displaying and maintaining static routes

Static route configuration examples

Static route FRR configuration example

BFD for static routes configuration example (direct session)

BFD for static routes configuration example (indirect session)

RIP overview

Operation of RIP

RIP message format

Supported RIP features

Protocols and standards

Configuring RIP basic functions

Configuring RIP route control

Disabling host route reception

Advertising a default route

Configuring a priority for RIP

Tuning and optimizing RIP networks

Configuring the maximum number of load balanced routes

Enabling source IP address check on incoming RIP updates

Specifying a RIP neighbor

Configuring RIP FRR

Configuring BFD for RIP

Displaying and maintaining RIP

Configuring RIP route redistribution

Configuring an additional metric for a RIP interface

Configuring RIP to advertise a summary route

RIP FRR configuration example

Configuring BFD for RIP (single-hop detection in BFD echo packet mode)

Configuring BFD for RIP (bidirectional detection in BFD control packet mode)

configure static routes

Troubleshooting RIP

Introduction to OSPF

Area based OSPF network partition

Router types

Classification of OSPF networks

dr and bdr

OSPF packet formats

Supported features

Enabling OSPF

Configuration procedure

Configuring OSPF areas

Configuring an NSSA area

Configuring OSPF network types

Configuring the OSPF network type for an interface as broadcast

Configuring the OSPF network type for an interface as P2MP

Configuring OSPF route control

Configuring OSPF inbound route filtering

Configuring ABR Type-3 LSA filtering

Configuring the maximum number of OSPF routes

Configuring OSPF route redistribution

Advertising a host route

Configuration prerequisites

Specifying LSA transmission delay

Specifying the LSA generation interval

Configuring stub routers

Adding the interface MTU into DD packets

Logging neighbor state changes

Enabling message logging

Configuring the LSU transmit rate

Configuring OSPF Graceful Restart

Configuring the OSPF GR Helper

Triggering OSPF Graceful Restart

Displaying and maintaining OSPF

ospf configuration examples

configuring ospf to advertise a summary route

configuring an ospf stub area

configuring an ospf nssa area

configuring ospf dr election

configuring ospf virtual links

configuring route filtering

configuring ospf frr

configuring bfd for ospf

troubleshooting ospf configuration

IS-IS configuration

configuring the is level and circuit level

configuring the network type of an interface as p2p

configuring the maximum number of equal cost routes

configuring a dis priority for an interface

enabling an interface to send small hello packets

configuring spf parameters

configuring system id to host name mappings

enabling the logging of neighbor state changes

configuring area authentication