HP ProCurve MSM313/MSM zl Switches Integrated Services Access Points CLI

Transcription

1 HP MSM313/MSM323 Integrated Services Access Points CLI Reference Guide HP ProCurve MSM313/MSM zl Switches Integrated Services Access Points CLI Installation and Getting Started Guide Reference Guide

2

3 HP MSM313/MSM323 Integrated Services Access Points CLI Reference Guide

4 Copyright 2010 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. This document contains proprietary information, which is protected by copyright. No part of this document may be photocopied, reproduced, or translated into another language without the prior written consent of Hewlett-Packard. Publication Number July 2010 Trademark Credits Windows NT, Windows, and MS Windows are US registered trademarks of Microsoft Corporation. Disclaimer HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. The only warranties for Hewlett-Packard products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett-Packard shall not be liable for technical or editorial errors or omissions contained herein. Hewlett-Packard assumes no responsibility for the use or reliability of its software on equipment that is not furnished by Hewlett-Packard. Warranty See the Customer Support/Warranty booklet included with the product. A copy of the specific warranty terms applicable to your Hewlett-Packard products and replacement parts can be obtained from your Hewlett-Packard Sales and Service Office or authorized dealer. Open Source Software Acknowledgement Statement This software incorporates open source components that are governed by the GNU General Public License (GPL), version 2. In accordance with this license, Hewlett-Packard will make available a complete, machine-readable copy of the source code components covered by the GNU GPL upon receipt of a written request. Send a request to: Hewlett-Packard Company, L.P. GNU GPL Source Code Attn: HP Support Roseville, CA USA

5 HP MSM313/MSM323 CLI Reference Guide 5 Contents Contents Alphabetical list of commands 11 Chapter 1 Introduction 15 About this guide...16 Products covered...16 Important terms...16 Typographical conventions...16 Command syntax...16 Management tool...17 Configuring CLI support...17 SSH client support...18 Entering strings...19 Context hierarchy...19 Sample CLI session...20 File transfer...20 A. The MSM313/MSM323 gets the file using a URL:...20 B. Send a file to the MSM313/MSM Chapter 2 CLI commands 21 View context...22 arping...22 enable...22 nslookup...22 ping...22 ps...22 quit...22 show license...23 show logging filtered...23 top...23 traceroute...23 Enable context...23 reboot device...23 show certificate...23 show certificate binding...23 ping...24 arping...24 arp...24 end...24 quit...24 rcapture...24 show arp...24 show bridge...25 show bridge forwarding...25 show dns cache...25 show interfaces...25 show ip route...25 show system info...25 show ip dhcp database...25 show dot11 associations...25 show dot11 statistics client-traffic...26 show local mesh...26 show wireless neighborhood...26 show wireless rogue-ap...26 show satellites...26 show client log...26 show radius statistics...26 show radius users...26 show users...27 show discrete pin...27 config...27 show all config...27 Config context...27 certificate...27 certificate binding...27 certificate revocation...27 end...28 factory settings...28 interface ethernet...28 reboot device...28 show certificate...28 show certificate binding...28 show config factory...28 username...28 interface ip...29 interface wireless...29 local mesh profile...29 interface pptp client-default...29 interface gre...29 virtual ap...29 ipsec policy...29 admin authentication local fallback...30 admin authentication radius...30 clock summer-time...30 clock timezone...30 ip http port...30 ip https port...31 ntp protocol...31 ntp server...31 snmp-server trap certificate-expired...31 snmp-server trap certificate-expires-soon...31 snmp-server trap web-fail...31 snmp-server trap web-login...32 snmp-server trap web-logout...32 web admin kickout...32 web allow...32 world-mode dot11 country code...32 web access internet-port...32 web access lan-port...33 web access wireless...33 web access interface vlan...33 web access interface gre...33 web access local mesh...33 web access lan...33 web access vpn...34 dhcp mode...34 dhcp server...34 dhcp server default domain name...34 dhcp server default lease period...34 dhcp server default permanent lease period...34 dhcp server logout html user...34 dhcp relay...34 dhcp relay circuit id...35 dhcp relay remote id...35 clock...35 ntp server...35 ntp server failure trap...35 config-update automatic...35 config-update operation...36 config-update time...36 config-update uri...36 config-update weekday...36 snmp-server trap config-change...36

6 HP MSM313/MSM323 CLI Reference Guide 6 Contents snmp-server trap config-update...36 logging destination...37 snmp-server trap syslog-severity...37 snmp-server...37 snmp-server access port snmp-server allow...37 snmp-server chassis-id...38 snmp-server contact...38 snmp-server heartbeat period...38 snmp-server location...38 snmp-server port...38 snmp-server readonly...38 snmp-server readwrite...39 snmp-server trap...39 snmp-server trap community...39 snmp-server trap destination...39 snmp-server trap heartbeat...39 snmp-server trap link-state...40 snmp-server trap snmp-authentication...40 snmp-server version...40 snmp-server access interface vlan...40 snmp-server access local mesh...40 snmp-server access interface gre...40 snmp-server access wireless...41 snmp-server access port snmp-server access lan...41 snmp-server access vpn...41 snmp-server trap new-satellite-detected...41 snmp-server trap satellite-unreachable...41 soap-server...42 soap-server access interface vlan...42 soap-server access port soap-server access port soap-server allow...42 soap-server http authentication...42 soap-server http authentication password...43 soap-server http authentication username...43 soap-server port...43 soap-server ssl...43 soap-server ssl with client certificate...43 soap-server access interface gre...43 soap-server access wireless...44 soap-server access local mesh...44 soap-server access lan...44 soap-server access vpn...44 snmp-server trap low-snr...44 snmp-server trap low-snr interval...44 snmp-server trap low-snr level...45 snmp-server trap new-association...45 snmp-server trap new-association interval...45 snmp-server trap vpn-connection...45 snmp-server trap wireless-association-fail...45 snmp-server trap wireless-association-success...45 snmp-server trap wireless-authentication-fail...45 snmp-server trap wireless-authentication-success...46 snmp-server trap wireless-deauthentication-fail...46 snmp-server trap wireless-deauthentication-success...46 snmp-server trap wireless-disassociation-fail...46 snmp-server trap wireless-disassociation-success...46 snmp-server trap wireless-reassociation-fail...46 snmp-server trap wireless-reassociation-success...47 snmp-server trap syslog-matches...47 snmp-server trap syslog-matches regex...47 snmp-server trap syslog-severity level...47 snmp-server trap network-trace...47 firmware-update automatic...47 firmware-update start...48 firmware-update time...48 firmware-update uri...48 firmware-update weekday...48 snmp-server trap firmware-update...48 ip name-server...48 ip name-server cache...49 ip name-server dynamic...49 ip name-server switch-on-servfail...49 ip name-server switch-over...49 ip name-server logout-host-name...49 ip name-server logout-ip-address...50 snmp-server trap unauthorized-ap...50 snmp-server trap unauthorized-ap interval...50 wireless-scan...50 wireless-scan period...50 wireless-scan url...50 access controller shared secret...51 radius-server profile...51 ip-qos profile...51 access controller...51 certificate ipsec ca...51 certificate ipsec local...51 certificate ipsec revocation...52 certificate ssl...52 session profile default...52 session profile...52 show session profile...52 remote configuration...52 dot11 igmp snooping-helper...53 discovery protocol...53 discovery protocol device-id...53 bridge priority...53 bridge protocol ieee...53 bandwidth control internet-port...54 bandwidth control internet-port high...54 bandwidth control internet-port low...54 bandwidth control internet-port max-rate...54 bandwidth control internet-port normal...55 bandwidth control internet-port very-high...55 ip route gateway...55 firmware distribution...55 firmware distribution default username...55 firmware distribution load cim...56 firmware distribution load list...56 firewall mode...56 show user profiles...56 show user profiles details...56 user profile...56 dot1x reauth...57 dot1x reauth period...57 dot1x reauth terminate...57 dot1x supplicant timeout...57 dynamic key...57 dynamic key interval...57 add wireless ip-qos profile...58 delete wireless ip-qos profile all...58 delete wireless ip-qos profile...58 wireless link qos...58 key chain...58 config-version...58 user tracking...58 user tracking destination...59 user tracking filter...59 user tracking port...59 Access Controller context...59 end...59 station allocate source ip address...59 station allow any ip address...59 station free access...60 station http proxy support...60 station idle detection...60 system accounting...60 authentication http...61

7 HP MSM313/MSM323 CLI Reference Guide 7 Contents authentication https...61 noc access internet...61 noc access vpn...61 noc allow...61 noc authentication...61 secure login...62 noc access interface vlan...62 noc access interface gre...62 ipass id...62 ipass name...62 wispr abort login url...62 wispr login url...63 wispr logoff url...63 access-list...63 use access-list...64 config file...64 https ssl certificate...64 mac-address...64 fail page...65 goodbye url...65 ipass login url...65 login error url...65 login page...65 login url...66 logo...66 messages...66 noc ssl ca-certificate...66 noc ssl certificate...66 session page...66 transport page...67 welcome url...67 notify user location changes...67 Default Session profile context...67 accounting interim update...67 idle timeout...67 maximum input octets...68 maximum input packets...68 maximum output octets...68 maximum output packets...68 maximum total octets...68 maximum total packets...68 nat one-to-one...69 session timeout...69 smtp redirection setup...69 end...69 smtp redirection...69 Session profile context...70 end...70 Internet interface context...70 duplex...70 end...70 speed...70 interface vlan...71 ipsec vlan interface...71 LAN interface context...71 duplex...71 end...71 speed...71 interface vlan...72 ipsec vlan interface...72 WAN IP interface context...72 pppoe client user...72 ip address mode...72 ip address...73 ip nat...73 nat limit port range...73 nat limit port range size...73 ip address dhcp client-id...74 end...74 pppoe auto-reconnect...74 pppoe mru...74 pppoe mtu...74 pppoe unnumbered...74 ip nat outside source static...75 ip rip authentication key-chain...75 ip rip authentication mode...75 ip rip authentication string...75 passive-interface...76 router rip...76 ip address alternate...76 LAN IP interface context...76 end...76 ip address...76 ip address management...77 passive-interface...77 router rip...77 Wireless context...77 end...77 radio active...77 rts threshold...78 distance...78 dot transmit power...79 antenna bidirectional...79 autochannel skip...79 beacon interval...79 dot11 automatic frequency...80 dot11 automatic frequency period...80 dot11 automatic frequency time...80 dot11 automatic transmit-power...80 dot11 automatic transmit-power period...80 multicast rate...80 station distance...80 dot11 mode...81 RADIUS remote configuration...81 end...81 active...81 credentials...81 interval...81 radius server profile...81 Virtual AP context...82 virtual ap name...82 access control...82 ingress interface...83 egress unauthenticated...83 max-association...83 ssid name...83 vlan...84 guest-mode...84 encryption key encryption key format...84 transmit key...85 authentication server access controller...85 authentication server accounting...85 authentication server accounting radius profile...85 authentication server radius...85 wpa-psk...85 authentication server request radius cui...86 dot1x session page...86 mac authentication accounting...86 mac authentication accounting radius profile...86 mandatory authentication...86 mac authentication radius profile...86 mac authentication remote...87 mac authentication request radius cui...87

8 HP MSM313/MSM323 CLI Reference Guide 8 Contents mac authentication local...87 mac authentication...87 html authentication...87 dot1x mandatory authentication...87 html authentication accounting...88 html authentication accounting radius profile...88 html authentication local...88 html authentication radius...88 html authentication radius profile...88 html authentication request radius cui...88 html authentication timeout...89 active...89 beacon dtim count...89 public forwarding...89 fast authentication...89 layer3 mobility...89 access lan stations...89 beacon transmit power...90 data rate maximum...90 data rate minimum...90 add ip-qos profile...90 delete ip-qos profile all...90 delete ip-qos profile...90 qos...91 upstream diffserv tagging...91 wmm advertising...92 html redirection...92 bandwidth...92 bandwidth default rates...92 bandwidth default rates maximum...92 radius accounting realms...92 radius authentication realms...92 location-aware group...93 location-aware called-station-id content...93 dhcp relay...93 dhcp relay active...93 dhcp relay circuit id...93 dhcp relay not active...93 dhcp relay remote id...93 dhcp relay subnet...94 dhcp server...94 dhcp server dns...94 dhcp server gateway...94 dhcp server range...94 dhcp server subnet...94 radius-framed-protocol-attribute...95 end...95 security...95 VLAN interface context...95 end...96 ip address...96 ip address mode...96 vlan name...96 ip default-gateway...96 ip nat...97 Local mesh context...97 end...97 active...97 interface...97 local mesh name...97 remote mac...97 security...98 security mode...98 security psk...98 security wep...98 speed...98 interface vlan...98 accept forced links...99 allowed downtime...99 dynamic local mesh...99 dynamic mode...99 initial discovery time...99 mesh id...99 minimum snr...99 preserve master link...99 promiscuous mode promiscuous mode startup delay snr cost per hop RADIUS context end radius-server accounting port radius-server alternate hosts radius-server authentication method radius-server authentication port radius-server deadtime radius-server host radius-server key radius-server message-authenticator radius-server name radius-server nasid radius-server timeout radius-server timeout radius-server force-nas-port-to-vlanid radius-server realm radius-server realm name IP_QOS context end end-port priority profile name protocol start-port DHCP server context end active gateway range permanent leases GRE interface context end force gre name ip address peer ip address remote ip address IPsec policy context end active authentication cipher dns domain dns server incoming nat incoming traffic network interface local id mode outgoing traffic network peer id peer ip address perfect forward secrecy preshared key Syslog destination context active logging facility logging host logging prefix...108

9 HP MSM313/MSM323 CLI Reference Guide 9 Contents name end level level matches message message process process PPTP client interface active pptp client credentials pptp client domain name pptp client server address end ip nat pptp client auto route discovery pptp client lcp echo passive-interface router rip Keychain context end key key chain name Keys context end key-string Subscription plan end Active Directory Group context end...113

10 HP MSM313/MSM323 CLI Reference Guide 10 Contents

11 HP MSM313/MSM323 CLI Reference Guide 11 Alphabetical list of commands accept forced links access control access controller shared secret access controller access lan stations access-list accounting interim update active add ip-qos profile add wireless ip-qos profile admin authentication local fallback admin authentication radius allowed downtime antenna bidirectional arp arping arping authentication http authentication https authentication server access controller authentication server accounting radius profile authentication server accounting authentication server radius authentication server request radius cui authentication autochannel skip bandwidth control internet-port high bandwidth control internet-port low bandwidth control internet-port max-rate bandwidth control internet-port normal bandwidth control internet-port very-high bandwidth control internet-port bandwidth default rates maximum bandwidth default rates bandwidth beacon dtim count beacon interval beacon transmit power bridge priority bridge protocol ieee certificate binding certificate ipsec ca certificate ipsec local certificate ipsec revocation certificate revocation certificate ssl certificate cipher clock summer-time clock timezone clock config file config config-update automatic config-update operation config-update time config-update uri config-update weekday config-version credentials data rate maximum data rate minimum delete ip-qos profile all delete ip-qos profile delete wireless ip-qos profile all delete wireless ip-qos profile dhcp mode dhcp relay active dhcp relay circuit id dhcp relay circuit id dhcp relay not active dhcp relay remote id dhcp relay remote id dhcp relay subnet dhcp relay dhcp relay dhcp server default domain name dhcp server default lease period dhcp server default permanent lease period dhcp server dns dhcp server gateway dhcp server logout html user dhcp server range dhcp server subnet dhcp server dhcp server discovery protocol device-id discovery protocol distance dns domain dns server dot11 automatic frequency period dot11 automatic frequency time dot11 automatic frequency dot11 automatic transmit-power period dot11 automatic transmit-power dot11 igmp snooping-helper dot11 mode dot dot1x mandatory authentication dot1x reauth period dot1x reauth terminate dot1x reauth dot1x session page dot1x supplicant timeout duplex duplex dynamic key interval dynamic key dynamic local mesh dynamic mode egress unauthenticated enable encryption key encryption key format end force end end-port factory settings fail page fast authentication firewall mode firmware distribution default username firmware distribution load cim firmware distribution load list firmware distribution firmware-update automatic firmware-update start firmware-update time firmware-update uri firmware-update weekday gateway

12 HP MSM313/MSM323 CLI Reference Guide 12 goodbye url gre name guest-mode html authentication accounting radius profile html authentication accounting html authentication local html authentication radius profile html authentication radius html authentication request radius cui html authentication timeout html authentication html redirection https ssl certificate idle timeout incoming nat incoming traffic network ingress interface initial discovery time interface ethernet interface gre interface ip interface pptp client-default interface vlan interface vlan interface vlan interface wireless interface interface interval ip address alternate ip address dhcp client-id ip address management ip address mode ip address mode ip address ip address ip address ip address ip default-gateway ip http port ip https port ip name-server cache ip name-server dynamic ip name-server logout-host-name ip name-server logout-ip-address ip name-server switch-on-servfail ip name-server switch-over ip name-server ip nat outside source static ip nat ip nat ip nat ip rip authentication key-chain ip rip authentication mode ip rip authentication string ip route gateway ipass id ipass login url ipass name ip-qos profile ipsec policy ipsec vlan interface ipsec vlan interface key chain name key chain key key-string layer3 mobility level level local id local mesh name local mesh profile location-aware called-station-id content location-aware group logging destination logging facility logging host logging prefix login error url login page login url logo mac authentication accounting radius profile mac authentication accounting mac authentication local mac authentication radius profile mac authentication remote mac authentication request radius cui mac authentication mac-address mandatory authentication matches max-association maximum input octets maximum input packets maximum output octets maximum output packets maximum total octets maximum total packets mesh id message message messages minimum snr mode multicast rate name nat limit port range size nat limit port range nat one-to-one noc access interface gre noc access interface vlan noc access internet noc access vpn noc allow noc authentication noc ssl ca-certificate noc ssl certificate notify user location changes nslookup ntp protocol ntp server failure trap ntp server ntp server outgoing traffic network passive-interface passive-interface passive-interface peer id peer ip address peer ip address perfect forward secrecy permanent leases ping ping pppoe auto-reconnect pppoe client user pppoe mru pppoe mtu... 74

13 HP MSM313/MSM323 CLI Reference Guide 13 pppoe unnumbered pptp client auto route discovery pptp client credentials pptp client domain name pptp client lcp echo pptp client server address preserve master link preshared key priority process process profile name promiscuous mode startup delay promiscuous mode protocol ps public forwarding qos quit quit radio active radius accounting realms radius authentication realms radius server profile radius-framed-protocol-attribute radius-server accounting port radius-server alternate hosts radius-server authentication method radius-server authentication port radius-server deadtime radius-server force-nas-port-to-vlanid radius-server host radius-server key radius-server message-authenticator radius-server name radius-server nasid radius-server profile radius-server realm name radius-server realm radius-server timeout radius-server timeout range rcapture reboot device reboot device remote configuration remote ip address remote mac router rip router rip router rip rts threshold secure login security mode security psk security wep security security session page session profile default session profile session timeout show all config show arp show bridge forwarding show bridge show certificate binding show certificate binding show certificate show certificate show client log show config factory show discrete pin show dns cache show dot11 associations show dot11 statistics client-traffic show interfaces show ip dhcp database show ip route show license show local mesh show logging filtered show radius statistics show radius users show satellites show session profile show system info show user profiles details show user profiles show users show wireless neighborhood show wireless rogue-ap smtp redirection setup smtp redirection snmp-server access interface gre snmp-server access interface vlan snmp-server access lan snmp-server access local mesh snmp-server access port snmp-server access port snmp-server access vpn snmp-server access wireless snmp-server allow snmp-server chassis-id snmp-server contact snmp-server heartbeat period snmp-server location snmp-server port snmp-server readonly snmp-server readwrite snmp-server trap certificate-expired snmp-server trap certificate-expires-soon snmp-server trap community snmp-server trap config-change snmp-server trap config-update snmp-server trap destination snmp-server trap firmware-update snmp-server trap heartbeat snmp-server trap link-state snmp-server trap low-snr interval snmp-server trap low-snr level snmp-server trap low-snr snmp-server trap network-trace snmp-server trap new-association interval snmp-server trap new-association snmp-server trap new-satellite-detected snmp-server trap satellite-unreachable snmp-server trap snmp-authentication snmp-server trap syslog-matches regex snmp-server trap syslog-matches snmp-server trap syslog-severity level snmp-server trap syslog-severity snmp-server trap unauthorized-ap interval snmp-server trap unauthorized-ap snmp-server trap vpn-connection snmp-server trap web-fail snmp-server trap web-login snmp-server trap web-logout snmp-server trap wireless-association-fail snmp-server trap wireless-association-success... 45

14 HP MSM313/MSM323 CLI Reference Guide 14 snmp-server trap wireless-authentication-fail snmp-server trap wireless-authentication-success snmp-server trap wireless-deauthentication-fail snmp-server trap wireless-deauthentication-success snmp-server trap wireless-disassociation-fail snmp-server trap wireless-disassociation-success snmp-server trap wireless-reassociation-fail snmp-server trap wireless-reassociation-success snmp-server trap snmp-server version snmp-server snr cost per hop soap-server access interface gre soap-server access interface vlan soap-server access lan soap-server access local mesh soap-server access port soap-server access port soap-server access vpn soap-server access wireless soap-server allow soap-server http authentication password soap-server http authentication username soap-server http authentication soap-server port soap-server ssl with client certificate soap-server ssl soap-server speed speed speed ssid name start-port station allocate source ip address station allow any ip address station distance station free access station http proxy support station idle detection system accounting top traceroute transmit key transmit power transport page upstream diffserv tagging use access-list user profile user tracking destination user tracking filter user tracking port user tracking username virtual ap name virtual ap vlan name vlan web access interface gre web access interface vlan web access internet-port web access lan web access lan-port web access local mesh web access vpn web access wireless web admin kickout web allow welcome url wireless link qos wireless-scan period wireless-scan url wireless-scan wispr abort login url wispr login url wispr logoff url wmm advertising world-mode dot11 country code wpa-psk... 85

15 Chapter 1: Introduction 1 Introduction Contents About this guide Configuring CLI support SSH client support Entering strings Context hierarchy Sample CLI session File transfer

16 HP MSM313/MSM323 CLI Reference Guide 16 1 Introduction About this guide This guide explains how to work with the Command Line Interface (CLI). Products covered This guide covers these products: MSM313, MSM313-R, MSM323, MSM323-R Important terms The following terms are used in this guide. Term AP service controller MSM313, MSM323 local mesh Virtual ap, VAP Description Refers only to HP MSM Access Points: MSM335, MSM310, MSM310-R, MSM320, and MSM320-R. Only in Chapter 2: CLI commands, sometimes used in place of MSM313 or MSM323. These product name references also include the R versions as in MSM313-R and MSM323-R. Previously referred to as WDS. Some older commands refer to wireless links whereas newer commands use the local mesh terminology and they also provide dynamic functionality. In this document, the terms Virtual ap and VAP are used in place of VSC (Virtual Service Community). Typographical conventions Command syntax Command syntax is formatted in a monospaced font as follows: Example use-access-list ip-qos profile <name> Description Command name. Specify it as shown. A single item enclosed in angle brackets and all formatted in italic indicates a user-supplied item. Specify the item. Do not include the angle brackets. In this example, a valid QoS profile name is required. For example: ip-qos profile voice

17 HP MSM313/MSM323 CLI Reference Guide 17 1 Introduction Example wireless interface (1 2) Description Multiple Items enclosed in parenthesis and separated by vertical bars indicate a mandatory choice. Include one of the mandatory items, without the parenthesis and without the vertical bar. In this example, either 1 or 2 must be included. For example: wireless interface 2 show logging [filtered] Items enclosed in square brackets are optional. You can either include them or not. Do not include the brackets. In this example you can specify the command in one of two ways: Management tool show logging show logging filtered When referring to the management tool interface, the Main menu name is presented first followed by a right angle-bracket and then the sub-menu name, as in Network > Ports. Configuring CLI support Using the MSM313/MSM323 management tool, open the CLI configuration page: Select Management > CLI. Use this page to enable/disable CLI support via an SSH or serial connection. A maximum of three concurrent CLI sessions are supported regardless of the connection type. The CLI supports SSH on the standard TCP port (22).

18 HP MSM313/MSM323 CLI Reference Guide 18 1 Introduction Connectivity and login credentials for SSH connections use the same settings as defined for management tool administrators on the Management tool page. Select Management > Management tool. SSH connections to the CLI can be made on any active interface. Support for each interface must be explicitly enabled under Security. The login credentials for SSH connections are the same as those defined under Administrator authentication. By default, both username and password are set to admin. Note: SSH logins always use the local administrator username and password, even if Administrator authentication is set to use an external RADIUS server. SSH client support The following SSH clients have been tested with the CLI. Others may work as well: OpenSSH Tectia SecureCRT Putty

19 HP MSM313/MSM323 CLI Reference Guide 19 1 Introduction Entering strings When entering a value that contains spaces, you must enclose it in quotation marks. For example, if the command syntax is: ssid <name> you must specify one of the following: ssid ANameWithNoSpaces ssid A name with spaces Context hierarchy CLI commands are grouped into functional contexts. The following tables show the context hierarchy and the command used to switch from the parent context. Context hierarchy View context Enable context Config context WAN IP interface context LAN IP interface context Internet interface context VLAN interface context LAN interface context VLAN interface context Wireless context Local mesh context VLAN interface context PPTP client interface GRE interface context Virtual AP context IPsec policy context DHCP server context Syslog destination context RADIUS context IP_QOS context Access Controller context Default Session profile context Session profile context RADIUS remote configuration User Profile context Keychain context Keys context Command to switch from parent context (This is the first context.) enable config interface ip wan interface ip lan interface ethernet port-2 interface vlan <id>[-<id2>] interface ethernet port-1 interface vlan <id>[-<id2>] interface wireless <number> local mesh profile <name> interface vlan <number> interface pptp client-default interface gre <name> virtual ap <name> ipsec policy <name> dhcp server lan logging destination <name> radius-server profile <name> ip-qos profile <name> access controller session profile default session profile <name> remote configuration radius user profile <name> key chain <name> key <number>

20 HP MSM313/MSM323 CLI Reference Guide 20 1 Introduction Sample CLI session This sample CLI session shows you how to set the WAN port to use a static IP address, disable NAT, and add an alternate IP address. MSM313 V. 5.2 CLI> enable CLI# config CLI(config)# interface ip wan CLI(config-if-ip)# ip address /24 CLI(config-if-ip)# ip address mode static CLI(config-if-ip)# no ip nat CLI(config-if-ip)# ip address alternate CLI(config-if-ip)# end CLI(config)# end CLI# quit File transfer In some cases you need to transfer files (certificates or configuration) to the MSM313/MSM323. Commands that have this capability typically include <uri> or <url> in their parameter list. Note: When you enter the commands discussed here, the files are transferred immediately. File transfer can be performed in two ways A. The MSM313/MSM323 gets the file using a URL: Replace parameter, set this parameters to the location of the file on an ftp or http server. For example: certificate ipsec ca ftp://ftp.example.com/certificate/my-root-certificate.pem B. Send a file to the MSM313/MSM323 Using SFTP (available with OpenSSH or SSH), authenticate with the CLI credentials. Then send the file to the MSM313/MSM323. For example: sftp msm313.mycompany.com >login: admin >password: **** >put my-root-certificate.pem file transferred (1k) >quit In the CLI, use the local://<filename> parameter in the URL. Replace <filename> with the filename you used to transfer using SFTP. For example: CLI(config)# certificate ipsec ca local://my-root-certificate.pem

21 Chapter 2: CLI commands 2 CLI commands

22 HP MSM313/MSM323 CLI Reference Guide 22 2 CLI commands View context Context path: View This is the root of the command tree. arping arping [ -AbDfhqUV] [ -c <count>] [ -w <deadline>] [ -s <source>] -I <interface> <destination> Pings a destination on a device interface using ARP packets. enable enable Switches to the enable context. nslookup nslookup [ -option authentication ] [ <host-to-find> - [< server> ]] Queries DNS servers for information on hosts or domains. ping ping <host> [-c <count>] [-s <length>] [-q] Determines if the specified remote IP address is active. <-c host> <-c count> <-s length> <-q> ps ps Displays all running processes. quit quit Quits the CLI. The IP address or DNS name of the host to ping. Number of pings. Length of the ping datagram. Quiet mode. No output.

23 HP MSM313/MSM323 CLI Reference Guide 23 2 CLI commands show license show license (colubris gpl other) Displays license information. Specify "colubris" for the HP ProCurve license. show logging filtered show logging [filtered] Displays the system log. top top Displays all running processes. traceroute traceroute [-n] [-r] [-v] [-m <max_ttl>] [-p <port#>] [-q <nqueries>] [-s <src_addr>] [-t <tos>] [-w <wait>] <host> [<data size>] Show the hosts that are traversed to reach the specified IP address. Enable context Context path: View > Enable This context provides access to various utilities. reboot device reboot device Restarts the system. show certificate show certificate Display current certificates. show certificate binding show certificate binding Display how the certificates are used.

24 HP MSM313/MSM323 CLI Reference Guide 24 2 CLI commands ping ping <host> [-c <count>] [-s <length>] [-q] Determines if the specified remote IP address is active. <-c host> <-c count> <-s length> <-q> arping The IP address or DNS name of the host to ping. Number of pings. Length of the ping datagram. Quiet mode. No output. arping [ -AbDfhqUV] [ -c <count>] [ -w <deadline>] [ -s <source>] -I <interface> <destination> Pings a destination on a device interface using ARP packets. arp arp [-evn] [-H <type>] [-i if]?- [<hostname>] arp [-v] [-i if] -d <hostname> [pub] arp [-v] [-H <type>] [-i if] -s <hostname> <hw_addr> [temp] arp [-v] [- H <type>] [-i if] -s <hostname> <hw_addr> [<netmask> <nm>] <pub> arp [-v] [-H <type>] [-i if] -Ds <hostname> ifa [<netmask> <nm>] <pub> Displays and modifies the Internet-to-Ethernet address translation tables used by the address resolution protocol. end end Switches to parent context. quit quit Exit the enable context. rcapture rcapture [<a>] [<b>] [<c>] [<d>] [<e>] [<f>] [<g>] [<h>] Sends port capture to an FTP server. Refer to Linux documentation for a complete description of this command and its options. show arp show arp Show the ARP table.

25 HP MSM313/MSM323 CLI Reference Guide 25 2 CLI commands show bridge show bridge Show bridge information. show bridge forwarding show bridge forwarding Show bridge forwarding information. show dns cache show dns cache [<serial>] Show DNS cache entries. Specify a serial number to display detailed information. show interfaces show interfaces Show networking interfaces. show ip route show ip route Show all IP routes. show system info show system info Show basic system information. show ip dhcp database show ip dhcp database Show the DHCP server lease database. show dot11 associations show dot11 associations Show all current wireless associations.

26 HP MSM313/MSM323 CLI Reference Guide 26 2 CLI commands show dot11 statistics client-traffic show dot11 statistics client-traffic Show current client matrix statistics. show local mesh show local mesh Show current local mesh interfaces. show wireless neighborhood show wireless neighborhood Show all access points detected nearby. show wireless rogue-ap show wireless rogue-ap Show all rogue access points detected nearby. show satellites show satellites [<deviceid>] Show current satellites of this access ponit. show client log show client log [<macaddr>] Display client station log. Enter the MAC address to display more details for a specific client station. show radius statistics show radius statistics Show RADIUS server statistics. show radius users show radius users [<filter>] Show users that are using RADIUS accounting.

27 HP MSM313/MSM323 CLI Reference Guide 27 2 CLI commands show users show users [<filter>] Show all users of this service controller. show discrete pin show discrete pin Display the state of the discrete pin. config config Switches to the config context. show all config show all config Print all configuration that applies to this device. Config context Context path: View > Enable > Config This is the root context for all configuration commands. certificate certificate (authority local) <uri> <certname> [<password>] Add a new certificate to the store, using the friendly name. certificate binding certificate binding (web-management html-auth soap eap) <certname> Assign a certificate to a service. no certificate binding (web-management html-auth soap eap) <certname> Unassign a certificate from a service. certificate revocation certificate revocation <uri> <certname> Add a Certificate Revocation List to an existing authority certificate.

28 HP MSM313/MSM323 CLI Reference Guide 28 2 CLI commands end end Switches to parent context. factory settings factory settings Resets the system configuration to factory default settings. interface ethernet interface ethernet (port-1 port-2) Switches to the specified Ethernet interface context. reboot device reboot device Restarts the system. show certificate show certificate Display current certificates. show certificate binding show certificate binding Display how the certificates are used. show config factory show config [factory] Generates a list of CLI commands that can be used to define the currently loaded configuration. username username <user> <password> Changes the current administrator username and password. <user> New administrator username. <password> New administrator password.

29 HP MSM313/MSM323 CLI Reference Guide 29 2 CLI commands interface ip interface ip (lan wan) Switches to the specified IP interface context. interface wireless interface wireless <interface number> Switches to the specified wireless interface context. local mesh profile local mesh profile <name> Switches to the specified local mesh link context. <name> interface pptp client-default interface pptp client-default Switches to the PPTP client interface context. interface gre Number of the local mesh link to configure. interface gre <name> Switches to the specified GRE interface or creates a new GRE interface with the specified name. no interface gre <name> Deletes the specified GRE interface. virtual ap virtual ap <name> Creates a new VAP (VSC) profile or switches to the existing VAP (VSC) context with the specified name. no virtual ap <name> Deletes the specified Virtual AP profile. name Name of an existing or new VAP (VSC) profile. ipsec policy ipsec policy <name> Switches to the specified IPSec policy or creates a new IPSec policy with the specified name.

30 HP MSM313/MSM323 CLI Reference Guide 30 2 CLI commands admin authentication local fallback admin authentication local fallback Allow administrators to login via the local account if the RADIUS server is unreachable. no admin authentication local fallback Do not allow administrators to login via the local account if the RADIUS server is unreachable. admin authentication radius admin authentication radius <name> Sets the RADIUS profile to use for authentication of administrator logins. no admin authentication radius Sets the authentication of administrator logins to occur using the specified RADIUS profile. <name> clock summer-time RADIUS profile name. clock summer-time Enables support for daylight savings time. no clock summer-time Disables support for daylight savings time. clock timezone clock timezone <gmtdiff> Sets the time zone the MSM313/MSM323 is operating in. <gmtdiff> ip http port Offset from GMT as follows: +-HOUR:MIN. For example, Eastern Standard time is -5:00. ip http port <number> Sets the port number to use for HTTP access to the MSM. <number> Port number. Range: Description HTTP connections made to this port are met with a warning and the browser is redirected to the secure web server port. By default. this parameter is set to port 80.

31 HP MSM313/MSM323 CLI Reference Guide 31 2 CLI commands ip https port ip https port <number> Sets the port number used for HTTPS access to the MSM. <number> Port number. Range: ntp protocol ntp protocol (ntp sntp) Sets the network time protocol to use. ntp server ntp server Enable this option to have the MSM periodically contact a network time server to update its internal clock. no ntp server Disables the use of a network time server. snmp-server trap certificate-expired snmp-server trap certificate-expired Send a trap when the SSL certificate has expired. A trap is sent every 12 hours. no snmp-server trap certificate-expired Do not send a trap when the SSL certificate has expired. snmp-server trap certificate-expires-soon snmp-server trap certificate-expires-soon Send a trap when the SSL certificate is about to expire. A trap is sent every 12 hours starting 15 days before the certificate expires. no snmp-server trap certificate-expires-soon Do not send a trap when the SSL certificate is about to expire. snmp-server trap web-fail snmp-server trap web-fail Send a trap each time an administrator login is refused. no snmp-server trap web-fail Do not send a trap each time an administrator login is refused.

32 HP MSM313/MSM323 CLI Reference Guide 32 2 CLI commands snmp-server trap web-login snmp-server trap web-login Send a trap each time an administrator login is accepted. no snmp-server trap web-login Do not send a trap each time an administrator login is accepted. snmp-server trap web-logout snmp-server trap web-logout Send a trap each time an administrator logs out. no snmp-server trap web-logout Do not send a trap each time an administrator logs out. web admin kickout web admin kickout Enables a new administrator login to terminate an existing administrator session. no web admin kickout Stops a new administrator from logging in until an existing administrator logs out. web allow web allow <ip address>/<mask> Adds an address to the list of hosts that can access the management tool. no web allow <ip address>/<mask> Removes the specified address from the list of hosts that can access the management tool. <address> </mask> IP address. world-mode dot11 country code Subnet mask in CIDR format. Specifies the number of bits in the mask. world-mode dot11 country code <code> Specifies the country the MSM is operating in. <code> An ISO3166 three-letter country code. web access internet-port web access internet-port Enables access to the management tool via the Internet port.

33 HP MSM313/MSM323 CLI Reference Guide 33 2 CLI commands no web access internet-port Blocks access to the management tool via the Internet port. web access lan-port web access lan-port Enables access to the management tool via the LAN port. no web access lan-port Blocks access to the management tool via the LAN port. web access wireless web access wireless Enables access to the management tool via the wireless port. no web access wireless Blocks access to the management tool via the wireless port. web access interface vlan web access interface vlan <name> Enables access to the management tool via the specified VLAN. no web access interface vlan <name> Removes access to the management tool for the specified VLAN. web access interface gre web access interface gre <name> Enables access to the management tool via the specified GRE tunnel. no web access interface gre <name> Disables access to the management tool via the specified GRE tunnel. web access local mesh web access local mesh <name> Enables access to the management tool via the specified local mesh. no web access local mesh <name> Disables access to the management tool via the specified local mesh. web access lan web access lan Enables access to the management tool via the LAN port. no web access lan Blocks access to the management tool via the LAN port.

34 HP MSM313/MSM323 CLI Reference Guide 34 2 CLI commands web access vpn web access vpn Enables access to the management tool via a VPN connection. no web access vpn Blocks access to the management tool via a VPN connection. dhcp mode dhcp mode (server relay none) Sets whether the MSM operates as a DHCP server or DHCP relay agent. dhcp server dhcp server lan Switches to the DHCP server context. dhcp server default domain name dhcp server default domain name <domain> Sets the DHCP server domain name. dhcp server default lease period dhcp server default lease period <number> Sets the default lease time for the DHCP server. dhcp server default permanent lease period dhcp server default permanent lease period <number> Sets the permanent lease time for the DHCP server. dhcp server logout html user dhcp server logout html user Logout HTML user upon discover request. no dhcp server logout html user Do not logout HTML user upon discover request. dhcp relay dhcp relay <primary-ip-address> <[secondary-ip-address]> Sets the primary and secondary DHCP server for the relay.