H3C Intrusion Prevention System. Command Reference. Hangzhou H3C Technologies Co., Ltd. Document Version: 5PW

Transcription

1 H3C Intrusion Prevention System Command Reference Hangzhou H3C Technologies Co., Ltd. Document Version: 5PW

2 Copyright , Hangzhou H3C Technologies Co., Ltd. and its licensors All Rights Reserved No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of Hangzhou H3C Technologies Co., Ltd. Trademarks H3C,, Aolynk,, H 3 Care,, TOP G,, IRF, NetPilot, Neocean, NeoVTL, SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V 2 G, V n G, PSPT, XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co., Ltd. All other trademarks that may be mentioned in this manual are the property of their respective owners. Notice The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied.

3 Preface The H3C Intrusion Prevention System Command Reference describes the commands and command syntax options available for the H3C Intrusion Prevention System. This preface includes: Audience Conventions About the H3C Intrusion Prevention System Documentation Set Obtaining Documentation Technical Support Documentation Feedback Audience This documentation is intended for: Network planners Field technical support and servicing engineers Network administrators working with the H3C Intrusion Prevention System Conventions This section describes the conventions used in this documentation set. Command conventions Convention Boldface italic [ ] { x y... } [ x y... ] { x y... } * [ x y... ] * &<1-n> Bold text represents commands and keywords that you enter literally as shown. Italic text represents arguments that you replace with actual values. Square brackets enclose syntax choices (keywords or arguments) that are optional. Braces enclose a set of required syntax choices separated by vertical bars, from which you select one. Square brackets enclose a set of optional syntax choices separated by vertical bars, from which you select one or none. Asterisk marked braces enclose a set of required syntax choices separated by vertical bars, from which you select at least one. Asterisk marked square brackets enclose optional syntax choices separated by vertical bars, from which you may select multiple choices or none. The argument or keyword and argument combination before the ampersand (&) sign can be entered 1 to n times. # A line that starts with a pound (#) sign is comments.

4 GUI conventions Boldface > Convention Window names, button names, field names, and menu items are in Boldface. For example, the New User window appears; click OK. Multi-level menus are separated by angle brackets. For example, File > Create > Folder. Symbols Convention Means reader be extremely careful. Improper operation may cause bodily injury. Means reader be careful. Improper operation may cause data loss or damage to equipment. Means an action or information that needs special attention to ensure successful configuration or good performance. Means a complementary description. Means techniques helpful for you to make configuration with ease. About the H3C Intrusion Prevention System Documentation Set To view the H3C Intrusion Prevention System documentation set, go to the H3C SecBlade IPS Cards Documentation Navigator. Product H3C SecBlade IPS Cards Navigator H3C SecBlade IPS Cards Documentation Navigator Obtaining Documentation You can access the most up-to-date H3C product documentation on the World Wide Web at Click the links on the top navigation bar to obtain different categories of product documentation: [Technical Support & Documents > Technical Documents] Provides hardware installation, software upgrading, and software feature configuration and maintenance documentation. [Products & Solutions] Provides information about products and technologies, as well as solutions. [Technical Support & Documents > Software Download] Provides the documentation released with the software version. Technical Support customer_service@h3c.com

5 Documentation Feedback You can your comments about product documentation to We appreciate your comments.

6 Table of Contents 1 Common Network Application Commands 1-1 Common Network Application Commands 1-1 network icmp echo-reply disable 1-1 ping 1-1 ssh service 1-4 telnet service Interface Management Commands 2-1 Interface Management Commands 2-1 combo enable 2-1 display interface 2-1 duplex 2-2 interface 2-3 ip address 2-3 reset counters interface 2-4 shutdown 2-5 speed Static Routing Configuration Commands 3-1 Static Routing Configuration Commands 3-1 display ip route-static 3-1 ip route-static Device Management Commands 4-1 Device Management Commands 4-1 boot-loader 4-1 bootimage upgrade 4-1 display boot-loader 4-2 display cpu-usage 4-2 display device 4-3 display environment 4-4 display fan 4-4 display memory 4-5 display power 4-5 reboot 4-6 temperature-limit Basic System Configuration Commands 5-1 Basic System Configuration Commands 5-1 clock datetime 5-1 collect diag_info 5-1 clock timezone 5-2 display clock 5-2 display history-command 5-3 i

7 display idle-timeout 5-3 display version 5-4 help 5-4 idle-timeout 5-5 list 5-5 password 5-6 quit 5-6 reset web-admin-user-password 5-7 return 5-7 sysname 5-8 system-view 5-8 terminal rows Encrypted P2P Traffic Identification Configuration Commands 6-1 Encrypted P2P Traffic Identification Configuration Commands 6-1 display p2p 6-1 p2p enable Command Index 7-1 ii

8 1 Common Network Application Commands Common Network Application Commands network icmp echo-reply disable network icmp echo-reply disable undo network icmp echo-reply disable System view Use the network icmp echo-reply disable command to disable the management interface of the device from sending ICMP echo replies so that other network devices cannot ping the management interface. Use the undo network icmp echo-reply disable command to enable the management interface of the device to send ICMP echo replies. By default, the management interface of the device can send ICMP echo replies. # Disable the management interface of the device from sending ICMP echo replies. ping [Sysname] network icmp echo-reply disable ping [ -Q tos -R -b -c count -f -i interval -n -p pad -q -s packet-size -t ttl -v -w timeout ] ip-address User view, system view -Q tos: Specifies the type of service (ToS) value of the ICMP echo requests, in the range 0 to 255. The default value is 0. -R: Records routes. By default, routes are not recorded. -b: Permits broadcast addresses. -c count: Specifies the number of ICMP echo requests to be sent, in the range 1 to The default value is

9 -f: Drops packets larger than the interface MTU. This means that the ICMP echo requests are not allowed to be fragmented. -i interval: Specifies the interval (in seconds) to send ICMP echo requests, in the range 1 to 255. The default value is 1. -n: Resolves the destination IP address, that is, searches the host name according to the host address. If the system obtains the host name of the IP address, it displays the host name in the ping command output. By default, the system does not resolve the destination IP addresses. -p pad: Specifies the padding string for the ICMP echo requests to be sent. It consists of 1 to 8 hexadecimal numbers and ranges from 0 to ffffffff. If its length is less than 8, one or more zeros will be added to the beginning so that it consists of 8 hexadecimals. For example, if you specify it as 0x2f, 0x f will be used for padding the ICMP echo requests. The padding string will be used partly (starting from the left most hexadecimal) and/or repeatedly as required so that the length of a request meets the requirement. By default, the padded bytes start from 0x01 up to 0xff, in the form of 0x feff01, where another round starts again if necessary until the total length of the ICMP echo request meets the requirement. -q: Displays only the statistics. By default, the system displays all information including the statistics information. -s packet-size: Specifies the length (in bytes) of the ICMP echo request (excluding the IP header and ICMP header), in the range 20 to The default value is 56. -t ttl: Specifies the TTL value for the ICMP echo request, in the range 1 to 255. The default value is 64. -v: Displays the details. -w timeout: Specifies the timeout time (in seconds) of ICMP echo replies, in the range of 0 to 60. ip-address: Destination IP address, in dotted decimal notation. Use the ping command to check whether a host is reachable and display the related statistics. To terminate the ping operation, press Ctrl+C. # Check whether the device with an IP address of is reachable. <Sysname> ping PING ( ) 56(84) bytes of data. 64 bytes from : icmp_seq=1 ttl=128 time=0.186 ms 64 bytes from : icmp_seq=2 ttl=128 time=0.844 ms 64 bytes from : icmp_seq=3 ttl=128 time=0.841 ms 64 bytes from : icmp_seq=4 ttl=128 time=0.171 ms ping statistics packets transmitted, 4 received, 0% packet loss, time 3001ms rtt min/avg/max/mdev = 0.171/0.510/0.844/0.332 ms The output above shows that the destination host is reachable, all the probe packets that the source device sends were replied, and the minimum, average, and maximum round trip time (RTT) are ms, ms, and ms respectively. # Check whether the device with an IP address of is reachable, and specify to display only the check result. [Sysname]ping -q

10 PING ( ) 56(84) bytes of data ping statistics packets transmitted, 4 received, 0% packet loss, time 2997ms rtt min/avg/max/mdev = 0.191/0.214/0.248/0.023 ms # Check whether the device with an IP address of is reachable, and specify to display the routing information. [Sysname]ping -R PING ( ) 56(124) bytes of data. 64 bytes from : icmp_seq=1 ttl=128 time=0.452 ms NOP RR: bytes from : icmp_seq=2 ttl=128 time=0.359 ms NOP (same route) 64 bytes from : icmp_seq=3 ttl=128 time=0.346 ms NOP (same route) 64 bytes from : icmp_seq=4 ttl=128 time=0.364 ms NOP (same route) ping statistics packets transmitted, 4 received, 0% packet loss, time 2997ms rtt min/avg/max/mdev = 0.346/0.380/0.452/0.044 ms The output shows that there is a route available between the local device and the device with an IP address of , and the route passes Table 1-1 ping command output description Field PING (84) bytes of data 64 bytes from : icmp_seq=1 ttl=128 time=0.186 ms RR: (same route) Check whether the device with an IP address of is reachable. Number of bytes in an ICMP echo request, and the number 84 in the parentheses is 56 + length of the ICMP header (8 bytes) + length of the IP header (20 bytes). An ICMP echo reply is received from the device with an IP address of : the ICMP echo reply is of 64 bytes, with sequence number 1, TTL 128, and response time ms. If no echo reply is received within the timeout time, the system outputs Request time out. Devices that the ICMP echo request and the ICMP echo reply pass The route is the same as that of the first ICMP echo request and ICMP echo reply ping statistics --- Statistics on packets received and sent during the ping operation 4 packets transmitted Number of ICMP echo requests sent 4 received Number of ICMP echo replies received 0% packet loss Percentage of the non-responded requests to the total requests. time 2997ms Total execution time of the ping command 1-3

11 Field rtt min/avg/max/mdev = 0.191/0.214/0.248/0.023 ms Minimum RTT, average RTT, maximum RTT, and RTT variance ssh service ssh service enable undo ssh service System view Use the ssh service enable command to enable SSH so that users can use SSH to log in to the current device. Use the undo ssh service command to disable SSH. By default, SSH is disabled. The username and password for SSH login are both sshadmin. The number of Telnet users and SSH users cannot exceed 7 at a time. # Enable SSH. [Sysname] ssh service enable telnet service telnet service enable undo telnet service System view Use the telnet service enable command to enable Telnet so that users can use Telnet to log in to the current device. Use the undo telnet service command to disable Telnet. By default, Telnet is disabled. The password for Telnet login is the same as that for Console login. 1-4

12 The number of Telnet users and SSH users cannot exceed 7 at a time. # Enable Telnet. [Sysname] telnet service enable 1-5

13 2 Interface Management Commands Interface Management Commands combo enable combo enable { copper fiber } Combo port view copper: Enables the electrical interface of the Combo port. In this case, connect the Combo port with a twisted-pair cable. fiber: Enables the optical interface of the Combo port. In this case, connect the Combo port with an optical cable. Use the combo enable command to enable the electrical or optical interface of a Combo port. Enabling one interface of the Combo port automatically disables the other. By default, the electrical interface of a Combo port is enabled. Related commands: display interface. # Enable the electrical interface of Combo port G-Ethernet 0/0/1. In this case, connect the Combo port with a twisted-pair cable. [Sysname] interface g-ethernet0/0/1 [Sysname-if] combo enable copper # Enable the optical interface of Combo port G-Ethernet 0/0/1. In this case, connect the Combo port with an optical cable. [Sysname] interface g-ethernet0/0/1 [Sysname-if] combo enable fiber display interface display interface [ interface-name ] Any view 2-1

14 interface-name: Specifies an interface by its type and number. Use the display interface command to display information about one or all interfaces, including the operational status information. If you specify no interface, the command will display information about all interfaces. Related commands: interface. # Display information about interface M-Ethernet 0/0/0. <Sysname> display interface m-gigabit0/0/0 Interface m-gigabit0/0/0 input packets 1175, bytes output packets 467, bytes administration state UP, line state UP 100Mbps-speed mode, full-duplex mode Link speed type is autonegotiation, link duplex type is force link combo enable copper inet add: , Mask Table 2-1 display interface command output description Field administration state line state speed mode duplex mode Link speed type link duplex type combo enable inet add Mask Status of the interface Link status of the interface Current speed mode of the interface Current duplex mode of the interface Configured speed mode, which can be: autonegotiation force link, indicating user-configured Configured duplex mode, which can be: autonegotiation force link, indicating user-configured Status of the Combo port, which can be: copper, indicating that the electrical interface is enabled fiber, indicating that the optical interface is enabled IP address of the interface Subnet mask of the interface duplex duplex { auto full half } undo duplex 2-2

15 Interface view auto: Automatically negotiates the duplex mode of the interface. full: Works in full-duplex mode. half: Works in half-duplex mode. Use the duplex command to specify the duplex mode for an Ethernet interface. Use the undo duplex command to restore the default. By default, the duplex mode of an Ethernet interface is auto. Note that: 10-GE interfaces only support the full keyword. The optical interface of a Combo port does not support the half keyword. GE interfaces working at 1000 Mbps do not support the half keyword. Related commands: speed, display interface. # Configure interface G-Ethernet 1/1 to work in full-duplex mode. [Sysname] interface g-ethernet0/0/0 [Sysname-if] duplex full interface interface interface-name System view interface-name: Specifies an interface by its type and number. Use the interface command to enter interface view. # Enter M-Gigabit 0/0/0 interface view. [Sysname] interface m-gigabit0/0/0 [Sysname-if] ip address ip address ip-address { mask mask-length } undo ip address [ ip-address { mask mask-length } ] 2-3

16 Management interface view ip-address: Management interface IP address, in dotted decimal notation. mask: Subnet mask of the management interface IP address, in dotted decimal notation. mask-length: Subnet mask length, represented by the number of consecutive ones in the mask. The value range is 1 to 30. Use the ip address command to assign an IP address to a management interface. Use the undo ip address command to remove an IP address of a management interface. The default IP address of a management interface is /24. Related commands: display interface. # Configure the IP address and subnet mask of management interface M-Gigabit 1/1 as and 24 (that is, ) respectively. [Sysname] interface m-gigabit0/0/0 [Sysname-if] ip address reset counters interface reset counters interface [ interface-name ] System view interface-name: Specifies an interface by its type and number. Use the reset counters interface command to clear statistics of an interface or all interfaces. To collect statistics of an interface within a specific period, you need to clear statistics of the interface before starting statistics collection. If you specify no interface, this command clears the statistics of all interfaces. If you specify an interface, this command clears the statistics of the specified interface. # Display statistics of interface M-Gigabit 0/0/0. <H3C> system-view [H3C] display interface m-gigabit0/0/0 Interface m-gigabit0/0/0 input packets 46, bytes 6187 output packets 16, bytes administration state UP, line state UP 100Mbps-speed mode, full-duplex mode 2-4

17 Link speed type is autonegotiation, link duplex type is autonegotiation combo enable copper inet add: , Mask # Clear statistics of interface M-Gigabit 0/0/0. [H3C]reset counters interface m-gigabit0/0/0 # Display statistics of interface M-Gigabit 0/0/0. [H3C] display interface m-gigabit0/0/0 Interface m-gigabit0/0/0 input packets 0, bytes 0 output packets 0, bytes 0 administration state UP, line state UP 100Mbps-speed mode, full-duplex mode Link speed type is autonegotiation, link duplex type is autonegotiation combo enable copper inet add: , Mask shutdown shutdown undo shutdown Interface view Use the shutdown command to shut down an Ethernet interface. Use the undo shutdown command to bring up an Ethernet interface. By default, an Ethernet interface is up. In certain circumstances, modifications to the interface parameters take effect only after you re-enable the interface. Related commands: display interface. # Shut down Ethernet interface G-Ethernet 0/0/1. [Sysname] interface g-ethernet0/0/1 [Sysname-if] shutdown # Bring up Ethernet interface G-Ethernet 0/0/1. [Sysname] interface g-ethernet0/0/1 [Sysname-if] undo shutdown 2-5

18 speed speed { auto } undo speed Interface view 10: Works at 10 Mbps. 100: Works at 100 Mbps. 1000: Works at 1000 Mbps. This keyword is available on only GE interfaces : Works at Mbps. auto: Automatically negotiates the speed. Use the speed command to configure the speed of the Ethernet interface. Use the undo speed command to restore the default. By default, an Ethernet interface automatically negotiates the speed with its partner interface. Note that: This command is not available on the optical interface of a Combo port. Support for the keywords of the command varies with device models. 10-GE interfaces only support the keyword. Related commands: duplex, display interface. # Set the speed of Ethernet interface G-Ethernet 0/0/1 to 100 Mbps. [Sysname] interface g-ethernet0/0/1 [Sysname-if] speed

19 3 Static Routing Configuration Commands Static Routing Configuration Commands display ip route-static display ip route-static System view Use the display ip route-static command to display all static route information. Related commands: ip route-static. # Display all static route information. [Sysname] display ip route-static Destination Genmask Gateway Table 3-1 display ip route-static command output description Field Destination Genmask Gateway IP address of a destination NMS Mask of the subnet where the NMS is located IP address of the next hop ip route-static ip route-static dest-addr mask geteway-addr undo ip route-static dest-addr mask geteway-addr System view dest-addr: IP address of the destination NMS, in dotted decimal notation. 3-1

20 mask: Mask of the subnet where the NMS is located, in dotted decimal notation. gateway-addr: IP address of the next hop, in dotted decimal notation. Use the ip route-static command to configure a static route to a destination NMS. Use the undo ip route-static command to delete the static route. Note that: If the destination IP address and mask of a route are both configured as , the route is a default route. Any packet whose destination IP address matches no entry in the routing table is forwarded through the default route. The IP address of the next hop cannot be the IP address of any local interface; otherwise, the static route does not take effect. Related commands: display ip route-static. # Configure a static route to the NMS whose IP address is /24, and specify as the IP address of the next hop. [Sysname] ip route-static

21 4 Device Management Commands Device Management Commands boot-loader boot-loader file file-name { backup main } User view, system view file file-name: Specifies a file name, a string of 1 to 64 characters, including letters, digits, hyphen (-), underscore (_) and dot (.). backup: Uses the file as the backup boot file. main: Uses the file as the main boot file. Use the boot-loader command to specify device boot files. A main boot file is used to boot a device and a backup boot file is used to boot a device only when a main boot file is unavailable. Related commands: display boot-loader. # Specify bzimage as the main boot file for the next system boot. <Sysname> boot-loader file bzimage main bootimage upgrade bootimage upgrade tftp ip-address get filename System view ip-address: IP address of the TFTP server. get: Download the specified file. filename: File name, a string of 1 to 64 characters, including letters, digits, hyphen (-), underscore (_) and dot (.). Use the bootimage upgrade command to download a boot file from the TFTP server. 4-1

22 The device can store at most three boot files. When the maximum number is reached, downloading a boot file with the same name as an existing one will overwrite the existing one; downloading a new boot file will fail and the system displays Up to three software images can be supported. The file to be downloaded must be a valid boot file. Otherwise, it cannot be downloaded. If the memory of the device is not enough, delete the existing applications as needed. # Download file aaa.bin from TFTP server [Sysname] bootimage upgrade tftp get aaa.bin display boot-loader display boot-loader User view, system view Use the display boot-loader command to display information about the boot files of a device. Related commands: boot-loader. # Display information about the boot files of the device. <Sysname> display boot-loader The app to boot at this time is current.bin. The main app to boot at next time is main.bin. The backup app to boot at next time is not exist. Table 4-1 display boot-loader command output description Field The app to boot at this time The main app to boot at next time The backup app to boot at next time File used when the device booted this time Main boot file to be used for the next boot of the device Backup up boot file to be used for the next boot of the device display cpu-usage display cpu-usage User view, system view 4-2

23 Use the display cpu-usage command to display statistics on CPU usage. The system collects statistics on CPU usage at an interval (usually 60 seconds), and save the statistics to the history records area. The maximum number of records that can be saved depends on the device model. On a device with a single CPU # Display information about the current CPU usage. <Sysname> display cpu-usage CPU usage is 1. On a device with more than one CPU # Display information about the current CPU usage. <Sysname> display cpu-usage CPU 0 usage is 1. CPU 1 usage is 0. display device display device [ cf-card harddisk [ harddisk-num ] manuinfo ] User view, system view cf-card: Displays information about the compact Flash (CF) card. harddisk: Displays information about one or all hard disks. harddisk-number: Index of the hard disk. manuinfo: Display the electrical label information of the device. Electrical label information is also called permanent configuration data or archive information, and it is written to the storage medium during the device commissioning or test process. The information includes the name, serial number, MAC address, manufacturing date, and vendor name. Use the display device command to display device information such as information about the boards, CF card, and hard disks. If you specify none of the keywords, the command displays brief information about all boards on the device. # Display brief information about all boards. Note that the output of this command depends on the device model. <Sysname> display device Slot # Type Online Status

24 0 NS11LSUA0 Present Normal # Display the electrical label information of the device. Note that the output of this command depends on the device model. <Sysname> display device manuinfo slot0 DEVICE_NAME:SECPATHT1000 DEVICE_SERIAL_NUMBER:DPPMWWB MAC_ADDRESS:00E0-FC MANUFACTURING_DATE: VENDOR_NAME:H3C display environment display environment [ cpu ] User view, system view cpu: Displays the temperature information of all CPUs in the device. Use the display environment command to display the temperature information of the device, including the current temperature and temperature alarm thresholds of the boards. Use the display environment cpu command to display the temperature information of all CPUs on the device. # Display the temperature information of the device. <Sysname> display environment System Temperature information (degree centigrade): Temperature Lower limit Upper limit # Display the temperature information of all CPUs on the device. <Sysname> display environment cpu CPU Temperature information (degree centigrade): CPU No Temperature Lower limit Upper limit display fan display fan [ fan-id ] User view, system view 4-4

25 fan-id: Number of the built-in fan. use the display fan command to display the operating status of the built-in fans. # Display the operating status of all built-in fans. <Sysname> display fan Status of fan 0 : OK. Status of fan 1 : OK. The output of the command shows that all the fans are working properly. display memory display memory User view, system view Use the display memory command to display the memory usage of a device. # Display the memory usage. <Sysname> display memory System Total Memory(Mbytes): 2027 Total Used Memory(Mbytes): 516 Used Rate: 25% display power display power [ power-id ] User view, system view power-id: ID of the power supply unit (PSU). Use the display power command to display the PSU information of a device. # Display the PSU information. <Sysname> display power Status of power 0 : OK. 4-5

26 Status of power 1 : ERROR. The output of the command shows that PSU 0 is working properly, but PSU 1 has an error. reboot reboot System view Use the reboot command to reboot the whole system of a device. Rebooting a device will tear down all services. Do so with caution. # Reboot the device. The output shows that there is no change to the configuration before reboot. [Sysname] reboot Current configuration may be lost in next startup if you continue.are you sure? (Y/N) [N]:y temperature-limit temperature-limit { board cpu } lower-value upper-value undo temperature-limit { board cpu } User view, system view board: Specifies the temperature alarm thresholds of the mainboard. cpu: Specifies the temperature alarm thresholds of the CPU. lower-value: Lower temperature limit, in the range of 0 to 70 degrees Celsius. upper-value: Upper temperature limit, in the range of 20 to 90 degrees Celsius. Use the temperature-limit command to set the temperature alarm thresholds for the CPU and mainboard. Use the undo temperature-limit command to restore the defaults. 4-6

27 By default, the CPU and mainboard share the same temperature alarm thresholds, that is, 10 degrees Celsius for the lower temperature limit and 80 degrees Celsius for the upper temperature limit. The value of the upper-value argument must be greater than that of the lower-value argument. Related commands: display environment. # Set the lower temperature limit to 30 degrees Celsius and the upper temperature limit to 80 degrees Celsius for the CPU. <Sysname> temperature-limit cpu

28 5 Basic System Configuration Commands Basic System Configuration Commands clock datetime clock datetime HH:MM:SS YYYY/MM/DD User view HH:MM:SS: Current time in the format of HH:MM:SS, where HH indicates the hours (in the range 0 to 23), MM indicates the minutes (in the range 0 to 59), and SS indicates the seconds (in the range 0 to 59). Leading zeros can be omitted. YYYY/MM/DD: Current date in the format of YYYY/MM/DD, where YYYY indicates the year (in the range 2000 to 2035), MM indicates the month of the year (in the range 1 to 12), and DD indicates the day of the month, whose value range varies with the month. Use the clock datetime command to set the current time and date of the device. This command is required in environments that use the absolute time. Related commands: display clock. # Set the current system time to 00:06:00 on January 1, <Sysname> clock datetime 0:6:0 2007/1/1 collect diag_info collect diag_info ip-address System view ip-address: IP address of the TFTP server. Use the collect diag_info command to generate a file named h3c.debug for the debugging information generated by the system, and upload the file to the specified TFTP server to save it. When the device fails, you can send the generated file to the device maintainer to locate the fault. 5-1

29 You need to configure the IP address of the TFTP server before collecting diagnostic information, and ensure that an available route exists between the device and the TFTP server. # Collect the diagnostic information and save it on the TFTP server with the IP address [Sysname] collect diag_info [Sysname] A file named h3c.debug exists under the specified path on the TFTP server. clock timezone clock timezone { gmt gmt+1 gmt+10 gmt+11 gmt+12 gmt+2 gmt+3 gmt+4 gmt+5 gmt+6 gmt+7 gmt+8 gmt+9 gmt-1 gmt-10 gmt-11 gmt-12 gmt-2 gmt-3 gmt-4 gmt-5 gmt-6 gmt-7 gmt-8 gmt-9 } undo clock timezone User view gmt: Specifies the Greenwich Mean Time (GMT) time zone. gmt+1 to gmt+12: Specifies the time zone of GMT + n hours, where n indicates the positive offset to the GMT. gmt-1 to gmt-12: Specifies the time zone of GMT - m hours, where m indicates the negative offset to the GMT. Use the clock timezone command to specify the local time zone. Use the undo clock timezone command to restore the default. After the above configuration, the system time, logs, and debugging information will all depend on the current system clock. By default, the time zone is GMT+8. Related commands: clock datetime, display clock. # Set the local time zone to GMT + 1. <Sysname> clock timezone gmt+1 display clock display clock User view 5-2

30 Use the display clock command to display the system time of a device, including the current time, date and time zone. You can set the current time, date and time zone by commands clock datetime and clock timezone. Refer to the relevant section of Basic System Configurations. Related commands: clock datetime, clock timezone. # Display the system time. <Sysname> display clock Wed May 28 18:02: GMT+8 display history-command display history-command Any view Use the display history-command command to display the commands executed recently. Up to 20 commands will be displayed. # Display the commands saved in the command history buffer. The output depends on your configurations. <Sysname> display history-command display history-command system-view quit display idle-timeout display idle-timeout System view Use the display idle-timeout command to display the current user connection timeout time. 5-3

31 If a user s connection stays idle for such a period of time, the device will tear down the connection automatically. Related commands: idle-timeout. # Display the current user connection timeout time. [Sysname] display idle-timeout current idle-timeout is 60 minute(s) 0 second(s). display version display version User view Use the display version command to display the system version information. ing the system version information, you will know: Software version Signature package version Hardware capacities Hardware version # Display the system version information. <Sysname> display version help help Any view Use the help command to display the help information of the command line interface (CLI). # In system view, display the help information of the CLI. 5-4

32 [Sysname] help H3C i-ware provides advanced help feature. When you need help, anytime at the command line please press '?'. If nothing matches, the help list will be empty and you must backup until entering a '?' shows the available options. Two styles of help are provided: 1. Full help is available when you are ready to enter a command argument (e.g. 'display?') and describes each possible argument. 2. Partial help is provided when an abbreviated argument is entered and you want to know what arguments match the input (e.g. 'display da?'). idle-timeout idle-timeout minutes [ seconds ] undo idle-timeout System view minutes [ seconds ]: User connection timeout time, where minutes is in the range 1 to 1440, and seconds is in the range 0 to 59. Use the idle-timeout command to set the user connection timeout time. Use the undo idle-timeout command to restore the default. If a user s connection stays idle for such a period of time, the device will tear down the connection automatically. By default, the user connection timeout time is 5 minutes. Related commands: display idle-timeout. # Set the user connection timeout time to 15 minutes. [Sysname] idle-timeout 15 list list Any view 5-5

33 Use the list command to list all commands available in the current view. # Display all available commands in system view. [Sysname] list password password System view Use the password command to specify the password for Console port or Telnet connection. After you issue the password command in system view, the system will prompt you to enter the old password. If the old password that you enter is correct, the system will prompt you to enter the new password twice. The two inputs for the new password must match. Otherwise, password configuration will fail. By default, the password is H3C for both Console and Telnet connection. The password must be a string of 6 to 8 visible characters that contains no space. # Change the password from abcdef to fedcba. [Sysname] password Old password: // Enter the old password abcdef. New password: // Enter the new password fedcba. Retype new password: // Enter the new password fedcba again. [Sysname] quit quit Any view 5-6

34 Use the quit command to return to an upper-level view. For example, if you are in system view, this command will bring you back to user view. If you are in user view, the command will terminate the current connection and reconnect to the device. Related commands: return. # Return to system view, and then to user view. [Sysname-if] quit [Sysname] quit <Sysname> reset web-admin-user-password reset web-admin-user-password System view Use the reset web-admin-user-password command to restore the default password of user admin. By default, there is a user with the username and password both being admin on the device. If the user admin has been deleted, the reset web-admin-user-password command does not take effect. # Restore the default password of user admin. [Sysname] reset web-admin-user-password return return Any view 5-7

35 Use the return command in any view to return to user view directly. Key combination Ctrl+Z has the same function. Related commands: quit. # Return to user view from interface view. [Sysname-if] return <Sysname> sysname sysname sysname undo sysname System view sysname: Device name, a string of 1 to 30 case sensitive characters. It starts with a letter, and can contain letters, numbers,., -, and _. Use the sysname command to configure the device name. Use the undo sysname command to restore the default. The default device name depends on the device model. The device name of a device is used as the prompt or part of the prompt of the CLI. For example, if the device name is Sysname, the prompt of the user view is <Sysname>. # Configure the device name as IPS. [Sysname] sysname IPS [IPS] system-view system-view User view Use the system-view in user view to enter system view. Related commands: quit, return. 5-8

36 # Enter system view from user view. [Sysname] terminal rows terminal rows rows undo terminal rows User view rows: Maximum number of lines to be displayed on a page, in the range 5 to 512. Use the terminal rows command to set the maximum number of lines that can be displayed on one page. Use the undo terminal rows command to restore the default. By default, up to 25 lines can be displayed on a page. # Set the maximum number of lines that can be displayed on one page to 20. <Sysname> terminal rows

37 6 Encrypted P2P Traffic Identification Configuration Commands Encrypted P2P Traffic Identification Configuration Commands display p2p display p2p System view Use the display p2p command to display information about the encrypted P2P traffic identification function. If the precise identification method is used, the command also displays the counts of UDP and TCP negotiation nodes. Related commands: p2p enable. # Display information about the encrypted P2P traffic identification function. [Sysname] display p2p P2P original identification is enabled. P2P length serial identification is enabled. P2P precise identification is enabled. UDP negotiate nodes: 2 TCP negotiate nodes: 0 The output shows that: The original identification method, length serial identification method, and precise identification method are all enabled. Currently, there are two UDP negotiation nodes and no TCP negotiation nodes. p2p enable p2p { length-serial original precise } enable undo p2p { length-serial original precise } enable 6-1

38 System view length-serial: Uses the length serial identification method. original: Uses the original identification method. precise: Uses the precise identification method. Use the p2p enable command to enable the encrypted P2P traffic identification function and specify the identification methods to be used. Use the undo p2p enable command to disable the function. You can use the p2p enable command repeatedly to specify two or all the three methods for the encrypted P2P traffic identification function. When specified at the same time, the three methods are used in this order: original identification, precise identification, and length serial identification. If the original identification method considers that a data flow is an encrypted P2P flow, the inspection of the data flow stops; otherwise, the precise identification method is used. If the precise identification method considers the data flow an encrypted P2P flow, the inspection stops. If not, the length serial identification method is used, and whether the flow is an encrypted P2P flow depends on the inspection result of the length serial identification method. By default, the encrypted P2P traffic identification is disabled. Related commands: display p2p. # Enable precise identification of encrypted P2P traffic. [Sysname] p2p precise enable 6-2

39 7 Command Index B C D H I L N P Q R S T B bootimage upgrade 4-1 boot-loader 4-1 C clock datetime 5-1 clock timezone 5-2 collect diag_info 5-1 combo enable 2-1 D display boot-loader 4-2 display clock 5-2 display cpu-usage 4-2 display device 4-3 display environment 4-4 display fan 4-4 display history-command 5-3 display idle-timeout 5-3 display interface 2-1 display ip route-static 3-1 display memory 4-5 display p2p 6-1 display power 4-5 display version 5-4 duplex 2-2 H help 5-4 I idle-timeout 5-5 interface 2-3 ip address 2-3 ip route-static 3-1 L list 5-5 N network icmp echo-reply disable 1-1 P p2p enable 6-1 password 5-6 ping 1-1 Q quit 5-6 R reboot 4-6 reset counters interface 2-4 reset web-admin-user-password 5-7 return 5-7 S shutdown 2-5 speed 2-6 ssh service 1-4 sysname 5-8 system-view 5-8 T telnet service 1-4 temperature-limit 4-6 terminal rows