HP MSR SERIES

To Next Page

HP MSR Router Series

Security

Command Reference(V7)

Part number: 5998-6475

Software version: CMW710-R0106

Document version: 6PW101-20140807

Main Page

Legal and Notice Information2
Table of Contents3
AAA Commands15
- General AAA Commands15
- Local User Commands46
- RADIUS Commands59
- HWTACACS Commands92
- LDAP Commands112
802.1X Commands124
- Display Dot1X124
- Display Dot1X Connection127
- Dot1X130
- Dot1X Authentication-Method131
- Dot1X Auth-Fail Vlan132
- Dot1X Critical Vlan133
- Dot1X Domain-Delimiter133
- Dot1X Guest-Vlan134
- Dot1X Handshake135
- Dot1X Handshake Secure136
- Dot1X Mandatory-Domain137
- Dot1X Max-User137
- Dot1X Multicast-Trigger138
- Dot1X Port-Control139
- Dot1X Port-Method140
- Dot1X Quiet-Period140
- Dot1X Re-Authenticate141
- Dot1X Re-Authenticate Server-Unreachable Keep-Online142
- Dot1X Retry142
- Dot1X Smarton143
- Dot1X Smarton Password144
- Dot1X Smarton Retry145
- Dot1X Smarton Switchid146
- Dot1X Smarton Timer Supp-Timeout146
- Dot1X Timer147
- Dot1X Unicast-Trigger149
- Reset Dot1X Guest-Vlan150
- Reset Dot1X Statistics150
MAC Authentication Commands151
- Display Mac-Authentication151
- Display Mac-Authentication Connection153
- Mac-Authentication155
- Mac-Authentication Domain156
- Mac-Authentication Host-Mode157
- Mac-Authentication Max-User158
- Mac-Authentication Re-Authenticate Server-Unreachable Keep-Online158
- Mac-Authentication Timer159
- Mac-Authentication Timer Auth-Delay160
- Mac-Authentication User-Name-Format161
- Reset Mac-Authentication Statistics162
Portal Commands164
- Display Portal Interface164
- Display Portal Packet Statistics166
- Display Portal Rule168
- Display Portal Server172
- Display Portal User174
- Display Portal Web-Server175
- Ipv6177
- Port178
- Portal { Bas-Ip | Bas-Ipv6179
- Portal Apply Web-Server180
- Portal Delete-User181
- Portal Domain182
- Portal Enable182
- Portal Fail-Permit Server183
- Portal Free-All Except Destination184
- Portal Free-Rule185
- Portal Free-Rule Source187
- Portal Ipv6 Free-All Except Destination187
- Portal Ipv6 Layer3 Source188
- Portal Ipv6 User-Detect189
- Portal Layer3 Source191
- Portal Max-User192
- Portal Roaming Enable192
- Portal Server193
- Portal User-Detect194
- Portal Web-Server195
- Reset Portal Packet Statistics196
- Server-Detect (Portal Authentication Server View)196
- Server-Detect (Portal Web Server View)197
- Url198
- Url-Parameter199
- User-Sync200
- Vpn-Instance201
Port Security Commands203
- Display Port-Security203
- Display Port-Security Mac-Address Block205
- Display Port-Security Mac-Address Security207
- Port-Security Authorization Ignore209
- Port-Security Enable210
- Port-Security Intrusion-Mode210
- Port-Security Mac-Address Security211
- Port-Security Mac-Move Permit213
- Port-Security Max-Mac-Count214
- Port-Security Ntk-Mode215
- Port-Security Oui215
- Port-Security Port-Mode216
- Port-Security Timer Autolearn Aging219
- Port-Security Timer Disableport220
Password Control Commands221
- Display Password-Control221
- Display Password-Control Blacklist222
- Password-Control { Aging | Composition | History | Length } Enable223
- Password-Control Aging224
- Password-Control Alert-Before-Expire226
- Password-Control Complexity226
- Password-Control Composition227
- Password-Control Enable229
- Password-Control Expired-User-Login230
- Password-Control History231
- Password-Control Length232
- Password-Control Login Idle-Time233
- Password-Control Login-Attempt234
- Password-Control Super Aging236
- Password-Control Super Composition236
- Password-Control Super Length237
- Password-Control Update-Interval238
- Reset Password-Control Blacklist239
- Reset Password-Control History-Record239
Public Key Management Commands241
- Display Public-Key Local Public241
- Display Public-Key Peer245
- Peer-Public-Key End246
- Public-Key Local Create247
- Public-Key Local Destroy250
- Public-Key Local Export Dsa252
- Public-Key Local Export Rsa254
- Public-Key Peer256
- Public-Key Peer Import Sshkey257
PKI Commands258
- Attribute258
- Ca Identifier259
- Certificate Request Entity260
- Certificate Request from261
- Certificate Request Mode262
- Certificate Request Polling263
- Certificate Request Url264
- Common-Name265
- Country265
- Crl Check266
- Crl Url266
- Display Pki Certificate Access-Control-Policy268
- Display Pki Certificate Attribute-Group269
- Display Pki Certificate Domain270
- Display Pki Certificate Request-Status274
- Display Pki Crl276
- Fqdn277
- Ldap-Server279
- Locality280
- Organization280
- Organization-Unit281
- Pki Abort-Certificate-Request281
- Pki Certificate Access-Control-Policy282
- Pki Certificate Attribute-Group283
- Pki Delete-Certificate283
- Pki Domain285
- Pki Entity285
- Pki Export286
- Pki Import293
- Pki Request-Certificate297
- Pki Retrieve-Certificate298
- Pki Retrieve-Crl299
- Pki Storage300
- Pki Validate-Certificate301
- Public-Key Dsa303
- Public-Key Rsa304
- Root-Certificate Fingerprint305
- Rule307
- Source308
- State309
- Usage309
Ipsec Commands311
- Ah Authentication-Algorithm311
- Description312
- Display Ipsec { Ipv6-Policy | Policy312
- Display Ipsec { Ipv6-Policy-Template | Policy-Template317
- Display Ipsec Profile318
- Display Ipsec Sa320
- Display Ipsec Statistics323
- Display Ipsec Transform-Set325
- Display Ipsec Tunnel326
- Encapsulation-Mode329
- Esp Authentication-Algorithm330
- Esp Encryption-Algorithm331
- Ike-Profile332
- Ipsec Anti-Replay Check333
- Ipsec Anti-Replay Window334
- Ipsec Apply334
- Ipsec Decrypt-Check Enable335
- Ipsec Logging Packet Enable336
- Ipsec Df-Bit336
- Ipsec Global-Df-Bit337
- Ipsec { Ipv6-Policy | Policy338
- Ipsec { Ipv6-Policy | Policy } Isakmp Template339
- Ipsec { Ipv6-Policy | Policy } Local-Address340
- Ipsec { Ipv6-Policy-Template | Policy-Template } Policy-Template341
- Ipsec Profile342
- Ipsec Sa Global-Duration343
- Ipsec Sa Idle-Time344
- Ipsec Transform-Set345
- Local-Address346
- Pfs346
- Protocol347
- Qos Pre-Classify348
- Remote-Address349
- Reset Ipsec Sa350
- Reset Ipsec Statistics351
- Reverse-Route Dynamic352
- Reverse-Route Preference353
- Reverse-Route Tag354
- Sa Duration354
- Sa Hex-Key Authentication355
- Sa Hex-Key Encryption356
- Sa Idle-Time358
- Sa Spi358
- Sa String-Key359
- Security Acl361
- Snmp-Agent Trap Enable Ipsec362
- Transform-Set363
IKE Commands365
- Authentication-Algorithm365
- Authentication-Method365
- Certificate Domain366
- Display Ike Proposal368
- Display Ike Sa369
- Dpd372
- Encryption-Algorithm373
- Exchange-Mode374
- Ike Dpd375
- Ike Identity376
- Ike Invalid-Spi-Recovery Enable377
- Ike Keepalive Interval378
- Ike Keepalive Timeout378
- Ike Keychain379
- Ike Limit380
- Ike Nat-Keepalive381
- Ike Profile381
- Ike Proposal382
- Ike Signature-Identity From-Certificate383
- Inside-Vpn384
- Keychain385
- Local-Identity385
- Match Local Address (IKE Keychain View)386
- Match Local Address (IKE Profile View)387
- Match Remote388
- Pre-Shared-Key390
- Priority (IKE Keychain View)391
- Priority (IKE Profile View)392
- Proposal392
- Reset Ike Sa393
- Reset Ike Statistics394
- Sa Duration394
- Snmp-Agent Trap Enable Ike395
SSH Commands397
- SSH Server Commands397
- SSH Client Commands409
SSL Commands435
- SSL Server Policy Configuration Commands435
- SSL Client Policy Configuration Commands440
ASPF Commands446
- Aspf Apply Policy446
- Aspf Policy447
- Detect447
- Display Aspf All449
- Display Aspf Interface450
- Display Aspf Policy450
- Display Aspf Session451
- Icmp-Error Drop454
- Reset Aspf Session455
- Tcp Syn-Check456
APR Commands457
- App-Group457
- Application Statistics Enable457
- Copy App-Group459
- Description459
- Display App-Group460
- Display Application462
- Display Application Statistics464
- Display Application Statistics Top467
- Display Port-Mapping Pre-Defined469
- Display Port-Mapping User-Defined470
- Include Application471
- Port-Mapping472
- Port-Mapping Acl473
- Port-Mapping Host474
- Port-Mapping Subnet475
- Reset Application Statistics477
Session Management Commands478
- Display Session Aging-Time Application478
- Display Session Aging-Time State479
- Display Session Relation-Table480
- Display Session Statistics482
- Display Session Table484
- Reset Session Table Ipv4490
- Reset Session Table Ipv6491
- Reset Session Table492
- Reset Session Statistics492
- Reset Session Relation-Table493
- Session Aging-Time Application494
- Session Aging-Time State495
- Session Log Bytes-Active497
- Session Log Enable497
- Session Log Packets-Active498
- Session Log Time-Active499
- Session Persistent Acl500
Connection Limit Commands502
- Connection-Limit Apply502
- Connection-Limit Apply Global503
- Connection-Limit503
- Display Connection-Limit504
- Display Connection-Limit Ipv6-Stat-Nodes507
- Display Connection-Limit Statistics509
- Display Connection-Limit Stat-Nodes510
- Limit513
- Reset Connection-Limit Statistics515
Object Group Commands516
- Description516
- Display Object Group516
- Network (Ipv4 Address Object Group View)518
- Network (Ipv6 Address Object Group View)520
- Object-Group522
- Port (Port Object Group View)523
- Service (Service Object Group View)525
IP Source Guard Commands528
- Display Ip Source Binding528
- Display Ipv6 Source Binding530
- Ip Source Binding (Interface View)531
- Ip Verify Source532
- Ipv6 Source Binding (Interface View)533
- Ipv6 Verify Source534
ARP Attack Protection Commands536
- Unresolvable IP Attack Protection Commands536
- Source MAC-Based ARP Attack Detection Commands538
- ARP Packet Source MAC Consistency Check Commands542
  - Arp Valid-Check Enable542
- ARP Active Acknowledgement Commands542
  - Arp Active-Ack Enable542
- Authorized ARP Commands543
  - Arp Authorized Enable543
- ARP Detection Commands544
- ARP Scanning and Fixed ARP Commands548
  - Arp Fixup548
  - Arp Scan548
- ARP Gateway Protection Commands549
  - Arp Filter Source549
- ARP Filtering Commands550
  - Arp Filter Binding550
Ipv4 Urpf Commands552
- Display Ip Urpf552
- Ip Urpf553
Ipv6 Urpf Commands555
- Display Ipv6 Urpf555
- Ipv6 Urpf556
Crypto Engine Commands558
- Crypto-Engine Accelerator Disable558
- Display Crypto-Engine558
- Display Crypto-Engine Statistics560
- Reset Crypto-Engine Statistics561
FIPS Commands563
- Display Fips Status563
- Fips Mode Enable563
- Fips Self-Test565
Attack Detection and Prevention Commands569
- Ack-Flood Action569
- Ack-Flood Detect570
- Ack-Flood Detect Non-Specific571
- Ack-Flood Threshold572
- Attack-Defense Apply Policy572
- Attack-Defense Local Apply Policy573
- Attack-Defense Policy574
- Attack-Defense Signature Log Non-Aggregate575
- Blacklist Enable575
- Blacklist Global Enable576
- Blacklist Ip577
- Blacklist Ipv6578
- Blacklist Logging Enable579
- Client-Verify Dns Enable580
- Client-Verify Http Enable580
- Client-Verify Protected Ip581
- Client-Verify Protected Ipv6582
- Client-Verify Tcp Enable583
- Display Attack-Defense Flood Statistics Ip584
- Display Attack-Defense Flood Statistics Ipv6587
- Display Attack-Defense Policy589
- Display Attack-Defense Policy Ip594
- Display Attack-Defense Policy Ipv6596
- Display Attack-Defense Scan Attacker Ip598
- Display Attack-Defense Scan Attacker Ipv6599
- Display Attack-Defense Scan Victim Ip601
- Display Attack-Defense Scan Victim Ipv6602
- Display Attack-Defense Statistics Interface604
- Display Attack-Defense Statistics Local608
- Display Blacklist Ip613
- Display Blacklist Ipv6614
- Display Client-Verify Protected Ip616
- Display Client-Verify Protected Ipv6619
- Display Client-Verify Trusted Ip622
- Display Client-Verify Trusted Ipv6624
- Dns-Flood Action627
- Dns-Flood Detect628
- Dns-Flood Detect Non-Specific629
- Dns-Flood Port630
- Dns-Flood Threshold631
- Exempt Acl631
- Fin-Flood Action632
- Fin-Flood Detect633
- Fin-Flood Detect Non-Specific634
- Fin-Flood Threshold635
- Http-Flood Action636
- Http-Flood Detect637
- Http-Flood Detect Non-Specific638
- Http-Flood Port639
- Http-Flood Threshold640
- Icmp-Flood Action641
- Icmp-Flood Detect Ip641
- Icmp-Flood Detect Non-Specific642
- Icmp-Flood Threshold643
- Icmpv6-Flood Action644
- Icmpv6-Flood Detect Ipv6645
- Icmpv6-Flood Detect Non-Specific646
- Icmpv6-Flood Threshold647
- Reset Attack-Defense Policy Flood647
- Reset Attack-Defense Statistics Interface648
- Reset Attack-Defense Statistics Local648
- Reset Blacklist Ip649
- Reset Blacklist Ipv6650
- Reset Blacklist Statistics650
- Reset Client-Verify Protected Statistics651
- Reset Client-Verify Trusted651
- Rst-Flood Action652
- Rst-Flood Detect653
- Rst-Flood Detect Non-Specific654
- Rst-Flood Threshold655
- Scan Detect655
- Signature { Large-Icmp | Large-Icmpv6 } Max-Length657
- Signature Detect658
- Signature Level Action661
- Signature Level Detect662
- Syn-Ack-Flood Action663
- Syn-Ack-Flood Detect663
- Syn-Ack-Flood Detect Non-Specific665
- Syn-Ack-Flood Threshold665
- Syn-Flood Action666
- Syn-Flood Detect667
- Syn-Flood Detect Non-Specific668
- Syn-Flood Threshold669
- Udp-Flood Action670
- Udp-Flood Detect671
- Udp-Flood Detect Non-Specific672
- Udp-Flood Threshold672
Support and Other Resources674
- Contacting HP674
  - Subscription Service674
- Related Information674
  - Documents674
  - Websites674
- Conventions675
- Command Conventions675
Index677

Table of Contents

Other manuals for HP MSR SERIES

Related product manuals