CloudEngine 8800&7800&6800&5800 Series

Switches
V200R001C00

Configuration Guide - Basic

Configuration

Issue 05
Date 2017-05-08

HUAWEI TECHNOLOGIES CO., LTD.

Copyright © Huawei Technologies Co., Ltd. 2017. All rights reserved.
No part of this document may be reproduced or transmitted in any form or by any means without prior written
consent of Huawei Technologies Co., Ltd.

Trademarks and Permissions

and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.
All other trademarks and trade names mentioned in this document are the property of their respective
holders.

Notice
The purchased products, services and features are stipulated by the contract made between Huawei and the
customer. All or part of the products, services and features described in this document may not be within the
purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information,
and recommendations in this document are provided "AS IS" without warranties, guarantees or
representations of any kind, either express or implied.

The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute a warranty of any kind, express or implied.

Huawei Technologies Co., Ltd.

Address: Huawei Industrial Base
Bantian, Longgang
Shenzhen 518129
People's Republic of China

Website: [Link]

Issue 05 (2017-05-08) Huawei Proprietary and Confidential i

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration About This Document

About This Document

Intended Audience
This document provides the basic concepts, configuration procedures, and configuration
examples in different application scenarios of the Basic configuration supported by the
device.

This document is intended for:

l Data configuration engineers

l Commissioning engineers
l Network monitoring engineers
l System maintenance engineers

Symbol Conventions
The symbols that may be found in this document are defined as follows.

Symbol Description

Indicates an imminently hazardous situation

which, if not avoided, will result in death or
serious injury.

Indicates a potentially hazardous situation

which, if not avoided, could result in death
or serious injury.

Indicates a potentially hazardous situation

which, if not avoided, may result in minor
or moderate injury.

Indicates a potentially hazardous situation

which, if not avoided, could result in
equipment damage, data loss, performance
deterioration, or unanticipated results.
NOTICE is used to address practices not
related to personal injury.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential ii

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration About This Document

Symbol Description

NOTE Calls attention to important information,

best practices and tips.
NOTE is used to address information not
related to personal injury, equipment
damage, and environment deterioration.

Command Conventions
The command conventions that may be found in this document are defined as follows.

Convention Description

Boldface The keywords of a command line are in boldface.

Italic Command arguments are in italics.

[] Items (keywords or arguments) in brackets [ ] are optional.

{ x | y | ... } Optional items are grouped in braces and separated by

vertical bars. One item is selected.

[ x | y | ... ] Optional items are grouped in brackets and separated by

vertical bars. One item is selected or no item is selected.

{ x | y | ... }* Optional items are grouped in braces and separated by

vertical bars. A minimum of one item or a maximum of all
items can be selected.

[ x | y | ... ]* Optional items are grouped in brackets and separated by

vertical bars. Several items or no item can be selected.

&<1-n> The parameter before the & sign can be repeated 1 to n

times.

# A line starting with the # sign is comments.

Interface Numbering Conventions

Interface numbers used in this manual are examples. In device configuration, use the existing
interface numbers on devices.

Security Conventions
l Password setting

Issue 05 (2017-05-08) Huawei Proprietary and Confidential iii

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration About This Document

– When configuring a password, the cipher text is recommended. To ensure device

security, change the password periodically.
– When you configure a password in plain text that starts and ends with %^%#......%^
%# (the password can be decrypted by the device), the password is displayed in the
same manner as the configured one in the configuration file. Do not use this setting.
– When you configure a password in cipher text, different features cannot use the
same cipher-text password. For example, the cipher-text password set for the AAA
feature cannot be used for other features.
– After the system software is downgraded and the switch restarts with the
configuration of the higher version, AAA, VTY, serial interface login, and SNMP
user passwords become invalid. As a result, users fail to log in to the switch using
the passwords and the switch is disconnected from the network management
system.
To address this problem, take the following measures:
i. If no password is configured for the console port, log in to the device through
the console port, and reconfigure AAA and password for users such as VTY
and SNMP users. To improve security, the console port password is
recommended.
ii. If a password is configured for login through the console port, the password
becomes invalid after the downgrade and you cannot log in to the switch
through the console port. Perform the following steps:
1) Connect to the console port.
2) Power recycle the device. During the startup, enter Ctrl+B according to
the prompt to enter the BIOS menu. The default password is
Admin@[Link].
3) Select [Link] console password to delete and change the console port
password.
4) Restart the device, log in to the device through the console port, and
reconfigure the password for AAA, VTY, or SNMP user.
l Encryption algorithm
Currently, the device uses the following encryption algorithms: DES, 3DES, AES, DSA,
RSA, DH, ECDH, HMAC, SHA1, SHA2, PBKDF2, scrypt, and MD5. The encryption
algorithm depends on the applicable scenario. Use the recommended encryption
algorithm; otherwise, security defense requirements may be not met.
– For the symmetrical encryption algorithm, use AES with the key of 256 bits or
more.
– When you need to use an asymmetric cryptography, RSA (2048-bit or longer key)
is recommended. In addition, use different key pairs for encryption and signature.
– For the digital signature, RSA (2048-bit or longer key) or DSA (2048-bit or longer
key) is recommended.
– For key negotiation, DH (2048-bit or longer key) or ECDH (256-bit or longer key)
is recommended.
– For the hash algorithm, use SHA with the key of 256 bits or more.
– For the HMAC algorithm, use HMAC-SHA2.
– DES, 3DES, RSA and AES are reversible encryption algorithm. If protocols are
used for interconnection, the locally stored password must be reversible.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential iv

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration About This Document

– SHA1, SHA2, and MD5 are irreversible encryption algorithm. When configuring a
password for local administrator, it is recommended that you use the SHA2
irreversible encryption algorithm.
– To prevent brute force cracking of the user password, the iteration algorithm is
added to the password on the basis of salts. The iteration algorithm uses PBKDF2
or scrypt key export algorithm.
– The ECB mode has a poor capability of defending against plaintext playback
attacks, so ECB is not recommended for password encryption.
– In SSH2.0, the symmetric cryptography using the CBC mode may undergo the
plaintext-recovery attack to cause a data leak. Therefore, the CBC mode is not
recommended for SSH2.0.
l Personal data
Some personal data may be obtained or used during operation or fault location of your
purchased products, services, features, so you have an obligation to make privacy
policies and take measures according to the applicable law of the country to protect
personal data.
l The terms mirrored port, port mirroring, traffic mirroring, and mirroring in this manual
are mentioned only to describe the product's function of communication error or failure
detection, and do not involve collection or processing of any personal information or
communication data of users.

Declaration
This manual is only a reference for you to configure your devices. The contents in the manual,
such as command line syntax, and command outputs, are based on the device conditions in
the lab. The manual provides instructions for general scenarios, but do not cover all usage
scenarios of all product models. The contents in the manual may be different from your actual
device situations due to the differences in software versions, models, and configuration files.
The manual will not list every possible difference. You should configure your devices
according to actual situations.
The specifications provided in this manual are tested in lab environment (for example, the
tested device has been installed with a certain type of boards or only one protocol is run on
the device). Results may differ from the listed specifications when you attempt to obtain the
maximum values with multiple functions enabled on the device.

Mappings between Product Software Versions and NMS

Versions
The mappings between product software versions and NMS versions are as follows.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential v

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration About This Document

CE8800&7800&6800&5800 NMS
series switches Product
Software Version

V200R001C00 eSight V300R006C00/iManager U2000 V200R016C50

(iManager U2000 V200R017C50 for CE6870EI and
CE7855EI)

Mappings between Product Software Versions and

Controller Versions
The mappings between product software versions and Controller versions are as follows.

CE8800&7800&6800&5800 Controller
series switches Product
Software Version

V200R001C00 Agile Controller - DCN V200R001C00

Change History
Changes between document issues are cumulative. Therefore, the latest document version
contains all updates made to previous versions.

Changes in Issue 06 (2017-09-12) for Product Version V200R001C00

This version has the following updates:
The documentation is updated according to product feature.

Changes in Issue 05 (2017-05-08) for Product Version V200R001C00

This version has the following updates:
The documentation is updated according to product feature.

Changes in Issue 04 (2016-12-31) for Product Version V200R001C00

This version has the following updates:
The documentation is updated according to product feature.

Changes in Issue 03 (2016-09-10) for Product Version V200R001C00

This version has the following updates:
The documentation is updated according to product feature.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential vi

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration About This Document

Changes in Issue 02 (2016-07-20) for Product Version V200R001C00

This version has the following updates:
The documentation is updated according to product feature.

Changes in Issue 01 (2016-04-15) for Product Version V200R001C00

Initial commercial release.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential vii

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration Contents

Contents

About This Document.....................................................................................................................ii

1 CLI Overview................................................................................................................................. 1
1.1 How to Use Command Lines..........................................................................................................................................1
1.1.1 Entering Command Views...........................................................................................................................................1
1.1.2 Selecting a Mode for the Configuration to Take Effect...............................................................................................3
1.1.3 Intelligent Command Backtracking.............................................................................................................................5
1.1.4 Setting Command Levels.............................................................................................................................................6
1.1.5 Editing Command Lines.............................................................................................................................................. 7
1.1.6 Using Command Line Online Help............................................................................................................................. 9
1.1.7 Interpreting Command Line Error Messages.............................................................................................................11
1.1.8 Using the undo Command Line................................................................................................................................. 11
1.1.9 Displaying History Commands................................................................................................................................. 12
1.1.10 Using Command Line Shortcut Keys...................................................................................................................... 14
1.1.11 Configuring an Alias for a Command......................................................................................................................16
1.2 Displaying the Command Output................................................................................................................................. 17
1.2.1 Displaying Command Line Configurations...............................................................................................................17
1.2.2 Controlling the Display Mode of Commands............................................................................................................17
1.2.3 Filtering Command Outputs...................................................................................................................................... 18

2 ZTP Configuration...................................................................................................................... 23
2.1 Introduction to ZTP...................................................................................................................................................... 23
2.2 Principles...................................................................................................................................................................... 24
2.2.1 Implementation.......................................................................................................................................................... 24
2.2.2 Intermediate File in INI Format.................................................................................................................................27
2.2.3 Intermediate File in Python Format...........................................................................................................................29
2.2.4 Automatic Stacking in ZTP....................................................................................................................................... 56
2.2.5 Checking the Integrity of Version Files..................................................................................................................... 57
2.2.6 Installing Licenses in a Batch.................................................................................................................................... 57
2.3 Configuration Notes..................................................................................................................................................... 58
2.4 Default Configuration...................................................................................................................................................60
2.5 Configuring an Unconfigured Device to Implement Automatic Deployment Using a USB Flash Drive................... 60
2.5.1 Enabling the ZTP Function........................................................................................................................................60
2.5.2 Editing the Intermediate File..................................................................................................................................... 61

Issue 05 (2017-05-08) Huawei Proprietary and Confidential viii

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration Contents

2.5.3 Powering on the Device.............................................................................................................................................61

2.5.4 Checking the Configuration.......................................................................................................................................61
2.6 Configuring an Unconfigured Device to Implement Automatic Deployment Through DHCP...................................62
2.6.1 Enabling the ZTP Function........................................................................................................................................62
2.6.2 Editing an Intermediate File...................................................................................................................................... 62
2.6.3 Configuring the DHCP Server or DHCP Relay Agent..............................................................................................63
2.6.4 Configuring the File Server....................................................................................................................................... 65
2.6.5 Powering on the Device.............................................................................................................................................66
2.6.6 Checking the Configuration.......................................................................................................................................66
2.7 Configuration Examples............................................................................................................................................... 67
2.7.1 Example for Configuring Unconfigured Devices to Implement Automatic Deployment Using a USB Flash Drive
............................................................................................................................................................................................ 67
2.7.2 Example for Configuring Unconfigured Devices to Implement Automatic Deployment Through DHCP.............. 68
2.7.3 Example for Configuring Unconfigured Devices to Implement Automatic Deployment and Set up a Stack
Through DHCP...................................................................................................................................................................94

3 USB-based Deployment Configuration................................................................................ 121

3.1 USB-based Deployment Overview............................................................................................................................ 121
3.2 Principles.................................................................................................................................................................... 122
3.3 Configuration Notes................................................................................................................................................... 125
3.4 Making an Index File..................................................................................................................................................127
3.5 Configuring USB-based Deployment.........................................................................................................................132
3.6 (Optional) Disabling the USB-based Deployment Function...................................................................................... 134
3.7 Configuration Examples............................................................................................................................................. 135
3.7.1 Example for Configuring USB-based Deployment.................................................................................................135

4 Logging In to the System for the First Time........................................................................ 137

4.1 First Login Overview..................................................................................................................................................137
4.2 Logging In Through a Console Port........................................................................................................................... 138
4.3 Logging In Through the Mini USB Port.................................................................................................................... 145
4.4 Configuration Example...............................................................................................................................................151
4.4.1 Example for Performing Basic Configuration on the Device at First Login...........................................................151

5 Configuring a User Interface...................................................................................................153

5.1 User Interface Overview.............................................................................................................................................153
5.2 Configuring the Console User Interface..................................................................................................................... 155
5.2.1 Configuring the Physical Attributes of the Console User Interface........................................................................ 156
5.2.2 Configuring Terminal Attributes on the Console User Interface.............................................................................157
5.2.3 Configuring the User Level on the Console User Interface.................................................................................... 158
5.2.4 Configuring the User Authentication Mode on the Console User Interface........................................................... 159
5.2.5 Checking the Configurations................................................................................................................................... 161
5.3 Configuring the VTY User Interface..........................................................................................................................162
5.3.1 Configuring the Maximum Number of Concurrent VTY User Interfaces.............................................................. 162
5.3.2 (Optional) Configuring Restrictions on ACL-based Logins on the VTY User Interface........................................163
5.3.3 Configuring Terminal Attributes on the VTY User Interface................................................................................. 164

Issue 05 (2017-05-08) Huawei Proprietary and Confidential ix

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration Contents

5.3.4 Configuring the User Level on the VTY User Interface......................................................................................... 165
5.3.5 Configuring the Authentication Mode for VTY Users............................................................................................166
5.3.6 (Optional) Enabling the Function of Blocking IP Addresses in VTY Access Scenarios........................................168
5.3.7 (Optional) Enabling the VTY User Interface's Security Policy.............................................................................. 168
5.3.8 Checking the Configurations................................................................................................................................... 169
5.4 Configuration Examples............................................................................................................................................. 169
5.4.1 Example of Configuring the Console User Interface.............................................................................................. 169
5.4.2 Example of Configuring a VTY User Interface...................................................................................................... 171

6 Configuring User Login........................................................................................................... 173

6.1 User Login Overview................................................................................................................................................. 173
6.2 Logging In to the Device............................................................................................................................................ 177
6.2.1 Logging In to the Device Through a Console Port..................................................................................................177
6.2.2 Logging In to the Device Through Telnet............................................................................................................... 181
6.2.3 Logging In to the Device Through STelnet............................................................................................................. 186
6.2.4 Common Operations After Login............................................................................................................................200
6.3 Configuring the Device as the Client to Log In to Another Device........................................................................... 201
6.3.1 Configuring the Device as the Telnet Client to Log In to Another Device............................................................. 201
6.3.2 Configuring the Device as the STelnet Client to Log In to Another Device...........................................................203
6.4 Configuration Examples............................................................................................................................................. 210
6.4.1 Example for Logging In to the Device Through a Console Port.............................................................................210
6.4.2 Example for Logging In to the Device Through Telnet.......................................................................................... 213
6.4.3 Example for Logging In to the Device Through STelnet........................................................................................ 215
6.4.4 Example for Configuring the Device as the Telnet Client to Log In to Another Device........................................ 226
6.4.5 Example for Configuring the Device as the STelnet Client to Log In to Another Device...................................... 228
6.5 Common Configuration Errors................................................................................................................................... 235
6.5.1 Failing to Log In to the Telnet Server Through Telnet............................................................................................ 235
6.5.2 Failing to Log In to the SSH Server Through STelnet............................................................................................ 236

7 File Management....................................................................................................................... 238

7.1 File System Overview................................................................................................................................................ 238
7.2 File Management Modes............................................................................................................................................ 241
7.3 Local File Management.............................................................................................................................................. 244
7.3.1 Logging In to the Device to Manage Files.............................................................................................................. 244
7.3.2 Managing Files When the Device Functions as an FTP Server.............................................................................. 246
7.3.3 Managing Files When the Device Functions as an SFTP Server............................................................................ 253
7.3.4 Managing Files When the Device Functions as an SCP Server.............................................................................. 266
7.4 File Management on Other Devices........................................................................................................................... 276
7.4.1 Managing Files When the Device Functions as a TFTP Client.............................................................................. 276
7.4.2 Managing Files When the Device Functions as an FTP Client............................................................................... 279
7.4.3 Managing Files When the Device Functions as an SFTP Client.............................................................................285
7.4.4 Managing Files When the Device Functions as an SCP Client...............................................................................292
7.5 Configuration Examples............................................................................................................................................. 298
7.5.1 Example of Logging In to the Device to Manage Files...........................................................................................298

Issue 05 (2017-05-08) Huawei Proprietary and Confidential x

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration Contents

7.5.2 Example for Managing Files When the Device Functions as an FTP Server......................................................... 299
7.5.3 Example for Managing Files Using SFTP When the Device Functions as an SSH Server.................................... 302
7.5.4 Example for Managing Files When the Device Functions as a TFTP Client..........................................................304
7.5.5 Example for Managing Files When the Device Functions as an FTP Client.......................................................... 305
7.5.6 Example for Managing Files When the Device Functions as an SFTP Client........................................................307
7.5.7 Example for Managing Files When the Device Functions as an SCP Client..........................................................312
7.6 Common Misconfigurations....................................................................................................................................... 314
7.6.1 FTP Login Failure................................................................................................................................................... 315
7.6.2 Failure in Uploading Files to the FTP Server..........................................................................................................317

8 Configuring System Startup....................................................................................................318

8.1 System Startup Overview........................................................................................................................................... 318
8.2 Managing Configuration Files....................................................................................................................................325
8.2.1 Saving the Configuration File..................................................................................................................................325
8.2.2 Comparing Configuration Files............................................................................................................................... 327
8.2.3 Backing Up the Configuration File......................................................................................................................... 327
8.2.4 Recovering the Configuration File.......................................................................................................................... 329
8.2.5 Clearing the Configuration File............................................................................................................................... 330
8.2.6 Rolling Back Configurations................................................................................................................................... 332
8.3 Configuring System Startup Files...............................................................................................................................334
8.4 Configuring Dynamic Module Loading..................................................................................................................... 335
8.5 Restarting the Device..................................................................................................................................................336
8.6 Configuration Examples............................................................................................................................................. 337
8.6.1 Example for Backing Up the Configuration File.....................................................................................................337
8.6.2 Example for Recovering the Configuration File..................................................................................................... 338
8.6.3 Example for Rolling Back Configurations.............................................................................................................. 339
8.6.4 Example of Configuring System Startup.................................................................................................................343

9 ISSU Configuration...................................................................................................................347
9.1 Introduction to ISSU...................................................................................................................................................347
9.2 Principles.................................................................................................................................................................... 348
9.3 Configuration Notes................................................................................................................................................... 350
9.4 Configuring ISSU....................................................................................................................................................... 353
9.4.1 (Optional) Adding a Device to a Group.................................................................................................................. 353
9.4.2 Checking ISSU Upgrade......................................................................................................................................... 353
9.4.3 Starting the ISSU Upgrade...................................................................................................................................... 354
9.4.4 Checking the Configuration.....................................................................................................................................355
9.5 Configuration Examples............................................................................................................................................. 355
9.5.1 Example for Performing an ISSU Upgrade............................................................................................................. 355

10 BIOS Menu............................................................................................................................... 362

10.1 BIOS Menu Description........................................................................................................................................... 362
10.2 BIOS Memory Test Menu........................................................................................................................................ 363
10.3 BIOS Main Menu..................................................................................................................................................... 364

Issue 05 (2017-05-08) Huawei Proprietary and Confidential xi

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration Contents

10.4 Update from serial interface..................................................................................................................................... 368

10.5 Update from ethernet interface................................................................................................................................. 369
10.5.1 Update system software.........................................................................................................................................370
10.5.2 Update system software with disk format............................................................................................................. 371
10.5.3 Modifying Parameters........................................................................................................................................... 373
10.6 Modify startup parameters........................................................................................................................................374
10.6.1 Display current startup configuration.................................................................................................................... 375
10.6.2 Modify startup configuration.................................................................................................................................375
10.7 File system................................................................................................................................................................ 376
10.7.1 Upload file to server.............................................................................................................................................. 377
10.8 DFX Submenu.......................................................................................................................................................... 378
10.9 Modify stack parameters.......................................................................................................................................... 378

11 Checking Declaration Information of an Open Source Software..................................381

Issue 05 (2017-05-08) Huawei Proprietary and Confidential xii

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

1 CLI Overview

About This Chapter

This chapter describes how to perform configuration and routine maintenance on devices by
running commands.

1.1 How to Use Command Lines

This section describes how to use command lines and some techniques to improve operating
efficiency.
1.2 Displaying the Command Output
This section describes how to query the configuration information about command lines,
control the method in which command outputs are displayed, and filter the command outputs.

1.1 How to Use Command Lines

This section describes how to use command lines and some techniques to improve operating
efficiency.

1.1.1 Entering Command Views

The device has many functions; therefore various configuration commands and query
commands are provided to facilitate device management and maintenance. Huawei switch
registers commands to different command views based on the functions of the commands so
that users can easily use them. To configure a function, enter the corresponding command
view and then run corresponding commands.

The device provides various command views. For the methods of entering the command
views except the following views, see the CloudEngine 8800&7800&6800&5800 Series
Switches Command Reference.

Common Command Views

l User view
In the user view, you can view the running status and statistics of the device.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 1

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

How To Enter: When a user logs in to the device, the user enters the user view and the
following prompt is displayed:
<HUAWEI>

l System view
In the system view, you can set the system parameters of the device, and enter other
function views from this view.
How To Enter: Run the system-view command and press Enter in the user view. The
system view is displayed.
<HUAWEI> system-view
Enter system view, return user view with return command.
[~HUAWEI]

l Interface view
In the interface view, you can configure interface parameters including physical
attributes, link layer protocols, and IP addresses.
How To Enter: Run the interface command and specify an interface type and number to
enter the interface [Link] interface 10GE is used as an example.
[~HUAWEI] interface 10ge X/Y/Z
[~HUAWEI-10GEX/Y/Z]

X/Y/Z indicates the number of an interface that needs to be specified. It is in the format of
stack ID/card number/interface sequence number.
l Routing protocol view
In routing protocol views, you can configure most routing protocol parameters. The
routing protocol views include the IS-IS view, OSPF view, and RIP view.
How To Enter: Run a command to activate a routing protocol process in the system view.
The corresponding routing protocol view is displayed.
[~HUAWEI] isis
[*HUAWEI-isis-1]

The command line prompt HUAWEI is the default host name (sysname). The prompt
indicates the current view. For example, <> indicates the user view and [] indicates all other
views except the user view.

You can enter ! or # followed by a character string in any view. All entered content
(including ! and #) is displayed as comments. That is, the corresponding configuration is not
generated.

NOTE

l Some commands can be executed in multiple views, but they have different functions after being
executed in different views. For example, you can run the lldp enable command in the system view
to enable LLDP globally and in the interface view to enable LLDP on an interface.
l In the system view, you can run the diagnose command to enter the diagnostic view. Diagnostic
commands are used for device fault diagnosis. If you run some commands in the diagnostic view, the
device may fail to run properly or services may be interrupted. Contact technical support personnel
and use these diagnostic commands with caution.

Exiting Command Views

You can run the quit command to return from the current view to an upper-level view.

For example, after you run the quit command to return from the AAA view to the system
view, you can run the quit command again to return from the system view to the user view.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 2

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

[~HUAWEI-aaa] quit
[~HUAWEI] quit
<HUAWEI>

To return from the AAA view directly to the user view, press Ctrl+Z or run the return
command.
# Press Ctrl+Z to return directly to the user view.
[~HUAWEI-aaa] // Enter Ctrl+Z
<HUAWEI>

# Run the return command to return directly to the user view.

[~HUAWEI-aaa] return
<HUAWEI>

1.1.2 Selecting a Mode for the Configuration to Take Effect

The system allows configurations to take effect immediately or in two stages to ensure
reliability of user configurations.
Before configuring a service, enter the system view. After the system view is displayed, the
system initiates the corresponding configuration process based on the configured mode.
l The immediate mode is the traditional mode.
After you enter a command line and press Enter, the system performs the syntax check.
The configuration takes effect as soon as it passes the syntax check.
l In the two-stage mode, the system configuration process is divided into two stages.
– In the first stage, a user enters command lines and the system performs syntax and
semantics checks in the candidate database. If syntax or semantics errors are found
in the command lines, the system displays a message on the terminal to inform the
user of the error and the cause.
– In the second stage, a user commits the configuration, and the system enters the
configuration commitment stage. The system delivers configurations in the
candidate database to a service. If the configurations take effect, the system adds
them to the running database of the current system. During the configuration
commitment stage, the system checks the configuration validity and displays
messages when configurations in the candidate databases are identical with those in
the running databases.

Table 1-1 Advantages and disadvantages of each mode

Mode Advantage Disadvantage

Immediate mode The system can immediately Configuration errors impact

detect the configuration services immediately
impact on services. because configurations take
effect immediately. Besides,
you cannot delete
configurations from the
services as a whole but have
to delete commands one by
one.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 3

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

Mode Advantage Disadvantage

Two-stage mode l Allows several service Configurations take effect

configurations to take only after the commit
effect as a whole. command is run.
l Allows users to preview
configurations in the
candidate database.
l Clears a configuration
that does not take effect
if an error occurs or the
configuration does not
meet the expectation.
l Minimizes the impact of
configuration process on
current services.

In two-phase validation mode, you must run the commit command for the configuration to
take effect. However, you do not need to run the commit command in the following cases:
l Query commands (such as display interface) are run.
l Maintenance commands (such as slave switchover, dual-active restore,
stack upgrade fast rollback-timer, stack upgrade fast stack member, switch mode,
and reset keepalive packets count) are run.
l Commands are run to enter the existing views (such as the stack view and physical
interface view) on a physical device. For example, the interface 10ge1/0/1 command is
run.
l The existing configurations on a device are reconfigured.

Immediate Mode
Run: system-view immediately, Enable the immediate mode.
In the immediate mode, the command prompt is as follows:
<HUAWEI> system-view immediately
Enter system view, return user view with return command.
[HUAWEI]

Two-Stage Mode
1. Run: system-view, enable the two-stage mode.
2. (Optional) Run: display configuration candidate [ merge ], display all uncommitted
configurations.
If you specify the merge keyword, the command displays uncommitted configurations
and committed configurations. If you do not specify the merge keyword, the command
displays uncommitted configurations.
You can edit the uncommitted configurations.
3. (Optional) Run: clear configuration candidate, delete all the uncommitted
configurations.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 4

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

If you do not need to execute the uncommitted configurations in the current

configuration process, you can delete them.
4. Run: commit, commit configurations.

In the two-stage mode, if the user has modified configurations but has not submit the
modification, the system prompt ~ is changed to *, prompting the user that the configurations
are not submitted. After the user runs the commit command to submit the configurations, the
system prompt * is restored to ~.

The following is an example:

<HUAWEI> system-view
Enter system view, return user view with return command.
[~HUAWEI] sysname HUAWEIA
[*HUAWEI] commit
[~HUAWEIA]

The symbol * has two meanings:

1. When * is displayed in an interactive operation, it indicates the configurations that have
not been submitted.
2. After the display current-configuration inactive or display current-configuration all
command is executed, * in the command output indicates offline configuration.

NOTE

l In both the immediate mode and two-stage mode, the system can lock the configuration of a service
as soon as the service process is initiated, to prevent a service from being affected. When the
configuration is locked, users can query configurations but cannot edit or commit configurations. If
configurations fail to be committed, waiting for 30 seconds and committing configurations again are
recommended. If configurations fail to be committed again, it indicates that the configuration is
locked by a user.
l You can run the configuration exclusive command to lock a configuration. If a configuration is
locked by another user, ask the user to unlock it.
l In two-phase configuration mode, when you perform the same configurations for multiple users,
only the configuration committed first takes effect. For other users, the system prompts a
configuration conflict.

1.1.3 Intelligent Command Backtracking

Each command can be run in a specific view. For example, the vlan command can be run in
the system view. You may need to run commands in different views during service
deployment, requiring frequent view switchovers and many operation steps. As a result,
service deployment efficiency is influenced.

Commands that can be run in the system view support the intelligent backtracking function. If
a command cannot be run in the current view (a non-system and non-user view), the system
automatically backtracks to the system view. If the command can be run in the system view,
the corresponding configuration is directly delivered, reducing command operation steps.

For example, the interface command can be run in the system view. If you are performing
operations in the VLAN view, you can directly run the interface command in the VLAN view
to enter the interface view.
<HUAWEI> system-view
[~HUAWEI] vlan 2
[*HUAWEI-vlan2] interface 10ge 1/0/1
[*HUAWEI-10GE1/0/1]

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 5

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

NOTE

l In some cases, the system automatically disables the intelligent backtracking function to prevent
service deployment from being affected. You need to return to the system view to run commands
that can be run in the system view.
l Intelligent backtracking requires that a command be entered in its complete format, and the
command word cannot be automatically displayed through the question mark help function.

1.1.4 Setting Command Levels

The system divides commands into four levels and sets the command level in the specified
view. The device administrator can change the command level as required, so that a lower-
level user can use some high-level commands. The device administrator can also change the
command level to a larger value to improve device security.

Context
l The system grants users different access permissions based on their roles. User levels are
classified into sixteen levels, which correspond to the command levels. Users can use
only the commands at the same or lower level than their own levels. By default, there are
four command levels 0 to 3 and sixteen user levels 0 to 15. Table 1-2 describes the
relationship between command levels and user levels.

Table 1-2 Relationship between command levels and user levels

User Com Name Description
Leve man
l d
Leve
l

0 0 Visit level Commands of this level include network diagnosis tool

commands (such as ping and tracert), commands for
accessing external devices from the local device (such
as Telnet) and some display commands.

1 0, 1 Monitoring Commands of this level are used for system

level maintenance, including display commands.
NOTE
Some display commands are not at this level. For example,
the display current-configuration and display saved-
configuration commands are at level 3. For details about
command levels, see the CloudEngine
8800&7800&6800&5800 Series Switches Command
Reference.

2 0, 1, Configurati Commands of this level are used for service

2 on level configuration to provide direct network services,
including routing commands and commands of each
network layer.

3 to 0, 1, Manageme Commands of this level are used for basic system

15 2, 3 nt level operations, including file system, FTP, TFTP
download, user management, command level
configuration, and debugging.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 6

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

l If refined right management is required, run the command-privilege level rearrange

command to extend command levels.

NOTICE
Changing the default command level without the guidance of technical personnel is not
recommended. This may result in inconvenience for operation and maintenance and bring
about security problems.

Procedure
Step 1 Run:
system-view

The system view is displayed.

Step 2 Run:
command-privilege level level view view-name command-key

The command level is set in the specified view.

Step 3 (Optional) Run:
command-privilege level rearrange

The command levels are extended in a batch.

You can use the command only when your user level is 15.
If the level of a command has been changed using the command-privilege level command,
the level of this command remains unchanged after you run the command-privilege level
rearrange command. Levels of the other commands are changed as follows:
l The visit level and monitoring level are retained.
l The configuration level is upgraded to level 10, and the management level is upgraded to
level 15.
The original command levels 0, 1, 2, and 3 are updated to 0, 1, 10, and 15 respectively. There
are no commands at levels 2 to 9 and levels 11 to 14. You can set commands to any of these
levels to manage user rights.
Step 4 Run:
commit

The configuration is committed.

----End

1.1.5 Editing Command Lines

Editing Feature
You can edit commands in a CLI that supports multi-line edition. Each command can contain
a maximum of 1022 characters. The keywords in the commands are case insensitive. Whether
a command parameter is case sensitive or not depends on what the parameter is.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 7

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

Table 1-3 lists keys that are frequently used for command editing.

Table 1-3 Keys for command editing

Key Function

Common key Inserts a character at the current location of the cursor if the
editing buffer is not full, and the cursor moves to the right.
Otherwise, an alarm is generated.

Backspace Deletes the character on the left of the cursor and the cursor
moves to the left. When the cursor reaches the head of the
command, an alarm is generated.

Left cursor key ← or Ctrl Moves the cursor to the left by the space of a character. When
+B the cursor reaches the head of the command, an alarm is
generated.

Right cursor key → or Moves the cursor to the right by the space of a character. When
Ctrl+F the cursor reaches the end of the command, an alarm is
generated.

Operating Techniques
Incomplete Keyword
You can enter incomplete keywords on the device. In the current view, you do not need to
enter complete keywords if the entered characters can match a unique keyword. This function
improves operating efficiency.
For example, to execute the display current-configuration command, you can enter d cu, di
cu, or dis cu, but you cannot enter d c or dis c because they do not match unique keywords.

NOTICE
The maximum length of a command (including the incomplete command) to be entered is
1022 characters. If a command in incomplete form is configured, the system saves the
command to the configuration file in its complete form, which may cause the command to
have more than 1022 characters. In this case, the command in incomplete form cannot be
restored after the system restarts. Therefore, when you configure a command in incomplete
form, pay attention to the length of the command.

Tab
Enter an incomplete keyword and press Tab to complete the keyword.
l When a unique keyword matches the input, the system replaces the incomplete input
with the unique keyword and displays it in a new line with the cursor leaving a space
behind. For example:
a. Enter an incomplete keyword.
[~HUAWEI] info-

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 8

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

b. Press Tab.
The system replaces the entered keyword and displays it in a new line with the
complete keyword followed by a space.
[~HUAWEI] info-center

l When the input has multiple matches, press Tab repeatedly to display the keywords
beginning with the incomplete input in a circle until the desired keyword is displayed. In
this case, the cursor closely follows the end of the keyword. For example:
a. Enter an incomplete keyword.
[~HUAWEI] info-center log

b. Press Tab.
The system displays the prefixes of all the matched keywords. In this example, the
prefix is log.
[~HUAWEI] info-center log-severity
Press Tab to switch from one matched keyword to another. In this case, the cursor
closely follows the end of a word.
[~HUAWEI] info-center logbuffer
[~HUAWEI] info-center logfile
[~HUAWEI] info-center loghost

Stop pressing Tab when the desired keyword is displayed.

l When an incorrect keyword is entered, press Tab and it is displayed in a new line without
being changed. For example:
a. Enter an incorrect keyword.
[~HUAWEI] info-center loglog

b. Press Tab.
[~HUAWEI] info-center loglog

The system displays information in a new line, but the keyword loglog remains
unchanged and there is no space between the cursor and the keyword, indicating
that this keyword does not exist.

1.1.6 Using Command Line Online Help

When using a command line, you can use the online help to obtain real-time help without
memorizing a large number of complex commands.
When entering command lines, you can enter a question mark (?) at any time to obtain online
help. You can choose to obtain full help or partial help.

Full Help
When entering a command, you can use the full help function to obtain keywords and
parameters for the command. Use any of the following methods to obtain full help from a
command line.

l Enter a question mark (?) in any command view to obtain all the commands and their
simple descriptions. For example:
<HUAWEI> ?
Current view commands:
activate Activate locked user
backup Backup information
capture-packet Enable capturing packet
cd Change current directory
clear Clear operation
clock Clock status and configuration information

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 9

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

copy Copy from one file to another

...
l Enter some keywords of a command and a question mark (?) separated by a space. All
keywords associated with this command, as well as simple descriptions, are displayed.
For example:
<HUAWEI> system-view
[~HUAWEI] user-interface vty 0 4
[~HUAWEI-ui-vty0-4] authentication-mode ?
aaa AAA authentication
password Authentication through the password of a user terminal interface
[~HUAWEI-ui-vty0-4] authentication-mode aaa ?
| Matching output
> Redirect the output to a file
>> Redirect the output to a file in append mode
<cr>

[~HUAWEI-ui-vty0-4] authentication-mode aaa

– "aaa" and "password" are keywords. "AAA authentication" and "Authentication
through the password of a user terminal interface" describe the keywords
respectively.
– "|" indicates that you can specify a method to display matching information. For
details, see 1.2.3 Filtering Command Outputs.
– ">" indicates that you can export the command output to a specified file. If the
destination file exists, overwrite the content in the previous file.
– ">>" indicates that you can add the command output to the end of a specified file
and reserve the content in the original file.
– <cr> indicates that there is no keyword or parameter in this position. You can press
Enter to run this command.
l Enter some keywords of a command and a question mark (?) separated by a space. All
parameters associated with this keyword, as well as simple descriptions, are listed. For
example:
<HUAWEI> system-view
[~HUAWEI] ftp server timeout ?
INTEGER<1-35791> The value of FTP timeout, the default value is 30 minutes
[~HUAWEI] ftp server timeout 35 ?
| Matching output
> Redirect the output to a file
>> Redirect the output to a file in append mode
<cr>

[~HUAWEI] ftp server timeout 35

"INTEGER<1-35791>" describes the value range of the parameter. "The value of FTP
timeout, the default value is 30 minutes" briefly describes the function of this parameter.

Partial Help
If you enter only the first or first several characters of a command keyword, partial help
provides keywords that begin with this character or character string. Use any of the following
methods to obtain partial help from a command line.
l Enter a character string followed directly by a question mark (?) to display all keywords
that begin with this character string. For example:
<HUAWEI> d?
debugging delete
dir display
<HUAWEI> d
l Enter a command and a string followed directly by a question mark (?) to display all the
keywords that begin with this string. For example:

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 10

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

<HUAWEI> display b?
bfd bgp

l Enter the first several letters of a keyword in a command and press Tab to display a
complete keyword. The first several letters, however, must uniquely identify the
keyword. If they do not identify a specific keyword, press Tab continuously to display
different keywords and you can select one as required.

NOTE

The command output obtained through the online help function is used for reference only.

1.1.7 Interpreting Command Line Error Messages

If a command is entered and passes syntax check, the system executes it. Otherwise, the
system reports an error message.
Table 1-4 lists the common error messages.

Table 1-4 Common error messages of the command line

Error Message Cause of the Error

Error: Unrecognized command found No command is found.

at '^' position.
No keyword is found.

Error: Wrong parameter found at '^' The parameter type is incorrect.

position.
The parameter value exceeds the limit.

Error: Incomplete command found at The entered command is incomplete.

'^' position.

Error: Too many parameters found at Too many parameters are entered.
'^' position.

Error: Ambiguous command found at Indefinite command is entered.

'^' position.

1.1.8 Using the undo Command Line

If a command line begins with the keyword undo, it is an undo command line. The undo
command lines restore default settings of parameters, disable functions, or delete
configurations. Almost each configuration command line has a corresponding undo
command.
Some examples of using the undo command are listed as follows:
l The undo command restores the default setting.
The sysname command sets a device host name. For example:
<HUAWEI> system-view
[~HUAWEI] sysname Server
[*HUAWEI] commit
[~Server] undo sysname
[*Server] commit
[~HUAWEI]

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 11

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

l The undo command disables a specified function.

The ftp server enable command enables the FTP server function on the device. For
example:
<HUAWEI> system-view
[~HUAWEI] ftp server enable
Warning: FTP is not a secure protocol, and it is recommended to use SFTP.
[*HUAWEI] commit
[~HUAWEI] undo ftp server
Info: Succeeded in closing the FTP server.
[*HUAWEI] commit

l The undo command deletes a specified configuration.

The header command configures the header information displayed on terminals when
users log in. For example:
<HUAWEI> system-view
[~HUAWEI] header login information "Hello,Welcome to Huawei!"
[*HUAWEI] commit

Log out of the terminal and re-log in. A message "Hello, Welcome to Huawei!" is
displayed before authentication. Run the undo header login command.
Hello,Welcome to Huawei!
Password:
Info: The max number of VTY users is 21, and the number of current VTY users
on
line is 2.
The current login time is 2012-06-06 16:31:24.
<HUAWEI> system-view
[~HUAWEI] undo header login
[*HUAWEI] commit

Log out of the terminal and re-log in. No message is displayed before authentication.
Password:
Info: The max number of VTY users is 21, and the number of current VTY users
on
line is 2.
The current login time is 2012-06-06 16:45:06.
<HUAWEI>

NOTE

The command output provided here is used for reference only. The actual output information may differ
from the preceding information.

1.1.9 Displaying History Commands

The device automatically stores history commands entered by a user. To enter a command that
has been executed, you can use this function to call up the history command.
By default, the system saves 10 history commands for each user. Run the history-command
max-size size-value command to reset the number of history commands that can be saved in a
specified user interface view. The maximum number is 256.

NOTE

If the value specified in the history-command max-size size-value command is large, it may take a long
time to obtain a required history command. Therefore, a large value is not recommended.

Table 1-5 shows operations on history commands.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 12

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

Table 1-5 Accessing history commands

Action Command or Key Result

Display history display history-command [ all- l The history commands

commands. users ] entered by the current
users are displayed when
all-users is not selected.
l The history commands
entered by all users are
displayed when all-users
is selected. (all-users
can be selected only by
users of level 3 or
higher.)

Display the earlier Up arrow key ↑ or Ctrl+P An earlier history command

history command. is displayed. If the current
command is the first
command, an alarm is
generated when you attempt
to display the earlier history
command.

Display the later Down arrow key ↓ or Ctrl+N A later history command is
history command. displayed. If the current
command is the latest
command, no output is
displayed and an alarm is
generated when you attempt
to display the later history
command.

NOTE

You cannot access history commands using the Up arrow key ↑ in HyperTerminal Windows 9X. The
Up arrow key ↑ has a different function in HyperTerminal Windows 9X and needs to be replaced by the
shortcut key Ctrl+P.

When using history commands, note the following:

l The saved history commands are the same as those entered by users. For example, if the
user enters an incomplete command, the saved command also is incomplete.
l If the user runs the same command several times, only the latest command is saved. If
the command is entered in different forms, they are considered as different commands.
For example, if the display current-configuration command is run several times, only
one history command is saved. If the display current-configuration command and the
dis curr command are used, both of them are saved.
l History commands entered by the current user can be deleted using the reset history-
command command in the user view. The deleted history commands cannot be
displayed.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 13

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

1.1.10 Using Command Line Shortcut Keys

You can use shortcut keys provided by the device to quickly enter commands.

There are two types of shortcut keys:

l User-defined shortcut keys: include Ctrl+G, Ctrl+L, Ctrl+O, and Ctrl+U. You can
associate these shortcut keys with any commands. When a shortcut key is pressed, the
system runs the corresponding command.
l System-defined shortcut keys: shortcut keys defined in the system that have fixed
functions. Users cannot define these shortcut keys. Table 1-6 lists the frequently used
system-defined shortcut keys.

NOTE

The terminal in use may affect the functions of the shortcut keys. For example, if the shortcut keys
defined by the terminal conflict with those defined in the system, the shortcut keys entered by the user
are captured by the terminal program and the commands corresponding to the shortcut keys are not
executed.

User-defined Shortcut Keys

When a user frequently uses a command or some commands, the user can use shortcut keys to
define these commands. Only management-level users have the rights to define shortcut keys.
The configurations are as follows:
1. Run the system-view command to enter the system view.
2. Run the hotkey { CTRL_G | CTRL_L | CTRL_O | CTRL_U } command-text
command to configure a shortcut key corresponding to a command.
3. Run the commit command to commit the configuration.

The system supports four user-defined shortcut keys and the default values are as follows:
l Ctrl+G: display current-configuration
l Ctrl+L: display ip routing-table
l Ctrl+O: undo debugging all
l Ctrl+U: Null

NOTE

l When defining shortcut keys, use double quotation marks to define the command if this command
contains several keywords separated by spaces. For example, hotkey ctrl_l "display tcp status".
Do not use double quotation marks to define a command if the command contains only one
keyword.
l Run the display hotkey command to view the status of the defined, undefined, and system-defined
shortcut keys.
l Run the undo hotkey command to restore default values of the configured shortcut keys.
l Shortcut keys are executed in the same way as commands. The system can record commands in their
original formats in the command buffer and logs to help query and locate the fault.
l The user-defined shortcut keys are available to all users. If a user does not have the rights to use the
command defined by a shortcut key, the system displays an error message when this shortcut key is
executed.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 14

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

System-defined Shortcut Keys

Table 1-6 System-defined shortcut keys

Key Function

Ctrl+A Moves the cursor to the beginning of the

current line.

Ctrl+B Moves the cursor back one character.

Ctrl+C Stops performing current functions.

Ctrl+D Deletes the character where the cursor is

located at.

Ctrl+E Moves the cursor to the end of the current line.

Ctrl+F Moves the cursor forward one character.

Ctrl+H Deletes the character on the left side of the

cursor.

Ctrl+K Stops outgoing connections in the call

establishment stage.

Ctrl+N Displays the next command in the history

command buffer.

Ctrl+P Displays the previous command in the history

command buffer.

Ctrl+R Redisplays information about the current line.

Ctrl+T Stops outgoing connections.

Ctrl+V Pastes the text of the clipboard.

Ctrl+W Deletes a character string on the left side of the

cursor.

Ctrl+X Deletes all the characters on the left side of the

cursor.

Ctrl+Y Deletes all the characters on the right side of the

cursor and the character where the cursor is
located at.

Ctrl+Z Returns to the user view.

Ctrl+] Stops incoming connections or redirects the

connections.

Esc+B Moves the cursor back one word.

Esc+D Deletes one word on the right side of the cursor.

Esc+F Moves the cursor forward one word.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 15

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

Key Function

Esc+N Moves the cursor downward a line.

Esc+P Moves the cursor upward a line.

Esc+< Locates the cursor at the start of text in the

clipboard.

Esc+> Locates the cursor at the end of text in the

clipboard.

1.1.11 Configuring an Alias for a Command

The command alias function sets a user-defined character string as the alias for a command on
the device.

Context
The alias command can be used in the following scenarios:
l Configure an easy-to-remember string of characters as the alias for a command. You can
then enter the alias string when you need to run the command. For example, define the
alias for display as show. You can enter the alias show to substitute display.
l Change the order of parameters. For example, after you configure the alias showif
parameter $ifnum $iftype command "display interface $iftype $ifnum" command,
you can enter showif 7 vlanif to substitute display interface vlanif 7.
To enable the command alias function for the current terminal, run the terminal command
alias command. To disable the command alias function for the current terminal, run the undo
terminal command alias command. If you disable the command alias function, configuration
information of command alias is not deleted. Therefore, the configuration information of the
command alias continues taking effect if you enable the command alias function again for the
current terminal. You can run the display terminal command alias command to view
configuration information of command alias.

Procedure
Step 1 Run:
system-view

The system view is displayed.

Step 2 Run:
command alias

The command alias view is displayed.

Step 3 Run:
alias alias-string [ parameter parameter & <1-32> ] command command

An alias is configured for a command.

Step 4 Run:
commit

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 16

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

The configuration is committed.

----End

Follow-up Procedure
l Run the display command alias command to view configuration information of the
command alias.
<HUAWEI> display command alias
show = display
showif $ifnum $iftype = display interface $iftype $ifnum

1.2 Displaying the Command Output

This section describes how to query the configuration information about command lines,
control the method in which command outputs are displayed, and filter the command outputs.

1.2.1 Displaying Command Line Configurations

After the configurations are complete, you can run the display command to check the
configuration and running information on the device.

For example, after all configurations of the FTP service are complete, you can run the display
ftp server command to check parameters of the FTP server. For details on the usage and
functions of the display command, see Checking the Configuration in each feature of the
Configuration Guide.

You can also check the current running configurations and configurations in the current view.
l Check the current running configurations:
display current-configuration
This command does not display parameters that use default settings.
l Check configurations in the current view:
display this
This command does not display parameters that use default settings.

NOTE

l You can run the timestamp enable command to enable the timestamp function in the system so that
the system adds the query time to the output of the display command.
l If the value of a field in the command output is too long, only some beginning characters of the
value are displayed.

1.2.2 Controlling the Display Mode of Commands

When running commands, you can specify the display mode.

l When the display output is more than one page, you can use Pg Up and Pg Dn to display
information on the previous page and the next page.
l When the information cannot be completely displayed on one screen, the system will
pause and you can view the information. You can use the function keys listed in Table
1-7 to control the display mode of command lines.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 17

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

NOTE
The screen-length screen-length temporary command sets the lines to be displayed temporarily
on the terminal screen. If screen-length is 0, the split screen function is disabled. Therefore, the
system will not pause when the information cannot be completely displayed on one screen.

Table 1-7 Display mode of commands

Key Function

Ctrl+C or Ctrl+Z Stops displaying information and running

commands.
NOTE
You can also press any key (the number key or letter
key) except space and Enter.

Space Continues to display the next screen of

information.

Enter Continues to display the next line of

information.

1.2.3 Filtering Command Outputs

Filtering command outputs help you quickly find the information you need. For example, you
can use a regular expression (specifying the rule to filter information) in a display command
filter the output information.

Display Feature
When the information cannot be completely displayed on one screen, you can adopt the pause
function. You have three choices, as described in Table 1-8.

Table 1-8 Display functions

Key Function

Plus sign (+)+regular-expression Functions the same as | include regular-

expression.

Minus sign (-)+regular-expression Functions the same as | exclude regular-

expression.

Slash (/)+regular-expression Functions the same as | begin regular-

expression.

Regular Expressions
A regular expression is a mode matching tool. It consists of common characters (such as
letters from a to z) and special characters (called meta-characters). The regular expression is a
template according to which you can search for the required string.
A regular expression provides the following functions:

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 18

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

l Searches for and obtains a sub-string that matches a rule in the string.
l Substitutes a string based on a certain matching rule.
The regular expression consists of common characters and special characters.
l Common characters
Common characters are used to match themselves in a string, including all upper-case
and lower-case letters, digits, punctuations, and special symbols. For example, a matches
the letter "a" in "abc", 10 matches the digit "10" in "[Link]", and @ matches the
symbol "@" in "xxx@[Link]".
l Special characters
Special characters are used together with common characters to match the complex or
special string combination. Table 1-9 describes special characters and their syntax.

Table 1-9 Description of special characters

Special Function Example
Characte
rs

\ Defines an escape character, which \* matches "*".

is used to mark the next character
(common or special) as the
common character.

^ Matches the starting position of the ^10 matches "[Link]" instead

string. of "[Link]".

$ Matches the ending position of the 1$ matches "[Link]" instead of

string. "[Link]".

* Matches the preceding element 10* matches "1", "10", "100",

zero or more times. "1000", and so on.
(10)* matches "null", "10", "1010",
"101010", and so on.

+ Matches the preceding element one 10+ matches "10", "100", "1000",
or more times. and so on.
(10)+ matches "10", "1010",
"101010", and so on.

. Matches any single character. 0.0 matches "0x0", "020", and so

on.
.oo. matches "book", "look", "tool",
and so on.

() Defines a subexpression, which can 100(200)+ matches "100200",

be null. Both the expression and "100200200", and so on.
the subexpression should be
matched.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 19

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

Special Function Example

Characte
rs

x|y Matches x or y. 100|200 matches "100" or "200".

1(2|3)4 matches "124" or "134",
instead of "1234", "14", "1224",
and "1334".

[xyz] Matches any single character in the [123] matches the character 2 in
regular expression. "255".

[^xyz] Matches any character that is not in [^123] matches any character
the regular expression. except for "1", "2", and "3".

[a-z] Matches any character within the [0-9] matches any character
specified range. ranging from 0 to 9.

[^a-z] Matches any character beyond the [^0-9] matches all non-numeric
specified range. characters.

_ Matches a comma ",", left brace _2008_ matches "2008", "space

"{", right brace "}", left parenthesis 2008 space", "space 2008", "2008
"(", and right parenthesis ")". space", ",2008,", "{2008}",
Matches the starting position of the "(2008)", "{2008)", and "(2008}".
input string.
Matches the ending position of the
input string.
Matches a space.

NOTE

Unless otherwise specified, all the characters in the preceding table must be printable characters.
l Degeneration of special characters
Certain special characters, when placed at certain positions in a regular expression,
degenerate to common characters.
– The special characters following "\" match special characters themselves.
– The special characters "*", and "+" are placed at the starting position of the regular
expression. For example, +45 matches "+45" and abc(*def) matches "abc*def".
– The special character "^" is placed at any position except for the start of the regular
expression. For example, abc^ matches "abc^".
– The special character "$" is placed at any position except for the end of the regular
expression. For example, 12$2 matches "12$2".
– A right parenthesis ")" or right bracket "]" is not paired with a corresponding left
parenthesis "(" or bracket "[". For example, abc) matches "abc)" and 0-9] matches
"0-9]".
NOTE

Unless otherwise specified, degeneration rules also apply when the preceding regular expressions
are subexpressions within parentheses.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 20

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

l Combination of common and special characters

In actual usage, regular expressions combine multiple common and special characters to
match certain strings.

Specifying a Filtering Mode in a Command

NOTE

When filtering conditions are set to query output information, the first line of the command output starts
with the entire regular expression but not the string to be filtered.

The system allows you to use | count to display the number of lines, | section to display the
command output by section after using filtering mode, | ignore-case to match a string of case-
insensitive characters, and | no-more to display filtered output information on only one
screen. | count, | section, | ignore-case, and | no-more can work together with the following
filtering modes.
Three filtering modes are provided for commands that support regular expressions.
l | begin regular-expression: displays all the lines beginning with the line that matches the
regular expression.
Filter the character strings to be entered until the specified case-sensitive character string
is displayed. All the character strings following this specified character string are
displayed on the screen.
l | exclude regular-expression: displays all the lines that do not match the regular
expression.
If the character strings to be entered do not contain the specified case-sensitive character
string, they are displayed on the screen. Otherwise, they are filtered.
l | include regular-expression: displays all the lines that match the regular expression.
If the character strings to be entered contain the specified case-sensitive character string,
they are displayed on the screen. Otherwise, they are filtered.
NOTE

The value of regular-expression is a string of 1 to 255 characters.

The command output can be filtered by multiple regular expressions. The regular expressions take effect
in configuration sequence. A maximum of 32 regular expressions can be configured to filter the
command output.
The | section parameter only applies to commands whose output information contains section
information, such as the display current-configuration and display this commands.

The following examples describe how to specify a filter mode in a command.

Example 1: Run the display interface brief command to display all the lines that do not
match the regular expression 10GE|40GE. 10GE|40GE matches 10GE or 40GE.
<HUAWEI> display interface brief | exclude 10GE|40GE
PHY: Physical
*down: administratively down
^down: standby
(l): loopback
(s): spoofing
(b): BFD down
(e): EFM down
(d): Dampening Suppressed
(p): port alarm down
(dl): DLDP down
InUti/OutUti: input utility rate/output utility rate
Interface PHY Protocol InUti OutUti inErrors outErrors

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 21

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 1 CLI Overview

Eth-Trunk2 down down 0% 0% 0 0

Eth-Trunk27 up up 0.01% 0.01% 0 0
MEth0/0/0 up up 0.01% 0.01% 0 0
NULL0 up up(s) 0% 0% 0 0
Vlanif2 down down -- -- 0 0
Vlanif10 down down -- -- 0 0
Vlanif20 down down -- -- 0 0
Vlanif200 up up -- -- 0 0

Example 2: Run the display current-configuration command to display all the lines that
match the regular expression vlan.
<HUAWEI> display current-configuration | include vlan
vlan batch 2 9 to 20 77 99 200 222 4091
vlan 19
mux-vlan
vlan 222
aggregate-vlan
access-vlan 1
instance 2 vlan 2
carrier-vlan 100
ce-vlan 10
port trunk allow-pass vlan 99 200
igmp-snooping static-router-port vlan 99
port trunk allow-pass vlan 20
port default vlan 77
port trunk allow-pass vlan 20

Example 3: Run the display current-configuration command to display the number of lines
that match the regular expression vlan.
<HUAWEI> display current-configuration | include vlan | count
Total lines: 14.

NOTE

The preceding information is used for reference only.

The device can redirect the output of a display command to a specified file in either of the
following modes:
l > filename
The output is redirected to a specified file. If the file already exists, the content of the file
is overwritten.
l >> filename
The output is appended to a specified file, with the original content of the file remaining
unchanged.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 22

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

2 ZTP Configuration

About This Chapter

This chapter describes how to configure Zero Touch Provisioning (ZTP) to allow automatic
deployment of unconfigured devices after power-on.
2.1 Introduction to ZTP
2.2 Principles
2.3 Configuration Notes
2.4 Default Configuration
2.5 Configuring an Unconfigured Device to Implement Automatic Deployment Using a USB
Flash Drive
2.6 Configuring an Unconfigured Device to Implement Automatic Deployment Through
DHCP
2.7 Configuration Examples

2.1 Introduction to ZTP

Definition
Zero Touch Provisioning (ZTP) allows newly delivered or unconfigured devices to
automatically load version files, including system software, license files, user-defined files,
configuration files, and patch files, after they start.

Purpose
After devices are installed, administrators have to commission the software onsite. If a large
number of devices are sparsely distributed on a network, manually configuring these device
lowers device deployment efficiency and increases labor costs.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 23

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

Devices running ZTP can automatically obtain and load version files from a USB flash drive
or file server, freeing the administrators from onsite configuration or deployment. ZTP
reduces labor costs and increases device deployment efficiency.

Related Documents
Video: CloudEngine Series Switches ZTP Introduction

2.2 Principles

2.2.1 Implementation

Automatic Deployment and Typical Networking

After an unconfigured device is powered on, it automatically starts the ZTP process and
attempts to complete automatic deployment using the installed USB flash drive. If automatic
deployment using the installed USB flash drive fails, the device attempts to complete
automatic deployment using DHCP. For the detailed process, see ZTP Process.
Figure 2-1 shows the typical networking of automatic deployment through DHCP.

Figure 2-1 Networking diagram of automatic deployment

lt
ry efau
ra d .
po ss, nd ess
e m re a dr DHCP
t
a dd s , d
ns P a res er a server
ai I d v
bt nt ad er
O me ay le s
i
a ge tew te f
an g dia a DNS
m e server
m
ter
in
Obtain
interme s the
diate fi
le.
Intermediate
Switch DHCP file server
relay agent Ob
tai
ns
ve
rsio
nf Version
ile file server
s.

l DHCP server: assigns a temporary management IP address, the default gateway, the IP
addresses of the DNS server and the intermediate file server to the device running ZTP.
l DHCP relay agent: relays packets exchanged between the device and DHCP server
located on different network segments.
l Intermediate file server: stores the intermediate file required by the device running
ZTP. The intermediate file can be an .ini file or a Python script. By parsing the

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 24

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

intermediate file, the device can obtain information about the version files and the IP
address of the version file server. An intermediate file server can be a TFTP, an FTP,
SFTP, or HTTP server.
l Version file server: stores the version files to be loaded to unconfigured devices,
including system software, configuration files, and patch files. The version file server
and the intermediate file server can be deployed on the same server, which can be a
TFTP, an FTP, SFTP, or HTTP server.
l DNS server: provides mappings between the domain names and IP addresses, and
resolves the IP address of the file server for the device running ZTP. Based on the
resolved IP address, the device can download the requested files.
NOTE

The TFTP/FTP/HTTP protocol will bring risk to device security. The SFTP mode is recommended.

ZTP Process
Figure 2-2 shows the ZTP flowchart.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 25

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

Figure 2-2 ZTP flowchart

The device is powered on
and starts the ZTP process.

Startup
Yes No
configuration file
exists?
The device stops ZTP
Yes
process and starts with Abort ZTP process?
the configuration file. The device stops ZTP
process and starts with No
zero configuration. A USB
Containing the
No intermediate
file is found?
The device obtains a temporary Yes
IP address and intermediate file The device obtains the
server address through DHCP. intermediate file from the
USB.
The device obtains an
intermediate file from the No Version files
intermediate file server and information Is
parses the file. obtained?
Yes
The device obtains version files The device obtains version
form the file server. files from the USB flash
drive.

The device loads the

version files.

ZTP process is
complete.

The device restarts.

The ZTP process goes through six stages:

1. The device is powered on and starts.
If a configuration file is available, the device starts with the configuration file. If no
configuration file is available, the device automatically starts the ZTP process.
If you use a console port to log in when the device is powered on, you can choose
whether to terminate the ZTP process as prompted. If you choose to terminate the ZTP
process, the device starts with zero configuration.
2. The device obtains the intermediate file and version files from the USB flash drive.
After the ZTP process starts, the unconfigured device first tries to obtain the intermediate
file from the USB flash drive. If the device obtains the intermediate file, it parses the file
and gets information about the version files to be loaded. After downloading the version
files, the device restarts to complete automatic deployment. The device enters stage 3 if

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 26

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

any of the following conditions occur: no USB flash drive is installed; the USB flash
drive contains an incorrect intermediate file; the device fails to obtain the version files.
3. The device obtains DHCP information.
If the device fails to implement automatic deployment using the USB flash drive, it starts
automatic deployment through DHCP. In DHCP mode, the device broadcasts DHCP
Request packets on ports in the following sequence: management port -> high-bandwidth
Ethernet port -> low-bandwidth Ethernet port. After receiving the DHCP Request packet,
the DHCP server sends a DHCP Reply packet to the device. Options in the packet
contain the requested information, including the IP address of the device, default
gateway, IP address of the intermediate file server, and name of the intermediate file.
4. The device obtains the intermediate file and version files.
According to the information carried in the DHCP Reply packet, the device obtains the
intermediate file and then downloads the version files from the version file server.
If the intermediate file is an .ini file, the device downloads the version files based on the
IP address and version file names contained in the intermediate file. If the intermediate
file is a Python script, the device automatically runs the script to download the version
files.
5. The device restarts.
The device automatically sets the version files downloaded from the server as the next
startup files. Then the device restarts, and automatic deployment is complete.

2.2.2 Intermediate File in INI Format

An .ini file can be used as an intermediate file to store device and version file information.

The .ini file has the name extension .ini. The file format is as follows:
NOTE

l If the device implements automatic deployment using a USB flash drive, the name of the .ini file must be
ztp_config.ini. If the device implements automatic deployment through DHCP, a user-defined file name
can be used.
l The configured user name, password, and version file name in the intermediate file cannot contain special
characters, including &, >, <, ", ', /, #.
;BEGIN DC
[GLOBAL CONFIG]
FILESERVER=[Link]

[DEVICEn DESCRIPTION]
ESN=210235527210D4000028
MAC=e468-a356-0cb0
DEVICETYPE=DEFAULT
SYSTEM-SOFTWARE=[Link]
SYSTEM-CONFIG=[Link]
SYSTEM-PAT=[Link]
;END DC

Table 2-1 Fields in the .ini file

Field Mandatory or Description
Optional

;BEGIN DC Mandatory It is the start flag of the file and cannot be

modified.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 27

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

Field Mandatory or Description

Optional

[GLOBAL CONFIG] Mandatory It is the start flag of the global

configuration and cannot be modified.

FILESERVER Mandatory If a USB flash drive is used for automatic

deployment, this field is in the following
format:
l file:/usb:/path
path specifies the directory where version
files are saved in the USB flash drive.
If automatic deployment is performed
through DHCP, this field specifies the
server path where the device can obtain
version files. The version file server can
be a TFTP, an FTP, SFTP, or HTTP
server. The format of this field depends
on the server type and can be any of the
following:
l t[Link]
l ftp://
[username[:password]@]hostname[:p
ort]/path
l sftp://
[username[:password]@]hostname[:p
ort]/path
l [Link]
The parameters username, password, and
port are optional. path specifies the
directory where the version file is saved
on the file server.
NOTE
The TFTP/FTP/HTTP protocol will bring risk
to device security. The SFTP mode is
recommended.

[DEVICEn Mandatory It is the start flag of the file description. n

DESCRIPTION] is a device number and starts from 0.

ESN Optional It specifies the equipment serial number

(ESN) of a device. If this field is set to
DEFAULT, the ESN of the device is not
checked. If this field is set to another
value, the ESN of the device must be the
same as the configured value.
The default value of this field is
DEFAULT. If this field does not exist or
is empty, the default value is used.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 28

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

Field Mandatory or Description

Optional

MAC Optional It specifies the MAC address of a device,

in the XXXX-XXXX-XXXX format. X
is a hexadecimal number. If this field is
set to DEFAULT, the device MAC
address is not checked. If this field is set
to another value, the device MAC
address must be the same as the
configured value.
The device ESN is checked ahead of
MAC address.
The default value of this field is
DEFAULT. If this field does not exist or
is empty, the default value is used.

DEVICETYPE Optional It specifies the device type. The value of

this field can be CE5850EI, CE6850EI,
or CE12800. If this field is set to
DEFAULT, the device type is not
checked.
The default value of this field is
DEFAULT. If this field does not exist or
is empty, the default value is used.

SYSTEM- Optional It specifies a system software name, with

SOFTWARE an extension .cc.

SYSTEM-CONFIG Optional It specifies a configuration file name,

with an extension .cfg, .zip, or .dat.

SYSTEM-PAT Optional It specifies a patch file name, with an

extension .pat.

;END DC Mandatory It is the end flag of the file and cannot be

modified.

2.2.3 Intermediate File in Python Format

A Python script can be used as an intermediate file. The device runs the Python script to
download version files.
The file name extension of the Python script is .py. Example of Python Script shows an
example of a Python script. Python Script Descriptions describes contents in the Python
script.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 29

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

NOTE

l If the device implements automatic deployment using a USB flash drive, the name of the Python script
must be ztp_script.py. If the device implements automatic deployment through DHCP, a user-defined file
name can be used.
l The configured user name, password, and version file name in the intermediate file cannot contain special
characters, including &, >, <, ", ', /, #.

Example of Python Script

NOTE

An example of a script file is as follows. You can modify the script file according to deployment
requirements.
#md5sum="96c89e148a8a4055cf3e9922379ae898"
#!/usr/bin/env python
#
# Copyright (C) Huawei Technologies Co., Ltd. 2008-2013. All rights reserved.
#
----------------------------------------------------------------------------------
------------------------------------
# History:
# Date Author Modification
# 20130629 Author created file.
#
----------------------------------------------------------------------------------
------------------------------------

"""
Zero Touch Provisioning (ZTP) enables devices to automatically load version files
including system software,
patch files, configuration files when the device starts up, the devices to be
configured must be new devices
or have no configuration files.

This is a sample of Zero Touch Provisioning user script. You can customize it to
meet the requirements of
your network environment.
"""

import httplib
import urllib
import string
import re
import [Link] as etree
import os
import stat
import logging
import traceback
import hashlib

from urlparse import urlparse

from urlparse import urlunparse
from time import sleep

# error code
OK = 0
ERR = 1

# File server in which stores the necessary system software, configuration and
patch files:
# 1) Specify the file server which supports the following format.
# t[Link]
# [Link]
# s[Link]
# [Link]
# 2) Do not add a trailing slash at the end of file server path.
FILE_SERVER = '[Link]

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 30

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

# Remote file paths:

# 1) The path may include directory name and file name.
# 2) If file name is not specified, indicate the procedure can be skipped.
# File paths of system software on file server, filename extension is '.cc'.
REMOTE_PATH_IMAGE = {
'CE5850EI' : '/image/[Link]',
'CE6850EI' : '/image/[Link]',
'CE12800' : '/image/[Link]',
}
# File path of configuration file on file server, filename extension is '.cfg',
'.zip' or '.dat'.
REMOTE_PATH_CONFIG = '/config/conf_%[Link]'
# File path of patch file on file server, filename extension is '.pat'
REMOTE_PATH_PATCH = {
'CE5850EI' : '/patch/[Link]',
'CE6850EI' : '/patch/[Link]',
'CE12800' : '/patch/[Link]',
}
# File path of stack member ID file on file server, filename extension is '.txt'
REMOTE_PATH_MEMID = '/stack/stack_member.txt'
# File path of license list file, filename extension is '.xml'
REMOTE_PATH_LICLIST = '[Link]'
# File path of md5 file, contains md5 value of image / patch / memid / license
file, file extension is '.txt'
REMOTE_PATH_MD5 = '/[Link]'
# File path of python file on file server, filename extension is '.py'
REMOTE_PATH_PYTHON = '/get_systeminfo.py'

# Max times to retry get startup when no query result

GET_STARTUP_INTERVAL = 15 # seconds
MAX_TIMES_GET_STARTUP = 120 # Max times to retry

# Max times to retry when download file faild

MAX_TIMES_RETRY_DOWNLOAD = 3

class OPSConnection(object):
"""Make an OPS connection instance."""

def __init__(self, host, port = 80):

[Link] = host
[Link] = port
[Link] = {
"Content-type": "application/xml",
"Accept": "application/xml"
}

[Link] = [Link]([Link], [Link])

def close(self):
"""Close the connection"""
[Link]()

def create(self, uri, req_data):

"""Create a resource on the server"""
ret = self._rest_call("POST", uri, req_data)
return ret

def delete(self, uri, req_data):

"""Delete a resource on the server"""
ret = self._rest_call("DELETE", uri, req_data)
return ret

def get(self, uri, req_data = None):

"""Retrieve a resource from the server"""
ret = self._rest_call("GET", uri, req_data)
return ret

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 31

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

def set(self, uri, req_data):

"""Update a resource on the server"""
ret = self._rest_call("PUT", uri, req_data)
return ret

def _rest_call(self, method, uri, req_data):

"""REST call"""
if req_data == None:
body = ""
else:
body = req_data

[Link]('HTTP request: %s %s HTTP/1.1', method, uri)

[Link](method, uri, body, [Link])
response = [Link]()
ret = ([Link], [Link], [Link]())
if [Link] != [Link]:
[Link]('%s', body)
[Link]('HTTP response: HTTP/1.1 %s %s\n%s', ret[0], ret[1],
ret[2])
return ret

class OPIExecError(Exception):
"""OPI executes error."""
pass

class ZTPErr(Exception):
"""ZTP error."""
pass

def get_addr_by_hostname(ops_conn, host, addr_type = '1'):

"""Translate a host name to IPv4 address format. The IPv4 address is returned
as a string."""
[Link]("Get IP address by host name...")
uri = "/dns/dnsNameResolution"
root_elem = [Link]('dnsNameResolution')
[Link](root_elem, 'host').text = host
[Link](root_elem, 'addrType').text = addr_type
req_data = [Link](root_elem, "UTF-8")
ret, _, rsp_data = ops_conn.get(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to get address by host name')

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:') + '/vrp:'
elem = root_elem.find(uri + "ipv4Addr", namespaces)
if elem is None:
raise OPIExecError('Failed to get IP address by host name')

return [Link]

def _http_download_file(ops_conn, url, local_path):

"""Download file using HTTP."""
[Link]('HTTP download "%s" to "%s".', url, local_path)

url_tuple = urlparse(url)
if not [Link](r"\d+\.\d+\.\d+\.\d+", url_tuple.hostname):
netloc = get_addr_by_hostname(ops_conn, url_tuple.hostname)
if url_tuple.port:
netloc += ':' + str(url_tuple.port)
url = urlunparse((url_tuple.scheme, netloc, url_tuple.path,
url_tuple.params, url_tuple.query,
url_tuple.fragment))

ret = OK
opener = [Link]()

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 32

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

try:
dst_file_path = "%s/%s" % ([Link](), [Link](url))
dst_file_path = [Link](dst_file_path)
[Link]('HTTP download destination file=%s.', dst_file_path)
[Link](url, dst_file_path)
[Link](dst_file_path, stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP |
stat.S_IROTH | stat.S_IXOTH)
except (KeyboardInterrupt, Exception), reason:
if [Link](dst_file_path):
[Link](dst_file_path) # Remove incomplete file
[Link](reason)
print('Error: Failed to download file "%s" using HTTP' %
[Link](url))
ret = ERR

return ret

def _ftp_download_file(ops_conn, url, local_path):

"""Download file using FTP."""
[Link]('FTP download "%s" to "%s".', url, local_path)
uri = "/ftpc/ftpcTransferFiles/ftpcTransferFile"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<ftpcTransferFile>
<serverIpv4Address>$serverIp</serverIpv4Address>
<commandType>get</commandType>
<userName>$username</userName>
<password>$password</password>
<localFileName>$localPath</localFileName>
<remoteFileName>$remotePath</remoteFileName>
</ftpcTransferFile>
''')
url_tuple = urlparse(url)
if [Link](r"\d+\.\d+\.\d+\.\d+", url_tuple.hostname):
server_ip = url_tuple.hostname
else:
server_ip = get_addr_by_hostname(ops_conn, url_tuple.hostname)
req_data = str_temp.substitute(serverIp = server_ip, username =
url_tuple.username, password = url_tuple.password,
remotePath = url_tuple.path[1:], localPath =
local_path)
ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
print('Failed to download file "%s" using FTP' %
[Link](local_path))
return ERR

return OK

def _del_rsa_peer_key(ops_conn, key_name):

"""Delete RSA peer key configuration"""
[Link]("Delete RSA peer key %s", key_name)
uri = "/rsa/rsaPeerKeys/rsaPeerKey"
root_elem = [Link]('rsaPeerKey')
[Link](root_elem, 'keyName').text = key_name
req_data = [Link](root_elem, "UTF-8")
try:
ret, _, _ = ops_conn.delete(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to delete RSA peer key')

except Exception, reason:

[Link](reason)

def _del_sshc_rsa_key(ops_conn, server_name, key_type = 'RSA'):

"""Delete SSH client RSA key configuration"""
[Link]("Delete SSH client RSA key for %s", server_name)
uri = "/sshc/sshCliKeyCfgs/sshCliKeyCfg"
root_elem = [Link]('sshCliKeyCfg')

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 33

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

[Link](root_elem, 'serverName').text = server_name

[Link](root_elem, 'pubKeyType').text = key_type
req_data = [Link](root_elem, "UTF-8")
try:
ret, _, _ = ops_conn.delete(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to delete SSH client RSA key')

except Exception, reason:

[Link](reason)

_del_rsa_peer_key(ops_conn, server_name)

def _set_sshc_first_time(ops_conn, switch):

"""Set SSH client attribute of authenticating user for the first time
access"""
if switch not in ['Enable', 'Disable']:
return ERR

[Link]('Set SSH client first-time enable switch = %s', switch)

uri = "/sshc/sshClient"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<sshClient>
<firstTimeEnable>$enable</firstTimeEnable>
</sshClient>
''')
req_data = str_temp.substitute(enable = switch)
ret, _, _ = ops_conn.set(uri, req_data)
if ret != [Link]:
if switch == 'Enable':
raise OPIExecError('Failed to enable SSH client first-time')
else:
raise OPIExecError('Failed to disable SSH client first-time')

return OK

def _sftp_download_file(ops_conn, url, local_path):

"""Download file using SFTP."""
_set_sshc_first_time(ops_conn, 'Enable')

[Link]('SFTP download "%s" to "%s".', url, local_path)

uri = "/sshc/sshcConnects/sshcConnect"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<sshcConnect>
<HostAddrIPv4>$serverIp</HostAddrIPv4>
<commandType>get</commandType>
<userName>$username</userName>
<password>$password</password>
<localFileName>$localPath</localFileName>
<remoteFileName>$remotePath</remoteFileName>
<identityKey>ssh-rsa</identityKey>
<transferType>SFTP</transferType>
</sshcConnect>
''')
url_tuple = urlparse(url)
if [Link](r"\d+\.\d+\.\d+\.\d+", url_tuple.hostname):
server_ip = url_tuple.hostname
else:
server_ip = get_addr_by_hostname(ops_conn, url_tuple.hostname)
req_data = str_temp.substitute(serverIp = server_ip, username =
url_tuple.username, password = url_tuple.password,
remotePath = url_tuple.path[1:], localPath =
local_path)
ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
print('Failed to download file "%s" using SFTP' %
[Link](local_path))

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 34

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

ret = ERR
else:
ret = OK

_del_sshc_rsa_key(ops_conn, server_ip)
_set_sshc_first_time(ops_conn, 'Disable')
return ret

def _tftp_download_file(ops_conn, url, local_path):

"""Download file using TFTP."""
[Link]('TFTP download "%s" to "%s".', url, local_path)
uri = "/tftpc/tftpcTransferFiles/tftpcTransferFile"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<tftpcTransferFile>
<serverIpv4Address>$serverIp</serverIpv4Address>
<commandType>get_cmd</commandType>
<localFileName>$localPath</localFileName>
<remoteFileName>$remotePath</remoteFileName>
</tftpcTransferFile>
''')
url_tuple = urlparse(url)
if [Link](r"\d+\.\d+\.\d+\.\d+", url_tuple.hostname):
server_ip = url_tuple.hostname
else:
server_ip = get_addr_by_hostname(ops_conn, url_tuple.hostname)
req_data = str_temp.substitute(serverIp = server_ip, remotePath =
url_tuple.path[1:], localPath = local_path)
ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
print('Failed to download file "%s" using TFTP' %
[Link](local_path))
return ERR

return OK

def _usb_download_file(ops_conn, url, local_path):

"""Download file using usb"""
[Link]('USB download "%s" to "%s".', url, local_path)

url_tuple = urlparse(url, allow_fragments=False)

src_path = url_tuple.path[1:]
try:
copy_file(ops_conn, src_path, local_path)
except:
print('Failed to download file "%s" using USB' %
[Link](local_path))
return ERR
return OK

def download_file(ops_conn, url, local_path, retry_times = 0):

"""Download file, support TFTP, FTP, SFTP and HTTP.

t[Link]
[Link]
s[Link]
[Link]

Args:
ops_conn: OPS connection instance
url: URL of remote file
local_path: local path to put the file

Returns:
A integer of return code
"""
url_tuple = urlparse(url)
print("Info: Download %s to %s" % (url_tuple.path[1:], local_path))
func_dict = {'tftp': _tftp_download_file,

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 35

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

'ftp': _ftp_download_file,
'sftp': _sftp_download_file,
'http': _http_download_file,
'file': _usb_download_file}
scheme = url_tuple.scheme
if scheme not in func_dict.keys():
raise ZTPErr('Unknown file transfer scheme %s' % scheme)

ret = OK
cnt = 0
while (cnt < 1 + retry_times):
if cnt:
print('Retry downloading...')
[Link]('Retry downloading...')
ret = func_dict[scheme](ops_conn, url, local_path)
if ret is OK:
break
cnt += 1

if ret is not OK:

raise ZTPErr('Failed to download file "%s"' % [Link](url))

return OK

class StartupInfo(object):
"""Startup configuration information

image: startup system software

config: startup saved-configuration file
patch: startup patch package
"""
def __init__(self, image = None, config = None, patch = None):
[Link] = image
[Link] = config
[Link] = patch

class Startup(object):
"""Startup configuration information

current: current startup configuration

next: current next startup configuration
"""
def __init__(self, ops_conn):
self.ops_conn = ops_conn
[Link], [Link] = self._get_startup_info()

def _get_startup_info(self):
"""Get the startup information."""
[Link]("Get the startup information...")
uri = "/cfg/startupInfos/startupInfo"
req_data = '''<?xml version="1.0" encoding="UTF-8"?>
<startupInfo>
<position/>
<configedSysSoft/>
<curSysSoft/>
<nextSysSoft/>
<curStartupFile/>
<nextStartupFile/>
<curPatchFile/>
<nextPatchFile/>
</startupInfo>'''

cnt = 0
while (cnt < MAX_TIMES_GET_STARTUP):
ret, _, rsp_data = self.ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
cnt += 1
[Link]('Failed to get the startup information')

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 36

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

continue

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
mpath = 'data' + [Link]('/', '/vrp:') # match path
nslen = len(namespaces['vrp'])
elem = root_elem.find(mpath, namespaces)
if elem is not None:
break
[Link]('No query result while getting startup info')
sleep(GET_STARTUP_INTERVAL) # sleep to wait for system ready when
no query result
cnt += 1

if elem is None:
raise OPIExecError('Failed to get the startup information')

current = StartupInfo() # current startup info

curnext = StartupInfo() # next startup info
for child in elem:
tag = [Link][nslen + 2:] # skip the namespace,
'{namespace}text'
if tag == 'curSysSoft':
[Link] = [Link]
elif tag == 'nextSysSoft':
[Link] = [Link]
elif tag == 'curStartupFile' and [Link] != 'NULL':
[Link] = [Link]
elif tag == 'nextStartupFile' and [Link] != 'NULL':
[Link] = [Link]
elif tag == 'curPatchFile' and [Link] != 'NULL':
[Link] = [Link]
elif tag == 'nextPatchFile' and [Link] != 'NULL':
[Link] = [Link]
else:
continue

return current, curnext

def _set_startup_image_file(self, file_path):

"""Set the next startup system software"""
[Link]("Set the next startup system software to %s...", file_path)
uri = "/sum/startupbymode"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<startupbymode>
<softwareName>$fileName</softwareName>
<mode>STARTUP_MODE_ALL</mode>
</startupbymode>
''')
req_data = str_temp.substitute(fileName = file_path)
# it is a action operation, so use create for HTTP POST
ret, _, _ = self.ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError("Failed to set startup system software")

def _set_startup_config_file(self, file_path):

"""Set the next startup saved-configuration file"""
[Link]("Set the next startup saved-configuration file to %s...",
file_path)
uri = "/cfg/setStartup"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<setStartup>
<fileName>$fileName</fileName>
</setStartup>
''')
req_data = str_temp.substitute(fileName = file_path)
# it is a action operation, so use create for HTTP POST

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 37

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

ret, _, _ = self.ops_conn.create(uri, req_data)

if ret != [Link]:
raise OPIExecError("Failed to set startup configuration file")

def _del_startup_config_file(self):
"""Delete startup config file"""
[Link]("Delete the next startup config file...")
uri = "/cfg/clearStartup"
req_data = '''<?xml version="1.0" encoding="UTF-8"?>
<clearStartup>
</clearStartup>
'''
# it is a action operation, so use create for HTTP POST
ret, _, _ = self.ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError("Failed to delete startup configuration file")

def _set_startup_patch_file(self, file_path):

"""Set the next startup patch file"""
[Link]("Set the next startup patch file to %s...", file_path)
uri = "/patch/startup"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<startup>
<packageName>$fileName</packageName>
</startup>
''')
req_data = str_temp.substitute(fileName = file_path)
# it is a action operation, so use create for HTTP POST
ret, _, _ = self.ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError("Failed to set startup patch file")

def _get_cur_stack_member_id(self):
"""rest api: Get current stack member id"""

[Link]("Get current stack member ID...")

uri = "/stack/stackMemberInfos/stackMemberInfo"
req_data = \
'''<?xml version="1.0" encoding="UTF-8"?>
<stackMemberInfo>
<memberID></memberID>
</stackMemberInfo>
'''
ret, _, rsp_data = self.ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
raise OPIExecError('Failed to get current stack member id, rsp not
ok')

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:') + '/vrp:'
elem = root_elem.find(uri + "memberID", namespaces)
if elem is None:
raise OPIExecError('Failed to get the current stack member id for no
"memberID" element')

return [Link]

def _set_stack_member_id(self, file_path, esn):

"""Set the next stack member ID"""

def get_stackid_from_file(fname, esn):

"""parse esn_id.txt file and get stack id according to esn num
format of esn_stackid file is like below:

sn Irf group Irf number

Sdddg 100 1
Sddde 100 2

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 38

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

"""
# fname must exist, guaranteed by caller
fname = [Link](fname)
with open(fname, 'rb') as item:
for line in item:
token = [Link]('[\r\n]')
token = [Link]()
if token[0] == esn:
return token[2]
return None

[Link]('Set the next stack member ID, filename %s', file_path)

uri = "/stack/stackMemberInfos/stackMemberInfo"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<stackMemberInfo>
<memberID>$curmemberid</memberID>
<nextMemberID>$memberid</nextMemberID>
</stackMemberInfo>
''')

cur_memid = self._get_cur_stack_member_id()
next_memid = get_stackid_from_file(file_path, esn)
if not next_memid:
[Link]('Failed to get stack id from %s, esn %s', file_path,
esn)
return

req_data = str_temp.substitute(curmemberid = cur_memid, memberid =

next_memid)
ret, _, _ = self.ops_conn.set(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to set stack id {}'.format(next_memid))

return OK

def _reset_stack_member_id(self):
"""rest api: reset stack member id"""

[Link]('Reset the next stack member ID')

uri = "/stack/stackMemberInfos/stackMemberInfo"
req_data = \
'''<?xml version="1.0" encoding="UTF-8"?>
<stackMemberInfo>
<memberID>1</memberID>
<nextMemberID>1</nextMemberID>
</stackMemberInfo>
'''

ret, _, _ = self.ops_conn.set(uri, req_data)

if ret != [Link]:
raise OPIExecError('Failed to reset stack id ')

return OK

def _reset_startup_patch_file(self):
"""Rest patch file for system to startup"""
[Link]("Reset the next startup patch file...")
uri = "/patch/resetpatch"
req_data = '''<?xml version="1.0" encoding="UTF-8"?>
<resetpatch>
</resetpatch>
'''
# it is a action operation, so use create for HTTP POST
ret, _, _ = self.ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to reset patch')

def reset_startup_info(self, slave):

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 39

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

"""Reset startup info and delete the downloaded files"""

[Link]("Reset the next startup information...")
_, configured = self._get_startup_info()

# 1. Reset next startup config file and delete it

try:
if [Link] != [Link]:
if [Link] is None:
self._del_startup_config_file()
else:
self._set_startup_config_file([Link])
if [Link] is not None:
del_file_all(self.ops_conn, [Link], slave)

except Exception, reason:

[Link](reason)

# 2. Reset next startup patch file

try:
if [Link] != [Link]:
if [Link] is None:
self._reset_startup_patch_file()
else:
self._set_startup_patch_file([Link])

if [Link] is not None:

del_file_all(self.ops_conn, [Link], slave)
except Exception, reason:
[Link](reason)

# 3. Reset next startup system software and delete it

try:
if [Link] != [Link]:
self._set_startup_image_file([Link])
del_file_all(self.ops_conn, [Link], slave)
except Exception, reason:
[Link](reason)

# 4. reset stack member id

try:
self._reset_stack_member_id()
except Exception, reason:
[Link](reason)

def set_startup_info(self, image_file, config_file, patch_file, memid_file,

slave, esn_str):
"""Set the next startup information."""
[Link]("Set the next startup information...")
# 1. Set next startup system software
if image_file is not None:
try:
self._set_startup_image_file(image_file)
except Exception, reason:
[Link](reason)
del_file_all(self.ops_conn, image_file, slave)
self.reset_startup_info(slave)
raise

# 2. Set next startup config file

if config_file is not None:
try:
self._set_startup_config_file(config_file)
except Exception, reason:
[Link](reason)
del_file_all(self.ops_conn, config_file, slave)
self.reset_startup_info(slave)
raise

# 3. Set next startup patch file

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 40

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

if patch_file is not None:

try:
self._set_startup_patch_file(patch_file)
except Exception, reason:
[Link](reason)
del_file_all(self.ops_conn, patch_file, slave)
self.reset_startup_info(slave)
raise

# 4. Set next member id

if memid_file is not None:
try:
self._set_stack_member_id(memid_file, esn_str)
except Exception, reason:
[Link](reason)
del_file_all(self.ops_conn, memid_file, None)
self.reset_startup_info(slave)
raise

def get_cwd(ops_conn):
"""Get the full filename of the current working directory"""
[Link]("Get the current working directory...")
uri = "/vfm/pwds/pwd"
req_data = \
'''<?xml version="1.0" encoding="UTF-8"?>
<pwd>
<dictionaryName/>
</pwd>
'''
ret, _, rsp_data = ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
raise OPIExecError('Failed to get the current working directory')

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:') + '/vrp:'
elem = root_elem.find(uri + "dictionaryName", namespaces)
if elem is None:
raise OPIExecError('Failed to get the current working directory for no
"directoryName" element')

return [Link]

def file_exist(ops_conn, file_path):

"""Returns True if file_path refers to an existing file, otherwise returns
False"""
uri = "/vfm/dirs/dir"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<dir>
<fileName>$fileName</fileName>
</dir>
''')
req_data = str_temp.substitute(fileName = file_path)
ret, _, rsp_data = ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
raise OPIExecError('Failed to list information about the file "%s"' %
file_path)

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:') + '/vrp:'
elem = root_elem.find(uri + "fileName", namespaces)
if elem is None:
return False

return True

def del_file(ops_conn, file_path):

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 41

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

"""Delete a file permanently"""

if file_path is None or file_path is '':
return

[Link]("Delete file %s permanently", file_path)

uri = "/vfm/deleteFileUnRes"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<deleteFileUnRes>
<fileName>$filePath</fileName>
</deleteFileUnRes>
''')
req_data = str_temp.substitute(filePath = file_path)
try:
# it is a action operation, so use create for HTTP POST
ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to delete the file "%s" permanently' %
file_path)

except Exception, reason:

[Link](reason)

def del_file_all(ops_conn, file_path, slave):

"""Delete a file permanently on all main boards"""
if file_path:
del_file(ops_conn, file_path)
if slave:
del_file(ops_conn, 'slave#' + file_path)

def copy_file(ops_conn, src_path, dest_path):

"""Copy a file"""
print('Info: Copy file %s to %s...' % (src_path, dest_path))
[Link]('Copy file %s to %s...', src_path, dest_path)
uri = "/vfm/copyFile"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<copyFile>
<srcFileName>$src</srcFileName>
<desFileName>$dest</desFileName>
</copyFile>
''')
req_data = str_temp.substitute(src = src_path, dest = dest_path)

# it is a action operation, so use create for HTTP POST

ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to copy "%s" to "%s"' % (src_path, dest_path))

def has_slave_mpu(ops_conn):
"""Whether device has slave MPU, returns a bool value"""
[Link]("Test whether device has slave MPU...")
uri = "/devm/phyEntitys"
req_data = \
'''<?xml version="1.0" encoding="UTF-8"?>
<phyEntitys>
<phyEntity>
<entClass>mpuModule</entClass>
<entStandbyState/>
<position/>
</phyEntity>
</phyEntitys>
'''
ret, _, rsp_data = ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
raise OPIExecError('Failed to get the device slave information')

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 42

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

uri = 'data' + [Link]('/', '/vrp:') + '/vrp:'

for entity in root_elem.findall(uri + 'phyEntity', namespaces):
elem = [Link]("vrp:entStandbyState", namespaces)
if elem is not None and [Link] == 'slave':
return True

return False

def get_system_info(ops_conn):
"""Get system info, returns a dict"""
[Link]("Get the system information...")
uri = "/system/systemInfo"
req_data = \
'''<?xml version="1.0" encoding="UTF-8"?>
<systemInfo>
<productName/>
<esn/>
<mac/>
</systemInfo>
'''
ret, _, rsp_data = ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
raise OPIExecError('Failed to get the system information')

sys_info = {}.fromkeys(('productName', 'esn', 'mac'))

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:')
nslen = len(namespaces['vrp'])
elem = root_elem.find(uri, namespaces)
if elem is not None:
for child in elem:
tag = [Link][nslen + 2:] # skip the namespace,
'{namespace}esn'
if tag in sys_info.keys():
sys_info[tag] = [Link]

return sys_info

def test_file_paths(image, config, patch, stack_memid, md5_file,

license_list_file):
"""Test whether argument paths are valid."""
[Link]("Test whether argument paths are valid...")
# check image file path
file_name = [Link](image)
if file_name is not '' and not file_name.lower().endswith('.cc'):
print('Error: Invalid filename extension of system software')
return False

# check config file path

file_name = [Link](config)
file_name = file_name.lower()
_, ext = [Link](file_name)
if file_name is not '' and ext not in ['.cfg', '.zip', '.dat']:
print('Error: Invalid filename extension of configuration file')
return False

# check patch file path

file_name = [Link](patch)
if file_name is not '' and not file_name.lower().endswith('.pat'):
print('Error: Invalid filename extension of patch file')
return False

# check stack member id file path

file_name = [Link](stack_memid)
if file_name is not '' and not file_name.lower().endswith('.txt'):
print('Error: Invalid filename extension of stack member ID file')
return False

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 43

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

# check md5 file path

file_name = [Link](md5_file)
if file_name is not '' and not file_name.lower().endswith('.txt'):
print('Error: Invalid filename extension of md5 file')
return False

# check license list file path

file_name = [Link](license_list_file)
if file_name is not '' and not file_name.lower().endswith('.xml'):
print('Error: Invalid filename extension of license list file')
return False

return True

def md5sum(fname, need_skip_first_line = False):

"""
Calculate md5 num for this file.
"""

def read_chunks(fhdl):
'''read chunks'''
chunk = [Link](8096)
while chunk:
yield chunk
chunk = [Link](8096)
else:
[Link](0)

md5_obj = hashlib.md5()
if isinstance(fname, basestring) and [Link](fname):
with open(fname, "rb") as fhdl:
#skip the first line
[Link](0)
if need_skip_first_line:
[Link]()
for chunk in read_chunks(fhdl):
md5_obj.update(chunk)
elif fname.__class__.__name__ in ["StringIO", "StringO"] or isinstance(fname,
file):
for chunk in read_chunks(fname):
md5_obj.update(chunk)
else:
pass
return md5_obj.hexdigest()

def md5_get_from_file(fname):
"""Get md5 num form file, stored in first line"""

with open(fname, "rb") as fhdl:

[Link](0)
line_first = [Link]()

# if not match pattern, the format of this file is not supported

if not [Link]('^#md5sum="[\\w]{32}"[\r\n]+$', line_first):
return 'None'

return line_first[9:41]

def md5_check_with_first_line(fname):
"""Validate md5 for this file"""

fname = [Link](fname)
md5_calc = md5sum(fname, True)
md5_file = md5_get_from_file(fname)

if md5_file.lower() != md5_calc:
[Link]('MD5 check failed, file %s', fname)
print('MD5 checksum of the file "%s" is %s' % (fname, md5_calc))
[Link]('MD5 checksum of the file "%s" is %s', fname, md5_calc)

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 44

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

print('MD5 checksum received from the file "%s" is %s' % (fname,

md5_file))
[Link]('MD5 checksum received from the file "%s" is %s', fname,
md5_file)
return False

return True

def md5_check_with_dic(md5_dic, fname):

"""md5 check with dic"""
if not md5_dic.has_key(fname):
[Link]('md5_dic does not has key %s, no need to do md5
verification', fname)
return True

md5sum_result = md5sum(fname, False)

if md5_dic[fname] == md5sum_result:
return True

print('MD5 checksum of the file "%s" is %s' % (fname, md5sum_result))

print('MD5 checksum received for the file "%s" is %s' % (fname,
md5_dic[fname]))
[Link]('MD5 check failed, file %s', fname)
[Link]('MD5 checksum of the file "%s" is %s', fname, md5sum_result)
[Link]('MD5 checksum received for the file "%s" is %s', fname,
md5_dic[fname])

return False

def parse_md5_file(fname):
"""parse md5 file"""

def read_line(fhdl):
"""read a line by loop"""
line = [Link]()
while line:
yield line
line = [Link]()
else:
[Link](0)

md5_dic = {}
with open(fname, "rb") as fhdl:
for line in read_line(fhdl):
line_spilt = [Link]()
if 2 != len(line_spilt):
continue
dic_tmp = {line_spilt[0]: line_spilt[1]}
md5_dic.update(dic_tmp)
return md5_dic

def verify_and_parse_md5_file(fname):
"""
vefiry data integrity of md5 file and parse this file

format of this file is like:

------------------------------------------------------------------
#md5sum="517cf194e2e1960429c6aedc0e4dba37"

file-name md5
conf_5618642831132.cfg c0ace0f0542950beaacb39cd1c3b5716
------------------------------------------------------------------
"""
if not md5_check_with_first_line(fname):
return ERR, None
return OK, parse_md5_file(fname)

def check_parameter(aset):
seq = ['&', '>', '<', '"', "'"]

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 45

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

if aset:
for c in seq:
if c in aset:
return True
return False

def check_filename(ops_conn):
sys_info = get_system_info(ops_conn)
url_tuple = urlparse(FILE_SERVER)
if check_parameter(url_tuple.username) or check_parameter(url_tuple.password):
raise ZTPErr('Invalid username or password, the name should not contain:
'+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_IMAGE.get(sys_info['productName'],
''))
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of system software, the name should not
contain: '+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_CONFIG)
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of configuration file, the name should not
contain: '+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_PATCH.get(sys_info['productName'],
''))
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of patch file, the name should not contain:
'+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_MEMID)
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of member ID file, the name should not
contain: '+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_MD5)
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of md5 file, the name should not contain:
'+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_LICLIST)
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of license list file, the name should not
contain: '+'&'+' >'+' <'+' "'+" '.")
return OK

def active_license(ops_conn, license_name):

if license_name:
uri = "/lcs/lcsActive"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<lcsActive>
<lcsFileName>$lcsFileName</lcsFileName>
</lcsActive>
''')
req_data = str_temp.substitute(lcsFileName = license_name)
ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
[Link]('Error: Failed to active license.')
return ERR
return OK

def main_proc(ops_conn):
"""Main processing"""
sys_info = get_system_info(ops_conn) # Get system info, such as esn and
system mac
cwd = get_cwd(ops_conn) # Get the current working directory
startup = Startup(ops_conn)
slave = has_slave_mpu(ops_conn) # Check whether slave MPU board
exists or not
chg_flag = False

check_filename(ops_conn)

# check remote file paths

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 46

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

if not test_file_paths(REMOTE_PATH_IMAGE.get(sys_info['productName'], ''),

REMOTE_PATH_CONFIG,
REMOTE_PATH_PATCH.get(sys_info['productName'], ''),
REMOTE_PATH_MEMID, REMOTE_PATH_MD5,
REMOTE_PATH_LICLIST):
return ERR

# download md5 file first, used to verify data integrity of files which will
be downloaded next
local_path_md5 = None
file_path = REMOTE_PATH_MD5
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_md5 = cwd + file_name
ret = download_file(ops_conn, url, local_path_md5,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download MD5 file "%s"' % file_name)
return ERR
print('Info: Download MD5 file successfully')
ret, md5_dic = verify_and_parse_md5_file(file_name)
# delete the file immediately
del_file_all(ops_conn, local_path_md5, None)
if ret is ERR:
print('Error: MD5 check failed, file "%s"' % file_name)
return ERR
else:
md5_dic = {}

# download configuration file

local_path_config = None
file_path = REMOTE_PATH_CONFIG
if "%s" in file_path:
file_path = REMOTE_PATH_CONFIG % sys_info['esn']
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_config = cwd + file_name
ret = download_file(ops_conn, url, local_path_config,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download configuration file "%s"' % file_name)
return ERR
print('Info: Download configuration file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
return ERR
if slave:
copy_file(ops_conn, local_path_config, 'slave#' + local_path_config)
chg_flag = True

# download patch file

local_path_patch = None
file_path = REMOTE_PATH_PATCH.get(sys_info['productName'], '')
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if [Link]:
cur_pat = [Link]([Link]).lower()
else:
cur_pat = ''
if file_name is not '' and file_name.lower() != cur_pat:
url = FILE_SERVER + file_path

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 47

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

local_path_patch = cwd + file_name

ret = download_file(ops_conn, url, local_path_patch,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download patch file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
return ERR
print('Info: Download patch file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
return ERR
if slave:
copy_file(ops_conn, local_path_patch, 'slave#' + local_path_patch)
chg_flag = True

# download stack member ID file

local_path_memid = None
file_path = REMOTE_PATH_MEMID
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_memid = cwd + file_name
ret = download_file(ops_conn, url, local_path_memid,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download system software "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
return ERR
print('Info: Download stack member ID file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
return ERR
chg_flag = True
#no need copy to slave board

# download system software

local_path_image = None
file_path = REMOTE_PATH_IMAGE.get(sys_info['productName'], '')
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if [Link]:
cur_image = [Link]([Link]).lower()
else:
cur_image = ''
if file_name is not '' and file_name.lower() != cur_image:
url = FILE_SERVER + file_path
local_path_image = cwd + file_name
ret = download_file(ops_conn, url, local_path_image,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
if file_exist(ops_conn, file_name):
del_file_all(ops_conn, local_path_image, slave)
print('Error: Failed to download system software "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
return ERR
print('Info: Download system software file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 48

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

del_file_all(ops_conn, local_path_config, slave)

del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
return ERR
if slave:
copy_file(ops_conn, local_path_image, 'slave#' + local_path_image)
chg_flag = True

# download license list file

local_path_liclist = None
file_path = REMOTE_PATH_LICLIST
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
download_space = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_liclist = cwd + file_name
ret = download_file(ops_conn, url, local_path_liclist,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download license list file "%s"' % file_name)
return ERR
print('Info: Download license list file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
return ERR
chg_flag = True

#execute license list file to get license file name which end with .dat
license_name = None
if local_path_liclist is not None:
tree = [Link](file_name)
root = [Link]()
for child in [Link]('Lic'):
name = [Link]('name')
esn = [Link]('Esn').text
if sys_info['esn'] in esn:
license_name = name
print('Info: License file name is "%s"' % license_name)
break
if license_name == None :
print('Error: Esn of this device is not in the license list file')
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
return ERR

# download license file

local_path_license = None
file_path = license_name
if file_path is not None:
if not file_path.startswith('/'):
file_path = '/' + file_path
file_path = download_space + file_path
file_name = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_license = cwd + file_name
ret = download_file(ops_conn, url, local_path_license,
MAX_TIMES_RETRY_DOWNLOAD)

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 49

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

if ret is ERR or not file_exist(ops_conn, file_name):

print('Error: Failed to download license file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
return ERR
print('Info: Download license file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
del_file_all(ops_conn, local_path_license, slave)
return ERR
chg_flag = True
#no need copy to slave board

# download python file

local_path_python = None
file_path = REMOTE_PATH_PYTHON
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_python = cwd + file_name
ret = download_file(ops_conn, url, local_path_python,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download python file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
del_file_all(ops_conn, local_path_license, slave)
return ERR
print('Info: Download python file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
del_file_all(ops_conn, local_path_license, slave)
del_file_all(ops_conn, local_path_python, slave)
return ERR
if slave:
copy_file(ops_conn, local_path_python, 'slave#' + local_path_python)
chg_flag = True

if chg_flag is False:
return ERR

# active license file

if local_path_license is not None:
ret = active_license(ops_conn, local_path_license)
if ret is ERR:
print('Info: Active license failed')
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 50

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

del_file_all(ops_conn, local_path_license, slave)

del_file_all(ops_conn, local_path_python, slave)
return ERR
print('Info: Active license sucessfully, name: %s' % local_path_license)
# set startup info
startup.set_startup_info(local_path_image, local_path_config,
local_path_patch,
local_path_memid, slave, sys_info['esn'])

# delete stack member ID file and license list file after used
del_file_all(ops_conn, local_path_memid, None)
del_file_all(ops_conn, local_path_liclist, None)

return OK

def main(usb_path = ''):

"""The main function of user script. It is called by ZTP frame, so do not
remove or change this function.

Args:
Raises:
Returns: user script processing result
"""
host = "localhost"
if usb_path and len(usb_path):
[Link]('ztp_script usb_path: %s', usb_path)
global FILE_SERVER
FILE_SERVER = '[Link] + usb_path
try:
# Make an OPS connection instance.
ops_conn = OPSConnection(host)
ret = main_proc(ops_conn)

except OPIExecError, reason:

[Link]('OPI execute error: %s', reason)
print("Error: %s" % reason)
ret = ERR

except ZTPErr, reason:

[Link]('ZTP error: %s', reason)
print("Error: %s" % reason)
ret = ERR

except IOError, reason:

print("Error: %s" % reason)
ret = ERR

except Exception, reason:

[Link](reason)
traceinfo = traceback.format_exc()
[Link](traceinfo)
ret = ERR

finally:
# Close the OPS connection
ops_conn.close()

return ret

if __name__ == "__main__":
main()

Python Script Descriptions

NOTE

Information in bold can be modified based on the actual running environment.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 51

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

l Specifies the MD5 code of the script.

#md5sum="96c89e148a8a4055cf3e9922379ae898"

You can use the MD5 code to check the integrity of the script downloaded by the device.
You can use an MD5 calculation tool, such as md5sum, to generate the MD5 code of the
script.
NOTE

The script cannot contain #md5sum= when the MD5 code is generated. Add #md5sum= to the
beginning of the script after the MD5 code is generated.
l Specifies the path where version files can be obtained.
FILE_SERVER = '[Link]

You can obtain version files from a TFTP, an FTP, SFTP, or HTTP server. Based on the
server used, the path can be any of the following:
– t[Link]
– [Link]
– s[Link]
– [Link]
The parameters username, password, and port are optional.
NOTE

If the device uses a USB flash drive for automatic deployment, set this field to ''.
The TFTP/FTP/HTTP protocol will bring risk to device security. The SFTP mode is recommended.
l Specifies the path and name of the system software.
REMOTE_PATH_IMAGE = {
'CE5850EI' : '/image/[Link]',
'CE6850EI' : '/image/[Link]',
'CE12800' : '/image/[Link]',
}

CE5850EI indicates the device model in the CE**** + EI/HI/LI format, for example
CE5850EI and CE6850EI. The value cannot be CE5850 or CE5850-48T4S2Q-EI.
/image/[Link] specifies the path and name of the system software
obtained by CE5850.
If the device does not need to load the system software, set this field to a double
quotation mark (").
REMOTE_PATH_IMAGE = {
'CE5850EI' : '',
'CE6850EI' : '',
'CE12800' : '',
}

l Specifies the path and name of the configuration file.

REMOTE_PATH_CONFIG = '/config/conf_%[Link]'

%s indicates a device serial number or MAC address, based on which you can obtain a
configuration file.
– If %s indicates a device serial number, the following part in the def main_proc()
function must be set to esn.
# download configuration file
local_path_config = None
file_path = REMOTE_PATH_CONFIG % sys_info['esn']

– If %s indicates a device MAC address, the following part in the def main_proc()
function must be set to mac.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 52

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

# download configuration file

local_path_config = None
file_path = REMOTE_PATH_CONFIG % sys_info['mac']

NOTE

l The serial number or MAC address in the file name must be uppercase.
l If %s indicates a device MAC address, the MAC address in the file name must be 1 plus the device
system MAC address. For example, if the device system MAC address is E468-A356-0DD0, the
file name must be conf_E468-[Link].
l Specifies the path and name of the patch file.
REMOTE_PATH_PATCH = ' 'CE5850EI' : '/patch/CE5850EI-
[Link]',
'CE6850EI' : '/patch/[Link]',
'CE12800' : '/patch/[Link]',
'

The patch file format is similar to the system software.

l Specifies the path and name of the stack member ID file.
REMOTE_PATH_MEMID = '/stack/stack_member.txt'

If multiple unconfigured devices set up a stack after they complete automatic

deployment, configure a stack member ID for each device.
See 2.2.4 Automatic Stacking in ZTP for the format of the stack member ID file.
This parameter is mandatory if a stack must be set up; otherwise, set this parameter to ''.
l Specifies the path and name of the license file.
REMOTE_PATH_LICLIST = '[Link]'

You can use a license list file to enable switches to automatically install licenses.
2.2.6 Installing Licenses in a Batch shows the license list file format.
If the switch does not need to load a license, set this field to a double quotation mark (").
l Specifies the path and name of the MD5 code file.
REMOTE_PATH_MD5 = '/[Link]'

You can use the MD5 code file to check the integrity of the files downloaded by the
device.
See 2.2.5 Checking the Integrity of Version Files for the format of the MD5 code file.
If the downloaded files do not need to be checked, set this field to ''.
l Specifies the path and name of the user-defined file.
REMOTE_PATH_PYTHON = '/get_systeminfo.py'

This field specifies the path and name of the user-defined file to be downloaded.
l Defines the interval for collecting device startup information.
GET_STARTUP_INTERVAL = 15

This field defines the interval for collecting device startup information.
l Defines the maximum number of times that device startup information is retransmitted.
MAX_TIMES_GET_STARTUP = 120

This field defines the maximum number of device startup information retransmissions.
l Defines the number of retries to download files.
MAX_TIMES_RETRY_DOWNLOAD = 3

This field defines the maximum number of retries to download files.

l Creates an OPS connection.
class OPSConnection()

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 53

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

You do not need to edit this field.

l Defines the HTTP header.
def __init__()

You do not need to edit this field.

l Encapsulates the OPS connection.
[Link] = [Link]()

You do not need to edit this field.

l Closes the OPS connection.
def close()

l Defines an add action.

def create()

You do not need to edit this field.

l Defines a delete action.
def delete()

You do not need to edit this field.

l Defines an obtain action.
def get()

You do not need to edit this field.

l Defines a configure action.
def set()

You do not need to edit this field.

l Sets the format of request code to REST.
def _rest_call()

You do not need to edit this field.

l Displays debugging logs.
[Link]()

You do not need to edit this field.

l Indicates an OPS process error.
class OPIExecError()

You do not need to edit this field.

l Indicates an automatic deployment error.
class ZTPErr()

You do not need to edit this field.

l Resolves domain names.
def get_addr_by_hostname()

You do not need to edit this field.

l Downloads files in HTTP mode.
def _http_download_file()

You do not need to edit this field.

l Downloads files in FTP mode.
def _ftp_download_file()

You do not need to edit this field.

l Clears the RSA key after SFTP download fails.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 54

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

def _del_rsa_peer_key()

You do not need to edit this field.

l Clears the IP address of the SSH server and RSA key after SSH download fails.
def _del_sshc_rsa_key()

You do not need to edit this field.

l Configures user attributes for SSH client authentication at the first login.
def _set_sshc_first_time()

You do not need to edit this field.

l Downloads files in SFTP mode.
def _sftp_download_file()

You do not need to edit this field.

l Downloads files in TFTP mode.
def _tftp_download_file()

You do not need to edit this field.

l Downloads files from a USB flash drive.
def _usb_download_file()

You do not need to edit this field.

l Defines file download parameters.
def download_file()

You do not need to edit this field.

l Obtains startup information and starts the device.
class StartupInfo()
class Startup()

You do not need to edit this field.

l Obtains the working directory of the user.
def get_cwd()

You do not need to edit this field.

l Checks whether the file to be downloaded exists.
def file_exist()

You do not need to edit this field.

l Deletes files after a load failure.
def del_file()

If files fail to be loaded, they are deleted so that the device can restore to the state before
ZTP starts. This facilitates subsequent operations.
You do not need to edit this field.
l Copies a file.
def copy_file()

You do not need to edit this field.

l Checks whether the device has a standby MPU.
def has_slave_mpu()

You do not need to edit this field.

l Obtains the system information.
def get_system_info()

You do not need to edit this field.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 55

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

l Checks whether the file path is available.

def test_file_paths()

You do not need to edit this field.

l Verifies the file using the MD5 code.
def md5sum()
def md5_get_from_file()
def md5_check_with_first_line()
def md5_check_with_dic()
def parse_md5_file()
def verify_and_parse_md5_file()

You do not need to edit this field.

l Checks whether the user name, password, file name contain special characters.
def check_parameter()
def check_filename()

You do not need to edit this field.

l Activates the license.
def active_license()

You do not need to edit this field.

l Defines the overall automatic deployment process.
def main_proc()
def main()
if __name__ == "__main__":
main()

You do not need to edit this field.

The main function must be provided; otherwise, the script cannot be executed.

2.2.4 Automatic Stacking in ZTP

To enable multiple unconfigured devices to set up a stack after automatic deployment is
complete, configure a stack member ID for each member device using the stack member ID
file.
The stack member ID file must be a text file, with the name extension .txt. The format is as
follows:
ESN Stack group Stack member
21023553380DCCE12823 10 1
21023553380DCCE12824 10 2

Table 2-2 Description of fields in the stack member ID file

Field Mandatory or Description
Optional

ESN Mandatory Specifies the equipment serial number

(ESN) of a device.

Stack group Mandatory Indicates the stack ID used to identify

different stacks.

Stack member Mandatory Specifies the stack member ID of the

device.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 56

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

2.2.5 Checking the Integrity of Version Files

You can use an MD5 code file to check the integrity of the files downloaded by the device.
The MD5 code of a file to be downloaded is saved in the MD5 code file in advance. After the
device downloads the file, it generates an MD5 code and then compares the generated MD5
code with that saved in the MD5 code file. If the generated MD5 code is different from that
saved in the MD5 code file, the device does not load the file.

The MD5 code file must be a text file, with the name extension .txt. The format is as follows:
#md5sum="540102b82d5ff5aee70deccc9236e3bb"

file-name md5
conf_5618642831132.cfg c0ace0f0542950beaacb39cd1c3b5716

Table 2-3 Description of fields in the MD5 code file

Field Mandatory or Description

Optional

#md5sum Mandatory Specifies the MD5 code of the file to be

checked.

file-name Mandatory Specifies the file name.

md5 Mandatory Specifies the MD5 code generated by the

device.

2.2.6 Installing Licenses in a Batch

You can use a license list file to enable switches to automatically install licenses. Information
about the licenses to be installed on switches is saved in the license list file in advance. After a
switch downloads the license list file, it downloads and installs the required license file based
on its ESN.

The license list file must be in XML format and uses the file name extension .xml. The format
is as follows:
<?xml version="1.0" encoding="utf-8"?>
<Index>
<Lic name="CloudEngine8800V200R002_20161221144427703.dat">
<Esn>2102350KGU10G6000025</Esn>
</Lic>
<Lic name="CloudEngine8800V200R002_20161221144440793.dat">
<Esn>2102350KGU10G6000026,2102350KGU10G6000027</Esn>
</Lic>
</Index>

NOTE

You can use the [Link] file in the .zip package obtained when downloading license files as the license list
file or edit an license list file according to format requirements. The license list file name can be customized.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 57

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

Table 2-4 Fields in the license list file

Field Mandatory or Description
Optional

Lic Mandatory License file information. The name

attribute indicates the license file name.

Esn Mandatory ESN of a switch. If multiple switches

need to install the same license, ESNs of
these switches must be separated by
commas.

2.3 Configuration Notes

Involved Network Elements

The following device participates in automatic deployment using a USB flash drive:
l USB flash drive

The following devices participate in automatic deployment using DHCP:

l DHCP server: assigns a temporary management IP address, the default gateway, the IP
addresses of the DNS server and the intermediate file server to the device running ZTP.
l DHCP relay agent: relays packets exchanged between the device and DHCP server
located on different network segments.
l Intermediate file server: stores the intermediate file required by the device running
ZTP. By parsing the intermediate file, the device can obtain information about the
version files and the IP address of the version file server.
l Version file server: stores the version files to be loaded to unconfigured devices,
including system software, configuration files, and patch files. The version file server
and the intermediate file server can be deployed on the same server.
l DNS server: provides mappings between the domain names and IP addresses, and
resolves the IP address of the file server for the device running ZTP. Based on the
resolved IP address, the device can download the requested files.

License Support
ZTP is a basic feature of a switch and is not under license control.

Version Support

Table 2-5 Minimum version supporting ZTP

Series Product Minimum Version Required

CE8800 CE8860EI V100R006C00

CE8850EI V200R002C50

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 58

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

Series Product Minimum Version Required

CE7800 CE7850EI V100R003C00

CE7855EI V200R001C00

CE6800 CE6810EI V100R003C00

CE6810-48S4Q-LI/ V100R003C10
CE6810-48S-LI

CE6810-32T16S4Q-LI/ V100R005C10
CE6810-24S2Q-LI

CE6850EI V100R003C00

CE6850-48S6Q-HI V100R005C00

CE6850-48T6Q-HI/ V100R005C10
CE6850UHI

CE6851HI V100R005C10

CE6855HI V200R001C00

CE6860EI V200R002C50

CE6870EI V200R002C50

CE6880EI V200R002C50

CE5800 CE5810EI V100R003C00

CE5850EI V100R003C00

CE5850HI V100R003C00

CE5855EI V100R005C10

Feature Dependencies and Limitations

l If unconfigured devices are required to set up a stack after they complete automatic
deployment, use the Python script as the intermediate file. The .ini file does not support
stack setup.
l If you want to implement automatic device deployment and stack setup, the
configuration file loaded to the device must contain the stack configuration related to this
stack member ID, including the stack priority, stack domain ID, and stack port.
l If the device implements automatic deployment using a USB flash drive, the
intermediate file name must be ztp_config.ini or ztp_script.py. If the device implements
automatic deployment using DHCP, the intermediate file name can be user-defined.
l The configured user name, password, and version file name in the intermediate file
cannot contain special characters, including &, >, <, ", ', /, #.
l A Python script file must be in Windows or Unix format.
l ZTP needs to be deployed on a private network because using a non-private network to
deploy ZTP has security risks.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 59

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

l It is recommended that you deploy ZTP using SFTP because TFTP, FTP, and HTTP have
security risks.

2.4 Default Configuration

Table 2-6 Default ZTP Configuration

Item Default Setting

ZTP function Enabled

2.5 Configuring an Unconfigured Device to Implement

Automatic Deployment Using a USB Flash Drive
Pre-configuration Tasks
Before configuring ZTP, complete the following tasks:
l Ensuring that the unconfigured device has no configuration file

Configuration Process
The following configuration tasks are mandatory and must be performed in sequence.

2.5.1 Enabling the ZTP Function

Background
To enable an unconfigured device to automatically start the ZTP process, the ZTP function
must be enabled on the device. The ZTP function is enabled on devices by default.

Procedure
Step 1 (Optional) Run the display system ztp command to check whether the device starts the ZTP
process at the next startup without configuration.

Step 2 Run the set ztp enable command to enable the ZTP function.

By default, the ZTP function is enabled on devices.

To disable an unconfigured device from starting the ZTP process, run the set ztp disable
command on the device.

----End

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 60

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

2.5.2 Editing the Intermediate File

Background
An intermediate file can be an .ini file or a Python script. You can choose a file type as
required. See 2.2.2 Intermediate File in INI Format and 2.2.3 Intermediate File in Python
Format for the file formats.

NOTE

l If an .ini file is used as the intermediate file, the file name must be ztp_config.ini. If a Python script is
used as the intermediate file, the file name must be ztp_script.py.
l If unconfigured devices are required to set up a stack after they complete automatic deployment, use the
Python script as the intermediate file. The .ini file does not support stack setup.

Procedure
Step 1 Edit the intermediate file according to the file type and format.
Step 2 (Optional) Edit the stack member ID file for stack setup and the MD5 code file for file
verification. See 2.2.4 Automatic Stacking in ZTP and 2.2.5 Checking the Integrity of
Version Files for formats of the two files.
Step 3 Save the intermediate file and version files. If the stack member ID file or MD5 check file
exists, you also need to save the file to the USB flash drive.
The intermediate file must be saved to the root directory of the USB flash drive. The stack
member ID file, MD5 code file, and version files are saved to the directory specified in the
intermediate file.

----End

2.5.3 Powering on the Device

Context
After saving the required files to the USB flash drive, connect it to an unconfigured device
and power on the device. The device then automatically downloads version files and restarts
to complete automatic deployment.

Procedure
Step 1 Connect the USB flash drive to the unconfigured device.
Step 2 Power on the device.

----End

2.5.4 Checking the Configuration

Procedure
Step 1 The device completes the ZTP process 15 minutes after it is powered on. Then you can log in
and run the display startup command to check whether the startup files are the required ones.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 61

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

Step 2 If automatic deployment fails, analyze ZTP logs on the device to find out the causes.
ZTP logs are saved to the file named ztp_YYYYMMHHMMSS.log in the directory flash:/.

----End

2.6 Configuring an Unconfigured Device to Implement

Automatic Deployment Through DHCP
Pre-configuration Tasks
Before configuring ZTP, complete the following tasks:
l Configuring routing to ensure that the DHCP server, file server, and unconfigured
devices have reachable routes to each other
l Ensuring that the unconfigured devices have no configuration file

Configuration Process
The configuration tasks 2.6.2 Editing an Intermediate File, 2.6.3 Configuring the DHCP
Server or DHCP Relay Agent, and 2.6.4 Configuring the File Server are mandatory and
can be performed in any sequence. After completing the preceding configuration tasks, power
on the device, and the device starts the ZTP process.

2.6.1 Enabling the ZTP Function

Background
To enable an unconfigured device to automatically start the ZTP process, the ZTP function
must be enabled on the device. The ZTP function is enabled on devices by default.

Procedure
Step 1 (Optional) Run the display system ztp command to check whether the device starts the ZTP
process at the next startup without configuration.
Step 2 Run the set ztp enable command to enable the ZTP function.
By default, the ZTP function is enabled on devices.
To disable an unconfigured device from starting the ZTP process, run the set ztp disable
command on the device.

----End

2.6.2 Editing an Intermediate File

Background
An intermediate file can be an .ini file or a Python script. You can choose a file type as
required. See 2.2.2 Intermediate File in INI Format and 2.2.3 Intermediate File in Python
Format for the file formats.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 62

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

NOTE

If unconfigured devices are required to set up a stack after they complete automatic deployment, use the
Python script as the intermediate file. The .ini file does not support stack setup.

Procedure
Step 1 Edit the intermediate file according to the file type and format.

Step 2 (Optional) Edit the stack member ID file for stack setup and the MD5 code file for file
verification. See 2.2.4 Automatic Stacking in ZTP and 2.2.5 Checking the Integrity of
Version Files for formats of the two files.

----End

2.6.3 Configuring the DHCP Server or DHCP Relay Agent

Context
Before powering on an unconfigured device, deploy a DHCP server from which the
unconfigured device can obtain the IP address, gateway address, intermediate file server
address, and intermediate file name.
The device sends to the DHCP server a DHCP discover packet that carries DHCP Option 60
and Option 61. Option 60 (Vendor class identifier) records the device manufacturer and
model, and Option 61 (Client-identifier) records the device ESN and MAC address.
Table 2-7 describes options that need to be configured on the DHCP server.

Table 2-7 Description of options

Option Mandatory Function
or Optional

1 Mandatory Specifies the subnet mask of the IP address.

3 Mandatory Configures the egress gateway of the DHCP client.

6 Optional Specifies the IP address of the DNS server. If you

configure the domain name of the intermediate file
server (for example, [Link]) as its host name,
deploy a DNS server to resolve the domain name to the
corresponding IP address. If you configure the IP
address of the intermediate file server as its host name,
you do not need to deploy a DNS server.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 63

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

Option Mandatory Function

or Optional

66 Optional Specifies the host name of the intermediate file server.

An intermediate file server can be a TFTP, an FTP,
SFTP, or HTTP server. The format of this field is as
follows:
l t[Link]
l [Link]
l s[Link]
l [Link]
The value of hostname can be a domain name or an IP
address. If hostname is set to a domain name, a DNS
server is required.
NOTE
Ensure that the configured user name and password do not
contain special characters forward slash (/) and number sign
(#).
The TFTP/FTP/HTTP protocol will bring risk to device
security. The SFTP mode is recommended.

67 Mandatory Specifies the name of the intermediate file. The

intermediate file name can be *.ini or ,*.py, and has a
maximum length of 255 bytes.
The file name format is path/filename, in which path
can contain or does not contain the host name of the
file server. For exmaple, the file name can be script/
ztp_script.py without a host name or http://
[Link]:8080/script/ztp_script.py containing the
host name. If the path without a host name is used, you
must configure Option 66 on the DHCP server.

150 Optional Specifies the IP address of the TFTP server.

NOTE

The DHCP client must apply for an IP address lease longer than 1 hour.

In following procedures, DHCP server and relay agent are CloudEngine switches. If a device
of a different type serves as the DHCP server or relay agent, see the documentation of the
corresponding product for configuration details.

Procedure
Step 1 Perform the following steps on the DHCP server:
1. Run the system-view command to enter the system view.
2. Run the dhcp enable command to enable DHCP.
3. Run the ip pool ip-pool-name command to create a global address pool and enter its
view.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 64

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

4. Run the gateway-list ip-address &<1-8> command to set a gateway address for DHCP
clients.
5. Run the network ip-address [ mask { mask | mask-length } ] command to specify the
range of IP addresses allocated to DHCP clients.
6. Run the option code [ sub-option sub-code ] { ascii ascii-string | hex hex-string | cipher
cipher-string | ip-address ip-address &<1-8> } command to configure DHCP option 66,
67 or 150. See Table 2-7 for DHCP options to be configured.
NOTE

When the password is contained in option, the ascii or hex type is insecure. Set the option type to
cipher. A secure password should contain at least two types of the following: lowercase letters,
uppercase letters, number, and special characters. In addition, the password must consist of six or more
than six characters.
7. Run the commit command to commit the configuration.
Step 2 (Optional) Perform the following steps on the DHCP relay agent:
If the unconfigured device and DHCP server are in different network segments, configure a
DHCP relay agent to forward DHCP packets exchanged between them.
1. Run the system-view command to enter the system view.
2. Run the dhcp enable command to enable DHCP.
3. Run the interface interface-type interface-number command to enter the interface view.
4. On an Ethernet interface, run:
undo portswitch

The interface is switched to Layer 3 mode.

By default, an Ethernet interface works in Layer 2 mode.
If an Ethernet interface already has Layer 2 configuration, this command will fail to be
executed on the interface. Before running this command on the interface, delete all the
Layer 2 configuration of the interface.
NOTE

If many Ethernet interfaces need to be switched to Layer 3 mode, run the undo portswitch batch
interface-type { interface-number1 [ to interface-number2 ] } &<1-10> command in the system
view to switch these interfaces to Layer 3 mode in batches.
5. Run the ip address ip-address { mask | mask-length } command to configure an IP
address for the interface.
6. Run the dhcp select relay command to enable the DHCP relay function.
7. Run the dhcp relay binding server ip ip-address command to specify the DHCP server
IP address on the DHCP relay agent.
8. Run the commit command to commit the configuration.

----End

2.6.4 Configuring the File Server

Context
A file server saves the files to be downloaded to unconfigured devices, including the
intermediate file and version files. You can use a switch as the file server. A file server must

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 65

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

have sufficient space to save files. Before configuring a switch as a file server, ensure that its
storage space is sufficient for the files. Usually, a third-party server is deployed on the ZTP
network to serve as the file server. For the configuration procedure, see the manual of the
third-party server.

The version file server and the intermediate file server can be deployed on the same server. A
file server can be a TFTP, an FTP, SFTP, or HTTP server. The HTTP server supports
concurrent access of multiple users.

NOTE

The file server and unconfigured devices must have reachable routes to each other.

Follow-up Procedure
After configuring the file server, save the intermediate file and version files to the working
directory of the file server. If the stack member ID file or MD5 check file exists, you also
need to save the file to the file server.

NOTE

To ensure security of the file server, configure a unique user name for the file server and assign read-
only permission to the user to prevent unauthorized modification to the files. After the ZTP process is
complete, disable the file server function.

2.6.5 Powering on the Device

Context
After completing the preceding configuration, power on the unconfigured device. The device
then automatically downloads version files and restarts to complete automatic deployment.

Procedure
Step 1 Power on the device.

----End

2.6.6 Checking the Configuration

Procedure
Step 1 The device completes the ZTP process 15 minutes after it is powered on. Then you can log in
and run the display startup command to check whether the startup files are the required ones.

Step 2 Run the display system ztp command to check whether the device completes deployment
through ZTP.

Step 3 If automatic deployment fails, analyze ZTP logs on the device to find out the causes.

ZTP logs are saved to the file named ztp_YYYYMMHHMMSS.log in the directory flash:/.

----End

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 66

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

2.7 Configuration Examples

This section only provides configuration examples for single features. For details about multi-
feature configuration cases, feature-specific configuration cases, interconnection cases,
protocol or hardware replacement cases, and industry application cases, see the Typical
Configuration Cases.

2.7.1 Example for Configuring Unconfigured Devices to

Implement Automatic Deployment Using a USB Flash Drive

Networking Requirements
A new network needs to be deployed. SwitchA and SwitchB are two unconfigured devices.
The customer requires that SwitchA and SwitchB automatically load system software and
configuration files after they are powered on to reduce labor costs and device deployment
time.

Table 2-8 lists information about SwitchA and SwitchB, and the files that the switches need
to load.

Table 2-8 Device information and files to be loaded

New Device Device Serial Number File to Be Loaded

Model

SwitchA CE5850EI 210235527210D4 l System software: CE5850EI-

000028 [Link]
l Configuration file:
conf_210235527210D4000028
.cfg

SwitchB CE5850EI 210235527210D4 l System software: CE5850EI-

000046 [Link]
l Configuration file:
conf_210235527210D4000046
.cfg

Configuration Roadmap
The configuration roadmap is as follows:
1. Edit the intermediate file ztp_config.ini to enable the switches to obtain their system
software packages and configuration files according to the intermediate file.
2. Save the intermediate file and version files to the USB flash drive so that the switches
can implement automatic deployment using the USB flash drive.
3. Install the USB flash drive and power on the switches to start the ZTP process.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 67

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

Procedure
Step 1 Edit the intermediate file.
Edit the intermediate file according to 2.2.2 Intermediate File in INI Format. The file is
named ztp_config.ini and has the following format:
;BEGIN DC
[GLOBAL CONFIG]
FILESERVER=file:/usb:/

[DEVICE0 DESCRIPTION]
ESN=210235527210D4000028
DEVICETYPE=CE5850EI
SYSTEM-SOFTWARE=[Link]
SYSTEM-CONFIG=conf_210235527210D4000028.cfg
[DEVICE1 DESCRIPTION]
ESN=210235527210D4000046
DEVICETYPE=CE5850EI
SYSTEM-SOFTWARE=[Link]
SYSTEM-CONFIG=conf_210235527210D4000046.cfg
;END DC

Step 2 Save the intermediate file and version files to the root directory of the USB flash drive.
Step 3 Connect the USB flash drive to SwitchA and power on SwitchA.
Step 4 Verify the configuration.
# The switch completes the ZTP process 15 minutes after it is powered on. Log in to the
switch and run the display startup command to check whether the current system software
and configuration file are the required ones.
<SwitchA> display startup
MainBoard:
Configured startup system software: flash:/[Link]
Startup system software: flash:/[Link]
Next startup system software: flash:/[Link]
Startup saved-configuration file: flash:/conf_210235527210D4000028.cfg
Next startup saved-configuration file: flash:/conf_210235527210D4000028.cfg
Startup paf file: default
Next startup paf file: default
Startup patch package: NULL
Next startup patch package: NULL

Step 5 After SwitchA completes automatic deployment, remove the USB flash drive and connect the
USB flash drive to SwitchB. Then power on SwitchB to start automatic deployment.

----End

2.7.2 Example for Configuring Unconfigured Devices to

Implement Automatic Deployment Through DHCP

Networking Requirements
As shown in Figure 2-3, SwitchA and SwitchB are two unconfigured switches on the
network, and both are connected to SwitchC. SwitchC functions as the egress gateway of
SwitchA and SwitchB. The routes between SwitchC and the DHCP server, and between
SwitchC and the file server are reachable.
The customer requires that SwitchA and SwitchB automatically load system software and
configuration files after they are powered on to reduce labor costs and device deployment
time.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 68

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

Table 2-9 lists information about SwitchA and SwitchB, and the files that the switches need
to load.

Table 2-9 Device information and files to be loaded

New Device Device Serial Number File to Be Loaded

Model

SwitchA CE5850EI 210235527210D4 l System software: CE5850EI-

000028 [Link]
l Configuration file:
conf_210235527210D4000028
.cfg

SwitchB CE5850EI 210235527210D4 l System software: CE5850EI-

000046 [Link]
l Configuration file:
conf_210235527210D4000046
.cfg

Figure 2-3 Configuring ZTP

DHCP server
[Link]

SwitchA
10GE1/0/1 [Link]/24

VLANIF10
[Link]

10GE1/0/2
SwitchB [Link]/24
SwitchC
DHCP relay agent
File server
[Link]

Configuration Roadmap
The configuration roadmap is as follows:
1. Configure an FTP server as the file server to save the intermediate file, system software,
and configuration files.
NOTE

The FTP protocol will bring risk to device security. The SFTP mode is recommended.
2. Edit the intermediate file ztp_script.py to enable the switches to obtain their system
software packages and configuration files according to the intermediate file.
3. Configure the DHCP server and relay agent to enable unconfigured switches to obtain
DHCP information.
4. Power on SwitchA and SwitchB to start the ZTP process.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 69

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

Procedure
Step 1 Configure the file server. (The following example uses a PC as the file server. If a device of a
different type functions as the file server, configure the device according to the corresponding
operation guide.)
1. Configure FTP server functions on the PC. Run an FTP server program (for example,
WFTPD32) on a PC. As shown in Figure 2-4, choose Security > Users/rights. In the
displayed dialog box, click New User to set the user name and password. Here, the user
name is ftpuser and the password is Pwd123. Enter the FTP working directory in the
Home Directory text box. Here, the working directory is D:\ztp. Click Done to close the
dialog box.

Figure 2-4 Configuring the file server

2. Configure the IP address and gateway for the file server. Ensure that the file server and
gateway of SwitchA and SwitchB have reachable routes to each other.

After configuring the file server, save the system software and configuration files to be loaded
to switches in the working directory D:\ztp.

Step 2 Edit the intermediate file.

Edit the intermediate file according to 2.2.3 Intermediate File in Python Format. The file is
named ztp_script.py. See ztp_script.py File and Configuration Files for the file contents.

After editing the intermediate file, save the file to the working directory D:\ztp on the file
server.

Step 3 Configure the DHCP server.

# Configure the IP address pool to be allocated by the DHCP server to clients and configure
the Option value of the DHCP server. For details, see the related DHCP server
documentation.

Table 2-10 Options of the DHCP server

Option No. Description Value

1 Subnet mask of an IP [Link]

address.

3 Egress gateway of the [Link]

DHCP client

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 70

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

Option No. Description Value

67 File server address and [Link]

intermediate file name.

# Configure the IP address and gateway for the DHCP server. Ensure that the DHCP server
and gateway of SwitchA and SwitchB have reachable routes to each other.
Step 4 Configure the DHCP relay agent.
# On SwitchC, configure the DHCP relay function and set the IP address of the VLANIF
interface connected to SwitchA and SwitchB to [Link]. The VLANIF interface functions as
the default gateway of SwitchA and SwitchB.
<HUAWEI> system-view
[~HUAWEI] sysname SwitchC
[*HUAWEI] commit
[~SwitchC] vlan batch 10
[*SwitchC] interface 10ge 1/0/1
[*SwitchC-10GE1/0/1] port link-type trunk
[*SwitchC-10GE1/0/1] port trunk allow-pass vlan 10
[*SwitchC-10GE1/0/1] port trunk pvid vlan 10
[*SwitchC-10GE1/0/1] quit
[*SwitchC] interface 10ge 1/0/2
[*SwitchC-10GE1/0/2] port link-type trunk
[*SwitchC-10GE1/0/2] port trunk allow-pass vlan 10
[*SwitchC-10GE1/0/2] port trunk pvid vlan 10
[*SwitchC-10GE1/0/2] quit
[*SwitchC] interface vlanif 10
[*SwitchC-Vlanif10] ip address [Link] 24
[*SwitchC-Vlanif10] quit
[*SwitchC] dhcp enable
[*SwitchC] interface vlanif 10
[*SwitchC-Vlanif10] dhcp select relay
[*SwitchC-Vlanif10] dhcp relay binding server ip [Link]
[*SwitchC-Vlanif10] commit

Step 5 Power on SwitchA and SwitchB to start the ZTP process.

Step 6 Verify the configuration.

# The switches complete the ZTP process 15 minutes after they are powered on. Log in to the
switches and run the display startup command to check whether the current system software
and configuration files are the required ones. Use SwitchA as an example.
<SwitchA> display startup
MainBoard:
Configured startup system software: flash:/[Link]
Startup system software: flash:/[Link] Next
startup system software: flash:/[Link]
Startup saved-configuration file: flash:/conf_210235527210D4000028.cfg
Next startup saved-configuration file: flash:/conf_210235527210D4000028.cfg
Startup paf file: default
Next startup paf file: default
Startup patch package: NULL
Next startup patch package: NULL

----End

ztp_script.py File and Configuration Files

ztp_script.py File

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 71

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

NOTE

#md5sum= is the MD5 code of the intermediate file ztp_script.py. You can modify the contents of
ztp_script.py according to actual networking requirements. After the modification, use an MD5 calculation
tool, such as md5sum, to generate the MD5 code of the modified file.
Note that the intermediate file cannot contain #md5sum= when the MD5 code is generated. Add #md5sum=
to the beginning of the script after the MD5 code is generated.
#md5sum="b9af26ec6467784de5ed46de9b894407"
#!/usr/bin/env python
#
# Copyright (C) Huawei Technologies Co., Ltd. 2008-2013. All rights reserved.
#
----------------------------------------------------------------------------------
------------------------------------
# History:
# Date Author Modification
# 20130629 Author created file.
#
----------------------------------------------------------------------------------
------------------------------------

"""
Zero Touch Provisioning (ZTP) enables devices to automatically load version files
including system software,
patch files, configuration files when the device starts up, the devices to be
configured must be new devices
or have no configuration files.

This is a sample of Zero Touch Provisioning user script. You can customize it to
meet the requirements of
your network environment.
"""

import httplib
import urllib
import string
import re
import [Link] as etree
import os
import stat
import logging
import traceback
import hashlib

from urlparse import urlparse

from urlparse import urlunparse
from time import sleep

# error code
OK = 0
ERR = 1

# File server in which stores the necessary system software, configuration and
patch files:
# 1) Specify the file server which supports the following format.
# t[Link]
# [Link]
# s[Link]
# [Link]
# 2) Do not add a trailing slash at the end of file server path.
FILE_SERVER = '[Link]

# Remote file paths:

# 1) The path may include directory name and file name.
# 2) If file name is not specified, indicate the procedure can be skipped.
# File paths of system software on file server, filename extension is '.cc'.
REMOTE_PATH_IMAGE = {
'CE5850EI' : '/[Link]',

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 72

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

'CE6850EI' : '/[Link]',
'CE12800' : '/[Link]',
}
# File path of configuration file on file server, filename extension is '.cfg',
'.zip' or '.dat'.
REMOTE_PATH_CONFIG = '/conf_%[Link]'
# File path of patch file on file server, filename extension is '.pat'
REMOTE_PATH_PATCH = {
'CE5850EI' : '',
'CE6850EI' : '',
'CE12800' : '',
}
# File path of stack member ID file on file server, filename extension is '.txt'
REMOTE_PATH_MEMID = ''
# File path of license list file, filename extension is '.xml'
REMOTE_PATH_LICLIST = ''
# File path of md5 file, contains md5 value of image / patch / memid / license
file, file extension is '.txt'
REMOTE_PATH_MD5 = ''
# File path of python file on file server, filename extension is '.py'
REMOTE_PATH_PYTHON = ''

# Max times to retry get startup when no query result

GET_STARTUP_INTERVAL = 15 # seconds
MAX_TIMES_GET_STARTUP = 120 # Max times to retry

# Max times to retry when download file faild

MAX_TIMES_RETRY_DOWNLOAD = 3

class OPSConnection(object):
"""Make an OPS connection instance."""

def __init__(self, host, port = 80):

[Link] = host
[Link] = port
[Link] = {
"Content-type": "application/xml",
"Accept": "application/xml"
}

[Link] = [Link]([Link], [Link])

def close(self):
"""Close the connection"""
[Link]()

def create(self, uri, req_data):

"""Create a resource on the server"""
ret = self._rest_call("POST", uri, req_data)
return ret

def delete(self, uri, req_data):

"""Delete a resource on the server"""
ret = self._rest_call("DELETE", uri, req_data)
return ret

def get(self, uri, req_data = None):

"""Retrieve a resource from the server"""
ret = self._rest_call("GET", uri, req_data)
return ret

def set(self, uri, req_data):

"""Update a resource on the server"""
ret = self._rest_call("PUT", uri, req_data)
return ret

def _rest_call(self, method, uri, req_data):

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 73

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

"""REST call"""
if req_data == None:
body = ""
else:
body = req_data

[Link]('HTTP request: %s %s HTTP/1.1', method, uri)

[Link](method, uri, body, [Link])
response = [Link]()
ret = ([Link], [Link], [Link]())
if [Link] != [Link]:
[Link]('%s', body)
[Link]('HTTP response: HTTP/1.1 %s %s\n%s', ret[0], ret[1],
ret[2])
return ret

class OPIExecError(Exception):
"""OPI executes error."""
pass

class ZTPErr(Exception):
"""ZTP error."""
pass

def get_addr_by_hostname(ops_conn, host, addr_type = '1'):

"""Translate a host name to IPv4 address format. The IPv4 address is returned
as a string."""
[Link]("Get IP address by host name...")
uri = "/dns/dnsNameResolution"
root_elem = [Link]('dnsNameResolution')
[Link](root_elem, 'host').text = host
[Link](root_elem, 'addrType').text = addr_type
req_data = [Link](root_elem, "UTF-8")
ret, _, rsp_data = ops_conn.get(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to get address by host name')

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:') + '/vrp:'
elem = root_elem.find(uri + "ipv4Addr", namespaces)
if elem is None:
raise OPIExecError('Failed to get IP address by host name')

return [Link]

def _http_download_file(ops_conn, url, local_path):

"""Download file using HTTP."""
[Link]('HTTP download "%s" to "%s".', url, local_path)

url_tuple = urlparse(url)
if not [Link](r"\d+\.\d+\.\d+\.\d+", url_tuple.hostname):
netloc = get_addr_by_hostname(ops_conn, url_tuple.hostname)
if url_tuple.port:
netloc += ':' + str(url_tuple.port)
url = urlunparse((url_tuple.scheme, netloc, url_tuple.path,
url_tuple.params, url_tuple.query,
url_tuple.fragment))

ret = OK
opener = [Link]()
try:
dst_file_path = "%s/%s" % ([Link](), [Link](url))
dst_file_path = [Link](dst_file_path)
[Link]('HTTP download destination file=%s.', dst_file_path)
[Link](url, dst_file_path)
[Link](dst_file_path, stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP |
stat.S_IROTH | stat.S_IXOTH)

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 74

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

except (KeyboardInterrupt, Exception), reason:

if [Link](dst_file_path):
[Link](dst_file_path) # Remove incomplete file
[Link](reason)
print('Error: Failed to download file "%s" using HTTP' %
[Link](url))
ret = ERR

return ret

def _ftp_download_file(ops_conn, url, local_path):

"""Download file using FTP."""
[Link]('FTP download "%s" to "%s".', url, local_path)
uri = "/ftpc/ftpcTransferFiles/ftpcTransferFile"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<ftpcTransferFile>
<serverIpv4Address>$serverIp</serverIpv4Address>
<commandType>get</commandType>
<userName>$username</userName>
<password>$password</password>
<localFileName>$localPath</localFileName>
<remoteFileName>$remotePath</remoteFileName>
</ftpcTransferFile>
''')
url_tuple = urlparse(url)
if [Link](r"\d+\.\d+\.\d+\.\d+", url_tuple.hostname):
server_ip = url_tuple.hostname
else:
server_ip = get_addr_by_hostname(ops_conn, url_tuple.hostname)
req_data = str_temp.substitute(serverIp = server_ip, username =
url_tuple.username, password = url_tuple.password,
remotePath = url_tuple.path[1:], localPath =
local_path)
ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
print('Failed to download file "%s" using FTP' %
[Link](local_path))
return ERR

return OK

def _del_rsa_peer_key(ops_conn, key_name):

"""Delete RSA peer key configuration"""
[Link]("Delete RSA peer key %s", key_name)
uri = "/rsa/rsaPeerKeys/rsaPeerKey"
root_elem = [Link]('rsaPeerKey')
[Link](root_elem, 'keyName').text = key_name
req_data = [Link](root_elem, "UTF-8")
try:
ret, _, _ = ops_conn.delete(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to delete RSA peer key')

except Exception, reason:

[Link](reason)

def _del_sshc_rsa_key(ops_conn, server_name, key_type = 'RSA'):

"""Delete SSH client RSA key configuration"""
[Link]("Delete SSH client RSA key for %s", server_name)
uri = "/sshc/sshCliKeyCfgs/sshCliKeyCfg"
root_elem = [Link]('sshCliKeyCfg')
[Link](root_elem, 'serverName').text = server_name
[Link](root_elem, 'pubKeyType').text = key_type
req_data = [Link](root_elem, "UTF-8")
try:
ret, _, _ = ops_conn.delete(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to delete SSH client RSA key')

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 75

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

except Exception, reason:

[Link](reason)

_del_rsa_peer_key(ops_conn, server_name)

def _set_sshc_first_time(ops_conn, switch):

"""Set SSH client attribute of authenticating user for the first time
access"""
if switch not in ['Enable', 'Disable']:
return ERR

[Link]('Set SSH client first-time enable switch = %s', switch)

uri = "/sshc/sshClient"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<sshClient>
<firstTimeEnable>$enable</firstTimeEnable>
</sshClient>
''')
req_data = str_temp.substitute(enable = switch)
ret, _, _ = ops_conn.set(uri, req_data)
if ret != [Link]:
if switch == 'Enable':
raise OPIExecError('Failed to enable SSH client first-time')
else:
raise OPIExecError('Failed to disable SSH client first-time')

return OK

def _sftp_download_file(ops_conn, url, local_path):

"""Download file using SFTP."""
_set_sshc_first_time(ops_conn, 'Enable')

[Link]('SFTP download "%s" to "%s".', url, local_path)

uri = "/sshc/sshcConnects/sshcConnect"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<sshcConnect>
<HostAddrIPv4>$serverIp</HostAddrIPv4>
<commandType>get</commandType>
<userName>$username</userName>
<password>$password</password>
<localFileName>$localPath</localFileName>
<remoteFileName>$remotePath</remoteFileName>
<identityKey>ssh-rsa</identityKey>
<transferType>SFTP</transferType>
</sshcConnect>
''')
url_tuple = urlparse(url)
if [Link](r"\d+\.\d+\.\d+\.\d+", url_tuple.hostname):
server_ip = url_tuple.hostname
else:
server_ip = get_addr_by_hostname(ops_conn, url_tuple.hostname)
req_data = str_temp.substitute(serverIp = server_ip, username =
url_tuple.username, password = url_tuple.password,
remotePath = url_tuple.path[1:], localPath =
local_path)
ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
print('Failed to download file "%s" using SFTP' %
[Link](local_path))
ret = ERR
else:
ret = OK

_del_sshc_rsa_key(ops_conn, server_ip)
_set_sshc_first_time(ops_conn, 'Disable')
return ret

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 76

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

def _tftp_download_file(ops_conn, url, local_path):

"""Download file using TFTP."""
[Link]('TFTP download "%s" to "%s".', url, local_path)
uri = "/tftpc/tftpcTransferFiles/tftpcTransferFile"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<tftpcTransferFile>
<serverIpv4Address>$serverIp</serverIpv4Address>
<commandType>get_cmd</commandType>
<localFileName>$localPath</localFileName>
<remoteFileName>$remotePath</remoteFileName>
</tftpcTransferFile>
''')
url_tuple = urlparse(url)
if [Link](r"\d+\.\d+\.\d+\.\d+", url_tuple.hostname):
server_ip = url_tuple.hostname
else:
server_ip = get_addr_by_hostname(ops_conn, url_tuple.hostname)
req_data = str_temp.substitute(serverIp = server_ip, remotePath =
url_tuple.path[1:], localPath = local_path)
ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
print('Failed to download file "%s" using TFTP' %
[Link](local_path))
return ERR

return OK

def _usb_download_file(ops_conn, url, local_path):

"""Download file using usb"""
[Link]('USB download "%s" to "%s".', url, local_path)

url_tuple = urlparse(url, allow_fragments=False)

src_path = url_tuple.path[1:]
try:
copy_file(ops_conn, src_path, local_path)
except:
print('Failed to download file "%s" using USB' %
[Link](local_path))
return ERR
return OK

def download_file(ops_conn, url, local_path, retry_times = 0):

"""Download file, support TFTP, FTP, SFTP and HTTP.

t[Link]
[Link]
s[Link]
[Link]

Args:
ops_conn: OPS connection instance
url: URL of remote file
local_path: local path to put the file

Returns:
A integer of return code
"""
url_tuple = urlparse(url)
print("Info: Download %s to %s" % (url_tuple.path[1:], local_path))
func_dict = {'tftp': _tftp_download_file,
'ftp': _ftp_download_file,
'sftp': _sftp_download_file,
'http': _http_download_file,
'file': _usb_download_file}
scheme = url_tuple.scheme
if scheme not in func_dict.keys():
raise ZTPErr('Unknown file transfer scheme %s' % scheme)

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 77

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

ret = OK
cnt = 0
while (cnt < 1 + retry_times):
if cnt:
print('Retry downloading...')
[Link]('Retry downloading...')
ret = func_dict[scheme](ops_conn, url, local_path)
if ret is OK:
break
cnt += 1

if ret is not OK:

raise ZTPErr('Failed to download file "%s"' % [Link](url))

return OK

class StartupInfo(object):
"""Startup configuration information

image: startup system software

config: startup saved-configuration file
patch: startup patch package
"""
def __init__(self, image = None, config = None, patch = None):
[Link] = image
[Link] = config
[Link] = patch

class Startup(object):
"""Startup configuration information

current: current startup configuration

next: current next startup configuration
"""
def __init__(self, ops_conn):
self.ops_conn = ops_conn
[Link], [Link] = self._get_startup_info()

def _get_startup_info(self):
"""Get the startup information."""
[Link]("Get the startup information...")
uri = "/cfg/startupInfos/startupInfo"
req_data = '''<?xml version="1.0" encoding="UTF-8"?>
<startupInfo>
<position/>
<configedSysSoft/>
<curSysSoft/>
<nextSysSoft/>
<curStartupFile/>
<nextStartupFile/>
<curPatchFile/>
<nextPatchFile/>
</startupInfo>'''

cnt = 0
while (cnt < MAX_TIMES_GET_STARTUP):
ret, _, rsp_data = self.ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
cnt += 1
[Link]('Failed to get the startup information')
continue

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
mpath = 'data' + [Link]('/', '/vrp:') # match path
nslen = len(namespaces['vrp'])
elem = root_elem.find(mpath, namespaces)

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 78

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

if elem is not None:

break
[Link]('No query result while getting startup info')
sleep(GET_STARTUP_INTERVAL) # sleep to wait for system ready when
no query result
cnt += 1

if elem is None:
raise OPIExecError('Failed to get the startup information')

current = StartupInfo() # current startup info

curnext = StartupInfo() # next startup info
for child in elem:
tag = [Link][nslen + 2:] # skip the namespace,
'{namespace}text'
if tag == 'curSysSoft':
[Link] = [Link]
elif tag == 'nextSysSoft':
[Link] = [Link]
elif tag == 'curStartupFile' and [Link] != 'NULL':
[Link] = [Link]
elif tag == 'nextStartupFile' and [Link] != 'NULL':
[Link] = [Link]
elif tag == 'curPatchFile' and [Link] != 'NULL':
[Link] = [Link]
elif tag == 'nextPatchFile' and [Link] != 'NULL':
[Link] = [Link]
else:
continue

return current, curnext

def _set_startup_image_file(self, file_path):

"""Set the next startup system software"""
[Link]("Set the next startup system software to %s...", file_path)
uri = "/sum/startupbymode"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<startupbymode>
<softwareName>$fileName</softwareName>
<mode>STARTUP_MODE_ALL</mode>
</startupbymode>
''')
req_data = str_temp.substitute(fileName = file_path)
# it is a action operation, so use create for HTTP POST
ret, _, _ = self.ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError("Failed to set startup system software")

def _set_startup_config_file(self, file_path):

"""Set the next startup saved-configuration file"""
[Link]("Set the next startup saved-configuration file to %s...",
file_path)
uri = "/cfg/setStartup"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<setStartup>
<fileName>$fileName</fileName>
</setStartup>
''')
req_data = str_temp.substitute(fileName = file_path)
# it is a action operation, so use create for HTTP POST
ret, _, _ = self.ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError("Failed to set startup configuration file")

def _del_startup_config_file(self):
"""Delete startup config file"""
[Link]("Delete the next startup config file...")

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 79

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

uri = "/cfg/clearStartup"
req_data = '''<?xml version="1.0" encoding="UTF-8"?>
<clearStartup>
</clearStartup>
'''
# it is a action operation, so use create for HTTP POST
ret, _, _ = self.ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError("Failed to delete startup configuration file")

def _set_startup_patch_file(self, file_path):

"""Set the next startup patch file"""
[Link]("Set the next startup patch file to %s...", file_path)
uri = "/patch/startup"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<startup>
<packageName>$fileName</packageName>
</startup>
''')
req_data = str_temp.substitute(fileName = file_path)
# it is a action operation, so use create for HTTP POST
ret, _, _ = self.ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError("Failed to set startup patch file")

def _get_cur_stack_member_id(self):
"""rest api: Get current stack member id"""

[Link]("Get current stack member ID...")

uri = "/stack/stackMemberInfos/stackMemberInfo"
req_data = \
'''<?xml version="1.0" encoding="UTF-8"?>
<stackMemberInfo>
<memberID></memberID>
</stackMemberInfo>
'''
ret, _, rsp_data = self.ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
raise OPIExecError('Failed to get current stack member id, rsp not
ok')

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:') + '/vrp:'
elem = root_elem.find(uri + "memberID", namespaces)
if elem is None:
raise OPIExecError('Failed to get the current stack member id for no
"memberID" element')

return [Link]

def _set_stack_member_id(self, file_path, esn):

"""Set the next stack member ID"""

def get_stackid_from_file(fname, esn):

"""parse esn_id.txt file and get stack id according to esn num
format of esn_stackid file is like below:

sn Irf group Irf number

Sdddg 100 1
Sddde 100 2
"""
# fname must exist, guaranteed by caller
fname = [Link](fname)
with open(fname, 'rb') as item:
for line in item:
token = [Link]('[\r\n]')
token = [Link]()

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 80

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

if token[0] == esn:
return token[2]
return None

[Link]('Set the next stack member ID, filename %s', file_path)

uri = "/stack/stackMemberInfos/stackMemberInfo"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<stackMemberInfo>
<memberID>$curmemberid</memberID>
<nextMemberID>$memberid</nextMemberID>
</stackMemberInfo>
''')

cur_memid = self._get_cur_stack_member_id()
next_memid = get_stackid_from_file(file_path, esn)
if not next_memid:
[Link]('Failed to get stack id from %s, esn %s', file_path,
esn)
return

req_data = str_temp.substitute(curmemberid = cur_memid, memberid =

next_memid)
ret, _, _ = self.ops_conn.set(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to set stack id {}'.format(next_memid))

return OK

def _reset_stack_member_id(self):
"""rest api: reset stack member id"""

[Link]('Reset the next stack member ID')

uri = "/stack/stackMemberInfos/stackMemberInfo"
req_data = \
'''<?xml version="1.0" encoding="UTF-8"?>
<stackMemberInfo>
<memberID>1</memberID>
<nextMemberID>1</nextMemberID>
</stackMemberInfo>
'''

ret, _, _ = self.ops_conn.set(uri, req_data)

if ret != [Link]:
raise OPIExecError('Failed to reset stack id ')

return OK

def _reset_startup_patch_file(self):
"""Rest patch file for system to startup"""
[Link]("Reset the next startup patch file...")
uri = "/patch/resetpatch"
req_data = '''<?xml version="1.0" encoding="UTF-8"?>
<resetpatch>
</resetpatch>
'''
# it is a action operation, so use create for HTTP POST
ret, _, _ = self.ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to reset patch')

def reset_startup_info(self, slave):

"""Reset startup info and delete the downloaded files"""
[Link]("Reset the next startup information...")
_, configured = self._get_startup_info()

# 1. Reset next startup config file and delete it

try:
if [Link] != [Link]:

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 81

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

if [Link] is None:
self._del_startup_config_file()
else:
self._set_startup_config_file([Link])
if [Link] is not None:
del_file_all(self.ops_conn, [Link], slave)

except Exception, reason:

[Link](reason)

# 2. Reset next startup patch file

try:
if [Link] != [Link]:
if [Link] is None:
self._reset_startup_patch_file()
else:
self._set_startup_patch_file([Link])

if [Link] is not None:

del_file_all(self.ops_conn, [Link], slave)
except Exception, reason:
[Link](reason)

# 3. Reset next startup system software and delete it

try:
if [Link] != [Link]:
self._set_startup_image_file([Link])
del_file_all(self.ops_conn, [Link], slave)
except Exception, reason:
[Link](reason)

# 4. reset stack member id

try:
self._reset_stack_member_id()
except Exception, reason:
[Link](reason)

def set_startup_info(self, image_file, config_file, patch_file, memid_file,

slave, esn_str):
"""Set the next startup information."""
[Link]("Set the next startup information...")
# 1. Set next startup system software
if image_file is not None:
try:
self._set_startup_image_file(image_file)
except Exception, reason:
[Link](reason)
del_file_all(self.ops_conn, image_file, slave)
self.reset_startup_info(slave)
raise

# 2. Set next startup config file

if config_file is not None:
try:
self._set_startup_config_file(config_file)
except Exception, reason:
[Link](reason)
del_file_all(self.ops_conn, config_file, slave)
self.reset_startup_info(slave)
raise

# 3. Set next startup patch file

if patch_file is not None:
try:
self._set_startup_patch_file(patch_file)
except Exception, reason:
[Link](reason)
del_file_all(self.ops_conn, patch_file, slave)
self.reset_startup_info(slave)

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 82

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

raise

# 4. Set next member id

if memid_file is not None:
try:
self._set_stack_member_id(memid_file, esn_str)
except Exception, reason:
[Link](reason)
del_file_all(self.ops_conn, memid_file, None)
self.reset_startup_info(slave)
raise

def get_cwd(ops_conn):
"""Get the full filename of the current working directory"""
[Link]("Get the current working directory...")
uri = "/vfm/pwds/pwd"
req_data = \
'''<?xml version="1.0" encoding="UTF-8"?>
<pwd>
<dictionaryName/>
</pwd>
'''
ret, _, rsp_data = ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
raise OPIExecError('Failed to get the current working directory')

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:') + '/vrp:'
elem = root_elem.find(uri + "dictionaryName", namespaces)
if elem is None:
raise OPIExecError('Failed to get the current working directory for no
"directoryName" element')

return [Link]

def file_exist(ops_conn, file_path):

"""Returns True if file_path refers to an existing file, otherwise returns
False"""
uri = "/vfm/dirs/dir"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<dir>
<fileName>$fileName</fileName>
</dir>
''')
req_data = str_temp.substitute(fileName = file_path)
ret, _, rsp_data = ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
raise OPIExecError('Failed to list information about the file "%s"' %
file_path)

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:') + '/vrp:'
elem = root_elem.find(uri + "fileName", namespaces)
if elem is None:
return False

return True

def del_file(ops_conn, file_path):

"""Delete a file permanently"""
if file_path is None or file_path is '':
return

[Link]("Delete file %s permanently", file_path)

uri = "/vfm/deleteFileUnRes"
str_temp = [Link](

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 83

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

'''<?xml version="1.0" encoding="UTF-8"?>

<deleteFileUnRes>
<fileName>$filePath</fileName>
</deleteFileUnRes>
''')
req_data = str_temp.substitute(filePath = file_path)
try:
# it is a action operation, so use create for HTTP POST
ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to delete the file "%s" permanently' %
file_path)

except Exception, reason:

[Link](reason)

def del_file_all(ops_conn, file_path, slave):

"""Delete a file permanently on all main boards"""
if file_path:
del_file(ops_conn, file_path)
if slave:
del_file(ops_conn, 'slave#' + file_path)

def copy_file(ops_conn, src_path, dest_path):

"""Copy a file"""
print('Info: Copy file %s to %s...' % (src_path, dest_path))
[Link]('Copy file %s to %s...', src_path, dest_path)
uri = "/vfm/copyFile"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<copyFile>
<srcFileName>$src</srcFileName>
<desFileName>$dest</desFileName>
</copyFile>
''')
req_data = str_temp.substitute(src = src_path, dest = dest_path)

# it is a action operation, so use create for HTTP POST

ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to copy "%s" to "%s"' % (src_path, dest_path))

def has_slave_mpu(ops_conn):
"""Whether device has slave MPU, returns a bool value"""
[Link]("Test whether device has slave MPU...")
uri = "/devm/phyEntitys"
req_data = \
'''<?xml version="1.0" encoding="UTF-8"?>
<phyEntitys>
<phyEntity>
<entClass>mpuModule</entClass>
<entStandbyState/>
<position/>
</phyEntity>
</phyEntitys>
'''
ret, _, rsp_data = ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
raise OPIExecError('Failed to get the device slave information')

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:') + '/vrp:'
for entity in root_elem.findall(uri + 'phyEntity', namespaces):
elem = [Link]("vrp:entStandbyState", namespaces)
if elem is not None and [Link] == 'slave':
return True

return False

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 84

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

def get_system_info(ops_conn):
"""Get system info, returns a dict"""
[Link]("Get the system information...")
uri = "/system/systemInfo"
req_data = \
'''<?xml version="1.0" encoding="UTF-8"?>
<systemInfo>
<productName/>
<esn/>
<mac/>
</systemInfo>
'''
ret, _, rsp_data = ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
raise OPIExecError('Failed to get the system information')

sys_info = {}.fromkeys(('productName', 'esn', 'mac'))

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:')
nslen = len(namespaces['vrp'])
elem = root_elem.find(uri, namespaces)
if elem is not None:
for child in elem:
tag = [Link][nslen + 2:] # skip the namespace,
'{namespace}esn'
if tag in sys_info.keys():
sys_info[tag] = [Link]

return sys_info

def test_file_paths(image, config, patch, stack_memid, md5_file,

license_list_file):
"""Test whether argument paths are valid."""
[Link]("Test whether argument paths are valid...")
# check image file path
file_name = [Link](image)
if file_name is not '' and not file_name.lower().endswith('.cc'):
print('Error: Invalid filename extension of system software')
return False

# check config file path

file_name = [Link](config)
file_name = file_name.lower()
_, ext = [Link](file_name)
if file_name is not '' and ext not in ['.cfg', '.zip', '.dat']:
print('Error: Invalid filename extension of configuration file')
return False

# check patch file path

file_name = [Link](patch)
if file_name is not '' and not file_name.lower().endswith('.pat'):
print('Error: Invalid filename extension of patch file')
return False

# check stack member id file path

file_name = [Link](stack_memid)
if file_name is not '' and not file_name.lower().endswith('.txt'):
print('Error: Invalid filename extension of stack member ID file')
return False

# check md5 file path

file_name = [Link](md5_file)
if file_name is not '' and not file_name.lower().endswith('.txt'):
print('Error: Invalid filename extension of md5 file')
return False

# check license list file path

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 85

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

file_name = [Link](license_list_file)
if file_name is not '' and not file_name.lower().endswith('.xml'):
print('Error: Invalid filename extension of license list file')
return False

return True

def md5sum(fname, need_skip_first_line = False):

"""
Calculate md5 num for this file.
"""

def read_chunks(fhdl):
'''read chunks'''
chunk = [Link](8096)
while chunk:
yield chunk
chunk = [Link](8096)
else:
[Link](0)

md5_obj = hashlib.md5()
if isinstance(fname, basestring) and [Link](fname):
with open(fname, "rb") as fhdl:
#skip the first line
[Link](0)
if need_skip_first_line:
[Link]()
for chunk in read_chunks(fhdl):
md5_obj.update(chunk)
elif fname.__class__.__name__ in ["StringIO", "StringO"] or isinstance(fname,
file):
for chunk in read_chunks(fname):
md5_obj.update(chunk)
else:
pass
return md5_obj.hexdigest()

def md5_get_from_file(fname):
"""Get md5 num form file, stored in first line"""

with open(fname, "rb") as fhdl:

[Link](0)
line_first = [Link]()

# if not match pattern, the format of this file is not supported

if not [Link]('^#md5sum="[\\w]{32}"[\r\n]+$', line_first):
return 'None'

return line_first[9:41]

def md5_check_with_first_line(fname):
"""Validate md5 for this file"""

fname = [Link](fname)
md5_calc = md5sum(fname, True)
md5_file = md5_get_from_file(fname)

if md5_file.lower() != md5_calc:
[Link]('MD5 check failed, file %s', fname)
print('MD5 checksum of the file "%s" is %s' % (fname, md5_calc))
[Link]('MD5 checksum of the file "%s" is %s', fname, md5_calc)
print('MD5 checksum received from the file "%s" is %s' % (fname,
md5_file))
[Link]('MD5 checksum received from the file "%s" is %s', fname,
md5_file)
return False

return True

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 86

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

def md5_check_with_dic(md5_dic, fname):

"""md5 check with dic"""
if not md5_dic.has_key(fname):
[Link]('md5_dic does not has key %s, no need to do md5
verification', fname)
return True

md5sum_result = md5sum(fname, False)

if md5_dic[fname] == md5sum_result:
return True

print('MD5 checksum of the file "%s" is %s' % (fname, md5sum_result))

print('MD5 checksum received for the file "%s" is %s' % (fname,
md5_dic[fname]))
[Link]('MD5 check failed, file %s', fname)
[Link]('MD5 checksum of the file "%s" is %s', fname, md5sum_result)
[Link]('MD5 checksum received for the file "%s" is %s', fname,
md5_dic[fname])

return False

def parse_md5_file(fname):
"""parse md5 file"""

def read_line(fhdl):
"""read a line by loop"""
line = [Link]()
while line:
yield line
line = [Link]()
else:
[Link](0)

md5_dic = {}
with open(fname, "rb") as fhdl:
for line in read_line(fhdl):
line_spilt = [Link]()
if 2 != len(line_spilt):
continue
dic_tmp = {line_spilt[0]: line_spilt[1]}
md5_dic.update(dic_tmp)
return md5_dic

def verify_and_parse_md5_file(fname):
"""
vefiry data integrity of md5 file and parse this file

format of this file is like:

------------------------------------------------------------------
#md5sum="517cf194e2e1960429c6aedc0e4dba37"

file-name md5
conf_5618642831132.cfg c0ace0f0542950beaacb39cd1c3b5716
------------------------------------------------------------------
"""
if not md5_check_with_first_line(fname):
return ERR, None
return OK, parse_md5_file(fname)

def check_parameter(aset):
seq = ['&', '>', '<', '"', "'"]
if aset:
for c in seq:
if c in aset:
return True
return False

def check_filename(ops_conn):

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 87

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

sys_info = get_system_info(ops_conn)
url_tuple = urlparse(FILE_SERVER)
if check_parameter(url_tuple.username) or check_parameter(url_tuple.password):
raise ZTPErr('Invalid username or password, the name should not contain:
'+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_IMAGE.get(sys_info['productName'],
''))
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of system software, the name should not
contain: '+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_CONFIG)
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of configuration file, the name should not
contain: '+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_PATCH.get(sys_info['productName'],
''))
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of patch file, the name should not contain:
'+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_MEMID)
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of member ID file, the name should not
contain: '+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_MD5)
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of md5 file, the name should not contain:
'+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_LICLIST)
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of license list file, the name should not
contain: '+'&'+' >'+' <'+' "'+" '.")
return OK

def active_license(ops_conn, license_name):

if license_name:
uri = "/lcs/lcsActive"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<lcsActive>
<lcsFileName>$lcsFileName</lcsFileName>
</lcsActive>
''')
req_data = str_temp.substitute(lcsFileName = license_name)
ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
[Link]('Error: Failed to active license.')
return ERR
return OK

def main_proc(ops_conn):
"""Main processing"""
sys_info = get_system_info(ops_conn) # Get system info, such as esn and
system mac
cwd = get_cwd(ops_conn) # Get the current working directory
startup = Startup(ops_conn)
slave = has_slave_mpu(ops_conn) # Check whether slave MPU board
exists or not
chg_flag = False

check_filename(ops_conn)

# check remote file paths

if not test_file_paths(REMOTE_PATH_IMAGE.get(sys_info['productName'], ''),
REMOTE_PATH_CONFIG,
REMOTE_PATH_PATCH.get(sys_info['productName'], ''),
REMOTE_PATH_MEMID, REMOTE_PATH_MD5,
REMOTE_PATH_LICLIST):
return ERR

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 88

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

# download md5 file first, used to verify data integrity of files which will
be downloaded next
local_path_md5 = None
file_path = REMOTE_PATH_MD5
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_md5 = cwd + file_name
ret = download_file(ops_conn, url, local_path_md5,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download MD5 file "%s"' % file_name)
return ERR
print('Info: Download MD5 file successfully')
ret, md5_dic = verify_and_parse_md5_file(file_name)
# delete the file immediately
del_file_all(ops_conn, local_path_md5, None)
if ret is ERR:
print('Error: MD5 check failed, file "%s"' % file_name)
return ERR
else:
md5_dic = {}

# download configuration file

local_path_config = None
file_path = REMOTE_PATH_CONFIG
if "%s" in file_path:
file_path = REMOTE_PATH_CONFIG % sys_info['esn']
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_config = cwd + file_name
ret = download_file(ops_conn, url, local_path_config,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download configuration file "%s"' % file_name)
return ERR
print('Info: Download configuration file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
return ERR
if slave:
copy_file(ops_conn, local_path_config, 'slave#' + local_path_config)
chg_flag = True

# download patch file

local_path_patch = None
file_path = REMOTE_PATH_PATCH.get(sys_info['productName'], '')
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if [Link]:
cur_pat = [Link]([Link]).lower()
else:
cur_pat = ''
if file_name is not '' and file_name.lower() != cur_pat:
url = FILE_SERVER + file_path
local_path_patch = cwd + file_name
ret = download_file(ops_conn, url, local_path_patch,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download patch file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
return ERR

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 89

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

print('Info: Download patch file successfully')

if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
return ERR
if slave:
copy_file(ops_conn, local_path_patch, 'slave#' + local_path_patch)
chg_flag = True

# download stack member ID file

local_path_memid = None
file_path = REMOTE_PATH_MEMID
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_memid = cwd + file_name
ret = download_file(ops_conn, url, local_path_memid,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download system software "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
return ERR
print('Info: Download stack member ID file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
return ERR
chg_flag = True
#no need copy to slave board

# download system software

local_path_image = None
file_path = REMOTE_PATH_IMAGE.get(sys_info['productName'], '')
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if [Link]:
cur_image = [Link]([Link]).lower()
else:
cur_image = ''
if file_name is not '' and file_name.lower() != cur_image:
url = FILE_SERVER + file_path
local_path_image = cwd + file_name
ret = download_file(ops_conn, url, local_path_image,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
if file_exist(ops_conn, file_name):
del_file_all(ops_conn, local_path_image, slave)
print('Error: Failed to download system software "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
return ERR
print('Info: Download system software file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
return ERR
if slave:
copy_file(ops_conn, local_path_image, 'slave#' + local_path_image)

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 90

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

chg_flag = True

# download license list file

local_path_liclist = None
file_path = REMOTE_PATH_LICLIST
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
download_space = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_liclist = cwd + file_name
ret = download_file(ops_conn, url, local_path_liclist,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download license list file "%s"' % file_name)
return ERR
print('Info: Download license list file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
return ERR
chg_flag = True

#execute license list file to get license file name which end with .dat
license_name = None
if local_path_liclist is not None:
tree = [Link](file_name)
root = [Link]()
for child in [Link]('Lic'):
name = [Link]('name')
esn = [Link]('Esn').text
if sys_info['esn'] in esn:
license_name = name
print('Info: License file name is "%s"' % license_name)
break
if license_name == None :
print('Error: Esn of this device is not in the license list file')
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
return ERR

# download license file

local_path_license = None
file_path = license_name
if file_path is not None:
if not file_path.startswith('/'):
file_path = '/' + file_path
file_path = download_space + file_path
file_name = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_license = cwd + file_name
ret = download_file(ops_conn, url, local_path_license,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download license file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 91

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

return ERR
print('Info: Download license file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
del_file_all(ops_conn, local_path_license, slave)
return ERR
chg_flag = True
#no need copy to slave board

# download python file

local_path_python = None
file_path = REMOTE_PATH_PYTHON
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_python = cwd + file_name
ret = download_file(ops_conn, url, local_path_python,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download python file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
del_file_all(ops_conn, local_path_license, slave)
return ERR
print('Info: Download python file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
del_file_all(ops_conn, local_path_license, slave)
del_file_all(ops_conn, local_path_python, slave)
return ERR
if slave:
copy_file(ops_conn, local_path_python, 'slave#' + local_path_python)
chg_flag = True

if chg_flag is False:
return ERR

# active license file

if local_path_license is not None:
ret = active_license(ops_conn, local_path_license)
if ret is ERR:
print('Info: Active license failed')
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
del_file_all(ops_conn, local_path_license, slave)
del_file_all(ops_conn, local_path_python, slave)
return ERR
print('Info: Active license sucessfully, name: %s' % local_path_license)
# set startup info
startup.set_startup_info(local_path_image, local_path_config,
local_path_patch,

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 92

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

local_path_memid, slave, sys_info['esn'])

# delete stack member ID file and license list file after used
del_file_all(ops_conn, local_path_memid, None)
del_file_all(ops_conn, local_path_liclist, None)

return OK

def main(usb_path = ''):

"""The main function of user script. It is called by ZTP frame, so do not
remove or change this function.

Args:
Raises:
Returns: user script processing result
"""
host = "localhost"
if usb_path and len(usb_path):
[Link]('ztp_script usb_path: %s', usb_path)
global FILE_SERVER
FILE_SERVER = '[Link] + usb_path
try:
# Make an OPS connection instance.
ops_conn = OPSConnection(host)
ret = main_proc(ops_conn)

except OPIExecError, reason:

[Link]('OPI execute error: %s', reason)
print("Error: %s" % reason)
ret = ERR

except ZTPErr, reason:

[Link]('ZTP error: %s', reason)
print("Error: %s" % reason)
ret = ERR

except IOError, reason:

print("Error: %s" % reason)
ret = ERR

except Exception, reason:

[Link](reason)
traceinfo = traceback.format_exc()
[Link](traceinfo)
ret = ERR

finally:
# Close the OPS connection
ops_conn.close()

return ret

if __name__ == "__main__":
main()

Configuration Files

l Configuration file of SwitchC

#
sysname SwitchC
#
vlan batch 10
#
dhcp enable
#
interface Vlanif10
ip address [Link] [Link]
dhcp select relay

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 93

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

dhcp relay binding server ip [Link]

#
interface 10GE1/0/1
port link-type trunk
port trunk pvid vlan 10
port trunk allow-pass vlan 10
#
interface 10GE1/0/2
port link-type trunk
port trunk pvid vlan 10
port trunk allow-pass vlan 10
#
return

2.7.3 Example for Configuring Unconfigured Devices to

Implement Automatic Deployment and Set up a Stack Through
DHCP

Networking Requirements
As shown in Figure 2-5, SwitchA and SwitchB are two unconfigured switches on the
network, and both are connected to SwitchC. SwitchC functions as the egress gateway of
SwitchA and SwitchB. The routes between SwitchC and DHCP server, and between SwitchC
and the file server are reachable.
To reduce labor costs and device deployment time, the customer requires that SwitchA and
SwitchB can automatically load system software and configuration file after they are powered
on and set up a stack after automatic deployment is complete.
Table 2-11 lists information about SwitchA and SwitchB, and the files that the switches need
to load.

Table 2-11 Device information and files to be loaded

New Device Device Serial Number File to Be Loaded
Model

SwitchA CE5850EI 210235527210D4 l System software: CE5850EI-

000028 [Link]
l Configuration file:
conf_210235527210D4000028
.cc

SwitchB CE5850EI 210235527210D4 l System software: CE5850EI-

000046 [Link]
l Configuration file:
conf_210235527210D4000046
.cfg

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 94

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

NOTE

To ensure that SwitchA and SwitchB can set up a stack, the following conditions must be met:
l SwitchA and SwitchB have been connected using stack cables before they are powered on.
l The configuration file must contain all stack configurations (including the stack priority, stack domain
ID, and stack port) related to the stack member ID to ensure that a stack can be set up successfully after
the configuration file is loaded. For example, the configuration file conf_210235527210D4000046.cfg
must contain the stack configurations related to stack member ID 2.

Figure 2-5 Configuring ZTP

DHCP server
[Link]

SwitchA [Link]/24
10GE1/0/1
Stack VLANIF10
link [Link]
10GE1/0/2
SwitchB [Link]/24
SwitchC
DHCP relay agent
File server
[Link]

Configuration Roadmap
The configuration roadmap is as follows:
1. Configure an FTP server as the file server to save the intermediate file, system software,
and configuration files.
NOTE

The FTP protocol will bring risk to device security. The SFTP mode is recommended.
2. Edit the intermediate file ztp_script.py and the stack member ID file
stack_memberid.txt so that the switches can obtain their system software packages and
configuration files according to the intermediate file, and obtain stack member IDs
according to the stack member ID file.
3. Configure the DHCP server and relay agent to enable unconfigured switches to obtain
DHCP information.
4. Power on SwitchA and SwitchB to start the ZTP process.

Procedure
Step 1 Configure the file server. (The following example uses a PC as the file server. If a device of a
different type functions as the file server, configure the device according to the corresponding
operation guide.)
1. Configure FTP server functions on the PC. Run an FTP server program (for example,
WFTPD32) on a PC. As shown in Figure 2-6, choose Security > Users/rights. In the
displayed dialog box, click New User to set the user name and password. Here, the user
name is ftpuser and the password is Pwd123. Enter the FTP working directory in the
Home Directory text box. Here, the working directory is D:\ztp. Click Done to close the
dialog box.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 95

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

Figure 2-6 Configuring the file server

2. Configure the IP address and gateway for the file server. Ensure that the file server and
gateway of SwitchA and SwitchB have reachable routes to each other.

After configuring the file server, save the system software and configuration files to be loaded
to switches in the working directory D:\ztp.

Step 2 Edit the intermediate file.

Edit the intermediate file according to 2.2.3 Intermediate File in Python Format. The file is
named ztp_script.py. See ztp_script.py File and Configuration Files for the file contents.

After editing the intermediate file, save the file to the working directory D:\ztp on the file
server.

Step 3 Edit the stack member ID file.

Write stack member IDs of SwitchA and SwitchB into stack_memberid.txt in the following
format:
ESN Stack group Stack member
210235527210D4000028 10 1
210235527210D4000046 10 2

ESN is the equipment serial number, and Stack member indicates the stack member ID of
the switches.

After editing the stack member ID file, save the file to the working directory D:\ztp on the file
server.

Step 4 Configure the DHCP server.

# Configure the IP address pool to be allocated by the DHCP server to clients and configure
the Option value of the DHCP server. For details, see the related DHCP server
documentation.

Table 2-12 Options of the DHCP server

Option No. Description Value

1 Subnet mask of an IP [Link]

address.

3 Egress gateway of the [Link]

DHCP client

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 96

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

Option No. Description Value

67 File server address and [Link]

intermediate file name.

# Configure the IP address and gateway for the DHCP server. Ensure that the DHCP server
and gateway of SwitchA and SwitchB have reachable routes to each other.
Step 5 Configure the DHCP relay agent.
# On SwitchC, configure the DHCP relay function and set the IP address of the VLANIF
interface connected to SwitchA and SwitchB to [Link]. The VLANIF interface functions as
the default gateway of SwitchA and SwitchB.
<HUAWEI> system-view
[~HUAWEI] sysname SwitchC
[*HUAWEI] commit
[~SwitchC] vlan batch 10
[*SwitchC] interface 10ge 1/0/1
[*SwitchC-10GE1/0/1] port link-type trunk
[*SwitchC-10GE1/0/1] port trunk allow-pass vlan 10
[*SwitchC-10GE1/0/1] port trunk pvid vlan 10
[*SwitchC-10GE1/0/1] quit
[*SwitchC] interface 10ge 1/0/2
[*SwitchC-10GE1/0/2] port link-type trunk
[*SwitchC-10GE1/0/2] port trunk allow-pass vlan 10
[*SwitchC-10GE1/0/2] port trunk pvid vlan 10
[*SwitchC-10GE1/0/2] quit
[*SwitchC] interface vlanif 10
[*SwitchC-Vlanif10] ip address [Link] 24
[*SwitchC-Vlanif10] quit
[*SwitchC] dhcp enable
[*SwitchC] interface vlanif 10
[*SwitchC-Vlanif10] dhcp select relay
[*SwitchC-Vlanif10] dhcp relay binding server ip [Link]
[*SwitchC-Vlanif10] commit

Step 6 Power on SwitchA and SwitchB to start the ZTP process.

Step 7 Verify the configuration.

# The switches complete the ZTP process 15 minutes after they are powered on. Log in to the
stack and run the display startup command to check whether the current system software and
configuration files are the required ones.
<SwitchA> display startup
MainBoard:
Configured startup system software: flash:/[Link]
Startup system software: flash:/[Link]
Next startup system software: flash:/[Link]
Startup saved-configuration file: flash:/conf_210235527210D4000028.cfg
Next startup saved-configuration file: flash:/conf_210235527210D4000028.cfg
Startup paf file: default
Next startup paf file: default
Startup patch package: NULL
Next startup patch package: NULL
SlaveBoard:
Configured startup system software: flash:/[Link]
Startup system software: flash:/[Link]
Next startup system software: flash:/[Link]
Startup saved-configuration file: flash:/conf_210235527210D4000028.cfg
Next startup saved-configuration file: flash:/conf_210235527210D4000028.cfg
Startup paf file: default
Next startup paf file: default

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 97

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

Startup patch package: NULL

Next startup patch package: NULL

----End

ztp_script.py File and Configuration Files

ztp_script.py File

NOTE

#md5sum= is the MD5 code of the intermediate file ztp_script.py. You can modify the contents of
ztp_script.py according to actual networking requirements. After the modification, use an MD5 calculation
tool, such as md5sum, to generate the MD5 code of the modified file.
Note that the intermediate file cannot contain #md5sum= when the MD5 code is generated. Add #md5sum=
to the beginning of the script after the MD5 code is generated.
#md5sum="10c61d44e255098c8a952b7b614abbf7"
#!/usr/bin/env python
#
# Copyright (C) Huawei Technologies Co., Ltd. 2008-2013. All rights reserved.
#
----------------------------------------------------------------------------------
------------------------------------
# History:
# Date Author Modification
# 20130629 Author created file.
#
----------------------------------------------------------------------------------
------------------------------------

"""
Zero Touch Provisioning (ZTP) enables devices to automatically load version files
including system software,
patch files, configuration files when the device starts up, the devices to be
configured must be new devices
or have no configuration files.

This is a sample of Zero Touch Provisioning user script. You can customize it to
meet the requirements of
your network environment.
"""

import httplib
import urllib
import string
import re
import [Link] as etree
import os
import stat
import logging
import traceback
import hashlib

from urlparse import urlparse

from urlparse import urlunparse
from time import sleep

# error code
OK = 0
ERR = 1

# File server in which stores the necessary system software, configuration and
patch files:
# 1) Specify the file server which supports the following format.
# t[Link]
# [Link]
# s[Link]

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 98

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

# [Link]
# 2) Do not add a trailing slash at the end of file server path.
FILE_SERVER = '[Link]

# Remote file paths:

# 1) The path may include directory name and file name.
# 2) If file name is not specified, indicate the procedure can be skipped.
# File paths of system software on file server, filename extension is '.cc'.
REMOTE_PATH_IMAGE = {
'CE5850EI' : '/[Link]',
'CE6850EI' : '/[Link]',
'CE12800' : '/[Link]',
}
# File path of configuration file on file server, filename extension is '.cfg',
'.zip' or '.dat'.
REMOTE_PATH_CONFIG = '/conf_%[Link]'
# File path of patch file on file server, filename extension is '.pat'
REMOTE_PATH_PATCH = {
'CE5850EI' : '',
'CE6850EI' : '',
'CE12800' : '',
}
# File path of stack member ID file on file server, filename extension is '.txt'
REMOTE_PATH_MEMID = '/stack_memberid.txt'
# File path of license list file, filename extension is '.xml'
REMOTE_PATH_LICLIST = ''
# File path of md5 file, contains md5 value of image / patch / memid / license
file, file extension is '.txt'
REMOTE_PATH_MD5 = ''
# File path of python file on file server, filename extension is '.py'
REMOTE_PATH_PYTHON = ''

# Max times to retry get startup when no query result

GET_STARTUP_INTERVAL = 15 # seconds
MAX_TIMES_GET_STARTUP = 120 # Max times to retry

# Max times to retry when download file faild

MAX_TIMES_RETRY_DOWNLOAD = 3

class OPSConnection(object):
"""Make an OPS connection instance."""

def __init__(self, host, port = 80):

[Link] = host
[Link] = port
[Link] = {
"Content-type": "application/xml",
"Accept": "application/xml"
}

[Link] = [Link]([Link], [Link])

def close(self):
"""Close the connection"""
[Link]()

def create(self, uri, req_data):

"""Create a resource on the server"""
ret = self._rest_call("POST", uri, req_data)
return ret

def delete(self, uri, req_data):

"""Delete a resource on the server"""
ret = self._rest_call("DELETE", uri, req_data)
return ret

def get(self, uri, req_data = None):

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 99

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

"""Retrieve a resource from the server"""

ret = self._rest_call("GET", uri, req_data)
return ret

def set(self, uri, req_data):

"""Update a resource on the server"""
ret = self._rest_call("PUT", uri, req_data)
return ret

def _rest_call(self, method, uri, req_data):

"""REST call"""
if req_data == None:
body = ""
else:
body = req_data

[Link]('HTTP request: %s %s HTTP/1.1', method, uri)

[Link](method, uri, body, [Link])
response = [Link]()
ret = ([Link], [Link], [Link]())
if [Link] != [Link]:
[Link]('%s', body)
[Link]('HTTP response: HTTP/1.1 %s %s\n%s', ret[0], ret[1],
ret[2])
return ret

class OPIExecError(Exception):
"""OPI executes error."""
pass

class ZTPErr(Exception):
"""ZTP error."""
pass

def get_addr_by_hostname(ops_conn, host, addr_type = '1'):

"""Translate a host name to IPv4 address format. The IPv4 address is returned
as a string."""
[Link]("Get IP address by host name...")
uri = "/dns/dnsNameResolution"
root_elem = [Link]('dnsNameResolution')
[Link](root_elem, 'host').text = host
[Link](root_elem, 'addrType').text = addr_type
req_data = [Link](root_elem, "UTF-8")
ret, _, rsp_data = ops_conn.get(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to get address by host name')

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:') + '/vrp:'
elem = root_elem.find(uri + "ipv4Addr", namespaces)
if elem is None:
raise OPIExecError('Failed to get IP address by host name')

return [Link]

def _http_download_file(ops_conn, url, local_path):

"""Download file using HTTP."""
[Link]('HTTP download "%s" to "%s".', url, local_path)

url_tuple = urlparse(url)
if not [Link](r"\d+\.\d+\.\d+\.\d+", url_tuple.hostname):
netloc = get_addr_by_hostname(ops_conn, url_tuple.hostname)
if url_tuple.port:
netloc += ':' + str(url_tuple.port)
url = urlunparse((url_tuple.scheme, netloc, url_tuple.path,
url_tuple.params, url_tuple.query,
url_tuple.fragment))

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 100

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

ret = OK
opener = [Link]()
try:
dst_file_path = "%s/%s" % ([Link](), [Link](url))
dst_file_path = [Link](dst_file_path)
[Link]('HTTP download destination file=%s.', dst_file_path)
[Link](url, dst_file_path)
[Link](dst_file_path, stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP |
stat.S_IROTH | stat.S_IXOTH)
except (KeyboardInterrupt, Exception), reason:
if [Link](dst_file_path):
[Link](dst_file_path) # Remove incomplete file
[Link](reason)
print('Error: Failed to download file "%s" using HTTP' %
[Link](url))
ret = ERR

return ret

def _ftp_download_file(ops_conn, url, local_path):

"""Download file using FTP."""
[Link]('FTP download "%s" to "%s".', url, local_path)
uri = "/ftpc/ftpcTransferFiles/ftpcTransferFile"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<ftpcTransferFile>
<serverIpv4Address>$serverIp</serverIpv4Address>
<commandType>get</commandType>
<userName>$username</userName>
<password>$password</password>
<localFileName>$localPath</localFileName>
<remoteFileName>$remotePath</remoteFileName>
</ftpcTransferFile>
''')
url_tuple = urlparse(url)
if [Link](r"\d+\.\d+\.\d+\.\d+", url_tuple.hostname):
server_ip = url_tuple.hostname
else:
server_ip = get_addr_by_hostname(ops_conn, url_tuple.hostname)
req_data = str_temp.substitute(serverIp = server_ip, username =
url_tuple.username, password = url_tuple.password,
remotePath = url_tuple.path[1:], localPath =
local_path)
ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
print('Failed to download file "%s" using FTP' %
[Link](local_path))
return ERR

return OK

def _del_rsa_peer_key(ops_conn, key_name):

"""Delete RSA peer key configuration"""
[Link]("Delete RSA peer key %s", key_name)
uri = "/rsa/rsaPeerKeys/rsaPeerKey"
root_elem = [Link]('rsaPeerKey')
[Link](root_elem, 'keyName').text = key_name
req_data = [Link](root_elem, "UTF-8")
try:
ret, _, _ = ops_conn.delete(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to delete RSA peer key')

except Exception, reason:

[Link](reason)

def _del_sshc_rsa_key(ops_conn, server_name, key_type = 'RSA'):

"""Delete SSH client RSA key configuration"""

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 101

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

[Link]("Delete SSH client RSA key for %s", server_name)

uri = "/sshc/sshCliKeyCfgs/sshCliKeyCfg"
root_elem = [Link]('sshCliKeyCfg')
[Link](root_elem, 'serverName').text = server_name
[Link](root_elem, 'pubKeyType').text = key_type
req_data = [Link](root_elem, "UTF-8")
try:
ret, _, _ = ops_conn.delete(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to delete SSH client RSA key')

except Exception, reason:

[Link](reason)

_del_rsa_peer_key(ops_conn, server_name)

def _set_sshc_first_time(ops_conn, switch):

"""Set SSH client attribute of authenticating user for the first time
access"""
if switch not in ['Enable', 'Disable']:
return ERR

[Link]('Set SSH client first-time enable switch = %s', switch)

uri = "/sshc/sshClient"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<sshClient>
<firstTimeEnable>$enable</firstTimeEnable>
</sshClient>
''')
req_data = str_temp.substitute(enable = switch)
ret, _, _ = ops_conn.set(uri, req_data)
if ret != [Link]:
if switch == 'Enable':
raise OPIExecError('Failed to enable SSH client first-time')
else:
raise OPIExecError('Failed to disable SSH client first-time')

return OK

def _sftp_download_file(ops_conn, url, local_path):

"""Download file using SFTP."""
_set_sshc_first_time(ops_conn, 'Enable')

[Link]('SFTP download "%s" to "%s".', url, local_path)

uri = "/sshc/sshcConnects/sshcConnect"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<sshcConnect>
<HostAddrIPv4>$serverIp</HostAddrIPv4>
<commandType>get</commandType>
<userName>$username</userName>
<password>$password</password>
<localFileName>$localPath</localFileName>
<remoteFileName>$remotePath</remoteFileName>
<identityKey>ssh-rsa</identityKey>
<transferType>SFTP</transferType>
</sshcConnect>
''')
url_tuple = urlparse(url)
if [Link](r"\d+\.\d+\.\d+\.\d+", url_tuple.hostname):
server_ip = url_tuple.hostname
else:
server_ip = get_addr_by_hostname(ops_conn, url_tuple.hostname)
req_data = str_temp.substitute(serverIp = server_ip, username =
url_tuple.username, password = url_tuple.password,
remotePath = url_tuple.path[1:], localPath =
local_path)
ret, _, _ = ops_conn.create(uri, req_data)

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 102

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

if ret != [Link]:
print('Failed to download file "%s" using SFTP' %
[Link](local_path))
ret = ERR
else:
ret = OK

_del_sshc_rsa_key(ops_conn, server_ip)
_set_sshc_first_time(ops_conn, 'Disable')
return ret

def _tftp_download_file(ops_conn, url, local_path):

"""Download file using TFTP."""
[Link]('TFTP download "%s" to "%s".', url, local_path)
uri = "/tftpc/tftpcTransferFiles/tftpcTransferFile"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<tftpcTransferFile>
<serverIpv4Address>$serverIp</serverIpv4Address>
<commandType>get_cmd</commandType>
<localFileName>$localPath</localFileName>
<remoteFileName>$remotePath</remoteFileName>
</tftpcTransferFile>
''')
url_tuple = urlparse(url)
if [Link](r"\d+\.\d+\.\d+\.\d+", url_tuple.hostname):
server_ip = url_tuple.hostname
else:
server_ip = get_addr_by_hostname(ops_conn, url_tuple.hostname)
req_data = str_temp.substitute(serverIp = server_ip, remotePath =
url_tuple.path[1:], localPath = local_path)
ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
print('Failed to download file "%s" using TFTP' %
[Link](local_path))
return ERR

return OK

def _usb_download_file(ops_conn, url, local_path):

"""Download file using usb"""
[Link]('USB download "%s" to "%s".', url, local_path)

url_tuple = urlparse(url, allow_fragments=False)

src_path = url_tuple.path[1:]
try:
copy_file(ops_conn, src_path, local_path)
except:
print('Failed to download file "%s" using USB' %
[Link](local_path))
return ERR
return OK

def download_file(ops_conn, url, local_path, retry_times = 0):

"""Download file, support TFTP, FTP, SFTP and HTTP.

t[Link]
[Link]
s[Link]
[Link]

Args:
ops_conn: OPS connection instance
url: URL of remote file
local_path: local path to put the file

Returns:
A integer of return code
"""

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 103

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

url_tuple = urlparse(url)
print("Info: Download %s to %s" % (url_tuple.path[1:], local_path))
func_dict = {'tftp': _tftp_download_file,
'ftp': _ftp_download_file,
'sftp': _sftp_download_file,
'http': _http_download_file,
'file': _usb_download_file}
scheme = url_tuple.scheme
if scheme not in func_dict.keys():
raise ZTPErr('Unknown file transfer scheme %s' % scheme)

ret = OK
cnt = 0
while (cnt < 1 + retry_times):
if cnt:
print('Retry downloading...')
[Link]('Retry downloading...')
ret = func_dict[scheme](ops_conn, url, local_path)
if ret is OK:
break
cnt += 1

if ret is not OK:

raise ZTPErr('Failed to download file "%s"' % [Link](url))

return OK

class StartupInfo(object):
"""Startup configuration information

image: startup system software

config: startup saved-configuration file
patch: startup patch package
"""
def __init__(self, image = None, config = None, patch = None):
[Link] = image
[Link] = config
[Link] = patch

class Startup(object):
"""Startup configuration information

current: current startup configuration

next: current next startup configuration
"""
def __init__(self, ops_conn):
self.ops_conn = ops_conn
[Link], [Link] = self._get_startup_info()

def _get_startup_info(self):
"""Get the startup information."""
[Link]("Get the startup information...")
uri = "/cfg/startupInfos/startupInfo"
req_data = '''<?xml version="1.0" encoding="UTF-8"?>
<startupInfo>
<position/>
<configedSysSoft/>
<curSysSoft/>
<nextSysSoft/>
<curStartupFile/>
<nextStartupFile/>
<curPatchFile/>
<nextPatchFile/>
</startupInfo>'''

cnt = 0
while (cnt < MAX_TIMES_GET_STARTUP):
ret, _, rsp_data = self.ops_conn.get(uri, req_data)

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 104

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

if ret != [Link] or rsp_data is '':

cnt += 1
[Link]('Failed to get the startup information')
continue

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
mpath = 'data' + [Link]('/', '/vrp:') # match path
nslen = len(namespaces['vrp'])
elem = root_elem.find(mpath, namespaces)
if elem is not None:
break
[Link]('No query result while getting startup info')
sleep(GET_STARTUP_INTERVAL) # sleep to wait for system ready when
no query result
cnt += 1

if elem is None:
raise OPIExecError('Failed to get the startup information')

current = StartupInfo() # current startup info

curnext = StartupInfo() # next startup info
for child in elem:
tag = [Link][nslen + 2:] # skip the namespace,
'{namespace}text'
if tag == 'curSysSoft':
[Link] = [Link]
elif tag == 'nextSysSoft':
[Link] = [Link]
elif tag == 'curStartupFile' and [Link] != 'NULL':
[Link] = [Link]
elif tag == 'nextStartupFile' and [Link] != 'NULL':
[Link] = [Link]
elif tag == 'curPatchFile' and [Link] != 'NULL':
[Link] = [Link]
elif tag == 'nextPatchFile' and [Link] != 'NULL':
[Link] = [Link]
else:
continue

return current, curnext

def _set_startup_image_file(self, file_path):

"""Set the next startup system software"""
[Link]("Set the next startup system software to %s...", file_path)
uri = "/sum/startupbymode"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<startupbymode>
<softwareName>$fileName</softwareName>
<mode>STARTUP_MODE_ALL</mode>
</startupbymode>
''')
req_data = str_temp.substitute(fileName = file_path)
# it is a action operation, so use create for HTTP POST
ret, _, _ = self.ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError("Failed to set startup system software")

def _set_startup_config_file(self, file_path):

"""Set the next startup saved-configuration file"""
[Link]("Set the next startup saved-configuration file to %s...",
file_path)
uri = "/cfg/setStartup"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<setStartup>
<fileName>$fileName</fileName>
</setStartup>

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 105

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

''')
req_data = str_temp.substitute(fileName = file_path)
# it is a action operation, so use create for HTTP POST
ret, _, _ = self.ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError("Failed to set startup configuration file")

def _del_startup_config_file(self):
"""Delete startup config file"""
[Link]("Delete the next startup config file...")
uri = "/cfg/clearStartup"
req_data = '''<?xml version="1.0" encoding="UTF-8"?>
<clearStartup>
</clearStartup>
'''
# it is a action operation, so use create for HTTP POST
ret, _, _ = self.ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError("Failed to delete startup configuration file")

def _set_startup_patch_file(self, file_path):

"""Set the next startup patch file"""
[Link]("Set the next startup patch file to %s...", file_path)
uri = "/patch/startup"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<startup>
<packageName>$fileName</packageName>
</startup>
''')
req_data = str_temp.substitute(fileName = file_path)
# it is a action operation, so use create for HTTP POST
ret, _, _ = self.ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError("Failed to set startup patch file")

def _get_cur_stack_member_id(self):
"""rest api: Get current stack member id"""

[Link]("Get current stack member ID...")

uri = "/stack/stackMemberInfos/stackMemberInfo"
req_data = \
'''<?xml version="1.0" encoding="UTF-8"?>
<stackMemberInfo>
<memberID></memberID>
</stackMemberInfo>
'''
ret, _, rsp_data = self.ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
raise OPIExecError('Failed to get current stack member id, rsp not
ok')

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:') + '/vrp:'
elem = root_elem.find(uri + "memberID", namespaces)
if elem is None:
raise OPIExecError('Failed to get the current stack member id for no
"memberID" element')

return [Link]

def _set_stack_member_id(self, file_path, esn):

"""Set the next stack member ID"""

def get_stackid_from_file(fname, esn):

"""parse esn_id.txt file and get stack id according to esn num
format of esn_stackid file is like below:

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 106

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

sn Irf group Irf number

Sdddg 100 1
Sddde 100 2
"""
# fname must exist, guaranteed by caller
fname = [Link](fname)
with open(fname, 'rb') as item:
for line in item:
token = [Link]('[\r\n]')
token = [Link]()
if token[0] == esn:
return token[2]
return None

[Link]('Set the next stack member ID, filename %s', file_path)

uri = "/stack/stackMemberInfos/stackMemberInfo"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<stackMemberInfo>
<memberID>$curmemberid</memberID>
<nextMemberID>$memberid</nextMemberID>
</stackMemberInfo>
''')

cur_memid = self._get_cur_stack_member_id()
next_memid = get_stackid_from_file(file_path, esn)
if not next_memid:
[Link]('Failed to get stack id from %s, esn %s', file_path,
esn)
return

req_data = str_temp.substitute(curmemberid = cur_memid, memberid =

next_memid)
ret, _, _ = self.ops_conn.set(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to set stack id {}'.format(next_memid))

return OK

def _reset_stack_member_id(self):
"""rest api: reset stack member id"""

[Link]('Reset the next stack member ID')

uri = "/stack/stackMemberInfos/stackMemberInfo"
req_data = \
'''<?xml version="1.0" encoding="UTF-8"?>
<stackMemberInfo>
<memberID>1</memberID>
<nextMemberID>1</nextMemberID>
</stackMemberInfo>
'''

ret, _, _ = self.ops_conn.set(uri, req_data)

if ret != [Link]:
raise OPIExecError('Failed to reset stack id ')

return OK

def _reset_startup_patch_file(self):
"""Rest patch file for system to startup"""
[Link]("Reset the next startup patch file...")
uri = "/patch/resetpatch"
req_data = '''<?xml version="1.0" encoding="UTF-8"?>
<resetpatch>
</resetpatch>
'''
# it is a action operation, so use create for HTTP POST
ret, _, _ = self.ops_conn.create(uri, req_data)
if ret != [Link]:

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 107

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

raise OPIExecError('Failed to reset patch')

def reset_startup_info(self, slave):

"""Reset startup info and delete the downloaded files"""
[Link]("Reset the next startup information...")
_, configured = self._get_startup_info()

# 1. Reset next startup config file and delete it

try:
if [Link] != [Link]:
if [Link] is None:
self._del_startup_config_file()
else:
self._set_startup_config_file([Link])
if [Link] is not None:
del_file_all(self.ops_conn, [Link], slave)

except Exception, reason:

[Link](reason)

# 2. Reset next startup patch file

try:
if [Link] != [Link]:
if [Link] is None:
self._reset_startup_patch_file()
else:
self._set_startup_patch_file([Link])

if [Link] is not None:

del_file_all(self.ops_conn, [Link], slave)
except Exception, reason:
[Link](reason)

# 3. Reset next startup system software and delete it

try:
if [Link] != [Link]:
self._set_startup_image_file([Link])
del_file_all(self.ops_conn, [Link], slave)
except Exception, reason:
[Link](reason)

# 4. reset stack member id

try:
self._reset_stack_member_id()
except Exception, reason:
[Link](reason)

def set_startup_info(self, image_file, config_file, patch_file, memid_file,

slave, esn_str):
"""Set the next startup information."""
[Link]("Set the next startup information...")
# 1. Set next startup system software
if image_file is not None:
try:
self._set_startup_image_file(image_file)
except Exception, reason:
[Link](reason)
del_file_all(self.ops_conn, image_file, slave)
self.reset_startup_info(slave)
raise

# 2. Set next startup config file

if config_file is not None:
try:
self._set_startup_config_file(config_file)
except Exception, reason:
[Link](reason)
del_file_all(self.ops_conn, config_file, slave)
self.reset_startup_info(slave)

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 108

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

raise

# 3. Set next startup patch file

if patch_file is not None:
try:
self._set_startup_patch_file(patch_file)
except Exception, reason:
[Link](reason)
del_file_all(self.ops_conn, patch_file, slave)
self.reset_startup_info(slave)
raise

# 4. Set next member id

if memid_file is not None:
try:
self._set_stack_member_id(memid_file, esn_str)
except Exception, reason:
[Link](reason)
del_file_all(self.ops_conn, memid_file, None)
self.reset_startup_info(slave)
raise

def get_cwd(ops_conn):
"""Get the full filename of the current working directory"""
[Link]("Get the current working directory...")
uri = "/vfm/pwds/pwd"
req_data = \
'''<?xml version="1.0" encoding="UTF-8"?>
<pwd>
<dictionaryName/>
</pwd>
'''
ret, _, rsp_data = ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
raise OPIExecError('Failed to get the current working directory')

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:') + '/vrp:'
elem = root_elem.find(uri + "dictionaryName", namespaces)
if elem is None:
raise OPIExecError('Failed to get the current working directory for no
"directoryName" element')

return [Link]

def file_exist(ops_conn, file_path):

"""Returns True if file_path refers to an existing file, otherwise returns
False"""
uri = "/vfm/dirs/dir"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<dir>
<fileName>$fileName</fileName>
</dir>
''')
req_data = str_temp.substitute(fileName = file_path)
ret, _, rsp_data = ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
raise OPIExecError('Failed to list information about the file "%s"' %
file_path)

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:') + '/vrp:'
elem = root_elem.find(uri + "fileName", namespaces)
if elem is None:
return False

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 109

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

return True

def del_file(ops_conn, file_path):

"""Delete a file permanently"""
if file_path is None or file_path is '':
return

[Link]("Delete file %s permanently", file_path)

uri = "/vfm/deleteFileUnRes"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<deleteFileUnRes>
<fileName>$filePath</fileName>
</deleteFileUnRes>
''')
req_data = str_temp.substitute(filePath = file_path)
try:
# it is a action operation, so use create for HTTP POST
ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to delete the file "%s" permanently' %
file_path)

except Exception, reason:

[Link](reason)

def del_file_all(ops_conn, file_path, slave):

"""Delete a file permanently on all main boards"""
if file_path:
del_file(ops_conn, file_path)
if slave:
del_file(ops_conn, 'slave#' + file_path)

def copy_file(ops_conn, src_path, dest_path):

"""Copy a file"""
print('Info: Copy file %s to %s...' % (src_path, dest_path))
[Link]('Copy file %s to %s...', src_path, dest_path)
uri = "/vfm/copyFile"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<copyFile>
<srcFileName>$src</srcFileName>
<desFileName>$dest</desFileName>
</copyFile>
''')
req_data = str_temp.substitute(src = src_path, dest = dest_path)

# it is a action operation, so use create for HTTP POST

ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
raise OPIExecError('Failed to copy "%s" to "%s"' % (src_path, dest_path))

def has_slave_mpu(ops_conn):
"""Whether device has slave MPU, returns a bool value"""
[Link]("Test whether device has slave MPU...")
uri = "/devm/phyEntitys"
req_data = \
'''<?xml version="1.0" encoding="UTF-8"?>
<phyEntitys>
<phyEntity>
<entClass>mpuModule</entClass>
<entStandbyState/>
<position/>
</phyEntity>
</phyEntitys>
'''
ret, _, rsp_data = ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
raise OPIExecError('Failed to get the device slave information')

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 110

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:') + '/vrp:'
for entity in root_elem.findall(uri + 'phyEntity', namespaces):
elem = [Link]("vrp:entStandbyState", namespaces)
if elem is not None and [Link] == 'slave':
return True

return False

def get_system_info(ops_conn):
"""Get system info, returns a dict"""
[Link]("Get the system information...")
uri = "/system/systemInfo"
req_data = \
'''<?xml version="1.0" encoding="UTF-8"?>
<systemInfo>
<productName/>
<esn/>
<mac/>
</systemInfo>
'''
ret, _, rsp_data = ops_conn.get(uri, req_data)
if ret != [Link] or rsp_data is '':
raise OPIExecError('Failed to get the system information')

sys_info = {}.fromkeys(('productName', 'esn', 'mac'))

root_elem = [Link](rsp_data)
namespaces = {'vrp' : '[Link]
uri = 'data' + [Link]('/', '/vrp:')
nslen = len(namespaces['vrp'])
elem = root_elem.find(uri, namespaces)
if elem is not None:
for child in elem:
tag = [Link][nslen + 2:] # skip the namespace,
'{namespace}esn'
if tag in sys_info.keys():
sys_info[tag] = [Link]

return sys_info

def test_file_paths(image, config, patch, stack_memid, md5_file,

license_list_file):
"""Test whether argument paths are valid."""
[Link]("Test whether argument paths are valid...")
# check image file path
file_name = [Link](image)
if file_name is not '' and not file_name.lower().endswith('.cc'):
print('Error: Invalid filename extension of system software')
return False

# check config file path

file_name = [Link](config)
file_name = file_name.lower()
_, ext = [Link](file_name)
if file_name is not '' and ext not in ['.cfg', '.zip', '.dat']:
print('Error: Invalid filename extension of configuration file')
return False

# check patch file path

file_name = [Link](patch)
if file_name is not '' and not file_name.lower().endswith('.pat'):
print('Error: Invalid filename extension of patch file')
return False

# check stack member id file path

file_name = [Link](stack_memid)
if file_name is not '' and not file_name.lower().endswith('.txt'):

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 111

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

print('Error: Invalid filename extension of stack member ID file')

return False

# check md5 file path

file_name = [Link](md5_file)
if file_name is not '' and not file_name.lower().endswith('.txt'):
print('Error: Invalid filename extension of md5 file')
return False

# check license list file path

file_name = [Link](license_list_file)
if file_name is not '' and not file_name.lower().endswith('.xml'):
print('Error: Invalid filename extension of license list file')
return False

return True

def md5sum(fname, need_skip_first_line = False):

"""
Calculate md5 num for this file.
"""

def read_chunks(fhdl):
'''read chunks'''
chunk = [Link](8096)
while chunk:
yield chunk
chunk = [Link](8096)
else:
[Link](0)

md5_obj = hashlib.md5()
if isinstance(fname, basestring) and [Link](fname):
with open(fname, "rb") as fhdl:
#skip the first line
[Link](0)
if need_skip_first_line:
[Link]()
for chunk in read_chunks(fhdl):
md5_obj.update(chunk)
elif fname.__class__.__name__ in ["StringIO", "StringO"] or isinstance(fname,
file):
for chunk in read_chunks(fname):
md5_obj.update(chunk)
else:
pass
return md5_obj.hexdigest()

def md5_get_from_file(fname):
"""Get md5 num form file, stored in first line"""

with open(fname, "rb") as fhdl:

[Link](0)
line_first = [Link]()

# if not match pattern, the format of this file is not supported

if not [Link]('^#md5sum="[\\w]{32}"[\r\n]+$', line_first):
return 'None'

return line_first[9:41]

def md5_check_with_first_line(fname):
"""Validate md5 for this file"""

fname = [Link](fname)
md5_calc = md5sum(fname, True)
md5_file = md5_get_from_file(fname)

if md5_file.lower() != md5_calc:

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 112

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

[Link]('MD5 check failed, file %s', fname)

print('MD5 checksum of the file "%s" is %s' % (fname, md5_calc))
[Link]('MD5 checksum of the file "%s" is %s', fname, md5_calc)
print('MD5 checksum received from the file "%s" is %s' % (fname,
md5_file))
[Link]('MD5 checksum received from the file "%s" is %s', fname,
md5_file)
return False

return True

def md5_check_with_dic(md5_dic, fname):

"""md5 check with dic"""
if not md5_dic.has_key(fname):
[Link]('md5_dic does not has key %s, no need to do md5
verification', fname)
return True

md5sum_result = md5sum(fname, False)

if md5_dic[fname] == md5sum_result:
return True

print('MD5 checksum of the file "%s" is %s' % (fname, md5sum_result))

print('MD5 checksum received for the file "%s" is %s' % (fname,
md5_dic[fname]))
[Link]('MD5 check failed, file %s', fname)
[Link]('MD5 checksum of the file "%s" is %s', fname, md5sum_result)
[Link]('MD5 checksum received for the file "%s" is %s', fname,
md5_dic[fname])

return False

def parse_md5_file(fname):
"""parse md5 file"""

def read_line(fhdl):
"""read a line by loop"""
line = [Link]()
while line:
yield line
line = [Link]()
else:
[Link](0)

md5_dic = {}
with open(fname, "rb") as fhdl:
for line in read_line(fhdl):
line_spilt = [Link]()
if 2 != len(line_spilt):
continue
dic_tmp = {line_spilt[0]: line_spilt[1]}
md5_dic.update(dic_tmp)
return md5_dic

def verify_and_parse_md5_file(fname):
"""
vefiry data integrity of md5 file and parse this file

format of this file is like:

------------------------------------------------------------------
#md5sum="517cf194e2e1960429c6aedc0e4dba37"

file-name md5
conf_5618642831132.cfg c0ace0f0542950beaacb39cd1c3b5716
------------------------------------------------------------------
"""
if not md5_check_with_first_line(fname):
return ERR, None
return OK, parse_md5_file(fname)

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 113

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

def check_parameter(aset):
seq = ['&', '>', '<', '"', "'"]
if aset:
for c in seq:
if c in aset:
return True
return False

def check_filename(ops_conn):
sys_info = get_system_info(ops_conn)
url_tuple = urlparse(FILE_SERVER)
if check_parameter(url_tuple.username) or check_parameter(url_tuple.password):
raise ZTPErr('Invalid username or password, the name should not contain:
'+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_IMAGE.get(sys_info['productName'],
''))
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of system software, the name should not
contain: '+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_CONFIG)
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of configuration file, the name should not
contain: '+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_PATCH.get(sys_info['productName'],
''))
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of patch file, the name should not contain:
'+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_MEMID)
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of member ID file, the name should not
contain: '+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_MD5)
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of md5 file, the name should not contain:
'+'&'+' >'+' <'+' "'+" '.")
file_name = [Link](REMOTE_PATH_LICLIST)
if file_name is not '' and check_parameter(file_name):
raise ZTPErr('Invalid filename of license list file, the name should not
contain: '+'&'+' >'+' <'+' "'+" '.")
return OK

def active_license(ops_conn, license_name):

if license_name:
uri = "/lcs/lcsActive"
str_temp = [Link](
'''<?xml version="1.0" encoding="UTF-8"?>
<lcsActive>
<lcsFileName>$lcsFileName</lcsFileName>
</lcsActive>
''')
req_data = str_temp.substitute(lcsFileName = license_name)
ret, _, _ = ops_conn.create(uri, req_data)
if ret != [Link]:
[Link]('Error: Failed to active license.')
return ERR
return OK

def main_proc(ops_conn):
"""Main processing"""
sys_info = get_system_info(ops_conn) # Get system info, such as esn and
system mac
cwd = get_cwd(ops_conn) # Get the current working directory
startup = Startup(ops_conn)
slave = has_slave_mpu(ops_conn) # Check whether slave MPU board
exists or not
chg_flag = False

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 114

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

check_filename(ops_conn)

# check remote file paths

if not test_file_paths(REMOTE_PATH_IMAGE.get(sys_info['productName'], ''),
REMOTE_PATH_CONFIG,
REMOTE_PATH_PATCH.get(sys_info['productName'], ''),
REMOTE_PATH_MEMID, REMOTE_PATH_MD5,
REMOTE_PATH_LICLIST):
return ERR

# download md5 file first, used to verify data integrity of files which will
be downloaded next
local_path_md5 = None
file_path = REMOTE_PATH_MD5
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_md5 = cwd + file_name
ret = download_file(ops_conn, url, local_path_md5,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download MD5 file "%s"' % file_name)
return ERR
print('Info: Download MD5 file successfully')
ret, md5_dic = verify_and_parse_md5_file(file_name)
# delete the file immediately
del_file_all(ops_conn, local_path_md5, None)
if ret is ERR:
print('Error: MD5 check failed, file "%s"' % file_name)
return ERR
else:
md5_dic = {}

# download configuration file

local_path_config = None
file_path = REMOTE_PATH_CONFIG
if "%s" in file_path:
file_path = REMOTE_PATH_CONFIG % sys_info['esn']
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_config = cwd + file_name
ret = download_file(ops_conn, url, local_path_config,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download configuration file "%s"' % file_name)
return ERR
print('Info: Download configuration file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
return ERR
if slave:
copy_file(ops_conn, local_path_config, 'slave#' + local_path_config)
chg_flag = True

# download patch file

local_path_patch = None
file_path = REMOTE_PATH_PATCH.get(sys_info['productName'], '')
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if [Link]:
cur_pat = [Link]([Link]).lower()
else:

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 115

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

cur_pat = ''
if file_name is not '' and file_name.lower() != cur_pat:
url = FILE_SERVER + file_path
local_path_patch = cwd + file_name
ret = download_file(ops_conn, url, local_path_patch,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download patch file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
return ERR
print('Info: Download patch file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
return ERR
if slave:
copy_file(ops_conn, local_path_patch, 'slave#' + local_path_patch)
chg_flag = True

# download stack member ID file

local_path_memid = None
file_path = REMOTE_PATH_MEMID
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_memid = cwd + file_name
ret = download_file(ops_conn, url, local_path_memid,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download system software "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
return ERR
print('Info: Download stack member ID file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
return ERR
chg_flag = True
#no need copy to slave board

# download system software

local_path_image = None
file_path = REMOTE_PATH_IMAGE.get(sys_info['productName'], '')
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if [Link]:
cur_image = [Link]([Link]).lower()
else:
cur_image = ''
if file_name is not '' and file_name.lower() != cur_image:
url = FILE_SERVER + file_path
local_path_image = cwd + file_name
ret = download_file(ops_conn, url, local_path_image,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
if file_exist(ops_conn, file_name):
del_file_all(ops_conn, local_path_image, slave)
print('Error: Failed to download system software "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
return ERR

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 116

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

print('Info: Download system software file successfully')

if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
return ERR
if slave:
copy_file(ops_conn, local_path_image, 'slave#' + local_path_image)
chg_flag = True

# download license list file

local_path_liclist = None
file_path = REMOTE_PATH_LICLIST
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
download_space = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_liclist = cwd + file_name
ret = download_file(ops_conn, url, local_path_liclist,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download license list file "%s"' % file_name)
return ERR
print('Info: Download license list file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
return ERR
chg_flag = True

#execute license list file to get license file name which end with .dat
license_name = None
if local_path_liclist is not None:
tree = [Link](file_name)
root = [Link]()
for child in [Link]('Lic'):
name = [Link]('name')
esn = [Link]('Esn').text
if sys_info['esn'] in esn:
license_name = name
print('Info: License file name is "%s"' % license_name)
break
if license_name == None :
print('Error: Esn of this device is not in the license list file')
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
return ERR

# download license file

local_path_license = None
file_path = license_name
if file_path is not None:
if not file_path.startswith('/'):
file_path = '/' + file_path
file_path = download_space + file_path
file_name = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 117

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

local_path_license = cwd + file_name

ret = download_file(ops_conn, url, local_path_license,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download license file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
return ERR
print('Info: Download license file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
del_file_all(ops_conn, local_path_license, slave)
return ERR
chg_flag = True
#no need copy to slave board

# download python file

local_path_python = None
file_path = REMOTE_PATH_PYTHON
if not file_path.startswith('/'):
file_path = '/' + file_path
file_name = [Link](file_path)
if file_name is not '':
url = FILE_SERVER + file_path
local_path_python = cwd + file_name
ret = download_file(ops_conn, url, local_path_python,
MAX_TIMES_RETRY_DOWNLOAD)
if ret is ERR or not file_exist(ops_conn, file_name):
print('Error: Failed to download python file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
del_file_all(ops_conn, local_path_license, slave)
return ERR
print('Info: Download python file successfully')
if not md5_check_with_dic(md5_dic, file_name):
print('Error: MD5 check failed, file "%s"' % file_name)
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)
del_file_all(ops_conn, local_path_memid, slave)
del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
del_file_all(ops_conn, local_path_license, slave)
del_file_all(ops_conn, local_path_python, slave)
return ERR
if slave:
copy_file(ops_conn, local_path_python, 'slave#' + local_path_python)
chg_flag = True

if chg_flag is False:
return ERR

# active license file

if local_path_license is not None:
ret = active_license(ops_conn, local_path_license)
if ret is ERR:
print('Info: Active license failed')
del_file_all(ops_conn, local_path_config, slave)
del_file_all(ops_conn, local_path_patch, slave)

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 118

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

del_file_all(ops_conn, local_path_memid, slave)

del_file_all(ops_conn, local_path_image, slave)
del_file_all(ops_conn, local_path_liclist, slave)
del_file_all(ops_conn, local_path_license, slave)
del_file_all(ops_conn, local_path_python, slave)
return ERR
print('Info: Active license sucessfully, name: %s' % local_path_license)
# set startup info
startup.set_startup_info(local_path_image, local_path_config,
local_path_patch,
local_path_memid, slave, sys_info['esn'])

# delete stack member ID file and license list file after used
del_file_all(ops_conn, local_path_memid, None)
del_file_all(ops_conn, local_path_liclist, None)

return OK

def main(usb_path = ''):

"""The main function of user script. It is called by ZTP frame, so do not
remove or change this function.

Args:
Raises:
Returns: user script processing result
"""
host = "localhost"
if usb_path and len(usb_path):
[Link]('ztp_script usb_path: %s', usb_path)
global FILE_SERVER
FILE_SERVER = '[Link] + usb_path
try:
# Make an OPS connection instance.
ops_conn = OPSConnection(host)
ret = main_proc(ops_conn)

except OPIExecError, reason:

[Link]('OPI execute error: %s', reason)
print("Error: %s" % reason)
ret = ERR

except ZTPErr, reason:

[Link]('ZTP error: %s', reason)
print("Error: %s" % reason)
ret = ERR

except IOError, reason:

print("Error: %s" % reason)
ret = ERR

except Exception, reason:

[Link](reason)
traceinfo = traceback.format_exc()
[Link](traceinfo)
ret = ERR

finally:
# Close the OPS connection
ops_conn.close()

return ret

if __name__ == "__main__":
main()

Configuration Files

l Configuration file of SwitchC

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 119

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 2 ZTP Configuration

#
sysname SwitchC
#
vlan batch 10
#
dhcp enable
#
interface Vlanif10
ip address [Link] [Link]
dhcp select relay
dhcp relay binding server ip [Link]
#
interface 10GE1/0/1
port link-type trunk
port trunk pvid vlan 10
port trunk allow-pass vlan 10
#
interface 10GE1/0/2
port link-type trunk
port trunk pvid vlan 10
port trunk allow-pass vlan 10
#
return

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 120

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 3 USB-based Deployment Configuration

3 USB-based Deployment Configuration

About This Chapter

USB-based deployment simplifies the deployment process, reduces the deployment costs, and
relieves users from software commissioning.
3.1 USB-based Deployment Overview
3.2 Principles
3.3 Configuration Notes
3.4 Making an Index File
3.5 Configuring USB-based Deployment
3.6 (Optional) Disabling the USB-based Deployment Function
3.7 Configuration Examples

3.1 USB-based Deployment Overview

Definition
USB-based deployment allows you to configure or upgrade devices using a USB flash drive.
Before device deployment, save the required files in a USB flash drive. After you connect the
USB flash drive to a device, the device downloads the files from the USB flash drive to
complete automatic upgrade or service deployment.

Purpose
As the network expands, more and more network devices are used and device deployment
becomes more frequent. Traditionally, software engineers have to deploy the devices one by
one, which is time-consuming and laborious. USB-based deployment frees software engineers
from such trouble. They only need to save the required files in a USB flash drive, and then
other onsite personnel can finish the deployment process easily. This function simplifies the
device deployment process and lowers deployment costs.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 121

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 3 USB-based Deployment Configuration

3.2 Principles

USB-based Deployment Process

Before a USB-based deployment, make an index file, save the index file in the root directory
of a USB flash drive, and save the upgrade files in the directory specified in the index file.
When you connect the USB flash drive to a device, the device downloads the specified files to
complete software upgrade.
Figure 3-1 shows the USB-based deployment flowchart.

Figure 3-1 USB-based deployment flowchart

Create an index file.

Copy the index file to the

root directory of a USB flash
drive, and copy deployment
files to the directory
specified by the index file.

Insert the USB flash drive

into a device.

The device restarts.

Remove the USB flash

drive.

Upgrade File Types

The device to be upgraded automatically loads the required files according to description in
the index file.
l Mandatory file
– Index file: The file name is smart_config.ini.
l Optional files
– System software: The file name extension is .cc.
– Configuration file: The file name extension is .cfg, .zip or .dat.
– Patch file: The file name extension is .pat.
Users can select one or more types of optional file based on the site requirements.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 122

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 3 USB-based Deployment Configuration

Device Running Process

Figure 3-2 shows the device running flowchart during USB-based deployment.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 123

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 3 USB-based Deployment Configuration

Figure 3-2 Device running flowchart

1. A user inserts a USB flash drive into a device.

2. The system checks whether an index No

file exists in the USB flash drive.

Yes

3. The system checks whether the index No

file is valid.

Yes

Failure
4. The system obtains deployment files.

Success

5. The system set files to be loaded during next

system startup.

6. The device restarts.

No
7. The system checks whether files loaded
are the same as deployment files.

Yes

8. The process ends. The user removes the USB

flash drive.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 124

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 3 USB-based Deployment Configuration

1. A user inserts a USB flash drive to a device.

2. The system checks if the USB-based deployment function is enabled.
3. The system detects the USB flash drive and checks whether an index file exists in the
USB flash drive.
– If an index file exists, the process goes to step 3.
– If no index file exists, the USB-based deployment process ends.
4. The system checks whether the index file is valid.
– If the index file is valid, the process goes to step 4.
– If the index file is invalid, the deployment fails.
5. The system obtains deployment files from the USB flash drive and saves them in
specified storage media.
– If files are obtained successfully, the process goes to step 5.
– If files are not obtained successfully, the deployment fails.
6. The system specifies the loaded files for next startup.
7. The device restarts.
8. The system checks whether the loaded files are the same as the specified upgrade files.
– If so, the deployment succeeds.
– If not, the deployment fails.
9. The USB-based deployment process ends. The user removes the USB flash drive from
the device.

3.3 Configuration Notes

Involved Network Elements

USB-based deployment requires the following component:
l USB flash drive

License Support
USB-based deployment is a basic feature of a switch and is not under license control.

Version Support

Table 3-1 Minimum version supporting USB-based deployment

Series Product Model Minimum Version Required

CE8800 CE8860EI V100R006C00

CE8850EI V200R002C50

CE7800 CE7850EI V100R003C00

CE7855EI V200R001C00

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 125

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 3 USB-based Deployment Configuration

Series Product Model Minimum Version Required

CE6800 CE6810EI V100R003C00

CE6810-48S4Q-LI/ V100R003C10
CE6810-48S-LI

CE6810-32T16S4Q-LI/ V100R005C10
CE6810-24S2Q-LI

CE6850EI V100R001C00

CE6850-48S6Q-HI V100R005C00

CE6850-48T6Q-HI/ V100R005C10
CE6850UHI

CE6851HI V100R005C10

CE6855HI V200R001C00

CE6860EI V200R002C50

CE6870-24S6CQ-EI/ V200R001C00
CE6870-48S6CQ-EI

CE6870-48T6CQ-EI V200R002C50

CE6880EI V200R002C50

CE5800 CE5810EI V100R002C00

CE5850EI V100R001C00

CE5850HI V100R003C00

CE5855EI V100R005C10

Feature Dependencies and Limitations

l The file system format of a USB flash drive must be FAT32 and its interface must be
standard USB2.0.
l To write data to a USB flash drive, disable the write-protection function.
l USB-based deployment is supported only on a standalone device but not in a stack that
contains multiple member devices.
l Before USB-based deployment, ensure that the device can start properly and has
sufficient space for saving deployment files.
l USB-based deployment files include the index file, system software, configuration file,
and patch file. The index file is mandatory. At least one of the other files must exist.
l The index file name must be smart_config.ini.
l Do not power off the device during file copy; otherwise, the upgrade fails or even the
device cannot start.
l Do not remove the USB flash drive before the USB-based deployment is complete;
otherwise, the data in the USB flash drive may be damaged.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 126

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 3 USB-based Deployment Configuration

l When deployment files include the configuration file and an authentication password for
USB-based deployment is configured, you must compress and encrypt the configuration
file using the configured authentication password before saving the configuration file to
the specified path of the USB flash drive. However, the configuration file in .zip format
cannot be compressed and encrypted. You need to first decompress the configuration file
in .zip format and then compress and encrypt the file before saving it to the USB flash
drive.

3.4 Making an Index File

Procedure of Making an Index File

To edit the index file on the PC, perform the following operations:
1. Create a text file.
2. Edit the file based on the index file format. The field names in the index file must be in
uppercase.
3. Rename the file as smart_config.ini.
4. Copy the smart_config.ini file to the root directory of the USB flash drive.

Index File Format

The index file format is as follows:
BEGIN DC
[GLOBAL CONFIG]
TIMESN=
EMS_ONLINE_STATE=
UPGRADEMODE=
[DEVICEn DESCRIPTION]
OPTION=
ESN=
MAC=
DIRECTORY=
SYSTEM-SOFTWARE=
SYSTEM-CONFIG=
HMAC=
SYSTEM-PAT=
END DC

Table 3-2 Fields in the index file

Field Mandatory or Description
Optional

BEGIN DC Mandatory Start tag of the index file. This field

cannot be modified.

[GLOBAL CONFIG] Mandatory Start tag of the global configuration. This

field cannot be modified.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 127

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 3 USB-based Deployment Configuration

Field Mandatory or Description

Optional

TIMESN Mandatory Data change time in the format

[Link].
For example, the value 20110628.080910
indicates 2011-06-28 08:09:10.
NOTE
The TIMESN field is a USB-based
deployment flag. A device has a default USB-
based deployment flag. If the
smart_config.ini file exists in the USB flash
drive, the device checks whether the default
USB-based deployment flag and the TIMESN
value in the smart_config.ini file are the
same. If they are different, the USB-based
deployment process is triggered. If the
deployment succeeds, the value of the default
USB-based deployment flag on the device is
changed to the TIMESN value in the
smart_config.ini file.

EMS_ONLINE_STA Optional Whether the NMS is online, indicating

TE whether a device registers with the NMS
after being deployed:
l YES: The device registers with the
NMS.
l NO: The device does not register with
the NMS.
The default value is NO.
NOTE
If this field does not exist or is empty, the
default value is used.

UPGRADEMODE Optional Upgrade mode:

l AUTO: automatic mode
l DFT: production mode, which is used
in production, commissioning, and
testing environment. In this mode,
only the system software version is
upgraded.
The default value is AUTO.
NOTE
If this field does not exist or is empty, the
default value is used.

[DEVICEn Mandatory Start tag of the file description. n

DESCRIPTION] indicates the device number. The value is
an integer and starts from 0.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 128

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 3 USB-based Deployment Configuration

Field Mandatory or Description

Optional

OPTION Optional Whether file information is valid:

l OK: valid
l NOK: invalid
The default value is OK.
NOTE
If this field does not exist or is empty, the
default value is used.

ESN Optional Serial number of a device. If the value of

this field is DEFAULT, the index file is
applicable to all devices. Otherwise, the
index file is applicable to a specific
device.
The default value is DEFAULT.
NOTE
If this field does not exist or is empty, the
default value is used.

MAC Optional Device MAC address, in XXXX-XXXX-

XXXX format. X is a hexadecimal
number. If the value of this field is
DEFAULT, the index file is applicable to
all devices. Otherwise, the index file is
applicable to a specific device.
The default value is DEFAULT.
NOTE
If this field does not exist or is empty, the
default value is used.

DIRECTORY Optional Path for storing deployment files.

l If the value is DEFAULT, the
deployment files are stored in the root
directory of the USB flash drive.
l If the value is /abc, the deployment
files are stored in the abc directory.
The default value is DEFAULT.
NOTE
If this field does not exist or is empty, the
default value is used.

SYSTEM- Optional System software file with file name

SOFTWARE extension .cc.

SYSTEM-CONFIG Optional Configuration file with file name

extension .cfg, .zip or .dat.
NOTE
If this field has a value, the MAC field cannot
be empty or default.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 129

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 3 USB-based Deployment Configuration

Field Mandatory or Description

Optional

HMAC Optional HMAC of the configuration file, which is

used to check the configuration file to be
loaded. The value is a string of 64
characters and is calculated for the
configuration file in the USB flash drive
based on the HMAC-SHA256 algorithm
through a calculation tool. The key used
for calculation must be the same as the
password configured using the set device
usb-deployment password password
command.
By default, no check is performed on the
configuration file.
NOTE
If this field does not exist or is empty, the
default value is used.
The HMAC can be generated for the
configuration file through the HMAC-
SHA256 calculation tool (such as OpenSSL).

SYSTEM-PAT Optional Patch file with file name extension .pat.

END DC Mandatory End tag of the index file.

Examples

Example 1
You need to create an index file for upgrading one device, and the requirements are as
follows:
l Data is changed at 08:09:10 on June 28, 2011.
l The device does not register with the NMS.
l The device MAC address is 0018-0303-1234.
l The system software [Link], the configuration file [Link], and
the patch file [Link] are stored in the root directory of the USB flash drive.
l The configuration file to be loaded is checked according to the HMAC
c3caaee8f4f6bd1389f438801e40dad9af30f2fbbe7e8f55121b39c6c16ba488.
The index file that meets the preceding requirements is as follows:
BEGIN DC
[GLOBAL CONFIG]
TIMESN=20110628.080910
EMS_ONLINE_STATE=NO
UPGRADEMODE=AUTO
[DEVICE0 DESCRIPTION]
OPTION=OK
ESN=DEFAULT
MAC=0018-0303-1234
DIRECTORY=DEFAULT

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 130

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 3 USB-based Deployment Configuration

SYSTEM-SOFTWARE=[Link]
SYSTEM-CONFIG=[Link]
HMAC=c3caaee8f4f6bd1389f438801e40dad9af30f2fbbe7e8f55121b39c6c16ba488
SYSTEM-PAT=[Link]
END DC

Example 2
You need to create an index file for upgrading multiple devices to the same software version,
and the requirements are as follows:
l Data is changed at 08:09:10 on June 28, 2011.
l The device does not register with the NMS.
l The system software [Link] is stored in the root directory of the USB flash
drive.
The index file that meets the preceding requirements is as follows:
BEGIN DC
[GLOBAL CONFIG]
TIMESN=20110628.080910
EMS_ONLINE_STATE=NO
UPGRADEMODE=AUTO
[DEVICE0 DESCRIPTION]
OPTION=OK
ESN=DEFAULT
MAC=DEFAULT
DIRECTORY=DEFAULT
SYSTEM-SOFTWARE=[Link]
END DC

Example 3
You need to create an index file for two devices with different description information, and
the requirements are as follows:
l Data is changed at 08:09:10 on June 28, 2011.
l The device does not register with the NMS.
l The MAC address of the first device is 0018-0303-1234.
l The MAC address of the second device is 0018-0303-5678.
l The system software [Link] and the configuration file [Link]
are stored in the root directory of the USB flash drive. The first device does not need to
load the configuration file while the second device must load the configuration file.
The index file that meets the preceding requirements is as follows:
BEGIN DC
[GLOBAL CONFIG]
TIMESN=20110628.080910
EMS_ONLINE_STATE=NO
UPGRADEMODE=AUTO
[DEVICE0 DESCRIPTION]
OPTION=OK
ESN=DEFAULT
MAC=0018-0303-1234
DIRECTORY=DEFAULT
SYSTEM-SOFTWARE=[Link]
[DEVICE1 DESCRIPTION]
OPTION=OK
ESN=DEFAULT
MAC=0018-0303-5678
DIRECTORY=DEFAULT

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 131

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 3 USB-based Deployment Configuration

SYSTEM-SOFTWARE=[Link]
SYSTEM-CONFIG=[Link]
END DC

3.5 Configuring USB-based Deployment

Background Information
When using USB-based deployment, pay attention to the following points:
l The file system format of a USB flash drive must be FAT32 and its interface must be
standard USB2.0.
l To write data to a USB flash drive, disable the write-protection function.
l USB-based deployment is supported only on a standalone device but not in a stack that
contains multiple member devices.
l Before USB-based deployment, ensure that the device can start properly and has
sufficient space for saving deployment files.
l USB-based deployment files include the index file, system software, configuration file,
and patch file. The index file is mandatory. At least one of the other files must exist.
l The index file name must be smart_config.ini.
l Do not power off the device during file copy; otherwise, the upgrade fails or even the
device cannot start.
l Do not remove the USB flash drive before the USB-based deployment is complete;
otherwise, the data in the USB flash drive may be damaged.
l When deployment files include the configuration file and an authentication password for
USB-based deployment is configured, you must compress and encrypt the configuration
file using the configured authentication password before saving the configuration file to
the specified path of the USB flash drive. However, the configuration file in .zip format
cannot be compressed and encrypted. You need to first decompress the configuration file
in .zip format and then compress and encrypt the file before saving it to the USB flash
drive.

Pre-configuration Tasks
l The device has been powered on and the self-check is successful.

Procedure
1. Run the system-view command to enter the system view.
2. Run the undo set device usb-deployment disable command to enable the USB-based
deployment function.
The USB-based deployment function is disabled by default. It is recommended that you
disable this function after a USB-based deployment is complete.
3. (Optional) Run the set device usb-deployment password [ password ] command to
configure an authentication password for USB-based deployment to check the validity of
the configuration file.
By default, no authentication password is configured on the device.
After an authentication password is configured, the device uses the password as the key
to calculate the HMAC of the configuration file to be loaded based on the HMAC-

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 132

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 3 USB-based Deployment Configuration

SHA256 algorithm and compares the calculated HMAC with the value of the HMAC
field in the index file. If the two HMAC values are the same, the device considers the
configuration file valid, and USB-based deployment can be performed. Otherwise, the
device considers the configuration file invalid, and USB-based deployment cannot be
performed.
NOTE

After an authentication password is configured using the set device usb-deployment password
password command, the HMAC field in the index file must contain the HMAC of the configuration
file. The HMAC is generated through the HMAC-SHA256 calculation tool (such as OpenSSL), and the
key is the configured authentication password.
To ensure device security, you are advised to configure the authentication password for USB-based
deployment and periodically change the password.
4. Run the commit command, the configuration is committed.
5. Create an index file.
For details, see 3.4 Making an Index File.
6. Save the index file in the root directory of a USB flash drive, and copy deployment files
to the specified directory.
The DIRECTORY field in the index file specifies the path for storing deployment files.
– If the value is DEFAULT, the deployment files are stored in the root directory of
the USB flash drive.
– If the value is /abc, the deployment files are stored in the abc directory.
NOTE

If deployment files include the configuration file and an authentication password for USB-based
deployment needs to be configured in step 3, you must compress and encrypt the configuration file
using the configured authentication password before saving the configuration file to the specified path
of the USB flash drive. However, the configuration file in .zip format cannot be compressed and
encrypted. You need to first decompress the configuration file in .zip format and then compress and
encrypt the file before saving it to the USB flash drive.
7. Insert the USB flash drive into a device to start the deployment process.
Based on the description information in the smart_config.ini file, the system first copies
deployment files from the USB flash drive to the default storage media (If the system
failed to copy files, the deployment indicator is steady red and the deployment failed),
set the system software, configuration file and patch file as files to be loaded during next
system startup, and automatically restarts.

Checking the Configuration

l Observe the ACT indicator to determine the USB-based deployment status:
– Steady green: USB-based deployment is successful.
– Blinking green: USB-based deployment is in progress.
– Steady red: USB-based deployment failed.
NOTE

Verify that USB-based deployment is successful and remove the USB flash drive. The USB-based
deployment process is complete.
l View the USB-based deployment reports to learn about the deployment result.
After the deployment is complete, the system generates the usbload_verify.txt or
usbload_error.txt files, containing the success information and error information
respectively. The report files are stored in the root directory of the USB flash drive.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 133

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 3 USB-based Deployment Configuration

The content and format of the usbload_verify.txt and usbload_error.txt files are as
follows:
===================================================
Time : 2011-10-29 10:30:50
MAC Address : 0e-0f-22-01-02-03
System Name : CE6850
Description : USB-based deployed succeeded.
===================================================

Table 3-3 USB-based deployment report description

Item Description

Time Date and time when the information is

generated.

MAC Address MAC address of a device.

System Name Device model.

Description USB-based deployment report

information.

3.6 (Optional) Disabling the USB-based Deployment

Function

Context
After the USB-based deployment function is enabled on a device, the device can be upgraded
once a qualified USB flash drive is connected to the device. After the USB-based deployment
function takes effect, to enhance device security and avoid service interruption caused by
unnecessary version upgrades, disable the USB-based deployment function. After the USB-
based deployment function is disabled, the device cannot be upgraded using any qualified
USB flash drive.

Procedure
Step 1 Run:
system-view

The system view is displayed:

Step 2 Run:
set device usb-deployment disable

The USB-based deployment function is disabled.

By default, the USB-based deployment function is disabled.

Step 3 Run:
commit

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 134

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 3 USB-based Deployment Configuration

The configuration is committed.

----End

3.7 Configuration Examples

This section only provides configuration examples for single features. For details about multi-
feature configuration cases, feature-specific configuration cases, interconnection cases,
protocol or hardware replacement cases, and industry application cases, see the Typical
Configuration Cases.

3.7.1 Example for Configuring USB-based Deployment

Networking Requirements
A user must upgrade two devices without the software commissioning engineers being onsite.
The requirements are as follows:
l The device can start properly and has sufficient space for saving deployment files.
l The devices must be upgraded at 2011-06-28 08:09:10.
l The device does not register with the NMS.
l The MAC address of the first device is 0018-0303-1234. The name of the system
software is [Link]. No configuration file needs to be loaded.
l The MAC address of the second device is 0018-0303-5678. The name of the system
software is [Link]. The configuration file [Link] must be loaded.

Configuration Roadmap
The configuration roadmap is as follows:
1. Enable USB-based deployment.
2. Create the index file smart_config.ini.
3. Save the smart_config.ini file in the root directory of a USB flash drive, and copy
deployment files to the directory specified by the index file.
4. Insert the USB flash drive into a device to start the deployment process.

Procedure
Step 1 Enable USB-based deployment.
<HUAWEI> system-view
[~HUAWEI] undo set device usb-deployment disable
[*HUAWEI] commit

Step 2 Create the index file smart_config.ini.

# Create an index file and name it smart_config.ini. The content and format of the index file
are as follows:
BEGIN DC
[GLOBAL CONFIG]
TIMESN=20110628.080910
EMS_ONLINE_STATE=NO
UPGRADEMODE=AUTO
[DEVICE0 DESCRIPTION]

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 135

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 3 USB-based Deployment Configuration

OPTION=OK
MAC=0018-0303-1234
DIRECTORY=DEFAULT
SYSTEM-SOFTWARE=[Link]
[DEVICE1 DESCRIPTION]
OPTION=OK
MAC=0018-0303-5678
DIRECTORY=DEFAULT
SYSTEM-SOFTWARE=[Link]
SYSTEM-CONFIG=[Link]
END DC

Step 3 Save the smart_config.ini file in the root directory of a USB flash drive, and copy the
[Link] and [Link] files to the directory specified by the index file.
Step 4 Insert the USB flash drive into the first device.

Step 5 Observe the deployment indicator to monitor the USB-based deployment process:
l If any deployment file is not found, the deployment indicator is off.
l If deployment files are found but not valid, the deployment failed and the deployment
indicator is steady red.
l If deployment files are found and valid, the USB-based deployment starts and the
deployment indicator blinks green.
Based on the description information in the smart_config.ini file, the system first copies
deployment files from the USB flash drive to the default storage media (If the system
failed to copy files, the deployment indicator is steady red and the deployment failed),
set the system software, configuration file and patch file as files to be loaded during next
system startup, and automatically restarts.
Step 6 Verify the configuration.
l After the device restarts, the system checks the deployment status. If the deployment
indicator is steady green, USB-based deployment [Link] the deployment indicator is
steady red, USB-based deployment fails.
NOTE

Verify that USB-based deployment is successful and remove the USB flash drive. The USB-based
deployment process is complete.
l After the deployment is complete, the system generates the usbload_verify.txt or
usbload_error.txt files, containing the success information and error information
respectively. The report files are stored in the root directory of the USB flash drive.
Step 7 After the first device is deployed, insert the USB flash drive into the second device to start the
deployment process.

----End

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 136

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 4 Logging In to the System for the First Time

4 Logging In to the System for the First Time

About This Chapter

This chapter describes how to log in to a new device to configure the device. You can log in
through the console port or Mini USB port.

NOTE

Only CE8860EI, CE6850HI, CE6855-48T6Q-HI and CE6850U-HI support login through the mini USB
port.

4.1 First Login Overview

4.2 Logging In Through a Console Port
After the device is powered on for the first time, you can log in to it from a PC through the
console port to configure and manage the device.
4.3 Logging In Through the Mini USB Port
If no serial port is available on your PC, connect the USB port of the PC to the Mini USB port
of a device that is powered on for the first time. After logging in to the device through the
Mini USB port, you can configure and manage the device.
4.4 Configuration Example
This section provides configuration examples for first login, including the examples for
configuring the system time, system name, management IP address, and login using Telnet.

4.1 First Login Overview

To configure a device that is powered on for the first time, log in to the device through the
console port or Mini USB port.
The device provides a console port. To configure a device, connect the user terminal serial
port to the device console port. In addition to the console port, CE8860EI, CE6850HI,
CE6855-48T6Q-HI and CE6850U-HI switches also provide a Mini USB port. You can also
connect the user terminal to the Mini USB port to configure the switch.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 137

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 4 Logging In to the System for the First Time

NOTE

l Before using the Mini USB port to log in to a device, install the Mini USB port driver on the user
terminal.
l When both the Mini USB port and console port are connected, only the Mini USB port can be used
for login.

4.2 Logging In Through a Console Port

After the device is powered on for the first time, you can log in to it from a PC through the
console port to configure and manage the device.

Pre-configuration Tasks
Before logging in to the device through the console port, complete the following tasks:
l Preparing the console cable
l Installing the terminal emulation software on the PC
NOTE

You can use the built-in terminal emulation software (such as the HyperTerminal of Windows
2000) on the PC. If no built-in terminal emulation software is available, use the third-party
terminal emulation software. For details, see the software user guide or online help. This section
uses the third-party software SecureCRT as an example.

Configuration Procedure
Use the terminal emulation software to log in to the device through the console port, and
complete basic configurations for the device.

Default Configuration

Table 4-1 Default configuration of the device console port

Parameter Default Setting

Transmission rate 9600 bit/s

Flow control mode None

Parity bit None

Stop bit 1

Data bit 8

Procedure
Step 1 Use the terminal emulation software to log in to the device through the console port.
1. Insert the DB9 connector of the console cable delivered with the product to the 9-pin
serial port on the PC, and insert the RJ45 connector to the console port of the device, as
shown in Figure 4-1.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 138

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 4 Logging In to the System for the First Time

Figure 4-1 Connecting to the device through the console port

RJ-45
CONSOLE CE6850-48S4Q-EI
STATUS STATUS STATUS STATUS
SYS
MST

ACT
L/A

ID

ETH
PAC-350WA-B ~100-240V;50/60Hz,5A FAN-40EA-B PWR1 FAN1 FAN2 PWR2 FAN-40EA-B PAC-350WA-B ~100-240V;50/60Hz,5A

DB-9

2. Start the terminal emulation software on the PC. Create a connection, select the
connected port, and set communication parameters.(This section uses the third-party
software SecureCRT as an example.)

a. Click to establish a connection, as shown in Figure 4-2.

Figure 4-2 Establishing a connection

b. Set the connected port and communication parameters, as shown in Figure 4-3.
Select the connected port based on actual situations. For example, you can view
port information in Device Manager in the Windows operating system, and select
the connected port.
Communication parameters of the terminal emulation software must be consistent
with the default attribute settings of the console user interface on the device, which
are 9600 bit/s baud rate, 8 data bits, 1 stop bit, no parity check, and no flow control.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 139

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 4 Logging In to the System for the First Time

NOTE

By default, no flow control mode is configured on the device. Because RTS/CTS is selected
in the software by default, you need to deselect RTS/CTS; otherwise, you cannot enter
commands.

Figure 4-3 Setting the connected port and communication parameters

NOTE

A PC may have multiple connection interfaces; therefore, the interface connected through the
console cable is selected in this example. Generally, COM1 is selected.
If the serial port communication parameters of the device are modified, modify the communication
parameters on the PC accordingly (ensure that the parameter values are the same) and re-establish
the connection.
3. Press Enter until the following information is displayed. Enter the password and confirm
password. (The following information is only for reference.)
An initial password is required for the first login via the console.
Continue to set it? [Y/N]: y
Set a password and keep it safe! Otherwise you will not be able to login via
the console.

Please configure the login password (8-16)

Enter Password:
Confirm Password:

NOTE

– If the authentication password is not configured, users can log in to the device without entering
the password. This mode has potential security risks. It is recommended that the authentication
password be configured.
– The password is a string of 8 to 16 case-sensitive characters. The password must contain at
least two of the following character types: upper-case and lower-case letters, digits, and special
characters except the question mark (?) and space.
– The password entered in interactive mode is not displayed on the screen.
– When you log in to the system again in password authentication mode, enter the password that
is set during the initial login.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 140

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 4 Logging In to the System for the First Time

You can run commands to configure the device. Enter a question mark (?) whenever you
need help.

Step 2 Configure the device.

Set the time, date, name, and IP address for the device, and the user level and authentication
mode for the Telnet user.
1. Set the time and date on the device.

Table 4-2 Actions for setting the time and date on the device
Action Command Description

Enter the system-view -

system view.

Set the time clock timezone time-zone-name – add: adds the specified time
zone. { add | minus } offset zone offset to the Coordinated
Universal Time (UTC). That
is, the sum of the default UTC
time zone and offset is equal to
the time zone specified by
time-zone-name.
– minus: subtracts the specified
time zone offset from the
UTC. That is, the remainder
obtained by subtracting offset
from the default UTC time
zone is equal to the time zone
specified by time-zone-name.

Submit the commit -

configuratio
n.

Return from quit -

the system
view to the
user view.

Set the clock datetime [ utc ] If the time zone is not set, the
current time HH:MM:SS YYYY-MM-DD time set using this command is
and date. considered as the UTC time.
Before setting the current time,
you are advised to confirm the
current zone and set the correct
time zone offset.

Enter the system-view -

system view.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 141

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 4 Logging In to the System for the First Time

Action Command Description

(Optional) clock daylight-saving-time time- – By default, the DST is not

Set the zone-name one-year start-time configured.
daylight start-date end-time end-date – If you configure periodic DST,
saving time offset the combination of the DST
(DST). Or start time and end time can be
clock daylight-saving-time time- any of the following: date
zone-name repeating start-time +date and day of the week
{ first | second | third | fourth | +day of the week. For the
last } weekday month end-time configuration method, see
{ first | second | third | fourth | clock daylight-saving-time.
last } weekday month offset NOTE
[ start-year [ end-year ] ] When the DST is used, you can
run the clock timezone time-
Or zone-name { add | minus } offset
clock daylight-saving-time time- command to set the time zone.
The time zone in the output of
zone-name repeating start-time the display clock command is,
start-date1 end-time end-date1 however, the name of the DST
offset [ start-year [ end-year ] ] time zone. When the DST ends,
the system displays the original
time zone.

Submit the commit -

configuratio
n.

2. Set the device name and IP address.

The IP address is used to log in to the device through Telnet.

Table 4-3 Actions for setting the device name and IP address
Action Command Description

Enter the system-view -

system view.

Set the sysname host-name By default, the device host name

device is HUAWEI.
name. To enter a Chinese device name,
run the language character-set
character command to enable the
system to support the Chinese
character set and then run the
sysname host-name command.

Enter the interface interface-type interface- You can assign the IP address to
interface number the management interface or
view. another Layer 3 interface (such as
the VLANIF interface).

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 142

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 4 Logging In to the System for the First Time

Action Command Description

Assign the ip address ip-address { mask | If a new IP address is assigned to

IP address to mask-length } an interface, the new IP address
an interface. overrides the original one.
NOTE
Configure the IP address and routes
according to the network plan to
ensure that the routes between the
terminal and device are reachable.

Submit the commit -

configuratio
n.

3. Configure the user level and authentication mode for the Telnet user.

Table 4-4 Actions for configuring the user level and authentication mode for the Telnet
user
Action Command Description

Enter the system-view -

system view.

Enable the undo telnet [ ipv6 ] server Upon factory delivery, the Telnet
telnet disable server is disabled.
service.

Enter the user-interface vty first-ui- -

VTY user number [ last-ui-number ]
interface
view.

Set the user privilege level level By default, users who log in
Telnet user through the VTY user interface
level. can access commands at level 0.

Set the authentication-mode aaa The system provides two

authenticatio authentication modes: AAA
n mode for authentication and password
the Telnet authentication. AAA
user to AAA authentication requires both the
authenticatio user name and password, which is
n. more secure than password
authentication. This topic
describes how to configure AAA
authentication. For the
configuration method of other
authentication modes, see
Configuring the VTY User
[Link] default, no
authentication mode is configured
for the VTY user interface.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 143

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 4 Logging In to the System for the First Time

Action Command Description

Enter the aaa -

AAA view.

Configure local-user user-name password -

the user irreversible-cipher irreversible-
name and cipher-password
password for
login
through
Telnet.

Set the login local-user user-name service- -

mode to type telnet
Telnet.

Submit the commit -

configuratio
n.

4. Save the configuration.

After basic configuration is complete, you are advised to save the configuration. If the
configuration information is lost, the connection and configuration for the first login
must be performed again.

Table 4-5 Actions for saving the configuration

Action Command Description

Return to the user view. return -

Save the configuration. save The current configuration

has been saved in the
configuration file. For
detailed operations, see
8.2.1 Saving the
Configuration File.

Step 3 Check the configuration.

l Run the display clock command to check the current date and clock setting.
l Run the display ip interface brief [ interface-type [ interface-number ] ] command to
check brief information about the IP address on the interface.
l Run the display user-interface [ ui-type ui-number1 | ui-number ] [ summary ]
command to check the physical attributes and configuration of the user interface.
l Run the display aaa local-user command to check the local user list.

----End

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 144

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 4 Logging In to the System for the First Time

4.3 Logging In Through the Mini USB Port

If no serial port is available on your PC, connect the USB port of the PC to the Mini USB port
of a device that is powered on for the first time. After logging in to the device through the
Mini USB port, you can configure and manage the device.

NOTE

Only CE8860EI, CE6850HI, CE6855-48T6Q-HI and CE6850U-HI support login through the Mini USB
port.

Pre-configuration Tasks
Before logging in to a device through the Mini USB port, complete the following tasks:

l Preparing a Mini USB cable

l Obtaining the Mini USB driver that is compatible with the PC's operating system
NOTE

To obtain the Mini USB driver, visit [Link] and download

CE_MiniUSB_driver. The Mini USB driver supports only Windows XP, Windows Vista, and
Windows 7 operating systems.
l Installing the terminal emulation software on the PC
NOTE

You can use the self-contained terminal emulation software of the operating system (such as the
HyperTerminal of Windows XP) on the PC. If no built-in terminal emulation software is available,
use the third-party terminal emulation software. For details, see the software user guide or online
help.

Configuration Procedure
Install the Mini USB driver on the PC, use the terminal emulation software to log in through
the Mini USB port, and configure the device.

Default Configuration

Table 4-6 Default configuration of the Mini USB port

Parameter Default Setting

Transmission rate 9600 bit/s

Flow control mode None

Parity bit None

Stop bit 1

Data bit 8

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 145

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 4 Logging In to the System for the First Time

Procedure
Step 1 Install the Mini USB driver.

For the method of installing a driver, see Mini USB Serial Port Usage Guide on CloudEngine
Series Switches on the Huawei enterprise support website ([Link]
enterprise).

Step 2 Use the terminal emulation software to log in to the device through the Mini USB port.
1. Start the terminal emulation software on the PC. Create a connection, select the
connected port, and set communication parameters.
NOTE

A PC may have multiple connection interfaces; therefore, the interface connected through the Mini
USB cable is selected in this example.
If the serial interface communication parameters of the device are modified, modify the
communication parameters on the PC accordingly (ensure that the parameter values are the same)
and re-establish the connection.
2. Press Enter until the following information is displayed. Enter the password and confirm
the password. (The following information is only for reference.)
An initial password is required for the first login via the console.
Continue to set it? [Y/N]: y
Set a password and keep it safe! Otherwise you will not be able to login via
the console.

Please configure the login password (8-16)

Enter Password:
Confirm Password:

NOTE

– If the authentication password is not configured, users can log in to the device without entering
the password. This mode has potential security risks. It is recommended that the authentication
password be configured.
– The password is a string of 8 to 16 case-sensitive characters. The password must contain at
least two of the following character types: upper-case and lower-case letters, digits, and special
characters except the question mark (?) and space.
– The password entered in interactive mode is not displayed on the screen.
– When you log in to the system again in password authentication mode, enter the password that
is set during the initial login.

You can run commands to configure the device. Enter a question mark (?) whenever you
need help.

Step 3 Configure the device.

After the configuration is complete, you can log in to the device using Telnet.
1. Set the time and date on the device.

Table 4-7 Actions for setting the time and date on the device

Action Command Description

Enter the system-view -

system view.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 146

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 4 Logging In to the System for the First Time

Action Command Description

Set the time clock timezone time-zone-name – add: adds the specified time
zone. { add | minus } offset zone offset to the Coordinated
Universal Time (UTC). That
is, the sum of the default UTC
time zone and offset is equal to
the time zone specified by
time-zone-name.
– minus: subtracts the specified
time zone offset from the
UTC. That is, the remainder
obtained by subtracting offset
from the default UTC time
zone is equal to the time zone
specified by time-zone-name.

Submit the commit -

configuratio
n.

Return from quit -

the system
view to the
user view.

Set the clock datetime [ utc ] If the time zone is not set, the
current time HH:MM:SS YYYY-MM-DD time set using this command is
and date. considered as the UTC time.
Before setting the current time,
you are advised to confirm the
current zone and set the correct
time zone offset.

Enter the system-view -

system view.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 147

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 4 Logging In to the System for the First Time

Action Command Description

(Optional) clock daylight-saving-time time- – By default, the DST is not

Set the zone-name one-year start-time configured.
daylight start-date end-time end-date – If you configure periodic DST,
saving time offset the combination of the DST
(DST). Or start time and end time can be
clock daylight-saving-time time- any of the following: date
zone-name repeating start-time +date and day of the week
{ first | second | third | fourth | +day of the week. For the
last } weekday month end-time configuration method, see
{ first | second | third | fourth | clock daylight-saving-time.
last } weekday month offset NOTE
[ start-year [ end-year ] ] When the DST is used, you can
run the clock timezone time-
Or zone-name { add | minus } offset
clock daylight-saving-time time- command to set the time zone.
The time zone in the output of
zone-name repeating start-time the display clock command is,
start-date1 end-time end-date1 however, the name of the DST
offset [ start-year [ end-year ] ] time zone. When the DST ends,
the system displays the original
time zone.

Submit the commit -

configuratio
n.

2. Set the device name and IP address.

The IP address is used to log in to the device through Telnet.

Table 4-8 Actions for setting the device name and IP address
Action Command Description

Enter the system-view -

system view.

Set the sysname host-name By default, the device host name

device is HUAWEI.
name. To enter a Chinese device name,
run the language character-set
character command to enable the
system to support the Chinese
character set and then run the
sysname host-name command.

Enter the interface interface-type interface- You can assign the IP address to
interface number the management interface or
view. another Layer 3 interface (such as
the VLANIF interface).

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 148

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 4 Logging In to the System for the First Time

Action Command Description

Assign the ip address ip-address { mask | If a new IP address is assigned to

IP address to mask-length } an interface, the new IP address
an interface. overrides the original one.
NOTE
Configure the IP address and routes
according to the network plan to
ensure that the routes between the
terminal and device are reachable.

Submit the commit -

configuratio
n.

3. Configure the user level and authentication mode for the Telnet user.

Table 4-9 Actions for configuring the user level and authentication mode for the Telnet
user
Action Command Description

Enter the system-view -

system view.

Enable the undo telnet [ ipv6 ] server Upon factory delivery, the Telnet
telnet disable server is disabled.
service.

Enter the user-interface vty first-ui- -

VTY user number [ last-ui-number ]
interface
view.

Set the user privilege level level By default, users who log in
Telnet user through the VTY user interface
level. can access commands at level 0.

Set the authentication-mode aaa The system provides two

authenticatio authentication modes: AAA
n mode for authentication and password
the Telnet authentication. AAA
user to AAA authentication requires both the
authenticatio user name and password, which is
n. more secure than password
authentication. This topic
describes how to configure AAA
authentication. For the
configuration method of other
authentication modes, see
Configuring the VTY User
[Link] default, no
authentication mode is configured
for the VTY user interface.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 149

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 4 Logging In to the System for the First Time

Action Command Description

Enter the aaa -

AAA view.

Configure local-user user-name password -

the user irreversible-cipher irreversible-
name and cipher-password
password for
login
through
Telnet.

Set the login local-user user-name service- -

mode to type telnet
Telnet.

Submit the commit -

configuratio
n.

4. Save the configuration.

After basic configuration is complete, you are advised to save the configuration. If the
configuration information is lost, the connection and configuration for the first login
must be performed again.

Table 4-10 Actions for saving the configuration

Action Command Description

Return to the user view. return -

Save the configuration. save The current configuration

has been saved in the
configuration file. For
detailed operations, see
8.2.1 Saving the
Configuration File.

Step 4 Check the configuration.

l Run the display clock command to check the current date and clock setting.
l Run the display ip interface brief [ interface-type [ interface-number ] ] command to
check brief information about the IP address on the interface.
l Run the display user-interface [ ui-type ui-number1 | ui-number ] [ summary ]
command to check the physical attributes and configuration of the user interface.
l Run the display aaa local-user command to check the local user list.

----End

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 150

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 4 Logging In to the System for the First Time

4.4 Configuration Example

This section provides configuration examples for first login, including the examples for
configuring the system time, system name, management IP address, and login using Telnet.
This section only provides configuration examples for single features. For details about multi-
feature configuration cases, feature-specific configuration cases, interconnection cases,
protocol or hardware replacement cases, and industry application cases, see the Typical
Configuration Cases.

4.4.1 Example for Performing Basic Configuration on the Device

at First Login
Networking Requirements
After logging in to the device through the console port, perform basic device configuration,
and set the user level to 15 and authentication mode to AAA for users 0-4 who perform
remote login through Telnet.

Figure 4-4 Networking diagram for configuring the device through the console port

Console
Network

PC1 Switch PC2

Configuration Roadmap
1. Log in to the device through the console port.
NOTE

The HyperTerminal of Windows 2000 can be used as the terminal emulation software on the PC.
2. Configure the device.

Procedure
Step 1 Log in to the device from PC1 through the console port. For details, see Logging In Through
the Console Port.
Step 2 Configure the device.
# Set the system date, time, and time zone.
<HUAWEI> clock timezone BJ add 08:00:00
<HUAWEI> clock datetime 20:10:00 2012-07-26

# Set the device name and IP address of the management interface.

<HUAWEI> system-view
[~HUAWEI] sysname Server
[*HUAWEI] commit
[~Server] interface meth 0/0/0

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 151

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 4 Logging In to the System for the First Time

[*Server-MEth0/0/0] ip address [Link] 24

[*Server-MEth0/0/0] quit

# Set the user level and authentication mode for Telnet users.
[*Server] undo telnet server disable
[*Server] user-interface vty 0 4
[*Server-ui-vty0-4] user privilege level 3
[*Server-ui-vty0-4] authentication-mode aaa
[*Server-ui-vty0-4] quit
[*Server] aaa
[*Server-aaa] local-user admin1234 password irreversible-cipher Helloworld@6789
[*Server-aaa] local-user admin1234 level 3
[*Server-aaa] local-user admin1234 service-type telnet
[*Server-aaa] commit
[~Server-aaa] quit

Step 3 Verify the configuration.

When completing the configuration, you can log in to the device through Telnet on PC2.

Access the command line interface of Windows 7 and log in to the device through Telnet.
C:\Windows\System32> telnet [Link]

Press Enter. On the displayed login page, enter the user name and password. If the
authentication succeeds, the command line interface for the user view is displayed. (The
following information is only for reference.)
Username:admin1234
Password:
Info: The max number of VTY users is 21, and the number of current VTY users on
line is 1,
and total number of terminal users online is 1.
The current login time is 2012-07-26 20:10:08+08:00.
First login successfully.
<Server>

----End

Configuration Files
Configuration file of the device
#
clock timezone BJ add 08:00:00
#
sysname Server
#
aaa
local-user admin1234 password irreversible-cipher $1c$g8wLJ`LjL!
$CyE(V{3qg5DdU:PM[6=6O$[Link],Q}>^)OBzgoU$
local-user admin1234 service-type telnet
local-user admin1234 level 3
#
interface MEth0/0/0
ip address [Link] [Link]
#
user-interface vty 0 4
authentication-mode aaa
user privilege level 3
#
return

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 152

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

5 Configuring a User Interface

About This Chapter

When a user logs in to the device using the console port, Telnet, or SSH, the system manages
the session between the user and the device on the corresponding user interface.

5.1 User Interface Overview

The system supports the console and VTY user interfaces.
5.2 Configuring the Console User Interface
Before logging in to the device using the console user interface to maintain the device locally,
a user can configure the attributes of the user interface to ensure device security.
5.3 Configuring the VTY User Interface
Before logging in to the device using Telnet or SSH to maintain the device locally or
remotely, a user can configure a VTY user interface to ensure device security.
5.4 Configuration Examples
This section describes configuration examples for the console and VTY user interfaces,
including networking requirements, configuration notes, and configuration roadmap.

5.1 User Interface Overview

The system supports the console and VTY user interfaces.
Each user interface maps a user interface view. In the user interface view that is a command-
line interface (CLI), you can configure and manage all physical and logical interfaces that
work in asynchronous and interactive modes to manage different user interfaces.

User Interfaces Supported by the Device

l Console (CON)
The console port is a serial port provided by the main control board of a device.
Each main control board provides one console port that conforms to the EIA/TIA-232
standard. The console port is a Data Connection Equipment (DCE) port. The serial port
of a user terminal can directly connect to the console port of the device to access the
device.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 153

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

When a user logs in the device using the mini USB port, the console user interface is
displayed.
l VTY
The Virtual Type Terminal (VTY) manages and monitors users who log in to the device
using VTY user interfaces
When a user's terminal connects to the device using Telnet or Secure Shell (SSH), a VTY
is set up. A maximum of 21 users can log in to the device using VTY interfaces at the
same time.

Relationship Between a User and a User Interface

A user interface is not devoted exclusively to a specific user. User interfaces are used to
manage and monitor users that have logged in to the system using a certain method. Although
a user interface can be used only by one user at a time, a user interface is not specific to a
fixed user.
When a user logs in to the device, the system assigns an available user interface with the
smallest number to the user. The login process depends on the configuration of the user
interface. For example, when user A logs in to the device using the console port, the login
process depends on the configuration in the console user interface view. If a user logs in to the
device in different modes, the user interface assigned to the user is different. If a user logs in
to the device at different time, the user interface assigned to the user may be different.

User Interface Number

When a user logs in to the device, the system assigns an available user interface with the
smallest number to the user. User interfaces can be numbered in either of the following ways:
l Relative numbering
The format of relative numbering is: user interface type + number.
Relative numbering uniquely specifies a user interface of the same type. Relative
numbering must comply with the following rules:
– Number of the CON port: CON 0
– Number of the VTY: The first VTY is 0, the second VTY is 1, and so on
l Absolute numbering
Absolute numbering uniquely specifies a user interface or a group of user interfaces. You
can run the display user-interface command to view user interfaces and their absolute
numbers supported by the current device.
There is only one console port on a main control board. 21 VTY user interfaces are
provided. You can use the user-interface maximum-vty command in the system to set
the maximum number of user interfaces. By default, the maximum number of user
interfaces is 5. VTY 16 to VTY 20 always exist regardless of the value set by the user-
interface maximum-vty command.
Table 5-1 describes the default absolute numbering of the console user interface and
VTY user interface.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 154

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

Table 5-1 Absolute and relative numbers of user interfaces

User Description Absolute Relative Number

Interface Number

Console user Manages and 0 to 19 0

interface controls users that
log in to the device
using the console
interface.

VTY user Manages and 34 to 54 The first interface is VTY 0,

interface controls users that the second is VTY 1, and so
log in to the device forth. By default, VTY 0 to
using Telnet or VTY 4 are available.
SSH. Absolute numbers 34 to 54
map relative numbers VTY 0
to VTY 20.

User Authentication Modes on a User Interface

After a user authentication mode is configured, the device authenticates users who want to log
in.

Two authentication modes are available:

l Password authentication: A user is authenticated only by password.

l AAA authentication: A user is authenticated by user name and password. Telnet users
usually use AAA authentication.

User Levels on User Interfaces

Users log in to the device are managed based on the user levels. The level of commands that a
user can use depends on the level of the user.

l In the password authentication mode, the level of commands that the user can run
depends on the level of the user interface.
l In the AAA authentication mode, the level of commands that the user can run depends
on the level of the local user specified in AAA configuration.

5.2 Configuring the Console User Interface

Before logging in to the device using the console user interface to maintain the device locally,
a user can configure the attributes of the user interface to ensure device security.

Pre-configuration Tasks
Before configuring a console user interface, complete the following tasks:

l Logging in to the device using a terminal

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 155

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

NOTE

To log in to the device through the console interface to maintain the device locally, configure the console
user interface including the physical attributes, terminal attributes, user level, and user authentication
mode. Users can set these parameters based on the site requirements or retain the default values.
The console user interface can also be used for logging in through the Mini USB interface; therefore, the
configured console user interface attributes take effect on the Mini USB interface.

Procedure
You can perform the configuration operations in any sequence.

5.2.1 Configuring the Physical Attributes of the Console User

Interface

Context
The physical attributes of the console user interface include the transmission rate, flow control
mode, parity bit, stop bit, and data bit of the console interface. To log in to the device using
the console interface, ensure that the attributes of the HyperTerminal are consistent with the
physical attributes of the device.

Procedure
Step 1 Run:
system-view

The system view is displayed.

Step 2 Run:
user-interface console interface-number

The console user interface view is displayed.

Step 3 Run:
speed speed-value

The transmission rate is set.

By default, the transmission rate is 9600 bit/s.
Step 4 Run:
flow-control { hardware | none | software }

The flow control mode is set.

By default, the flow control mode is None.
Step 5 Run:
parity { even | mark | none | odd | space }

The parity bit is set.

By default, the parity bit is None.
Step 6 Run:
stopbits { 1.5 | 1 | 2 }

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 156

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

The stop bit is set.

By default, the stop bit is 1.

Step 7 Run:
databits { 5 | 6 | 7 | 8 }

The data bit is set.

By default, the data bit is 8.

Step 8 Run:
commit

The configuration is committed.

----End

5.2.2 Configuring Terminal Attributes on the Console User

Interface

Context
Users can configure terminal attributes including the timeout disconnection function, number
of lines or columns on the terminal screen, and size of the history command buffer on the
console user interface.

Procedure
Step 1 Run:
system-view

The system view is displayed.

Step 2 Run:
user-interface console interface-number

The console user interface view is displayed.

Step 3 Run:
idle-timeout minutes [ seconds ]

The timeout disconnection function is set.

If no operation is performed on the device before the end of the timeout period, the terminal
disconnects from the device automatically.

By default, the timeout duration is 10 minutes in console user interface view.

NOTE
If the idle timeout interval is set to 0 or a large value, the terminal will remain in the login state, resulting
in security risks. You are advised to run the lockcommand to lock the current connection.

Step 4 Run:
screen-length screen-length [ temporary ]

The number of lines displayed on the terminal screen is set.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 157

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

The temporary parameter specifies the temporary number of lines displayed on the terminal
screen.

The default number of lines displayed on the terminal screen is 24.

Step 5 Run:
screen-width screen-width

The number of columns displayed on the terminal screen is set.

The default number of columns displayed on the terminal screen is 80. Each character is a
column.

Step 6 Run:
history-command max-size size-value

The history command buffer is set.

By default, the history command buffer can store up to 10 commands.

Step 7 Run:
commit

The configuration is committed.

----End

5.2.3 Configuring the User Level on the Console User Interface

Context
l Users can be configured with different user levels to control the device access
permission, improving device security.
l User levels map command levels. A user can only run commands at the same or lower
level.

Procedure
Step 1 Run:
system-view

The system view is displayed.

Step 2 Run:
user-interface console interface-number

The console user interface view is displayed.

Step 3 Run:
user privilege level level

The user level is set.

Table 5-2 describes the mapping between user levels and command levels.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 158

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

Table 5-2 Mapping between user levels and command levels

User Com Permis Description
Level man sion
d
Level

0 0 Visit Commands at this level are network diagnosis commands,

such as ping and tracert commands, and commands used to
access remote devices such as Telnet clients.

1 0 and Monitor Commands at this level are system maintenance commands

1 ing such as display commands.
NOTE
Some display commands are not at this level. For example, the display
current-configuration and display saved-configuration commands
are at level 3. For details about command levels, see the CloudEngine
8800&7800&6800&5800 Series Switches Command Reference.

2 0, 1, Configu Commands at this level are used for service configuration.

and 2 ration These commands include routing commands and commands at
each network layer to provide network services to users.

3-15 0, 1, Manage Commands at these levels are system basic operation

2, and ment commands that support services, including file system, FTP,
3 TFTP, user management commands, command level
configuration commands, and debugging commands.

NOTE

l By default, the command level for the console port on the user interface is 15 when the command-
privilege level rearrange command is run, while is 3 when the command-privilege level
rearrange command is not run.
l If the command access level configured in the user interface view and user priority are inconsistent,
user priority takes precedence.

Step 4 Run:
commit

The configuration is committed.

----End

5.2.4 Configuring the User Authentication Mode on the Console

User Interface

Context
The console user interface provides AAA authentication, password authentication, and non-
authentication for login users.

Procedure
l Configuring AAA authentication

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 159

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

a. Run:
system-view

The system view is displayed.

b. Run:
user-interface console interface-number

The console user interface view is displayed.

c. Run:
authentication-mode aaa

The user authentication mode is set to AAA.

d. Run:
quit

Exit from the console user interface view.

e. Run:
aaa

The AAA view is displayed.

f. Run:
local-user user-name password irreversible-cipher irreversible-cipher-
password

The local user name and password are configured.

g. Run:
local-user user-name service-type terminal

The service type of the local user is set to terminal.

h. Run:
quit

The user quit the AAA view.

i. Run:
commit

The configuration is committed.

l Configuring password authentication
a. Run:
system-view

The system view is displayed.

b. Run:
user-interface console interface-number

The console user interface view is displayed.

c. Run:
authentication-mode password

The user authentication mode is set to password.

d. Run:
set authentication password [ cipher password ]

The authentication password is configured. You can enter a password in plain text
or cipher text.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 160

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

NOTE

The password can be in plain text or cipher text. When the cipher password parameter is not
specified, enter the plain text password in interactive mode. When the cipher password
parameter is specified, enter either plain or cipher password. No matter which type of
password you enter, the password is saved in the configuration file in cipher text.
e. Run:
commit

The configuration is committed.

l Configuring non-authentication
a. Run:
system-view

The system view is displayed.

b. Run:
user-interface console interface-number

The console user interface view is displayed.

c. Run:
authentication-mode none

The authentication mode is set to non-authentication.

NOTE

The non-authentication mode allows users to log in from the console port without
authentication. This mode cannot ensure system security. AAA or password authentication is
recommended to enhance system security.
d. Run:
commit

The configuration is committed.

----End

5.2.5 Checking the Configurations

Context
After configurations for the console user interface are complete, run the commands to check
the configurations.

Procedure
l Run the display users [ all ] command to view user information for the user interface.
l Run the display user-interface console ui-number [ summary ] command to view the
information about the user interface.
l Run the display aaa local-user command to view the local user list.
l Run the display aaa access-user command to view online users.

----End

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 161

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

5.3 Configuring the VTY User Interface

Before logging in to the device using Telnet or SSH to maintain the device locally or
remotely, a user can configure a VTY user interface to ensure device security.

Pre-configuration Tasks
Before configuring a VTY user interface, complete the following tasks:
l Log in to the device using a terminal.
NOTE

Parameters have default values with the exception of the ACL number that restricts the call-in and call-
out permissions on the VTY interface, authentication mode on the user interface, and user name and
password. You can set parameters based on the site requirements.

Procedure
You can perform the configuration operations in any sequence.

5.3.1 Configuring the Maximum Number of Concurrent VTY User

Interfaces

Context
Users can configure the maximum number of concurrent VTY user interfaces to control the
number of users who log in to the device at the same time. The number of VTY user
interfaces equals the total number of Telnet and SSH (STelnet) users.

Procedure
Step 1 Run:
system-view

The system view is displayed.

Step 2 Run:
user-interface maximum-vty number

The maximum number of VTY user interfaces is set.

By default, the maximum number of VTY user interfaces is 5.

NOTICE
When the maximum number of VTY user interfaces is set to 0, no user (including the NMS
user) can log in to the device using the VTY interface.

If the configured maximum number is smaller than the original, logged in users are not
affected and no additional configuration is needed.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 162

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

After increasing the number of VTY user interfaces, you must configure the authentication
mode for new VTY users.
Step 3 Run:
commit

The configuration is committed.

----End

5.3.2 (Optional) Configuring Restrictions on ACL-based Logins

on the VTY User Interface

Context
You can use the ACL to restrict login permissions on the VTY user interface. Before
configuring restrictions on login permissions on the VTY user interface, run the acl command
in the system view to create an ACL and enter the ACL view, and run the rule command to
add rules for accessing the ACL.

NOTE

l The user interface supports basic ACLs (2000-2999) and advanced ACLs (3000-3999).
l ACL rule:
l When permit is used in the ACL rule:
l If the ACL is applied in the inbound direction, other devices that match the ACL rule
can access the local device.
l If the ACL is applied in the outbound direction, the local device can access other devices
that match the ACL rule.
l When deny is used in the ACL rule:
l If the ACL is applied in the inbound direction, other devices that match the ACL rule
cannot access the local device.
l If the ACL is applied in the outbound direction, the local device cannot access other
devices that match the ACL rule.
l When the ACL rule is configured but packets from other devices do not match the rule:
l If the ACL is applied in the inbound direction, other devices cannot access the local
device.
l If the ACL is applied in the outbound direction, the local device cannot access other
devices.
l When the ACL contains no rule:
l If the ACL is applied in the inbound direction, any other devices can access the local
device.
l If the ACL is applied in the outbound direction, the local device can access any other
devices.
l For details on how to configure the ACL, see "ACL Configuration" in the CloudEngine
8800&7800&6800&5800 Series Switches Configuration Guide - Security.

Procedure
Step 1 Run:
system-view

The system view is displayed.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 163

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

Step 2 Run:
user-interface vty first-ui-number [ last-ui-number ]

The VTY user interface view is displayed.

Step 3 Run:
acl [ ipv6 ] { acl-number | acl-name } { inbound | outbound }

ACL restrictions on VTY login permissions are configured.

l To restrict users at a specified address or address segment from logging in to the device,
use the inbound parameter.
l To restrict users who have log in to a device from logging in to other devices, use the
outbound parameter.

Step 4 Run:
commit

The configuration is committed.

----End

5.3.3 Configuring Terminal Attributes on the VTY User Interface

Context
Users can configure terminal attributes on the VTY user interface. These attributes include the
timeout disconnection function, number of lines on the terminal screen, and size of the history
command buffer.

Procedure
Step 1 Run:
system-view

The system view is displayed.

Step 2 Run:
user-interface vty first-ui-number [ last-ui-number ]

The VTY user interface view is displayed.

Step 3 Run:
shell

The VTY terminal service is enabled.

By default, all VTY terminal services are enabled.

Step 4 Run:
idle-timeout minutes [ seconds ]

The timeout disconnection function is set.

If no operation is performed on the device before the end of the timeout period, the terminal
disconnects from the device automatically.

By default, the timeout duration is 10 minutes in vty user interface view.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 164

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

NOTE
If the idle timeout interval is set to 0 or a large value, the terminal will remain in the login state, resulting
in security risks. You are advised to run the lockcommand to lock the current connection.

Step 5 Run:
screen-length screen-length [ temporary ]

The number of lines displayed on the terminal screen is set.

The temporary parameter specifies the temporary number of lines displayed on the terminal
screen.

The default number of lines displayed on the terminal screen is 24.

Step 6 Run:
history-command max-size size-value

The history command buffer is set.

By default, the history command buffer can store up to 10 commands.

Step 7 Run:
commit

The configuration is committed.

----End

5.3.4 Configuring the User Level on the VTY User Interface

Context
l Users can be configured with different user levels to control the device access
permission, improving device security.
l User levels map command levels. A user can only run commands at the same or lower
level.

Procedure
Step 1 Run:
system-view

The system view is displayed.

Step 2 Run:
user-interface vty first-ui-number [ last-ui-number ]

The VTY user interface view is displayed.

Step 3 Run:
user privilege level level

The user level is set.

Table 5-3 describes the mapping between user levels and command levels.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 165

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

Table 5-3 Mapping between user levels and command levels

User Com Permis Description
Level man sion
d
Level

0 0 Visit Commands at this level are network diagnosis commands,

such as ping and tracert commands, and commands used to
access remote devices such as Telnet clients.

1 0 and Monitor Commands at this level are system maintenance commands

1 ing such as display commands.
NOTE
Some display commands are not at this level. For example, the display
current-configuration and display saved-configuration commands
are at level 3. For details about command levels, see the CloudEngine
8800&7800&6800&5800 Series Switches Command Reference.

2 0, 1, Configu Commands at this level are used for service configuration.

and 2 ration These commands include routing commands and commands at
each network layer to provide network services to users.

3-15 0, 1, Manage Commands at these levels are system basic operation

2, and ment commands that support services, including file system, FTP,
3 TFTP, user management commands, command level
configuration commands, and debugging commands.

NOTE

l By default, users that log in to the device using the VTY interface can run commands at level 0.
l If the command access level configured in the user interface view and user priority are inconsistent,
user priority takes precedence.

Step 4 Run:
commit

The configuration is committed.

----End

5.3.5 Configuring the Authentication Mode for VTY Users

Context
The system provides AAA and password authentication modes to ensure device security.

Procedure
l Configuring AAA authentication
a. Run:
system-view

The system view is displayed.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 166

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

b. Run:
user-interface vty first-ui-number [ last-ui-number ]

The VTY user interface view is displayed.

c. Run:
authentication-mode aaa

The user authentication mode is set to AAA.

d. Run:
quit

The user quits the VTY user interface view.

e. Run:
aaa

The AAA view is displayed.

f. Run:
local-user user-name password irreversible-cipher irreversible-cipher-
password

The local user name and password are configured.

g. Run:
local-user user-name service-type { telnet | ssh }

The service type of the local user is set to Telnet or SSH.

h. Run:
quit

Exit from the AAA view.

i. Run:
commit

The configuration is committed.

l Configuring password authentication
a. Run:
system-view

The system view is displayed.

b. Run:
user-interface vty first-ui-number [ last-ui-number ]

The VTY user interface view is displayed.

c. Run:
authentication-mode password

The user authentication mode is set to password.

d. Run:
set authentication password [ cipher password ]

The authentication password is configured. You can enter a password in plain text
or cipher text.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 167

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

NOTE

The password can be in plain text or cipher text. When the cipher password parameter is not
specified, enter the plain text password in interactive mode. When the cipher password
parameter is specified, enter either plain or cipher password. No matter which type of
password you enter, the password is saved in the configuration file in cipher text.
e. Run:
commit

The configuration is committed.

----End

5.3.6 (Optional) Enabling the Function of Blocking IP Addresses

in VTY Access Scenarios
The function of blocking IP addresses in VTY access scenarios allows a device to block IP
addresses that fail to be authenticated, thus improving the device security.

Procedure
Step 1 Run:
system-view

The system view is displayed.

Step 2 Run:
security password

The security password view is displayed.

Step 3 Run:
undo ip-block vty-password-mode disable

The function of blocking IP addresses in VTY access scenarios is enabled.

By default, The function of blocking IP addresses in VTY access scenarios is enabled.
Step 4 Run:
commit

The configuration is committed.

NOTE
In VTY access scenarios, IP addresses that fail to be authenticated will be blocked only when the
function of blocking IP addresses is enabled.

----End

5.3.7 (Optional) Enabling the VTY User Interface's Security Policy

This section describes how to enable the VTY user interface's security policy. It is
recommended that you enable the security policy to harden the VTY user interface's security.

Procedure
Step 1 Run:
system-view

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 168

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

The system view is displayed.

Step 2 Run:
undo user-interface vty security-policy disable

The VTY user interface's security policy is enabled.

By default, the VTY user interface's security policy is enabled.
Step 3 Run:
commit

The configuration is committed.

----End

5.3.8 Checking the Configurations

Context
After configurations for the VTY user interface are complete, run the commands to check the
configurations.

Procedure
l Run the display users [ all ] command to view user information for the user interface.
l Run the display user-interface maximum-vty command to view the maximum number
of VTY user interfaces.
l Run the display user-interface vty ui-number1 [ summary ] command to view the
information about the user interface.
l Run the display aaa local-user command to view the local user list.
l Run the display ssh server ip-block all command to check information about the IP
addresses of all the clients that fail to pass authentication.
l Run the display ssh server ip-block list command to check information about client IP
addresses that are locked because of authentication failures.
----End

5.4 Configuration Examples

This section describes configuration examples for the console and VTY user interfaces,
including networking requirements, configuration notes, and configuration roadmap.
This section only provides configuration examples for single features. For details about multi-
feature configuration cases, feature-specific configuration cases, interconnection cases,
protocol or hardware replacement cases, and industry application cases, see the Typical
Configuration Cases.

5.4.1 Example of Configuring the Console User Interface

Networking Requirements
Before logging in to the device using the console user interface to maintain the device locally,
a user can configure the attributes of the console user interface to ensure device security.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 169

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

In this example, the level of console users is 15. The password authentication mode and
authentication password Helloworld@6789 are configured for console users to log in to the
device.

Configuration Roadmap
The configuration roadmap is as follows:
1. Configure the user level on the console user interface.
2. Configure the authentication mode and password on the console user interface.

Procedure
Step 1 Configure the user level on the console user interface.
<HUAWEI> system-view
[~HUAWEI] user-interface console 0
[~HUAWEI-ui-console0] user privilege level 15

Step 2 Configure the authentication mode and password on the console user interface.
[*HUAWEI-ui-console0] authentication-mode password
[*HUAWEI-ui-console0] set authentication password
Please configure the login password
(8-16)

Enter
Password:

Confirm Password:
[*HUAWEI-ui-console0] commit
[~HUAWEI-ui-console0] quit

After the console user interface is configured, users can use the console interface to log in to
the device in the password authentication mode to maintain the device locally. For details on
how to log in to the device see 6.2.1 Logging In to the Device Through a Console Port.
Step 3 Verify the configuration.
# Run the quit command to disconnect the terminal from the device, connect the terminal to
the device using a console cable, and verify that the new password is valid.
# Run the user-interface console 0 command to enter the console interface view, and run the
display this command to check the configurations on the console interface.
[~HUAWEI] user-interface console 0
[~HUAWEI-ui-console0] display this
#
user-interface con 0
authentication-mode password
set authentication password cipher $1c$g8wLJ`LjL!$CyE(V{3qg5DdU:PM[6=6O
$[Link],Q}>^)OBzgoU$
#
return

----End

Configuration File
#
user-interface con 0
authentication-mode password
set authentication password cipher $1c$g8wLJ`LjL!$CyE(V{3qg5DdU:PM[6=6O
$[Link],Q}>^)OBzgoU$
#
return

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 170

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

5.4.2 Example of Configuring a VTY User Interface

Networking Requirements
A user can use the VTY interface to log in to a remote device using Telnet. The device
administrator can configure the attributes of the VTY user interface to ensure device security.

In this example, the level of VTY users is 2. The password authentication mode and
authentication password Helloworld@6789 are configured for VTY users to log in to the
device. Only the user whose IP address is [Link] can log in to the device.

If a user logs in to the device and does not perform an operation within 30 minutes, the user's
terminal disconnects from the device.

Configuration Roadmap
The configuration roadmap is as follows:

1. Configure the maximum number of concurrent VTY user interfaces to 8.

2. Configure restrictions on call-in and call-out permissions on the VTY user interface to
allow users at a specified address or address segment to log in to the device.
3. Configure terminal attributes on the VTY user interface.
4. Configure the user level on the VTY user interface.
5. Configure the authentication mode and password of the VTY user interface.

Procedure
Step 1 Configure the maximum number of concurrent VTY user interfaces.
<HUAWEI> system-view
[~HUAWEI] user-interface maximum-vty 8

Step 2 Configure restrictions on call-in and call-out permissions on the VTY user interface.
[*HUAWEI] acl 2000
[*HUAWEI-acl4-basic-2000] rule permit source [Link] 0
[*HUAWEI-acl4-basic-2000] quit
[*HUAWEI] user-interface vty 0 7
[*HUAWEI-ui-vty0-7] acl 2000 inbound

Step 3 Configure terminal attributes on the VTY user interface.

[*HUAWEI-ui-vty0-7] shell
[*HUAWEI-ui-vty0-7] idle-timeout 30
[*HUAWEI-ui-vty0-7] screen-length 30
[*HUAWEI-ui-vty0-7] history-command max-size 20

Step 4 Configure the user level on the VTY user interface.

[*HUAWEI-ui-vty0-7] user privilege level 2
[*HUAWEI-ui-vty0-7] commit

Step 5 Configure the authentication mode and password of the VTY user interface.
[*HUAWEI-ui-vty0-7] authentication-mode password
[*HUAWEI-ui-vty0-7] set authentication password
Please configure the login password (8-16)
Enter Password:
Confirm Password:
[*HUAWEI-ui-vty0-7] commit
[~HUAWEI-ui-vty0-7] quit

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 171

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 5 Configuring a User Interface

After the VTY user interface is configured, users can log in to the device in the password
authentication mode using Telnet to maintain the device locally or remotely. For details on
how to log in to the device see 6.2.2 Logging In to the Device Through Telnet.
Step 6 Verify the configuration.
# Connect the terminal to the device using Telnet, and verify that the new password is valid.
# Use [Link] to log in to the device using Telnet. The login succeeds.
# Run the user-interface vty 0 7 command to enter the VTY interface view, and run the
display this command to check the configurations on the VTY interface.
[~HUAWEI] user-interface vty 0 7
[~HUAWEI-ui-vty0-7] display this
#
user-interface vty 0 7
acl 2000 inbound
authentication-mode password
user privilege level 2
set authentication password cipher $2a$JNWQ*Vz)SP$Cc>T80W$d8;&w2+
$KR.<A3f<9[}0t&No0V:o!o."$
history-command max-size 20
idle-timeout 30 0
screen-length 30
#
return

----End

Configuration File
#
acl number 2000
rule 5 permit source [Link] 0
#
user-interface maximum-vty 8
#
user-interface vty 0 7
acl 2000 inbound
authentication-mode password
user privilege level 2
set authentication password cipher $2a$JNWQ*Vz)SP$Cc>T80W$d8;&w2+
$KR.<A3f<9[}0t&No0V:o!o."$
history-command max-size 20
idle-timeout 30 0
screen-length 30
#
return

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 172

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

6 Configuring User Login

About This Chapter

6.1 User Login Overview

When the device works as the server, a user can log in to the device through a console port,
Telnet, or STelnet. When the device works as the client, the user can log in to other devices
from the client through Telnet or STelnet.
6.2 Logging In to the Device
A user can log in to the device through a console port, Telnet, or STelnet. After login, the user
can perform common operations to manage and maintain the device.
6.3 Configuring the Device as the Client to Log In to Another Device
A user can log in to another device on the network through Telnet or STelnet from the current
device to manage and maintain the remote device.
6.4 Configuration Examples
This section describes the examples for logging in to the device through a console port,
Telnet, STelnetand for configuring the device to log in to another device.
6.5 Common Configuration Errors
This section describes the common configuration errors and isolation methods.

6.1 User Login Overview

When the device works as the server, a user can log in to the device through a console port,
Telnet, or STelnet. When the device works as the client, the user can log in to other devices
from the client through Telnet or STelnet.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 173

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

NOTE

The device has two systems: VRP system and open system. The dual systems run on the same Linux
OS. The open system uses the container mode to be isolated from the VRP system and communicates
with the VRP system through the virtual network. The VRP system and open system provide the
following functions:
l VRP system: manages all network interfaces of the device and provides secure high-performance
network channels through capabilities such as routing, security, AAA and VPN of the VRP
protocol stack.
l Open system: is the client of third-party software such as OMI, Puppet, and OpenFlow, is
connected to the VRP system through the virtual network, and provides standard NetConf and
OpenFlow interfaces of the VRP system for third-party software. After obtaining device
information, third-party software clients send information to corresponding servers.
This document applies to the VRP system unless otherwise specified. For details about how to log in to
the open system, see Open System Usage Guide.

To manage and maintain devices locally or remotely, a user needs to configure the user
interface, user management information, and terminal services before login.
l User interface: provides the login entry.
l User management information: ensures login security.
l Terminal services: support login protocols such as Telnet and Secure Shell Telnet
(STelnet).
A user can log in to the device in one of the modes describes in Table 6-1 to configure and
manage the device.

Table 6-1 User login modes

Login Advantage Disadvant Usage Scenario Description
Mode age

Logging A dedicated Devices l The device is It is the basis for other

In Console cannot be configured for the login modes.
Throug cable is used remotely first time. By default, a user can
h the to connect logged in l A user cannot log in to the device
Console terminals and remotely log in to through the console port
Port and the maintained. the device. from the local host, and
device to can use the commands at
ensure l The device
cannot be started. level 3.
effective
control on The user can
the device. access the BIOS
menu through the
console port for
diagnosis or
system upgrade.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 174

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Login Advantage Disadvant Usage Scenario Description

Mode age

Logging Devices can The TCP A user connects a By default, a user cannot
In be managed protocol is terminal to the log in to the device
Throug and used to network, logs in to through Telnet. The user
h Telnet maintained transmit the device through needs to log in to the
locally or data in plain Telnet, and performs device through the
remotely. text, which local or remote console port from the
Each device brings configuration. This local host and configure
does not security cannot apply to the the following items:
need to be threats. network required for l Routes between the
connected to high security. terminal and device
a terminal, (Make sure that the
which route is reachable.
facilitates By default, no IP
user address is configured
operations. on the device.)
l Telnet server
functions and
parameters
l Telnet user login
interface

Logging The STelnet Configurati If the network has a By default, a user cannot
In protocol ons are high security log in to the device
Throug implements complicated requirement, a user directly through STelnet.
h secure . can log in to the The user needs to log in
STelnet remote device through to the device through the
logins on STelnet. STelnet console port from the
insecure based on the Secure local host or through
networks, Shell (SSH) protocol Telnet and configure the
which provides information following items:
ensures data security and l Routes between the
integrity and authentication, terminal and device
reliability which protects (Make sure that the
and devices against route is reachable.
guarantees attacks such as IP By default, no IP
secure data address spoofing. address is configured
transmission. on the device.)
l STelnet server
functions and
parameters
l SSH user login
interface
l SSH user

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 175

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Console Port
A main control board provides one console port that conforms to the EIA/TIA-232 standard.
The console port is a Data Connection Equipment (DCE) port. The serial port on a user
terminal is directly connected to the console port on the device for login.

Telnet
In the TCP/IP protocol suite, the Telnet protocol is applied to the application layer. The Telnet
protocol provides remote login and virtual terminal functions through networks. The server/
client mode is used. The Telnet client sends a request to the Telnet server, which then provides
the Telnet service. The device supports the Telnet client and server functions.
As shown in Figure 6-1, SwitchA works as the Telnet server and provides the Telnet client
service, and SwitchB provides the Telnet server functions for SwitchA.

Figure 6-1 Diagram of the client/server mode adopted by Telnet

Telnet Session 1 Telnet Session 2

Telnet
Server

PC SwitchA SwitchB

STelnet
Telnet uses the TCP protocol to transmit plain text, which does not have a secure
authentication mode and is vulnerable to Denial of Service (DoS), IP address spoofing, and
route spoofing attacks.
Through STelnet based on SSH2.0, the client and server establish a secure connection through
negotiation, and the client can then log in to the server. SSH provides secure remote access on
an insecure network by supporting the following functions:
l Revest-Shamir-Adleman Algorithm (RSA) and Elliptic Curves Cryptography (ECC)
authentication: A key pair consisting of the public and private keys needs to be created
on the client, and the public key is sent to the server to which the client will log in. The
server compares the client public key carried in the packet with the locally configured
client public key. If the two public keys are inconsistent, the server disconnects from the
client. If they are consistent, the client continues using the private key in the local key
pair to perform digest algorithm, and sends the result (digital signature) to the server. The
server uses the preconfigured client public key to authenticate the digital signature.
l Data Encryption Standard (DES), 3DES, AES256, ARC4-128, ARC4-256, AES128-
CTR, AES256-CTR and AES128: AES is Advanced Encryption Standard. User names,
passwords, and transmitted data can be encrypted.
The device supports the SSH server functions and can connect to multiple SSH clients. The
device also supports the SSH client functions and allows users to establish SSH connections
to the SSH server and remotely log in to the server. When working as the SSH server, the

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 176

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

device supports SSH2.0 and SSH1.0. When working as the SSH client, the device only
supports SSH2.0.
SSH supports local connections and WAN connections.
l Local connection
As shown in Figure 6-2, an SSH channel can be established between the SSH client and
server for local connections.

Figure 6-2 Establishing an SSH channel on a LAN

WorkStation SSH Server

Server LapTop SSH Client

l WAN connection
As shown in Figure 6-3, an SSH channel can be established between the SSH client and
server for WAN connections.

Figure 6-3 Establishing an SSH channel on a WAN

Local LAN Remote LAN

WAN

Switch SSH Server

SSH Client PC

6.2 Logging In to the Device

A user can log in to the device through a console port, Telnet, or STelnet. After login, the user
can perform common operations to manage and maintain the device.

6.2.1 Logging In to the Device Through a Console Port

Pre-configuration Tasks
Before logging in to the device through a console port, complete the following tasks:

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 177

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

l Preparing the console cable

l Installing the terminal emulation software on the PC
NOTE

You can use the built-in terminal emulation software (such as the HyperTerminal of Windows
2000) on the PC. If no built-in terminal emulation software is available, use the third-party
terminal emulation software. For details, see the software user guide or online help. This section
uses the third-party software SecureCRT as an example.

Default Configuration

Table 6-2 Default configuration of the device console port

Parameter Default Setting

Transmission rate 9600 bit/s

Flow control mode None

Parity bit None

Stop bit 1

Data bit 8

Procedure
Step 1 Use the terminal simulation software to log in to the device through a console port.
1. Insert the DB9 connector of the console cable delivered with the product to the 9-pin
serial port on the PC, and insert the RJ45 connector to the console port of the device, as
shown in Figure 6-4.

Figure 6-4 Connecting to the device through the console port

RJ-45
CONSOLE CE6850-48S4Q-EI
STATUS STATUS STATUS STATUS
SYS
MST

ACT
L/A

ID

ETH
PAC-350WA-B ~100-240V;50/60Hz,5A FAN-40EA-B PWR1 FAN1 FAN2 PWR2 FAN-40EA-B PAC-350WA-B ~100-240V;50/60Hz,5A

DB-9

2. Start the terminal emulation software on the PC. Create a connection, select the
connected port, and set communication parameters.(This section uses the third-party
software SecureCRT as an example.)

a. Click to establish a connection, as shown in Figure 6-5.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 178

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Figure 6-5 Establishing a connection

b. Set the connected port and communication parameters, as shown in Figure 6-6.
Select the connected port based on actual situations. For example, you can view
port information in Device Manager in the Windows operating system, and select
the connected port.
Communication parameters of the terminal emulation software must be consistent
with the default attribute settings of the console user interface on the device, which
are 9600 bit/s baud rate, 8 data bits, 1 stop bit, no parity check, and no flow control.
NOTE

By default, no flow control mode is configured on the device. Because RTS/CTS is selected
in the software by default, you need to deselect RTS/CTS; otherwise, you cannot enter
commands.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 179

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Figure 6-6 Setting the connected port and communication parameters

NOTE

A PC may have multiple connection interfaces; therefore, the interface connected through the
console cable is selected in this example. Generally, COM1 is selected.
If the serial port communication parameters of the device are modified, modify the communication
parameters on the PC accordingly (ensure that the parameter values are the same) and re-establish
the connection.
3. Press Enter until the system prompts you to enter the password. (The system will
prompt you to enter the user name and password in AAA authentication. The following
information is only for reference.)
Login authentication

Password:

You can run commands to configure the device. Enter a question mark (?) whenever you
need help.

----End

Checking the Configuration

l Run the display users [ all ] command to check the user log information on the user
interface.
l Run the display user-interface console 0 command to check the user interface
information.
l Run the display aaa local-user command to check the local user attributes.
l Run the display aaa access-user command to check the online user information.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 180

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

6.2.2 Logging In to the Device Through Telnet

Pre-configuration Tasks
Before logging in to the device through Telnet, complete the following task:

l Configuring routes between a terminal and the device

Configuration Process
NOTE

The Telnet protocol poses a security risk, and therefore the STelnet V2 mode is recommended.

This figure describes the tasks in the configuration process for login through Telnet. Tasks 1,
2, and 3 can be performed in any sequence.
Begin

[Link] the Telnet configure the

Enable the
server functions and Telnet server
Telnet service.
parameters parameters.

Configure the Configure the VTY

[Link] the Configure the Con
user user interface to
Telnet user login user level for the attri
authentication support the Telnet
interface user interface. use
mode. protocol.

[Link] a local Configure the Configure the Configure the

Telnet user (AAA local user name service type for level for the
authentication mode) and password. the local user. local user.

[Link] in to the device

through Telnet from a
terminal

Mandatory
Over
Optional

Default Configuration

Table 6-3 Default settings of the parameters for logging in to the device through Telnet

Parameter Default Setting

Telnet service Disabled

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 181

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Parameter Default Setting

Telnet server port number 23

VTY user interface authentication mode no authentication mode is configured

Protocol supported by the VTY user

the system supports all protocols
interface

The default command access level for the

User level
VTY user interface is 0

Procedure
l Configuring the Telnet server functions and parameters
Before connecting to the device through Telnet from a user terminal, make sure that the
Telnet service is enabled on the device.

Table 6-4 Configuring the Telnet server functions and parameters

Operation Command Description

Enter the system system-view -

view.

Enable the Telnet undo telnet [ ipv6 ] server Upon factory delivery, the
service. disable Telnet server is disabled.

The default listening port

number is 23.
(Optional) After the listening port number
Configure the telnet [ ipv6 ] server port of the Telnet server is changed,
listening port of port-number attackers do not know the new
the Telnet server. listening port number. This
effectively prevents attackers
from accessing the listening
port.

By default, no ACL is
configured for the Telnet server.
(Optional)
telnet [ ipv6 ] server acl { acl- An ACL is configured to
Configure an
number | acl-name } determine which clients can log
ACL.
in to the current device through
Telnet.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 182

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Operation Command Description

By default, the source interface

of a Telnet server is not
specified.
(Optional) NOTE
Configure the Before specifying the source
telnet server-source -i
source IP address interface of the Telnet server,
loopback interface-number ensure that the loopback interface
of the Telnet
to be specified as the source
server.
interface has been created. If the
loopback interface is not created,
the telnet server-source command
cannot be correctly executed.

(Optional) telnet server login-failed By default, an alarm is

Configure alarm threshold-alarm upper-limit generated if the number of
generation and report-times lower-limit login failures reaches 30 within
clearance resume-times period period- 5 minutes and is cleared if the
thresholds for the time number of login failures falls
number of Telnet below 20 within the same
server login period.
failures within a
specified period.

Commit the commit -

configuration.

l Configuring the Telnet user login interface

Configure the user level, call-in and call-out permission, and other basic attributes for the
VTY user interface.

Table 6-5 Configuring the Telnet user login interface

Operation Command Description

Enter the system view. system-view -

Enter the VTY user user-interface vty first-ui-

-
interface view. number [ last-ui-number ]

The default user level for

the VTY user interface is
0.
To run the commands of a
higher level, configure a
Configure the user level higher user level.
user privilege level level
for the user interface. If the user level configured
for the user interface
conflicts with the user's
operation permission, the
user permission takes
precedence.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 183

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Operation Command Description

The none, password and

AAA authentication
modes are supported.
Configure either
authentication mode as
required.
l After configuring the
password
authentication mode,
run the set
authentication
password command to
set the local
authentication
password.
l After configuring the
Configure the user authentication-mode AAA authentication
authentication mode. { password | aaa | none } mode, see Configuring
a Local Telnet User
(AAA Authentication
Mode).
l The none
authentication mode
has potential security
risks and is not
recommended.
For details on the
password authentication
mode, see Configuring a
User Authentication
Mode for the VTY User
Interface. The AAA
authentication mode is
recommended.

Configure the VTY user By default, the VTY user

protocol inbound { all |
interface to support the interface supports all
telnet }
Telnet protocol. protocols.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 184

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Operation Command Description

By default, login
permissions are not
restricted.
(Optional) Configure For details, see (Optional) Configure this action to
restrictions on ACL-based Configuring Restrictions prevent a user with a
logins on the user on ACL-based Logins on certain address or address
interface. the VTY User Interface. segment from logging in to
the device or prevent a
user who has logged in to
the device from logging in
to another device.

For details, see

Configuring the Use the default settings for
(Optional) Configure other Maximum Number of other attributes of the VTY
attributes of the user VTY User Interfaces and user interface. You can
interface. Configuring Terminal configure attributes based
Attributes for the VTY on the usage requirements.
User Interface.

Commit the configuration. commit -

l Configuring a local Telnet user (AAA authentication mode)

Configure the administrator's user name and password to ensure that only the
administrator can log in to the device.

Table 6-6 Configuring a local Telnet user (AAA authentication mode)

Operation Command Description

Enter the system view. system-view -

Enter the AAA view. aaa -

local-user user-name
Configure the local user password irreversible-
-
name and password. cipher irreversible-cipher-
password

Configure the service type local-user user-name

-
for the local user. service-type telnet

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 185

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Operation Command Description

After login, a user can

only run the commands at
levels equal to or lower
than the user level, which
ensures the device security.
Configure the level for the local-user user-name level
local user. level If the user level configured
for the user interface
conflicts with the user's
operation permission, the
user permission takes
precedence.

Commit the configuration. commit -

l Logging in to the device through Telnet from a terminal

You can use Windows command line prompts or third-party software to log in to the
device through Telnet from a terminal. Windows command line prompts are used as an
example.

Perform the following operations on the terminal:

a. Access the command line window.

b. Run the telnet ip-address port command to log in to the device through Telnet.
C:\Documents and Settings\Administrator> telnet [Link] 1025

c. Press Enter and enter the password and the user name configured for the AAA
authentication mode in the login window. If authentication is successful, the
command-line prompt of the user view is displayed and you have successfully
logged in to the device. (The following information is only for reference.)
Username:admin1234
Password:
Info: The max number of VTY users is 8, the number of current VTY users
online is 1, and total number of terminal users online is 1.
The current login time is 2012-08-04 19:49:11.
First login successfully.
<Telnet Server>

----End

Checking the Configuration

l Run the display users [ all ] command to check the connections on the user interface.
l Run the display tcp status command to check all TCP connections.
l Run the display telnet server status command to check the current connections of the
Telnet server.

6.2.3 Logging In to the Device Through STelnet

Pre-configuration Tasks
Before logging in to the device through STelnet, complete the following tasks:

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 186

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

l Configure routes between a terminal and the device.

l Install the SSH client software on the terminal.

Configuration Process
NOTE

The STelnet V1 protocol poses a security risk, and therefore the STelnet V2 mode is recommended.

Table 6-7 describes the tasks in the configuration process for login using STelnet.

Table 6-7 Tasks in the configuration process for login using STelnet

No. Task Description Remarks

Generate the local server key

pair, enable the STelnet
server function, and set the
Configuring the STelnet
server parameters including
1 server functions and
the port number, key pair
parameters
updating interval, and SSH
authentication timeout
interval and retries.
Tasks 1, 2, and 3 can
Configure the user level,
be performed in any
authentication mode,
sequence.
Configuring the SSH whether to support the SSH
2
user login interface protocol, and other basic
attributes for the VTY user
interface.

Configure the SSH user

name, password,
3 Configuring an SSH user
authentication mode, and
service type.

Use the SSH client software

Logging in to the device
4 to log in to the device from a -
through STelnet
terminal.

Default Configuration

Table 6-8 Default settings of the parameters for logging in to the device through STelnet

Parameter Default Setting

STelnet service Disabled

SSH server port number 22

Interval for updating the SSH server key 0 hours, indicating that the key pair is never
pair updated.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 187

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Parameter Default Setting

Timeout interval for SSH authentication 60 seconds

Maximum number of SSH authentication

3
retries

SSH server's compatibility with earlier

Disabled
versions

VTY user interface authentication mode No authentication mode

Protocol supported by the VTY user

All protocols
interface

SSH user authentication mode No authentication mode supported

SSH user service type No service type supported

Whether the SSH server assigns a public

No public key assigned
key to a user

The default command access level for the

User level
VTY user interface is 0.

Procedure
l Configuring the STelnet server functions and parameters

Table 6-9 Configuring the STelnet server functions and parameters

Operation Command Description

Enter the
system-view -
system view.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 188

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Operation Command Description

Method 1:
Run the rsa local-key-pair
create, dsa local-key-pair
create, or ecc local-key-pair
create command to generate a
local RSA, DSA, or ECC key
pair.
Method 2:
1. Run the rsa key-pair label
label-name [ modulus
modulus-bits ], dsa key-
pair label label-name In method 1:
[ modulus modulus-bits ], After the key pair is generated,
or ecc key-pair label label- you can run the display rsa local-
name [ modulus modulus- key-pair public, display dsa
bits ] command to generate local-key-pair public, or display
an RSA, a DSA, or an ECC ecc local-key-pair public
key pair with a specific command to view the public key
label name. in the local RSA, DSA, or ECC
2. Run the ssh server assign key pair.
{ rsa-host-key | dsa-host- In method 2:
key | ecc-host-key } label- After the key pair is generated,
Generate a
name command to assign you can run the display rsa key-
local key pair.
the generated RSA host key, pair [ brief | label label-name ],
RSA server key, DSA host display dsa key-pair [ brief |
key, or ECC host key to the label label-name ], or display ecc
SSH server. key-pair [ brief | label label-
NOTE name ] command to view the
l The device can generate a RSA, DSA, or ECC key pair with
maximum of 20 key pairs in a specific label.
method 2. You can use
NOTE
different key pairs in different
Because a longer key pair provides
periods to ensure higher
higher security, you are advised to
communication security. The
use key pairs of the largest length.
maximum number of key pairs
the device can generate is
specified by the rsa key-pair
maximum, dsa key-pair
maximum, and ecc key-pair
maximum commands.
l You can also run the rsa key-
pair label load private
private-key public public-key
or dsa key-pair label load
private private-key public
public-key command to load
the local RSA or DSA key
pair file to the server.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 189

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Operation Command Description

By default, the STelnet service is

disabled.
Enable the
STelnet stelnet server enable After you disable the STelnet
service. service on the SSH server, all
clients that have logged in through
STelnet are disconnected.

The default port number is 22.

If a new port number is set, the
SSH server terminates all
Set the port established STelnet connections,
number of the ssh server port port-number and uses the new port number to
SSH server. attempt to establish connections.
This prevents attackers from
accessing the standard SSH
service port and ensures security.

By default, the keepalive function

is enabled on the SSH server.
After the keepalive function is
enabled on the SSH server, the
Enable the server responds to keepalive
keepalive packets received from the SSH
undo ssh server keepalive
function on client. If the keepalive function is
disable
the SSH disabled on the SSH server, the
server. client will disconnect from the
SSH server when there is no data
exchange, which causes server
resource waste due to
reconnections.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 190

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Operation Command Description

By default, an SSH server

supports the following key
exchange algorithms:
dh_group_exchange_sha256,
dh_group_exchange_sha1,
dh_group1_sha1,
ecdh_sha2_nistp256,
ecdh_sha2_nistp384,
ecdh_sha2_nistp521 and
sm2_kep.
ssh server key-exchange During the negotiation process,
{ dh_group14_sha1 | the client and server negotiate the
(Optional) Set
dh_group1_sha1 | key exchange algorithm for packet
a key
dh_group_exchange_sha1 | transmission. The server compares
exchange
dh_group_exchange_sha256 | the key exchange algorithm list
algorithm list
ecdh_sha2_nistp256 | sent by the client with its own key
of the SSH
ecdh_sha2_nistp384 | exchange algorithm list, and
server.
ecdh_sha2_nistp521 | selects the first key exchange
sm2_kep } * algorithm on the client's list that
matches a key exchange algorithm
on its own list as the key exchange
algorithm for packet transmission.
If no algorithm on the client's list
matches an algorithm on the
server's list, the negotiation fails.
NOTE
When the public key algorithm on the
server is ECC, the sm2_kep
algorithm is preferred.

By default, an SSH server

supports encryption algorithms
AES256_CTR and AES128_CTR
(Optional) Set ssh server cipher { des_cbc | when the device starts with no
an encryption 3des_cbc | aes128_cbc | configuration. When the device
algorithm list aes256_cbc | aes128_ctr | starts with configuration, an SSH
for the SSH aes256_ctr | arcfour128 | server supports encryption
server. arcfour256 | blowfish_cbc } * algorithms 3DES_CBC,
AES128_CBC, AES256_CBC,
AES128_CTR, AES256_CTR,
Arcfour128 and Arcfour256.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 191

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Operation Command Description

By default, an SSH server

supports HMAC algorithms
(Optional) Set sha2_256_96, sha2_256 and
an HMAC sha1_96 when the device starts
ssh server hmac { md5 |
authentication with no configuration. When the
md5_96 | sha1 | sha1_96 |
algorithm list device starts with configuration,
sha2_256 | sha2_256_96 } *
for the SSH an SSH server supports HMAC
server. algorithms MD5, MD5_96,
SHA1, SHA1_96, SHA2_256,
and SHA2_256_96.

The default interval for updating

the SSH server key pair is 0,
(Optional) Set indicating that the key pair is
the interval for ssh server rekey-interval never updated.
updating a key hours The server key pair is
pair. automatically updated at the
configured interval, which ensures
security.

The default timeout interval for

(Optional) Set SSH authentication is 60 seconds.
the SSH If you have not logged in
authentication ssh server timeout seconds successfully within the timeout
timeout interval for SSH authentication,
interval. the current connection is
terminated to ensure security.

The default number of SSH

(Optional) Set authentication retries is 3.
the number of
ssh server authentication- The number of SSH
SSH
retries times authentication retries is set to
authentication
retries. prevent access from unauthorized
users.

(Optional)
Enable the
compatibility By default, the server's
ssh server compatible-ssh1x
with SSH compatibility with earlier versions
enable
protocols of is disabled.
earlier
versions.

By default, no ACL is configured

(Optional) for the SSH server.
ssh [ ipv6 ] server acl { acl-
Configure an An ACL is configured to
number | acl-name }
ACL. determine which clients can log in
to the current device through SSH.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 192

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Operation Command Description

By default, the source interface of

an SSH server is not specified.
(Optional)
NOTE
Configure the
Before running this command to
source ssh server-source -i interface- specify the source interface, ensure
interface of type interface-number that the physical interface exists on
the SSH the device or the logical interface has
server. been created successfully; otherwise,
this command cannot be run
successfully.

(Optional) undo ssh server ip-block By default, an SSH server is

Enable an disable enabled to lock client IP
SSH server to addresses.
lock client IP If an SSH server is enabled to lock
addresses. client IP addresses, locked client
IP addresses fail to pass
authentication and are displayed
in the display ssh server ip-block
list command output.
If an SSH server is disabled from
locking client IP addresses, the
display ssh server ip-block list
command does not display any
client IP address that is locked
because of an authentication
failure.
NOTE
If a user logs in using SSH, the user's
IP address will be locked for 5
minutes upon 6 incorrect password
attempts within 5 minutes. The IP
address can be unlocked by running
the activate ssh server ip-block ip-
address ip-address [ vpn-instance
vpn-name ] command in the locking
period.

(Optional)
Configure
alarm
generation and By default, an alarm is generated
ssh server login-failed
clearance if the number of login failures
threshold-alarm upper-limit
thresholds for reaches 30 within 5 minutes and is
report-times lower-limit
the number of cleared if the number of login
resume-times period period-
SSH server failures falls below 20 within the
time
login failures same period.
within a
specified
period.

Commit the
commit -
configuration.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 193

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

– When the local RSA key pair is generated, two key pairs (a server key pair and a
host key pair) are generated at the same time. Each key pair contains a public key
and a private key. The length of the two key pairs ranges from 512 bits to 2048 bits.
The default length is 2048 bits.
– When the local DSA key pair is generated, only the host key pair is generated. The
length of the host key pair can be 512, 1024, or 2048 bits. The default length is
2048 bits.
– When the local ECC key pair is generated, only the host key pair is generated. The
length of the host key pair can be 256, 384, or 521 bits. The default length is 521
bits.
l Configuring the SSH user login interface
Configure the VTY user interface for login to support the SSH protocol before logging in
to the device through SSH.

Table 6-10 Configuring the SSH user login interface

Operation Command Description

Enter the system

system-view -
view.

Enter the VTY user user-interface vty first-ui-

-
interface view. number [ last-ui-number ]

By default, no authentication
mode is used on the VTY user
interface.
Configure the AAA To configure the VTY user
authentication mode interface to support SSH,
authentication-mode aaa configure the AAA
for the VTY user
interface. authentication mode for the
VTY user interface. If the AAA
authentication mode is not set,
the protocol inbound ssh
command does not take effect.

Configure the VTY

user interface to protocol inbound { all | By default, the VTY user
support the SSH ssh } interface supports all protocols.
protocol.

Other user interface attributes

include the maximum number
of user interfaces, terminal
(Optional)
attributes, and user level. These
Configure other For details, see Configuring
attributes have default values,
attributes of the VTY User Interfaces.
and you do not need to set
VTY user interface.
them. You can configure
attributes based on the usage
requirements.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 194

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Operation Command Description

Commit the
commit -
configuration.

l Configuring SSH user information

Configure SSH user information including the authentication mode. Authentication

modes including RSA, password, password-rsa, DSA, password-dsa, ECC, password-
ecc, and all are supported.
– The password-rsa authentication mode consists of the password and RSA
authentication modes.
– The password-dsa authentication mode consists of the password and DSA
authentication modes.
– The password-ecc authentication mode consists of the password and ECC
authentication modes.
– The all authentication mode indicates that SSH users only need to authenticated by
DSA, ECC, password, or RSA.

Table 6-11 Configuring SSH user information

Operation Command Description

Enter the system

system-view -
view.

Create an SSH user. ssh user user-name -

If SSH users are not

created using the ssh
user command,
directly run the ssh
authentication-type
default password
ssh user user-name authentication- command to configure
Configure an
type { password | rsa | password-rsa the default password
authentication mode
| all | dsa | password-dsa | ecc | authentication mode
for the SSH user.
password-ecc } for users. This mode
simplifies the
configurations when a
large number of users
exist, because you
need to configure only
AAA users.

By default, no service
Configure the SSH ssh user user-name service-type
type is configured for
user service type. { stelnet | all }
an SSH user.

Commit the
commit -
configuration.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 195

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

– The password authentication mode is implemented based on the AAA. To log in to

the device in the password-dsa, password-ecc, password, or password-rsa
authentication mode, create a local user with the same user name in the AAA view.
– If the SSH user uses the password authentication mode, only the SSH server needs
to generate the RSA, DSA, or ECC key. If the SSH user uses the RSA, DSA, or
ECC authentication mode, both the SSH server and client need to generate the RSA,
DSA, or ECC key and configure the public key of the peer end locally.
Perform any of the following configurations according to authentication mode you
select:
– To configure password authentication for the SSH user, see Table 6-12.
– To configure RSA , DSA, or ECC authentication for the SSH user, see Table 6-13.
– To configure password-rsa, password-dsa, or password-ecc authentication for the
SSH user, configure an AAA user and set the RSA, DSA, or ECC public key. See
Table 6-12 and Table 6-13.

Table 6-12 Configuring password, password-dsa, password-ecc, or password-rsa

authentication for the SSH user
Operation Command Description

Enter the system view. system-view -

Enter the AAA view. aaa -

local-user user-name
Configure the local user password irreversible-
-
name and password. cipher irreversible-cipher-
password

Configure the service type local-user user-name

-
for the local user. service-type ssh

Configure the level for the local-user user-name level

-
local user. level

Return to the system view. quit -

Commit the configuration. commit -

Table 6-13 Configuring DSA, ECC, RSA, password-dsa, password-ecc, or password-rsa

authentication for the SSH user
Operation Command Description

Enter the system view. system-view -

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 196

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Operation Command Description

By default, the
authentication type for the
SSH connection is AAA.
When the authentication
type is AAA, only the
password authentication
mode can be configured. If
the public key
authentication mode is
Configure the used, perform either of the
ssh authorization-type following operations to
authentication type for the
default root implement successful
SSH connection.
login of the SSH user:
l Run this command to
set the authentication
type for the SSH
connection to root.
l In the AAA view,
create a local user with
the same name as the
SSH user.

rsa peer-public-key key-

name [ encoding-type
{ der | openssh | pem } ]
or
Display the RSA, DSA, or dsa peer-public-key key-
-
ECC public key view. name encoding-type { der
| openssh | pem }
or
ecc peer-public-key key-
name

Display the public key

public-key-code begin -
editing view.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 197

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Operation Command Description

l The public key must be

a hexadecimal
character string in the
public key encoding
format, and generated
by the client software
that supports SSH. For
Edit the public key. hex-data detailed operations, see
the SSH client software
help.
l You must enter the
RSA, DSA, or ECC
public key on the
device that works as
the SSH server.

l If no key public code

hex-data is entered, the
public key cannot be
generated after you run
this command.
l If the specified key
Exit from the public key key-name has been
public-key-code end deleted in another view,
editing view.
the system displays a
message indicating that
the key does not exist
and returns to the
system view directly
when you run this
command.

Return to the system view

peer-public-key end -
from the public key view.

Assign an RSA, DSA, or ssh user user-name assign

ECC public key to an SSH { rsa-key | dsa-key | ecc- -
user. key } key-name

Commit the configuration. commit -

l Logging in to the device through STelnet

Use the SSH client software to log in to the device using STelnet from a terminal. The
third-party software PuTTY is used as an example here.
# Use the PuTTY software to log in to the device, enter the device IP address, and select
the SSH protocol type.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 198

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Figure 6-7 PuTTY Configuration page - password authentication mode

# Click Open. Enter the user name and password at the prompt, and press Enter. You
have logged in to the SSH server. (The following information is only for reference.)
login as: client001
Sent username "client001"
client001@[Link]'s password:

Warning: The initial password poses security risks.

The password needs to be changed. Change now? [Y/N]: n

Info: The max number of VTY users is 21, the number of current VTY users
online is 2, and total number of terminal users online is 2.
The current login time is 2012-08-04 20:09:11+00:00.
First login successfully.
<SSH Server>

----End

Checking the Configuration

l Run the display ssh user-information [ username ] command to check information
about an SSH user on the SSH server. If no SSH user is specified, this command displays
information about all SSH users on the SSH server.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 199

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

l Run the display ssh server status command to check the global SSH server
configuration.
l Run the display ssh server session command to check the sessions connected to the
SSH client on the SSH server.

6.2.4 Common Operations After Login

After logging in to the device, you can configure services and functions on the device and and
set login user information.
l Displaying online users
l Releasing an online user
l Locking the user configuration permission
l Locking a user interface
l Displaying online users
After login, you can check the information about online users.
– Run the display users [ all ] command to check the online user information.
l Releasing an online user
To disconnect a login user from the device, you can release the user.
– Run the kill user-interface { ui-number | ui-type ui-number1 } command to release
the online user.
You can run the display users command to check the login user information on the
current devices.
l Locking the user configuration permission
When multiple users log in to the system to perform configuration, the configurations
may conflict. To avoid service exceptions, you can lock the user configuration
permission to ensure that only one user can perform configuration at the same time.
a. Run the configuration exclusive command to assign the configuration permission
to the current user.
After you lock the user configuration permission, the user who is assigned the
permission can have the exclusive configuration permission.
NOTE

l This command applies to all views.

l You can run the display configuration exclusive user command to check the users for
whom the configuration permission has been locked.
l If the configuration permission has been locked, a message is displayed when you
attempt to lock the permission set again.
b. Run the system-view command to display the system view.
c. (Optional) Run the configuration exclusive timeout timeout-value command to set
the unlocking interval.
This command specifies the maximum interval for locking the configuration
permission when no configuration command is issued. After the specified period,
the system automatically unlocks the configuration permission and other users can
perform configuration.
The default locking interval is 30 seconds.
d. Run the commit command to commit the configuration.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 200

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

l Locking a user interface

When you leave the operation terminal temporarily, you can lock the user interface to
prevent unauthorized users from logging in to the terminal.
a. Run the lock command to lock the user interface.
b. Enter the lock password and confirm password.
<HUAWEI> lock
Enter Password:
Confirm Password:
Info: The terminal is locked.

After you run the lock command, the system prompts you to enter the lock
password and confirm password. If the two passwords are the same, the current
interface is locked successfully.
To unlock the user interface, you must press Enter and enter the correct login
password as prompted.

6.3 Configuring the Device as the Client to Log In to

Another Device
A user can log in to another device on the network through Telnet or STelnet from the current
device to manage and maintain the remote device.

6.3.1 Configuring the Device as the Telnet Client to Log In to

Another Device
Pre-configuration Tasks
Before configuring the device as the Telnet client to log in to another device, complete the
following tasks:
l Logging in to the device from a terminal
l Configuring a route between the device and Telnet server
l Enabling the Telnet service on the Telnet server
l Obtaining the Telnet user name, password, and port number configured on the Telnet
server

Configuration Process
NOTE

The Telnet protocol poses a security risk, and therefore the STelnet V2 protocol is recommended.

Table 6-14 describes the tasks in the process of configuring the device as the Telnet client to
log in to another device.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 201

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Table 6-14 Tasks in the process of configuring the device as the Telnet client to log in to
another device
No. Task Description Remarks

(Optional) Configure Configure the source

1
Telnet client parameters. address of the client.

Use the Telnet -

Log in to another device command to log in to
2
through Telnet. the device from a
terminal.

Procedure
1. (Optional) Configure Telnet client parameters.

Table 6-15 Configuring Telnet client parameters

Action Command Description

Enter the system view. system-view -

The Telnet client source

telnet client source { -a source- address on the server
Configure the Telnet
ip-address | -i interface-type must be the same as the
client source address.
interface-number } address configured
running this command.

Commit the
commit -
configuration.

Return to user view. quit -

2. Log in to another device through Telnet.

Table 6-16 Actions for logging in to another device through Telnet

Action Command Description

Perform either of the

following steps by
determining whether the
network protocol is
telnet [ [ vpn-instance vpn- based on IPv4 or IPv6.
Use the IPv4 address instance-name ] -a source-ip-
to log in to the server address | -i interface-type The Telnet client can log
through Telnet. interface-number ] host-ip [ port- in successfully with no
number ] port specified only when
the server is listening on
port 23. If the server is
listening on another
port, the port number

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 202

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Action Command Description

Use the IPv6 address telnet ipv6 host-ipv6 [ -oi

must be specified upon
to log in to the server interface-type interface-number ]
login.
through Telnet. [ port-number ]

Checking the Configuration

l Run the display tcp status command to check all TCP connections.

6.3.2 Configuring the Device as the STelnet Client to Log In to

Another Device

Pre-configuration Tasks
Before configuring the device as the STelnet client to log in to another device, complete the
following tasks:

l Log in to the device from a terminal.

l Configure a route between the device and STelnet server.
l Enable the STelnet service on the STelnet server.
l Obtain the SSH user information and port number configured on the STelnet server.

Configuration Process
NOTE

The STelnet V1 protocol poses a security risk, and therefore the STelnet V2 mode is recommended.

Table 6-17 describes the tasks in the process of configuring the device as the STelnet client to
log in to another device.

Table 6-17 Tasks in the process of configuring the device as the STelnet client to log in to
another device
No. Task Description Remarks

Generate a local key pair and

configure the public key on the
SSH server.
Generating a local key Perform this step only when
1
pair the device logs in to the SSH
server in RSA, DSA, or ECC Tasks 1, 2, and 3
authentication mode, not the can be performed in
password authentication mode. any sequence.
You can enable the first
Configuring the mode
authentication function of the
for connecting the device
2 SSH client or configure the
to the SSH server for the
SSH client to assign a public
first time
key to the SSH server.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 203

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

No. Task Description Remarks

Set the interval for sending

keepalive packets on the SSH
Setting the SSH client
3 client and the maximum
parameters
number of keepalive packets
sent by the SSH client.

Use the STelnet command to

Logging in to another
4 log in to the device from a -
device through STelnet.
terminal.

Default Configuration

Table 6-18 Default values for configuring the device as the STelnet client to log in to another
device
Parameter Default Setting

First authentication on the SSH client Disabled

Whether the SSH client assigns the RSA,

No
DSA, or ECC public key to the SSH server

Procedure
l Generating a local key pair
NOTE

Perform this step only when the device logs in to the SSH server in RSA, DSA, or ECC
authentication mode, not the password authentication mode.

Table 6-19 Actions for generating a local key pair

Action Command Description

Enter the system

system-view -
view.

Perform one of the operations

based on the key type.
Run the display rsa local-key-
rsa local-key-pair create, pair public, display dsa local-
Generate a local
dsa local-key-pair create, or key-pair public, or display ecc
key pair.
ecc local-key-pair create local-key-pair public command
to view the public key in the
local RSA, DSA, or ECC key
pair.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 204

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Action Command Description

Commit the
commit -
configuration.

l Configuring the mode for connecting the device to the SSH server for the first time
If the public key of the SSH server has not been saved on the client, the system cannot
check SSH server validity when the device that works as the client connects to the SSH
server for the first time. The connection fails. Perform one of the following operations:
– Enabling the first authentication mode on the SSH client: The system does not
check the public key of the SSH server, which ensures that the first connection is
successful. The system then assigns and saves the public key for subsequent
authentication. For details, see Table 6-20. This configuration method is simple.
– Configuring the SSH client to assign a public key to the SSH server. The public key
generated on the server is saved on the client, which ensures that the SSH server
validity check is successful for the first connection. For details, see Table 6-21.
This configuration method is complex but has high security.
Select either of the preceding configuration method as required.

Table 6-20 Actions for enabling first authentication for the SSH client
Action Command Description

Enter the system

system-view -
view.

Enable first
By default, first authentication is
authentication on ssh client first-time enable
disabled on the SSH client.
the SSH client.

Commit the
commit -
configuration.

Table 6-21 Actions for configuring the SSH client to assign the RSA, DSA, or ECC
public key to the SSH server
Action Command Description

Enter the system

system-view -
view.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 205

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Action Command Description

rsa peer-public-key key-

name [ encoding-type { der |
openssh | pem } ]
or
Enter the RSA,
dsa peer-public-key key- Perform one of the operations
DSA, or ECC
name encoding-type { der | based on the key type.
public key view.
openssh | pem }
or
ecc peer-public-key key-
name

Enter the public

public-key-code begin -
key editing view.

l The public key must be a

hexadecimal character string
in the public key encoding
format, and generated by the
Edit the public SSH server.
hex-data
key. l After entering the public key
editing view, you must enter
the RSA, DSA, or ECC
public key that is generated
on the server to the client.

l If the entered key code hex-

data is invalid, the public key
cannot be generated after you
run this command.
Quit the public l If the specified key key-name
public-key-code end has been deleted, the system
key editing view.
displays a message indicating
that the key does not exist
and returns to the system
view directly when you run
this command.

Return to the
peer-public-key end -
system view.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 206

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Action Command Description

If the SSH server public key

saved in the SSH client does not
take effect, run the undo ssh
client server-ip-address assign
Bind the RSA,
ssh client server-ip-address { rsa-key | dsa-key | ecc-key }
DSA, or ECC
assign { rsa-key | dsa-key | command to cancel the binding
public key to the
ecc-key } key-name between the SSH server and
SSH server.
RSA, DSA, or ECC public key,
and run this command to assign
a new RSA, DSA, or ECC
public key to the SSH server.

Commit the
commit -
configuration.

l Setting the SSH client parameters

Table 6-22 Actions for setting the SSH client parameters

Action Command Description

Enter the system

system-view -
view.

Set the interval The default interval for sending

for sending ssh client keepalive-interval keepalive packets on the SSH
keepalive packets seconds client is 0. The value 0 indicates
on the SSH client. that keepalive packets are not
sent.
If the interval for sending
keepalive packets is set to 0, the
maximum number of keepalive
packets does not take effect.
Set the maximum
If the SSH client does not
number of
ssh client keepalive- receive any data packet from the
keepalive packets
maxcount count server within a period, the client
sent by the SSH
sends the maximum number of
client.
keepalive packets to the server.
If the client does not receive any
keepalive response packet from
the server, the client disconnects
from the server.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 207

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Action Command Description

By default, the SSH client

supports all key exchange
algorithms.
During the negotiation process,
the client and server negotiate
ssh client key-exchange the key exchange algorithm for
{ dh_group14_sha1 | packet transmission. The server
(Optional) dh_group1_sha1 | compares the key exchange
Configure a key dh_group_exchange_sha1 | algorithm list sent by the client
exchange dh_group_exchange_sha256 with its own key exchange
algorithm list on | ecdh_sha2_nistp256 | algorithm list, and selects the
the SSH client. ecdh_sha2_nistp384 | first key exchange algorithm on
ecdh_sha2_nistp521 | the client's list that matches a
sm2_kep } * key exchange algorithm on its
own list as the key exchange
algorithm for packet
transmission. If no algorithm on
the client's list matches an
algorithm on the server's list, the
negotiation fails.

By default, an SSH client

ssh client cipher { des_cbc | supports encryption algorithms
(Optional) Set an
3des_cbc | aes128_cbc | including DES_CBC,
encryption
aes256_cbc | aes128_ctr | 3DES_CBC, AES128_CBC,
algorithm list for
aes256_ctr | arcfour128 | AES256_CBC, AES128_CTR,
the SSH client.
arcfour256 } * AES256_CTR, Arcfour128, and
Arcfour256.

(Optional) Set an By default, an SSH client

HMAC ssh client hmac { md5 | supports HMAC authentication
authentication md5_96 | sha1 | sha1_96 | algorithms including MD5,
algorithm list for sha2_256 | sha2_256_96 } * MD5_96, SHA1, SHA1_96,
the SSH client. SHA2_256, and SHA2_256_96.

Commit the
commit -
configuration.

l Logging in to another device through STelnet

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 208

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Table 6-23 Actions for logging in to another device through STelnet

Action Command Description

stelnet [ -a source-ip-address | -i interface- Run either of the

type interface-number ] [ -force-receive- commands based
pubkey ] host-ip [ port-number ] [ -vpn- on the network
instance vpn-instance-name | prefer_kex address type.
kex-type | prefer_ctos_cipher cipher-type | Only when the
Use the IPv4
prefer_stoc_cipher cipher-type | number of the port
address to log in
prefer_ctos_hmac hmac-type | to which the server
to the SSH server
prefer_stoc_hmac hmac-type | attempts to connect
through STelnet.
prefer_ctos_compress compress-type | is 22, the port
prefer_stoc_compress compress-type | -ki number for the
aliveinterval | -kc alivecountmax | identity- STelnet client login
key { dsa | ecc | rsa } | user-identity-key does not need to be
{ dsa | ecc | rsa } ] * specified.
Otherwise, the port
number for the
STelnet client login
must be specified.
When logging in to
the SSH server, the
STelnet client can
carry the source IP
stelnet ipv6 [ -a source-ip-address ] [ - address and VPN
force-receive-pubkey ] host-ipv6 [ -oi instance name and
interface-type interface-number ] [ port- select a key
number ] [ prefer_kex kex-type | exchange
prefer_ctos_cipher cipher-type | algorithm, an
Use the IPv6 encryption
prefer_stoc_cipher cipher-type |
address to log in algorithm,
prefer_ctos_hmac hmac-type |
to the SSH server compression
prefer_stoc_hmac hmac-type |
through STelnet. algorithm, and an
prefer_ctos_compress compress-type |
prefer_stoc_compress compress-type | -ki HMAC algorithm,
aliveinterval | -kc alivecountmax | identity- and configure the
key { dsa | ecc | rsa } | user-identity-key keepalive function.
{ dsa | ecc | rsa } ] * If the source
interface is
specified using -i
interface-type
interface-number,
the -vpn-instance
vpn-instance-name
parameter is not
supported.

----End

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 209

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Checking the Configuration

Run the display ssh server-info command to check the mapping between all SSH servers and
public keys on the SSH client.

6.4 Configuration Examples

This section describes the examples for logging in to the device through a console port,
Telnet, STelnetand for configuring the device to log in to another device.
This section only provides configuration examples for single features. For details about multi-
feature configuration cases, feature-specific configuration cases, interconnection cases,
protocol or hardware replacement cases, and industry application cases, see the Typical
Configuration Cases.

6.4.1 Example for Logging In to the Device Through a Console

Port
Networking Requirements
When you cannot remotely log in to the device, you can perform local login through a console
port. If you log in to the device through a console port, only password authentication is
required. To improve security, use AAA on the console user interface.

Figure 6-8 Networking diagram of user login through a console port

PC Switch

Configuration Roadmap
The configuration roadmap is as follows:
1. Use the terminal simulation software to log in to the device through a console port.
2. Configure the authentication mode of the console user interface.
NOTE

You can use the built-in terminal emulation software (such as the HyperTerminal of Windows 2000) on
the PC. If no built-in terminal emulation software is available, use the third-party terminal emulation
software. For details, see the software user guide or online help. This section uses the third-party
software SecureCRT as an example.

Procedure
Step 1 Use the terminal simulation software to log in to the device through a console port.
1. Insert the DB9 connector of the console cable delivered with the product to the 9-pin
serial port on the PC, and insert the RJ45 connector to the console port of the device, as
shown in Figure 6-9.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 210

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Figure 6-9 Connecting to the device through the console port

RJ-45
CONSOLE CE6850-48S4Q-EI
STATUS STATUS STATUS STATUS
SYS
MST

ACT
L/A

ID

ETH
PAC-350WA-B ~100-240V;50/60Hz,5A FAN-40EA-B PWR1 FAN1 FAN2 PWR2 FAN-40EA-B PAC-350WA-B ~100-240V;50/60Hz,5A

DB-9

2. Start the terminal emulation software on the PC. Create a connection, select the
connected port, and set communication parameters.(This section uses the third-party
software SecureCRT as an example.)

a. Click to establish a connection, as shown in Figure 6-10.

Figure 6-10 Establishing a connection

b. Set the connected port and communication parameters, as shown in Figure 6-11.
Select the connected port based on actual situations. For example, you can view
port information in Device Manager in the Windows operating system, and select
the connected port.
Communication parameters of the terminal emulation software must be consistent
with the default attribute settings of the console user interface on the device, which
are 9600 bit/s baud rate, 8 data bits, 1 stop bit, no parity check, and no flow control.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 211

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

NOTE

By default, no flow control mode is configured on the device. Because RTS/CTS is selected
in the software by default, you need to deselect RTS/CTS; otherwise, you cannot enter
commands.

Figure 6-11 Setting the connected port and communication parameters

NOTE

A PC may have multiple connection interfaces; therefore, the interface connected through the
console cable is selected in this example. Generally, COM1 is selected.
If the serial port communication parameters of the device are modified, modify the communication
parameters on the PC accordingly (ensure that the parameter values are the same) and re-establish
the connection.
3. Press Enter until the system prompts you to enter the password. (The system will
prompt you to enter the user name and password in AAA authentication. The following
information is only for reference.)
Login authentication

Password:

You can run commands to configure the device. Enter a question mark (?) whenever you
need help.
Step 2 Configure the authentication mode of the console user interface.
<HUAWEI> system-view
[~HUAWEI] user-interface console 0
[*HUAWEI-ui-console0] authentication-mode aaa
[*HUAWEI-ui-console0] user privilege level 15
[*HUAWEI-ui-console0] quit
[*HUAWEI] aaa
[*HUAWEI-aaa] local-user admin1234 password irreversible-cipher Helloworld@6789
[*HUAWEI-aaa] local-user admin1234 level 3
[*HUAWEI-aaa] local-user admin1234 service-type terminal
[*HUAWEI-aaa] commit

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 212

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

After the preceding operations, you can re-log in to the device on the console user interface
only by entering the user name admin1234 and password Helloworld@6789.

----End

Configuration Files
#
aaa
local-user admin1234 password irreversible-cipher $1c$g8wLJ`LjL!
$CyE(V{3qg5DdU:PM[6=6O$[Link],Q}>^)OBzgoU$
local-user admin1234 service-type terminal
local-user admin1234 level 3
#
user-interface con 0
authentication-mode aaa
#
return

6.4.2 Example for Logging In to the Device Through Telnet

Networking Requirements
As shown in Figure 6-12, users require simplified configurations and manage the device.
Configure AAA authentication for Telnet users on the server, and configure a security policy
to ensure that only users in compliance with the security policy can log in to the device.

Figure 6-12 Networking diagram of logging in to the device through Telnet

[Link]/32 [Link]/24
PC1

[Link]/32 Telnet Server

PC2

Configuration Roadmap
The configuration roadmap is as follows:
1. Configure the Telnet login mode to implement remote network device maintenance.
2. Configure the administrator's user name and password and the AAA authentication mode
to ensure that only users passing the authentication can log in to the device.
3. Configure a security policy to ensure that only users in compliance with the security
policy can log in to the device.

Procedure
Step 1 Set the server listening port number and enable the server function.
<HUAWEI> system-view
[~HUAWEI] sysname Telnet Server
[*HUAWEI] commit
[~Telnet Server] undo telnet server disable

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 213

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

[*Telnet Server] telnet server port 1025

Step 2 Set the VTY user interface parameters.

# Set the maximum number of VTY user interfaces.
[*Telnet Server] user-interface maximum-vty 8
[*Telnet Server] commit

# Set the IP address of the device to which the user is allowed to log in.
[*Telnet Server] acl 2001
[*Telnet Server-acl4-basic-2001] rule permit source [Link] 32
[*Telnet Server-acl4-basic-2001] rule deny source [Link] 32
[*Telnet Server-acl4-basic-2001] quit
[*Telnet Server] user-interface vty 0 7
[*Telnet Server-ui-vty0-7] acl 2001 inbound

# Configure the terminal attributes of the VTY user interface.

[*Telnet Server-ui-vty0-7] shell
[*Telnet Server-ui-vty0-7] idle-timeout 20
[*Telnet Server-ui-vty0-7] screen-length 30
[*Telnet Server-ui-vty0-7] history-command max-size 20

# Configure the user authentication mode of the VTY user interface.

[*Telnet Server-ui-vty0-7] authentication-mode aaa
[*Telnet Server-ui-vty0-7] quit

Step 3 Configure the login user information.

# Configure the login authentication mode.
[*Telnet Server] aaa
[*Telnet Server-aaa] local-user admin1234 password irreversible-cipher
Helloworld@6789
[*Telnet Server-aaa] local-user admin1234 service-type telnet
[*Telnet Server-aaa] local-user admin1234 level 3
[*Telnet Server-aaa] commit
[~Telnet Server-aaa] quit

Step 4 Configure the client login.

Enter commands at the command line prompt to log in to the device through Telnet.
C:\Documents and Settings\Administrator> telnet [Link] 1025

Press Enter, and enter the user name and password in the login window. If the authentication
is successful, the command line prompt of the user view is displayed. The user view
configuration environment is displayed.
Username:admin1234
Password:
Info: The max number of VTY users is 8, the number of current VTY users online is
1, and total number of terminal users online is 1.
The current login time is 2012-08-04 19:49:11.
First login successfully.
<Telnet Server>

----End

Configuration Files
Telnet server configuration file
#
sysname Telnet Server

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 214

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

#
telnet server port 1025
#
acl number 2001
rule 5 permit source [Link] 0
rule 10 deny source [Link] 0
#
aaa
local-user admin1234 password irreversible-cipher $1c$g8wLJ`LjL!
$CyE(V{3qg5DdU:PM[6=6O$[Link],Q}>^)OBzgoU$
local-user admin1234 service-type telnet
local-user admin1234 level 3
#
user-interface maximum-vty 8
#
user-interface vty 0 7
acl 2001 inbound
authentication-mode aaa
history-command max-size 20
idle-timeout 20 0
screen-length 30
#
return

6.4.3 Example for Logging In to the Device Through STelnet

Networking Requirements
As shown in Figure 6-13, users require secure login, but Telnet cannot provide a secure
authentication method. In this scenario, STelnet can be configured to ensure security of
remote login. PC1 and PC2 have reachable routes to the SSH server, and [Link] is
the IP address of the management interface on the SSH server. Two login users client001 and
client002 need to be configured on the SSH server. PC1 uses the account of client001 to log in
to the SSH server through password authentication; PC2 uses the account of client002 to log
in to the SSH server through RSA authentication. Configure a security policy to ensure that
only PC1 and PC2 can be used to log in to the device.

Figure 6-13 Networking diagram of logging in to the device through STelnet

[Link]/24
PC1 [Link]/24

[Link]/24

PC2
SSH Server
[Link]/24

PC3

Configuration Roadmap
The configuration roadmap is as follows:
1. Install the SSH server software on PC1. Install the key pair generation software, public
key conversion software, and SSH server login software on PC2.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 215

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

2. Generate a local key pair on the SSH server to implement secure data exchange between
the server and client.
3. Configure different authentication modes for the SSH users client001 and client002 on
the SSH server.
4. Enable the STelnet service on the SSH server.
5. Configure a security policy to ensure that only PC1 and PC2 can be used to log in to the
device.
6. Configure the STelnet server type for the SSH users client001 and client002 on the SSH
server.
7. Log in to the SSH server as the client001 and client002 users through STelnet.

Procedure
Step 1 Generate a local key pair on the server.
<HUAWEI> system-view
[~HUAWEI] sysname SSH Server
[*HUAWEI] commit
[~SSH Server] rsa local-key-pair create
The key name will be: SSH Server_Host
The range of public key size is (2048 ~ 2048).
NOTE: Key pair generation will take a short while.

Step 2 Create an SSH user on the server.

NOTE

There are eight authentication modes for an SSH user: password, RSA, password-RSA, DSA, password-
DSA, ECC, password-ECC, and all.

# Configure the VTY user interface.

[*SSH Server] user-interface vty 0 4
[*SSH Server-ui-vty0-4] authentication-mode aaa
[*SSH Server-ui-vty0-4] protocol inbound ssh
[*SSH Server-ui-vty0-4] quit

l Create an SSH user named client001.

# Create an SSH user named client001 and configure the password authentication mode
for the user.
[*SSH Server] aaa
[*SSH Server-aaa] local-user client001 password irreversible-cipher Huawei@123
[*SSH Server-aaa] local-user client001 level 3
[*SSH Server-aaa] local-user client001 service-type ssh
[*SSH Server-aaa] quit
[*SSH Server] ssh user client001 authentication-type password

l Create an SSH user named client002.

# Create an SSH user named client002 and configure the RSA authentication mode for
the user.
[*SSH Server] ssh user client002 authentication-type rsa
[*SSH Server] ssh authorization-type default root
[*SSH Server] commit

# Generate a local key pair of the client on PC2.

a. Run [Link] on the client. It is used to generate the public and private key
files.
Select SSH2 RSA and click Generate. By moving the cursor in the blank area to
generated the key.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 216

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Figure 6-14 PuTTY Key Generate page (1)

After the key is generated, click Save public key to save the key in the [Link]
file.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 217

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Figure 6-15 PuTTY Key Generate page (2)

Click Save private key. The PuTTYgen Warning dialog box is displayed. Click
Yes. The private key is saved in the [Link] file.

Figure 6-16 PuTTY Key Generate page (3)

b. Run [Link] on the client. Convert the generated public key to the character
string required for the device.
Open the [Link] file required by SSH that is generated in the previous step.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 218

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Figure 6-17 ssh key converter page (1)

Click Convert(C). You can see the public keys before and after conversion.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 219

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Figure 6-18 ssh key converter page (2)

# Enter the RSA public key generated on PC2 to the SSH server.
[~SSH Server] ssh authorization-type default root
[*SSH Server] rsa peer-public-key rsakey001
[SSH Server] rsa peer-public-key rsakey001
[SSH Server] rsa peer-public-key rsakey001
[*SSH Server-rsa-public-key] public-key-code begin
[*SSH Server-rsa-public-key-rsa-key-code] 30820108 02820101 00DD8904 1A5E30AA
976F384B 5DB366A7
[*SSH Server-rsa-public-key-rsa-key-code] 048C0E79 06EC6B08 8BB9567D 75914B5B
4EA7B2E5 1938D118
[*SSH Server-rsa-public-key-rsa-key-code] 4B863A38 BA7E0F0D BE5C5AE4 CA55B192
B531AC48 B07D21E3
[*SSH Server-rsa-public-key-rsa-key-code] 62E3F2A5 8C04C443 CF51CF51 136B5B9E
812AB1B7 1250EB24
[*SSH Server-rsa-public-key-rsa-key-code] A4AE5083 A1DB18EC E2395C9B B806E8F0
0BE24FB5 16958784
[*SSH Server-rsa-public-key-rsa-key-code] 403B617F 8AAAB1F8 C6DE8C3C F09E4D23
7D1C17BF 4AAF09C4
[*SSH Server-rsa-public-key-rsa-key-code] 74C083AF 17CD3075 3396B322 32C57FF0
B1991971 02F1033B
[*SSH Server-rsa-public-key-rsa-key-code] 81AA6D47 44520F23 685FAF72 04BA4B6E
615EF224 14E64E2A

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 220

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

[*SSH Server-rsa-public-key-rsa-key-code] 331EEB7F 188D9805 96DBFD30 0C947A5A

BA879DC4 F848B769
[*SSH Server-rsa-public-key-rsa-key-code] 513C35CD B52B2917 02B77693 F79910EE
5287F252 977F985E
[*SSH Server-rsa-public-key-rsa-key-code] 5F186C94 93F26780 4E7F5F9D 5287350A
0A4F4988 1BF6AB7C
[*SSH Server-rsa-public-key-rsa-key-code] 1B020125
[*SSH Server-rsa-public-key-rsa-key-code] public-key-code end
[*SSH Server-rsa-public-key] peer-public-key end

# Bind the RSA public key of the STelnet client to the SSH user client002 on the SSH
server.
[*SSH Server] ssh user client002 assign rsa-key rsakey001

Step 3 Enable the STelnet service on the SSH server.

# Enable the STelnet service.
[*SSH Server] stelnet server enable

Step 4 Configure a security policy to ensure that only PC1 and PC2 can be used to log in to the
device.
[*SSH Server] acl 2001
[*SSH Server-acl4-basic-2001] rule permit source [Link] 32
[*SSH Server-acl4-basic-2001] rule permit source [Link] 32
[*SSH Server-acl4-basic-2001] rule deny source [Link] 32
[*SSH Server-acl4-basic-2001] quit
[*SSH Server] ssh server acl 2001

Step 5 Configure the STelnet service type for the client001 and client002 users.
[*SSH Server] ssh user client001 service-type stelnet
[*SSH Server] ssh user client002 service-type stelnet
[*SSH Server] commit

Step 6 Verify the configuration.

l Log in to the SSH server as the client001 user from PC1 using the password
authentication mode.
# Use the PuTTY software to log in to the device, enter the device IP address, and select
the SSH protocol type.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 221

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Figure 6-19 PuTTY Configuration page - password authentication mode

# Click Open. Enter the user name and password at the prompt, and press Enter. You
have logged in to the SSH server.
login as: client001
Sent username "client001"
client001@[Link]'s password:

Warning: The initial password poses security risks.

The password needs to be changed. Change now? [Y/N]: n

Info: The max number of VTY users is 21, the number of current VTY users
online is 2, and total number of terminal users online is 2.
The current login time is 2012-08-04 20:09:11+00:00.
First login successfully.
<SSH Server>

l Log in to the SSH server as the client002 user from PC2 using the RSA authentication
mode.
# Use the PuTTY software to log in to the device, enter the device IP address, and select
the SSH protocol type.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 222

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Figure 6-20 PuTTY Configuration page - RSA authentication mode (1)

# Choose Connection > SSH in the navigation tree. The page shown in Figure 6-21 is
displayed. Select 2 for Preferred SSH protocol version

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 223

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Figure 6-21 PuTTY Configuration page - RSA authentication mode (2)

# Choose Connection > SSH > Auth in the navigation tree. The page shown in Figure
6-22 is displayed. Select the [Link] file corresponding to the public key configured
on the server.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 224

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Figure 6-22 PuTTY Configuration page - RSA authentication mode (3)

# Click Open. Enter the user name at the prompt, and press Enter. You have logged in
to the SSH server.
login as: client002
Authenticating with public key "rsa-key"

Info: The max number of VTY users is 21, the number of current VTY users
online is 2, and total number of terminal users online is 2.
The current login time is 2012-08-06 04:30:23+00:00.
First login successfully.
<SSH Server>

----End

Configuration Files
SSH server configuration file
#
sysname SSH Server
#
rsa peer-public-key rsakey001
public-key-code begin

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 225

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

30820108
02820101
00DD8904 1A5E30AA 976F384B 5DB366A7 048C0E79 06EC6B08 8BB9567D 75914B5B
4EA7B2E5 1938D118 4B863A38 BA7E0F0D BE5C5AE4 CA55B192 B531AC48 B07D21E3
62E3F2A5 8C04C443 CF51CF51 136B5B9E 812AB1B7 1250EB24 A4AE5083 A1DB18EC
E2395C9B B806E8F0 0BE24FB5 16958784 403B617F 8AAAB1F8 C6DE8C3C F09E4D23
7D1C17BF 4AAF09C4 74C083AF 17CD3075 3396B322 32C57FF0 B1991971 02F1033B
81AA6D47 44520F23 685FAF72 04BA4B6E 615EF224 14E64E2A 331EEB7F 188D9805
96DBFD30 0C947A5A BA879DC4 F848B769 513C35CD B52B2917 02B77693 F79910EE
5287F252 977F985E 5F186C94 93F26780 4E7F5F9D 5287350A 0A4F4988 1BF6AB7C
1B
0201
25
public-key-code end
peer-public-key end
#
acl number 2001
rule 5 permit source [Link] 0
rule 10 permit source [Link] 0
rule 15 deny source [Link] 0
#
aaa
local-user client001 password irreversible-cipher $1c$-3P&"H{'b'$({Ak~<"{gM<C
$COLj\+R_yeo:|PaFRQh-r6OTch*$
local-user client001 service-type ssh
local-user client001 level 3
#
stelnet server enable
ssh server acl 2001
ssh user client001
ssh user client001 authentication-type password
ssh user client001 service-type stelnet
ssh user client002
ssh user client002 authentication-type rsa
ssh user client002 assign rsa-key rsakey001
ssh user client002 service-type stelnet
ssh authorization-type default root
#
user-interface vty 0 4
authentication-mode aaa
protocol inbound ssh
#
return

6.4.4 Example for Configuring the Device as the Telnet Client to

Log In to Another Device
Networking Requirements
As shown in Figure 6-23, the PC and Switch1 have reachable routes to each other; Switch1
and Switch2 have reachable routes to each other. The user needs to manage and maintain
Switch2 remotely. However, the PC cannot directly log in to Switch2 through Telnet because
it has no reachable route to Switch2. The user can log in to Switch1 through Telnet, and then
log in to Switch2 from Switch1. To prevent unauthorized devices from logging in to Switch2
through Telnet, an ACL needs to be configured to allow only the Telnet connection from
Switch1 to Switch2.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 226

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Figure 6-23 Networking diagram of configuring the device as the Telnet client to log in to
another device
Session Session

[Link]/24 [Link]/24

Network Network

PC Switch1 Switch2

Configuration Roadmap
The configuration roadmap is as follows:
1. Configure the Telnet authentication mode and password on Switch2.
2. Configure the Switch2 to allow Switch1 access with ACL.
3. Log in to Switch2 from Switch1 through Telnet.

Procedure
Step 1 Configure the Telnet authentication mode and password on Switch2.
<HUAWEI> system-view
[~HUAWEI] sysname Switch2
[*HUAWEI] commit
[~Switch2] user-interface vty 0 4
[*Switch2-ui-vty0-4] user privilege level 3
[*Switch2-ui-vty0-4] authentication-mode aaa
[*Switch2-ui-vty0-4] quit

Step 2 Configure the login user information.

[*Switch2] aaa
[*Switch2-aaa] local-user admin1234 password irreversible-cipher Helloworld@6789
[*Switch2-aaa] local-user admin1234 service-type telnet
[*Switch2-aaa] local-user admin1234 level 3
[*Switch2-aaa] commit
[~Switch2-aaa] quit

Step 3 Configure the Switch2 to allow Switch1 access with ACL.

[*Switch2] acl 2000
[*Switch2-acl4-basic-2000] rule permit source [Link] 0
[*Switch2-acl4-basic-2000] quit
[*Switch2] user-interface vty 0 4
[*Switch2-ui-vty0-4] acl 2000 inbound
[*Switch2-ui-vty0-4] commit
[~Switch2-ui-vty0-4] quit

NOTE

It is optional to configure an ACL for Telnet services.

Step 4 Verify the configuration.

# After the preceding configuration, you can log in to Switch2 from Switch1 through Telnet.
You cannot log in to Switch2 from other devices.
<HUAWEI> system-view

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 227

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

[~HUAWEI] sysname Switch1

[*HUAWEI] commit
[~Switch1] quit
<Switch1> telnet [Link]
Username:admin1234
Password:
Info: The max number of VTY users is 8, the number of current VTY users online is
1, and total number of terminal users online is 1.
The current login time is 2012-08-04 19:49:11.
First login successfully.
<Switch2>

----End

Configuration Files
Switch2 configuration file
#
sysname Switch2
#
acl number 2000
rule 5 permit source [Link] 0
#
aaa
local-user admin1234 password irreversible-cipher $1c$g8wLJ`LjL!
$CyE(V{3qg5DdU:PM[6=6O$[Link],Q}>^)OBzgoU$
local-user admin1234 level 3
local-user admin1234 service-type telnet

#
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa
user privilege level 3
#
return

6.4.5 Example for Configuring the Device as the STelnet Client to

Log In to Another Device
Networking Requirements
The enterprise requires that secure data exchange should be performed between the server and
client. As shown in Figure 6-24, two login users Client001 and Client002 are configured and
they use the password and RSA authentication modes respectively to log in to the SSH server.
A new port number is configured and the default port number is not used.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 228

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Figure 6-24 Networking diagram of logging in to another device through STelnet

SSH Server

[Link]/16

HUB

[Link]/16 [Link]/16

Client001 Client002

Configuration Roadmap
The configuration roadmap is as follows:

1. Generate a local key pair on the SSH server to implement secure data exchange between
the server and client.
2. Configure different authentication modes for the SSH users client001 and client002 on
the SSH server.
3. Enable the STelnet service on the SSH server.
4. Configure the STelnet server type for the SSH users client001 and client002 on the SSH
server.
5. Set the SSH server listening port number on the SSH server to prevent attackers from
accessing the SSH service standard port and ensure security.
6. Log in to the SSH server as the client001 and client002 users through STelnet.

Procedure
Step 1 Generate a local key pair on the server.
<HUAWEI> system-view
[~HUAWEI] sysname SSH Server
[*HUAWEI] commit
[~SSH Server] rsa local-key-pair create
The key name will be: SSH Server_Host
The range of public key size is (2048 ~ 2048).
NOTE: Key pair generation will take a short while.

Step 2 Create an SSH user on the server.

NOTE

There are eight authentication modes for an SSH user: password, RSA, password-RSA, DSA, password-
DSA, ECC, password-ECC, and all.

# Configure the VTY user interface.

[*SSH Server] user-interface vty 0 4
[*SSH Server-ui-vty0-4] authentication-mode aaa
[*SSH Server-ui-vty0-4] protocol inbound ssh
[*SSH Server-ui-vty0-4] quit

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 229

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

l Create an SSH user named client001.

# Create an SSH user named client001 and configure the password authentication mode
for the user.
[*SSH Server] aaa
[*SSH Server-aaa] local-user client001 password irreversible-cipher Huawei@123
[*SSH Server-aaa] local-user client001 level 3
[*SSH Server-aaa] local-user client001 service-type ssh
[*SSH Server-aaa] quit
[*SSH Server] ssh user client001
[*SSH Server] ssh user client001 authentication-type password

l Create an SSH user named client002.

# Create an SSH user named client002 and configure the RSA authentication mode for
the user.
[*SSH Server] ssh user client002
[*SSH Server] ssh user client002 authentication-type rsa
[*SSH Server] ssh authorization-type default root
[*SSH Server] commit

# Generate a local key pair for Client002.

<HUAWEI> system-view
[~HUAWEI] sysname client002
[*HUAWEI] commit
[~client002] rsa local-key-pair create
The key name will be: client002_Host
The range of public key size is (2048 ~ 2048).
NOTE: Key pair generation will take a short while.
[*client002] commit

# Check the public key in the RSA key pair generated on the client.
[~client002] display rsa local-key-pair public
======================Host key==========================
Time of key pair created : 2014-03-03 08:56:38
Key name : client002_Host
Key type : RSA encryption key
========================================================
Key code:

3082010A
02820101
00A4BAB8 B964077E F7657F7F E4BE1DE8 71EE1707
E4EE2864 2D06FBE0 BFC1CB52 F99B7A99 0132B709
3F841CA2 3544B8B2 6EE0A9ED 04B19FE3 FB3DA86D
BE68FFE2 2303108D BDC24B80 A1793A08 FDA0B6C1
13C31EA5 298EC9B1 2B0BC8BD 32CFF896 29F8CA98
8B1724AF 5DA8A390 20906ADE 6A8AD77D 6234F0C8
DC965BA0 1771D9C0 A89ED49B 5ECF7EE2 D5997527
FC87FE03 E51658C1 0996DFDF DC456376 2FA4B268
4345131D 431419D2 DD5E4003 6A7D3295 145F3175
22E80686 E6B39A05 799D6BCF A78F69B6 BC2D0836
F5013421 77D68B89 A9EC182A 04B87BE3 500FCE14
9C95CF78 75704359 0C70FD60 1EFC0B99 32F02142
4CE781E4 36A60BFC 2CBD07F6 9E700CEE 4D
0203
010001

Host public key for PEM format code:

---- BEGIN SSH2 PUBLIC KEY ----
AAAAB3NzaC1yc2EAAAADAQABAAABAQCkuri5ZAd+92V/f+S+Hehx7hcH5O4oZC0G
++C/wctS+Zt6mQEytwk/hByiNUS4sm7gqe0EsZ/j+z2obb5o/+IjAxCNvcJLgKF5
Ogj9oLbBE8MepSmOybErC8i9Ms/4lin4ypiLFySvXaijkCCQat5qitd9YjTwyNyW
W6AXcdnAqJ7Um17PfuLVmXUn/If+A+UWWMEJlt/f3EVjdi+ksmhDRRMdQxQZ0t1e
QANqfTKVFF8xdSLoBobms5oFeZ1rz6ePaba8LQg29QE0IXfWi4mp7BgqBLh741AP
zhSclc94dXBDWQxw/WAe/AuZMvAhQkzngeQ2pgv8LL0H9p5wDO5N
---- END SSH2 PUBLIC KEY ----

Public key code for pasting into OpenSSH authorized_keys file:

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 230

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCkuri5ZAd+92V/f+S+Hehx7hcH5O4oZC0G++C/
wctS+Zt6mQEytwk/hByiNUS4sm7gqe0EsZ/j+z2obb5o/
+IjAxCNvcJLgKF5Ogj9oLbBE8MepSmOybErC8i9Ms/
4lin4ypiLFySvXaijkCCQat5qitd9YjTwyNyWW6AXcdnAqJ7Um17PfuLVmXUn/If+A+UWWMEJlt/
f3EVjdi
+ksmhDRRMdQxQZ0t1eQANqfTKVFF8xdSLoBobms5oFeZ1rz6ePaba8LQg29QE0IXfWi4mp7BgqBLh7
41APzhSclc94dXBDWQxw/WAe/AuZMvAhQkzngeQ2pgv8LL0H9p5wDO5N rsa-key

Host public key for SSH1 format code:

2048 65537
207951578566723598485473612698580299492428435858311826691945232273681931049003
464975156406283877999441481175657431905603728398665186508263345707894349677484
217580598190093729334060817838060780955449126599749626192655532498343534107533
323544305478060443118682108915155361063215476748577556785624206276792428389535
386415963031963197355449455867856248244224701824312943027014161231178397535397
111353242333550044093772619909488601542170799462826313639069974340296484981794
888174430354307491156572632525093810706287949592233095399772699929571517497640
61913059943557804219705266011480071185559202342216149175188942626811469

======================Server key========================
Time of key pair created : 2014-03-03 08:56:39
Key name : client002_Server
Key type : RSA encryption key
========================================================
Key code:

3081B9
0281B1
00B9AE42 B8419F19 35C49A7B A55DBB6F 67D931F3
9C19ECF9 9E17961B D01ED5DD 3AE68CFA 38C57113
C93663F2 86768B19 AD0F603E 98F2C6AB A71A6C26
8813411D 4AA56BC4 6505EC15 94647621 AB7D03BB
79DA9B24 09BB1FD2 3927E2F9 00F79116 466411CD
AC3D8FF6 A051FA5A 9BCE84CE 20842134 D2D27B4A
219CB801 9F5A90E0 518DEEFC F48F5ED4 49215B1F
11E1AC81 5E168A97 3AA5320D 7B158556 AF5CC95C
9B508BBC 6EEFEEF9 0E23AA13 59E1F746 D5
0203
010001
# Configure the RSA public key on the SSH server. (Information in bold in the display
command output is the RSA public key. Copy the information to the server.)
[~SSH Server] rsa peer-public-key rsakey001
[*SSH Server-rsa-public-key] public-key-code begin
[*SSH Server-rsa-public-key-rsa-key-code] 3082010A
[*SSH Server-rsa-public-key-rsa-key-code] 2820101
[*SSH Server-rsa-public-key-rsa-key-code] 00A4BAB8 B964077E F7657F7F E4BE1DE8
71EE1707
[*SSH Server-rsa-public-key-rsa-key-code] E4EE2864 2D06FBE0 BFC1CB52 F99B7A99
0132B709
[*SSH Server-rsa-public-key-rsa-key-code] 3F841CA2 3544B8B2 6EE0A9ED 04B19FE3
FB3DA86D
[*SSH Server-rsa-public-key-rsa-key-code] BE68FFE2 2303108D BDC24B80 A1793A08
FDA0B6C1
[*SSH Server-rsa-public-key-rsa-key-code] 13C31EA5 298EC9B1 2B0BC8BD 32CFF896
29F8CA98
[*SSH Server-rsa-public-key-rsa-key-code] 8B1724AF 5DA8A390 20906ADE 6A8AD77D
6234F0C8
[*SSH Server-rsa-public-key-rsa-key-code] DC965BA0 1771D9C0 A89ED49B 5ECF7EE2
D5997527
[*SSH Server-rsa-public-key-rsa-key-code] FC87FE03 E51658C1 0996DFDF DC456376
2FA4B268
[*SSH Server-rsa-public-key-rsa-key-code] 4345131D 431419D2 DD5E4003 6A7D3295
145F3175
[*SSH Server-rsa-public-key-rsa-key-code] 22E80686 E6B39A05 799D6BCF A78F69B6
BC2D0836
[*SSH Server-rsa-public-key-rsa-key-code] F5013421 77D68B89 A9EC182A 04B87BE3
500FCE14
[*SSH Server-rsa-public-key-rsa-key-code] 9C95CF78 75704359 0C70FD60 1EFC0B99
32F02142

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 231

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

[*SSH Server-rsa-public-key-rsa-key-code] 4CE781E4 36A60BFC 2CBD07F6 9E700CEE

4D
[*SSH Server-rsa-public-key-rsa-key-code] 203
[*SSH Server-rsa-public-key-rsa-key-code] 10001
[*SSH Server-rsa-public-key-rsa-key-code] public-key-code end
[*SSH Server-rsa-public-key] peer-public-key end

# Bind the RSA public key of the STelnet client to the SSH user client002 on the SSH
server.
[*SSH Server] ssh user client002 assign rsa-key rsakey001

Step 3 Enable the STelnet service on the SSH server.

# Enable the STelnet service.
[*SSH Server] stelnet server enable

Step 4 Configure the STelnet service type for the client001 and client002 users.
[*SSH Server] ssh user client001 service-type stelnet
[*SSH Server] ssh user client002 service-type stelnet

Step 5 Configure a new listening port number on the SSH server.

[*SSH Server] ssh server port 1025
[*SSH Server] commit

Step 6 Connect the STelnet client to the SSH server.

# Enable the first authentication function on the SSH client upon the first login.
Enable the first authentication function for Client001.
<HUAWEI> system-view
[~HUAWEI] sysname client001
[*HUAWEI] commit
[~client001] ssh client first-time enable
[*client001] commit
[~client001] quit

Enable the first authentication function for Client002.

[~client002] ssh client first-time enable
[*client002] commit
[~client002] quit

# Log in to the SSH server from Client001 in password authentication mode by entering the
user name and password.
<client001> stelnet [Link] 1025
Trying [Link] ...
Press CTRL+K to abort
Connected to [Link] ...
The server's public key does not match the one cached before.
The server is not authenticated. Continue to access it?[Y/N]:y
The keyname:[Link] already exists. Update it? [Y/N]:n

Please input the username: client001

Please select public key type for user authentication [R for RSA/D for DSA/E for
ECC] Please select [R/D/E]:r
Enter password:

Enter the password. The following information indicates that you have logged in successfully:
Warning: The initial password poses security risks.
The password needs to be changed. Change now? [Y/N]:n

Info: The max number of VTY users is 21, the number of current VTY users online
is 4, and total number of terminal users online is 4.
The current login time is 2013-12-31 11:22:06.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 232

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

The last login time is 2013-12-31 10:24:13 from [Link] through SSH.
<SSH Server>

# Log in to the SSH server from Client002 in RSA authentication mode.

<client002> stelnet [Link] 1025
Trying [Link] ...
Press CTRL+K to abort
Connected to [Link] ...
The server's public key does not match the one cached before.
The server is not authenticated. Continue to access it?[Y/N]:y
The keyname:[Link] already exists. Update it? [Y/N]: n

Please input the username: client002

Please select public key type for user authentication [R for RSA/D for DSA/E for
ECC] Please select [R/D/E]:r

Info: The max number of VTY users is 21, the number of current VTY users online
is 4, and total number of terminal users online is 4.
The current login time is 2013-12-31 11:36:06.
<SSH Server>

If the user view is displayed, you have logged in successfully. If the message "Session is
disconnected" is displayed, the login fails.
Step 7 Verify the configuration.
Attackers fail to log in to the SSH server using the default listening port number 22.
<client002> stelnet [Link]
Trying [Link] ...
Press CTRL+K to abort
Error: Failed to connect to the remote host.

Run the display ssh server status commands. You can see that the STelnet service has been
enabled. Run the display ssh user-information command. Information about the configured
SSH users is displayed.
# Check the status of the SSH server.
[~SSH Server] display ssh server status
SSH Version : 2.0
SSH authentication timeout (Seconds) : 60
SSH authentication retries (Times) : 3
SSH server key generating interval (Hours) : 0
SSH version 1.x compatibility : Disable
SSH server keepalive : Enable
SFTP server : Enable
STelnet server : Enable
SNETCONF server : Disable
SNETCONF server port(830) : Enable
SCP server : Disable
SSH server DES : Disable
SSH server port : 1025
ACL name : --
ACL number : --
ACL6 name : --
ACL6 number : --
SSH server source address : [Link]

# Check information about SSH users.

[~SSH Server] display ssh user-information
--------------------------------------------------------------------------------
User Name : client001
Authentication type : password
User public key name : --
User public key type : --
Sftp directory : flash:

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 233

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Service type : stelnet

User Name : client002

Authentication type : rsa
User public key name : --
User public key type : --
Sftp directory : flash:
Service type : stelnet
--------------------------------------------------------------------------------
Total 2, 2 printed

----End

Configuration Files
l SSH server configuration file
#
sysname SSH Server
#
rsa peer-public-key rsakey001
public-key-code begin
3082010A
02820101
00A4BAB8 B964077E F7657F7F E4BE1DE8 71EE1707 E4EE2864 2D06FBE0 BFC1CB52
F99B7A99 0132B709 3F841CA2 3544B8B2 6EE0A9ED 04B19FE3 FB3DA86D BE68FFE2
2303108D BDC24B80 A1793A08 FDA0B6C1 13C31EA5 298EC9B1 2B0BC8BD 32CFF896
29F8CA98 8B1724AF 5DA8A390 20906ADE 6A8AD77D 6234F0C8 DC965BA0 1771D9C0
A89ED49B 5ECF7EE2 D5997527 FC87FE03 E51658C1 0996DFDF DC456376 2FA4B268
4345131D 431419D2 DD5E4003 6A7D3295 145F3175 22E80686 E6B39A05 799D6BCF
A78F69B6 BC2D0836 F5013421 77D68B89 A9EC182A 04B87BE3 500FCE14 9C95CF78
75704359 0C70FD60 1EFC0B99 32F02142 4CE781E4 36A60BFC 2CBD07F6 9E700CEE
4D
0203
010001
public-key-code end
peer-public-key end
#
aaa
local-user client001 password irreversible-cipher $1a$v!=.5/:(q-$xL=\K
+if"'S}>k7vGP5$_ox0B@ys7.'DBHL~3*aN$
local-user client001 service-type ssh
local-user client001 level 3
#
ssh server port 1025
stelnet server enable
ssh user client001
ssh user client001 authentication-type password
ssh user client001 service-type stelnet
ssh user client002
ssh user client002 authentication-type rsa
ssh user client002 assign rsa-key rsakey001
ssh user client002 service-type stelnet
#
user-interface vty 0 4
authentication-mode aaa
protocol inbound ssh
#
return

l Client001 configuration file

#
sysname client001
#
ssh client first-time enable
#
return

l Client002 configuration file

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 234

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

#
sysname client002
#
ssh client first-time enable
#
return

6.5 Common Configuration Errors

This section describes the common configuration errors and isolation methods.

6.5.1 Failing to Log In to the Telnet Server Through Telnet

Fault Description
The Telnet server fails to be logged in through Telnet.

Procedure
Step 1 Check whether the number of users who have logged in to the Telnet server reaches the upper
limit.

Log in to the device through a console port. Run the display users command to check
whether the current VTY channel is completely occupied. By default, a maximum number of
five VTY channels are allowed. You can run the display user-interface maximum-vty
command to check the maximum number of users allowed in the current VTY channel.

If the number of current users has reached the upper limit, run the user-interface maximum-
vty 21 command to increase the maximum number of users allowed in the VTY channel to
21.

Step 2 Check whether an ACL has been configured on the VTY user interface of the device.

Run the user-interface vty command on the Telnet server to display the user interface view.
Run the display this command to check whether an ACL has been configured on the VTY
user interface. If yes, record the ACL number.

Run the display acl acl-number command on the Telnet server to check whether the Telnet
client IP address is denied in the ACL. If yes, run the undo rule rule-id command in the ACL
view to delete the deny rule, and then run the rule permit source source-ip-address soucer-
wildcard command in the ACL view to permit the client IP address.

Step 3 Check the protocol configuration in the VTY user interface view.

Run the user-interface vty command on the Telnet server to display the user interface view.
Run the display this command to check whether protocol inbound on the VTY user
interface is set to telnet or all(By default, the system supports all protocols). If no, run the
protocol inbound { telnet | all } command to enable Telnet users to connect to the device.

Step 4 Check whether login authentication is configured in the VTY user interface view.
l If the password authentication mode for login is configured in the VTY channel using
the authentication-mode password command, you must enter the password upon login.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 235

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

l If the AAA authentication mode is configured using the authentication-mode aaa

command, you must run the local-user user-name password command to create a local
AAA user.

----End

6.5.2 Failing to Log In to the SSH Server Through STelnet

Fault Description
The SSH server fails to be logged in through STelnet.

Procedure
Step 1 Check whether the SSH service is enabled on the SSH server.
Log in to the SSH server through the console port or using Telnet. Run the display ssh server
status command to check the SSH server configuration.
If the STelnet service is disabled, run the stelnet server enable command to enable the
STelnet service on the SSH server.
Step 2 Check the protocol configuration in the VTY user interface view on the SSH server.
Run the user-interface vty command on the SSH server to display the user interface view.
Run the display this command to check whether protocol inbound on the VTY user
interface is set to ssh or all(By default, the system supports all protocols). If no, run the
protocol inbound { ssh | all } command to enable STelnet users to connect to the device.
Step 3 Check whether an SSH user is configured on the SSH server.
Run the display ssh user-information command to view the configuration of the SSH user. If
there is no configuration, run the ssh user, ssh user authentication-type, ssh user service-
type commands in the system view to create an SSH user and configure the SSH user
authentication mode and service type.
Step 4 Check whether the number of users who have logged in to the SSH server reaches the upper
limit.
Log in to the device through a console port. Run the display users command to check
whether the current VTY channel is completely occupied. By default, a maximum number of
five VTY channels are allowed. You can run the display user-interface maximum-vty
command to check the maximum number of users allowed in the current VTY channel.
If the number of current users has reached the upper limit, run the user-interface maximum-
vty 21 command to increase the maximum number of users allowed in the VTY channel to
21.
Step 5 Check whether an ACL is configured on the user interface of the SSH server.
Run the user-interface vty command on the SSH server to display the SSH user interface
view. Run the display this command to check whether an ACL has been configured on the
VTY user interface. If yes, record the ACL number.
Run the display acl acl-number command on the SSH server to check whether the SSH client
IP address is denied in the ACL. If yes, run the undo rule rule-id command in the ACL view
to delete the deny rule, and then run the rule permit source source-ip-address soucer-
wildcard command in the ACL view to permit the client IP address.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 236

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 6 Configuring User Login

Step 6 Check the SSH version on the SSH client and server.
Run the display ssh server status command on the SSH server to check the SSH version.
If the version is SSHv1, run the ssh server compatible-ssh1x enable command to configure
the version compatibility function on the server.
Step 7 Check whether the first authentication function is enabled on the SSH client.
Run the display this command in the system view on the SSH client to check whether the
first authentication function is enabled on the SSH client.
If no, an STelnet user fails to log in to the SSH server for the first time because verifying the
RSA public key on the SSH server fails. Run the ssh client first-time enable command to
enable the first authentication function on the SSH client.

----End

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 237

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

7 File Management

About This Chapter

This chapter provides information about file management. This information includes an
overview, descriptions, and other details related to file management.

7.1 File System Overview

7.2 File Management Modes
7.3 Local File Management
7.4 File Management on Other Devices
7.5 Configuration Examples
7.6 Common Misconfigurations

7.1 File System Overview

File System
The file system manages files and directories on storage media. In the file system, users can
create, delete, modify, and rename a file or a directory, and view contents of a file.

Storage Medium
The device supports the flash memory and USB flash drive.

NOTE

A USB flash drive is mainly used for USB-based deployment or system file loading. The USB flash
drive must use the FAT32 format. Set the format to FAT32 (format the USB flash drive) before using the
USB flash drive.

Naming Rules for Files

l File name
A file resides in the current working directory if the file name is in this format.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 238

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

l Drive + Path + File name

This file name format uniquely identifies files in specified paths.
In this format, drive indicates the storage medium and can be set to flash:.
drive of devices in a stack can be set to:
– flash: root directory of the flash memory of the master switch on a device in a
stack.
– stack ID#flash: root directory of the flash memory in a slot on a device in a stack.
For example, slot2#flash: indicates the flash memory in slot 2.
In the file name, path indicates the directory and subdirectory. The directory name is
case-sensitive. Spaces and the following characters cannot be used in the directory name:
~*/\:'"
Paths are either absolute or relative. The relative path is related to the root directory or
the current working directory. A relative path starting with a slash (/) is related to the
root directory.
– flash:/my/test/ is an absolute path.
– /selftest/ is related to the root directory and indicates the selftest directory in the
root directory.
– selftest/ is related to the current working directory and indicates the selftest
directory in the current working directory.
For example, in the dir flash:/my/test/[Link] command, flash:/my/test/ is an
absolute path.
Run the dir /my/test/[Link] command to find the [Link] file from a directory
related to the root directory.
Run the dir test/[Link] command to find the [Link] file from a directory related
to the current working directory (flash:/my/ for example).
NOTE

l In the file operation command format, filename indicates the file name.
l In the file operation command format, directory indicates the path (drive + path).

File List Information

Run the dir command to view information about files.
<HUAWEI> dir
Directory of flash:/

Idx Attr Size(Byte) Date Time FileName

0 drwx - Mar 03 2013 03:44:28 $_checkpoint
1 -rw- 104,517,153 Mar 02 2013 18:22:18 [Link]
2 drwx - Mar 03 2013 03:42:52 POST
3 -rw- 14 Mar 03 2013 03:45:32 [Link]
4 -rw- 16,781 Mar 03 2013 03:41:39 [Link]
5 drwx - Jan 19 2012 09:54:13 logfile
6 drwx - Feb 27 2013 04:44:53 lost+found
7 -rw- 33,036 Mar 03 2013 03:41:39 [Link]

670,092 KB total (569,904 KB free)

Table 7-1 lists information about files queried through the dir command.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 239

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Table 7-1 File information

Item Description

$_checkpoint Directory for storing configuration rollback

point information.

**.cc Software version file.

POST Directory for storing hardware self-test

information when the system starts.

[Link] System forwarding resource template,

which exists in the user directory after the
forwarding mode is set in the system.

[Link] System hardware configuration file.

logfile Directory for storing log information:

l [Link]: detailed logs of key events and
exceptions
l [Link]: logs of operations and key
events
You can run the display logbuffer
command to view event logs and other logs.

lost+found Directory for storing information about the

damaged file in the file management
module recovered by the system during
abnormal restart.

**.zip/**.cfg/**.dat System configuration file. For details, see

the save command.
The file name extension of compressed log
files is also .zip.
l log_slot ID_time.[Link]: a common log
file that reaches a specified size
l diaglog_slot ID_time.[Link]: a
diagnostic log file that reaches a
specified size
You can run the info-center logfile size
command to set the size of a log file.

*.ztbl File for saving security MAC address

information after port security is configured.

*.cap File for saving captured packets after packet

capture is configured on the device.

*.MOD/*.mod Modules that are not running can be

dynamically loaded to the system using a
file. The file must be uploaded to the
directory flash:/$_install_mod/.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 240

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

7.2 File Management Modes

The device can function as a server or client to manage files.

l When the device functions as a server, you can access the device from a terminal to
manage files on the device and transfer files between the device and the terminal.
l When the device functions as a client, you can use the device to manage files on other
devices and transfer files between the device and other devices.

In Trivial File Transfer Protocol (TFTP) mode, the device can function only as a client. In File
Transfer Protocol (FTP), Secure File Transfer Protocol (SFTP), or Secure Copy Protocol
(SCP) mode, the device can function both as a server and a client.

NOTICE
To ensure high security, do not use the RSA key pair whose length is less than 2048 digits.

Table 7-2 describes the advantages and disadvantages of different file management modes.

Table 7-2 File management modes

Mode Usage Scenario Advantage Disadvantage

In the scenario of
managing directories,
and files, log in to the
You can log in to the Only files on the local
device through the
Device device directly to device can be managed.
console port, Telnet, or
login manage directories and File transfer is not
STelnet. This login
files. supported.
mode is mandatory for
storage medium
management.

l The FTP mode is

easy to configure
and supports file
transfer and
The FTP mode is operations on
applicable to the file directories. In FTP mode, data is
transfer scenario with
l The FTP mode transmitted in plain
FTP low network security
supports file transfer text, causing security
requirements. The FTP
between two file risks.
mode is widely used in
systems.
version upgrade.
l The authorization
and authentication
functions are
provided.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 241

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Mode Usage Scenario Advantage Disadvantage

l In TFTP mode, the

device can function
On the LAN of a lab, only as a client.
the TFTP mode can be l The TFTP mode
used to load or upgrade supports only file
versions online. The Compared with FTP transfer, but does not
TFTP mode is mode, TFTP mode support interaction.
TFTP
applicable to the consumes less memory l In TFTP mode, data
environment without usage. is transmitted in
complicated plain text, causing
interactions between a security risks, and
client and a server. no authorization or
authentication
function is provided.

The SFTP mode is

applicable to the l Data is encrypted
scenario with high and protected.
network security l The SFTP mode Configurations are
SFTP
requirements. The supports file transfer complicated.
SFTP mode is widely and operations on
used in log download directories.
and file backup.

l Data is encrypted
and protected.
The SCP mode is
l In SCP mode, files Configurations are
applicable to the highly-
are uploaded or complicated (similar to
efficient file upload and
SCP downloaded when SFTP configurations),
download scenarios
the client is and interactions are not
with high network
connected to the supported.
security requirements.
server, which is
efficient.

Device login, FTP, and TFTP are easy to learn and configure. The following section describes
the SFTP mode and SCP mode in more detail.

SFTP Mode
As a part of Secure Shell (SSH), the SFTP protocol allows remote users to securely log in to
the device and perform file management and transmission through the security channel
provided by SSH. Therefore, SFTP improves data transmission security. In addition, the
device can function as the SSH client to connect to the remote SSH server for the secure file
transmission.

SSH security features:

l Encrypted transmission: When an SSH connection is set up, two devices negotiate an
encryption algorithm and a session key to ensure secure communications between them.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 242

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

l Public key-based authentication: The device supports the RSA, DSA or ECC
authentication mode.
l Server authentication: The SSH protocol authenticates a server based on the public key
to defend against attacks from bogus servers.
l Interaction data check: The SSH protocol uses the CRC (for SSH1.5) or MD5-based
MAC algorithm (for SSH2.0) to check the data integrity and authenticity. This
mechanism protects the system from man-in-the-middle attacks.

Establishment of an SSH connection:

1. Negotiate the SSH version.

The client and the server negotiate an SSH version by exchanging character strings that
specify the SSH version.
2. Negotiate the algorithm.
The server and the client negotiate the key exchange algorithm, encryption algorithm,
and MAC algorithm for subsequent communications.
3. Exchange keys.
Based on the key exchange algorithm, the server and the client obtain the same session
key and session ID after calculation.
4. Authenticate users.
The client sends an authentication request containing the user identity information to the
server. If the authentication succeeds or expires, the client is disconnected from the
server.
The public key-based and password-based authentication modes are supported.
– In public key-based (RSA, DSA or ECC) authentication mode, the client must
generate the RSA, DSA or ECC key and send it to the server. When a user initiates
an authentication request, the client randomly generates a text that is encrypted with
the private key and sends it to the server. The server decrypts the text by using the
public key. If decryption succeeds, the server considers this user trusted and grants
this user access rights. If decryption fails, the client is disconnected from the server.
– Password-based authentication is implemented by the Authentication, Authorization
and Accounting (AAA). Similar to Telnet and FTP, SSH supports local database
authentication and remote RADIUS server authentication. The SSH server
compares the user name and password of an SSH client with the preset ones.
Authentication succeeds if both match.
5. Request a session.
After user authentication is complete, the client sends a session request to the server.
After receiving the request, the server processes it.
6. Enter the interactive session.
After the session request is accepted, the SSH connection enters the interactive session
mode. In this mode, data is transmitted bidirectionally.

NOTE

Before an SSH connection is set up, the local key pair (RSA, DSA or ECC key pair) must be generated
on the server. The key pair is used to generate the session key and session ID and authenticate the server.
This step is the key to SSH server configuration.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 243

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

SCP Mode
Based on the SSH remote file copy function, SCP is used to copy, upload, and download files.
SCP commands are easy to use, improving network maintenance efficiency.

7.3 Local File Management

Context

NOTICE
When downloading files to the device or performing other operations on the device, ensure
that the power supply of the device is working properly; otherwise, the downloaded file or the
file system may be damaged. As a result, the storage medium on the device may be damaged
or the device cannot be properly started.

7.3.1 Logging In to the Device to Manage Files

Pre-configuration Tasks
Before logging in to the device to manage files, complete the following tasks:

l Ensuring that routes are reachable between the terminal and the device
l Ensuring that a user have logged in to the device using a terminal

Configuration Process
After a user logs in to the device on a terminal, the user can perform operations on storage
media, directories, and files.

Users can perform the following operations in any sequence.

Procedure
l Perform operations on directories.

Table 7-3 Performing operations on directories

Operation Command Description

Display the current

pwd -
directory.

Change the current

cd [ directory ] -
directory.

Display files and

dir [ /all ] [ filename |
subdirectories in a -
directory | /all-filesystems ]
specified directory.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 244

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

Create a directory. mkdir directory -

l The directory to be
deleted must be empty.
Delete a directory. rmdir directory l A deleted directory and
its files cannot be restored
from the recycle bin.

l Perform operations on files.

Table 7-4 Performing operations on files

Operation Command Description

To view the content on the

Display the file last specified lines, run the
more filename [ offset ]
content. tail file-name [ line ]
command.

l Before copying a file,

ensure that the storage
space is sufficient for the
file.
copy source-filename
Copy a file. l If the target file has the
destination-filename [ all ]
same name as an existing
file, the system prompts
you whether to overwrite
the existing file.

If the target file has the same

move source-filename name as an existing file, the
Move a file.
destination-filename system prompts you whether
to overwrite the existing file.

Rename a file. rename old-name new-name -

zip source-filename
Compress a file. -
destination-filename

unzip source-filename
Decompress a file. -
destination-filename

This command cannot delete

delete [ /unreserved ] [ / a directory.
Delete a file. quiet ] { filename | NOTICE
devicename } [ all ] In this command, /unreserved
indicates that the file cannot be
restored.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 245

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

If you run the delete

command without the /
unreserved keyword, the file
undelete { filename |
Restore a file. is moved to the recycle bin.
devicename }
You can run this command to
restore the files in the recycle
bin.

To delete a file permanently,

Remove a file from reset recycle-bin [ /f |
remove the file from the
the recycle bin. filename | devicename ]
recycle bin.

Enter the system To perform multiple

system-view
view. operations at one time, run
the execute batch-filename
Execute batch files or command in the system view.
execute batch-filename The batch files must be
VRP Shell Languages
[ parameter &<1-8> ] stored in the storage medium
(VSL) scripts.
first.

----End

7.3.2 Managing Files When the Device Functions as an FTP Server

Users can connect the local terminal to a remote device to manage files using FTP. FTP is
widely used for file service operations such as version upgrade.

Pre-configuration Tasks
Before connecting to the FTP server to manage files, complete the following tasks:
l Ensuring that routes are reachable between the terminal and the device.
l Ensuring that the terminal functions as the FTP client.

Configuration Process

NOTICE
The FTP protocol will bring risk to device security. The SFTPv2 or SCP mode is
recommended.

Table 7-5 describes the procedure for managing files when the device functions as an FTP
server. The 1, 2, 3 steps can be performed in any sequence.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 246

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Table 7-5 Managing files when the device functions as an FTP server
No. Task Description

Configure FTP server parameters

1 Set FTP server parameters including the port number, source
address, and timeout duration.

Configure local FTP user

Configure local FTP user information including the service
2
information type, user level, and authorized
directory.

Configure the ACL rule and FTP

3 (Optional) Configure the FTP ACL basic ACL to improve FTP access
security.

Connect to the device using FTP

4 Connect to the device using FTP
from the terminal.

Default Parameter Settings

Table 7-6 Default parameter settings

Parameter Default Value

FTP server function Disabled

Listening port number 21

FTP user No local user is created.

Procedure
l Set FTP server parameters.

Table 7-7 Setting FTP server parameters

Operation Command Description

Enter the system

system-view -
view.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 247

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

The default port number is 21.

If a new port number is
configured, the FTP server
(Optional) Specify disconnects from all FTP clients
ftp [ ipv6 ] server port
a port number for and uses the new port number to
port-number
the FTP server. listen to connection requests.
Attackers do not know the port
number and cannot access the
listening port of the FTP server.

Enable the FTP By default, the FTP server

ftp [ ipv6 ] server enable
server function. function is disabled.

After the source address of the

FTP server is configured,
incoming and outgoing packets
(Optional) ftp server source { -a are filtered, ensuring the device
Configure the source-ip-address | -i security.
source address of interface-type interface-
the FTP server. number } After the source address of the
FTP server is configured, you
must enter the source address to
log in to the FTP server.

By default, the idle timeout

duration is 30 minutes.
(Optional)
Configure the ftp [ ipv6 ] server timeout During the timeout duration, if
timeout duration of minutes no operation is performed on the
the FTP server. FTP server, the FTP client
disconnects from the FTP server
automatically.

Submit the
commit -
configurations.

NOTE

l If the FTP service is enabled, the port number of the FTP service cannot be changed. To
change the port number, run the undo ftp [ ipv6 ] server command to disable the FTP service
first.
l After operations on files are complete, run the undo ftp [ ipv6 ] server command to disable
the FTP server function to ensure the device security.
l Configure local FTP user information.
Before performing operations on files using FTP, configure the local user name and
password, service type, and authorized directory on the FTP server.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 248

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Table 7-8 Configuring local FTP user information

Operation Command Description

Enter the system

system-view -
view.

Enter the AAA

aaa -
view.

local-user user-name
Configure the local
password irreversible-
user name and -
cipher irreversible-cipher-
password.
password
NOTE
You must set the local user level
Configure the local local-user user-name level
to the administrator level (3 or
user level. level 15). Otherwise, the FTP
connection cannot be established.

Configure the
local-user user-name service- By default, a local user can use
service type for
type ftp any access type.
local users.

By default, the FTP directory

of a local user is empty.
When multiple FTP users use
the same authorized directory,
you can use the ftp server
Configure an default-directory directory
local-user user-name ftp- command to configure a
authorized
directory directory default directory for these FTP
directory.
users. In this case, you do not
need run the local-user user-
name ftp-directory directory
command to configure an
authorized directory for each
user.

Submit the
commit -
configurations.

l (Optional) Configure an ACL for the FTP server.

An ACL is composed of a list of rules such as the source address, destination address,
and port number of packets. ACL rules are used to classify packets. After these rules are
applied to routing devices, the routing devices determine the packets to be received and
rejected.
Users can configure a basic ACL to allow only specified clients to connect to the FTP
server.
The ACL rules are as follows:
– When permit is used in the ACL rule, devices that match the ACL rule can
establish FTP connections with the local device.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 249

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

– When deny is used in the ACL rule, devices that match the ACL rule cannot
establish FTP connections with the local device.
– When the ACL rule is configured but packets from devices do not match the rule,
other devices cannot establish FTP connections with the local device.
– When the ACL contains no rule, any device can establish FTP connections with the
local device.

Table 7-9 (Optional) Configuring an ACL for the FTP server

Operation Command Description

Enter the system

system-view -
view.

acl { [ number ] acl-number |

Enter the ACL view. -
name acl-name }

rule [ rule-id ] { deny |

permit } [ fragment-type
fragment | source { source-ip-
Configure the ACL address { source-wildcard | 0 |
-
rule. src-netmask } | any } | time-
range time-name | vpn-
instance vpn-instance-name |
logging ] *

Return to the system

quit -
view.

Configure a basic
ftp [ ipv6 ] server acl { acl-
ACL for the FTP -
number | acl-name }
server.

Submit the
commit -
configurations.

l Connect to the device using FTP.

Users can use the Windows CLI or third-party software to connect to the device from a
terminal using FTP. The following describes how to connect to the device using
commands in the Windows CLI:

– Run the ftp ip-address command to connect to the device using FTP.
In the preceding command, ip-address indicates the IP address configured on the
device. Routes between the terminal and the device are reachable.
– Enter the user name and password as prompted and press Enter. If command
prompt ftp> is displayed in the FTP client view, the user accesses the working
directory on the FTP server. (The following information is only for reference.)
C:\Windows\System32> ftp [Link]
Connected to [Link].
220 FTP service ready.
User([Link]:(none)):huawei
331 Password required for huawei.
Password:

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 250

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

230 User logged in.

ftp>

l Run FTP commands to perform file-related operations.

After connecting to the FTP server, users can run FTP commands to perform file-related
operations including performing operations on directories and files, configuring the file
transfer mode, and viewing the online help about FTP commands.

NOTE

User rights are configured on the FTP server.

Users can perform the following operations in any sequence.

Table 7-10 Running FTP commands to perform file-related operations

Operation Command Description

Change the
working directory cd remote-directory -
on the server.

Change the -
current working
cdup
directory to its
parent directory.

Display the -
working directory pwd
on the server.

The lcd command displays the

Display or change local working directory on the
the local working lcd [ local-directory ] client, and the pwd command
directory. displays the working directory on
the remote server.

The directory name can consist of

Create a directory letters and digits. The following
mkdir remote-directory
on the server. special characters are not
supported: < > ? \ :

Delete a directory
rmdir remote-directory -
from the server.

l The ls command displays only

the directory or file name, and
the dir command displays
Display detailed directory or file
information about information such as name, size,
dir/ls [ remote-filename and date when the directory or
the specified
[ local-filename ] ] file is created.
directory or file
on the server. l If no directory is specified in
the command, the system
searches for the file in user's
authorized directories.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 251

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

Delete a file from

delete remote-filename -
the server.

put local-filename l To upload a file, run the put

Upload one or [ remote-filename ] command.
more files. Or l To upload multiple files, run
mput local-filenames the mput command.

get remote-filename l To download a file, run the get

Download one or [ local-filename ] command.
more files. Or l To download multiple files, run
mget remote-filenames the mget command.

Set the file Select one of them.

transfer mode to ascii l The default file transfer mode
ASCII. is ASCII.
l The ASCII mode is used to
Set the file transfer text files, and the
transfer mode to binary binary mode is used to transfer
Binary. programs, system software, and
database files.

Set the data

transmission passive
mode to passive. Select one of them.
The default data transmission
Set the data undo passive mode is active.
transmission
mode to active.

View the online

help about FTP remotehelp [ command ] -
commands.

Enable the system By default, the prompt function is

prompt
prompt function. disabled.

After the verbose function is

Enable the enabled, all FTP response
verbose
verbose function. messages are displayed on the FTP
client.

l (Optional) Change the login user.

The current user can switch to another user in the FTP client view. The new FTP
connection is the same as that established by running the ftp command.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 252

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

When the login user is

switched to another user,
Change the current user in
user user-name the original user is
the FTP client view.
disconnected from the FTP
server.

l Disconnect the FTP client from the FTP server.

Users can run different commands in the FTP client view to disconnect the FTP client
from the FTP server.

Operation Command Description

Disconnect the FTP

client from the FTP
bye or quit
server and return to the
user view.
Select one of them.
Disconnect the FTP
client from the FTP
close or disconnect
server and retains the
FTP client view.

----End

Checking the Configuration

l Run the display ftp server command to check the FTP server configuration and status.
l Run the display ftp server users command to view information about the FTP users
who log in to the FTP server.

7.3.3 Managing Files When the Device Functions as an SFTP

Server
SFTP allows a terminal to connect to the remote device using SSH and ensures the data
transmission security.

Pre-configuration Tasks
Before connecting to the SFTP server to manage files, complete the following tasks:
l Ensuring that routes are reachable between the terminal and the device
l Ensuring that the SSH client software has been installed on the terminal

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 253

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Configuration Process

NOTICE
l The SFTPv1 protocol will bring risk to device security. The SFTPv2 mode is
recommended.
l To ensure high security, do not use the RSA key pair whose length is less than 2048 digits.

Table 7-11 describes the procedure for managing files when the device functions as an SFTP
server.

Table 7-11 Managing files when the device functions as an SFTP server
No. Task Description Remarks

1 Generate local key pair,

enable the SFTP server, and
configure SFTP server
parameters, including the
Set SFTP server
port number, key pair
parameters
updating time, SSH The two steps can be
authentication timeout performed in any
duration, and number of sequence.
SSH authentication retries.

2 Create an SSH user and set

Configure SSH user the service type, authorized
information directory, and authentication
mode on the SFTP server.

3 Connect to the device using -

Connect to the device
the SSH client software on
using SFTP
the terminal.

Default Parameter Settings

Table 7-12 Default parameter settings

Parameter Default Value

SFTP server function Disabled

Listening port number 22

0, indicating the key pair of the server is

Time for updating the key pair of the server
never updated

SSH authentication timeout duration 60 seconds

Number of SSH authentication retries 3

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 254

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Parameter Default Value

SSH user No SSH user is created.

Type of service for SSH users No service type is supported.

By default, the authorized directory of the

Authorized directory for SSH users SFTP service for the SSH user is not
configured.

Procedure
l Set SFTP server parameters.

Table 7-13 Setting SFTP server parameters

Operation Command Description

Enter the system view. system-view -

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 255

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

Method 1:
Run the rsa local-key-
pair create, dsa local-
key-pair create, or ecc
local-key-pair create
command to generate a
local RSA, DSA, or In method 1:
ECC key pair. After the key pair is generated,
Method 2: you can run the display rsa
local-key-pair public, display
1. Run the rsa key-pair dsa local-key-pair public, or
label label-name display ecc local-key-pair
[ modulus modulus- public command to view the
bits ], dsa key-pair public key in the local RSA,
label label-name DSA, or ECC key pair.
[ modulus modulus- In method 2:
bits ], or ecc key-
Generate a local key pair label label- After the key pair is generated,
pair. name [ modulus you can run the display rsa key-
modulus-bits ] pair [ brief | label label-name ],
command to generate display dsa key-pair [ brief |
an RSA, a DSA, or label label-name ], or display
an ECC key pair ecc key-pair [ brief | label label-
with a specific label name ] command to view the
name. RSA, DSA, or ECC key pair
with a specific label.
2. Run the ssh server
NOTE
assign { rsa-host- Because a longer key pair provides
key | dsa-host-key | higher security, you are advised to
ecc-host-key } label- use key pairs of the largest length.
name command to
assign the generated
RSA host key, RSA
server key, DSA host
key, or ECC host key
to the SSH server.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 256

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

NOTE
l The device can
generate a maximum
of 20 key pairs in
method 2. You can use
different key pairs in
different periods to
ensure higher
communication
security. The
maximum number of
key pairs the device
can generate is
specified by the rsa
key-pair maximum,
dsa key-pair
maximum, and ecc
key-pair maximum
commands.
l You can also run the
rsa key-pair label
load private private-
key public public-key
or dsa key-pair label
load private private-
key public public-key
command to load the
local RSA or DSA
key pair file to the
server.

Enable the SFTP By default, the SFTP server

sftp server enable
server function. function is disabled.

ssh server key-

exchange{ dh_group14
_sha1 |
dh_group1_sha1 |
dh_group_exchange_s
(Optional) Set the key By default, an SSH server
ha1 |
exchange algorithm supports all key exchange
dh_group_exchange_s
list of the SSH server. algorithms.
ha256 |
ecdh_sha2_nistp256 |
ecdh_sha2_nistp384 |
ecdh_sha2_nistp521 |
sm2_kep } *

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 257

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

By default, an SSH server

supports encryption algorithms
ssh server cipher AES256_CTR and
{ des_cbc | 3des_cbc | AES128_CTR when the device
aes128_cbc | starts with no configuration.
(Optional) Set the
aes256_cbc | When the device starts with
encryption algorithm
aes128_ctr | aes256_ctr configuration, an SSH server
list of the SSH server.
| arcfour128 | supports encryption algorithms
arcfour256 | 3DES_CBC, AES128_CBC,
blowfish_cbc } * AES256_CBC, AES128_CTR,
AES256_CTR, Arcfour128 and
Arcfour256.

By default, an SSH server

supports HMAC algorithms
sha2_256_96, sha2_256 and
(Optional) Set the ssh server hmac { md5 sha1_96 when the device starts
HMAC authentication | md5_96 | sha1 | with no configuration. When the
algorithm list of the sha1_96 | sha2_256 | device starts with configuration,
SSH server. sha2_256_96 } * an SSH server supports HMAC
algorithms MD5, MD5_96,
SHA1, SHA1_96, SHA2_256,
and SHA2_256_96.

By default, the listening port

number is 22.
If a new port number is
(Optional) Configure configured, the SSH server
ssh server port port- disconnects from all SSH clients
the listening port
number and uses the new port number to
number.
listen to connection requests.
Attackers do not know the port
number and cannot access the
listening port of the SSH server.

By default, the interval for

updating the key pair is 0. The
value 0 indicates that the key pair
(Optional) Configure is never updated.
the interval for ssh server rekey- After the interval for updating
updating the key pair interval hours the SSH server key pair is set
of the server. using this command, the system
will automatically update the key
pair at intervals, which ensures
security.

(Optional) Configure By default, the SSH

ssh server timeout
the SSH authentication authentication timeout duration is
seconds
timeout duration. 60 seconds.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 258

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

(Optional) Configure ssh server

By default, the number of SSH
the number of SSH authentication-retries
authentication retries is 3.
authentication retries. times

(Optional) Enable By default, the server's

ssh server compatible-
earlier versions to be compatibility with earlier
ssh1x enable
compatible. versions is disabled.

By default, no ACL is configured

for the SSH server.
ssh [ ipv6 ] server acl
(Optional) Configure An ACL is configured to
{ acl-number | acl-
an ACL. determine which clients can log
name }
in to the current device through
SSH.

By default, the keepalive

function is enabled on the SSH
server.
After the keepalive function is
enabled on the SSH server, the
(Optional) Enable the server responds to keepalive
undo ssh server packets received from the SSH
keepalive function on
keepalive disable client. If the keepalive function is
the SSH server.
disabled on the SSH server, the
server will disconnect from the
SSH client when there is no data
exchange, which causes server
resource waste due to
reconnections.

By default, the source interface

of an SSH server is not specified.
NOTE
(Optional) Configure ssh server-source -i Before running this command to
the source IP address interface-type interface- specify the source interface, ensure
of the SSH server. number that the physical interface exists on
the device or the logical interface
has been created successfully;
otherwise, this command cannot be
run successfully.

By default, a maximum of five

clients can connect to the SSH
(Optional) Configure server.
the maximum number
sftp max-sessions max- If the maximum number is
of clients that can
session-count changed to a value smaller than
connect to the SSH
server. the number of login users, login
users' connections retain, but
new access requests are rejected.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 259

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

The default idle timeout period is

(Optional) Configure 10 minutes.
the idle timeout period You can run the sftp idle-
sftp idle-timeout
for disconnecting an timeout 0 0 command to disable
minutes [ seconds ]
SFTP client from the the function of disconnecting the
SFTP server. client from the SFTP server in
case of timeout.

Submit the
commit -
configurations.

– When the local RSA key pair is generated, two key pairs (a server key pair and a
host key pair) are generated at the same time. Each key pair contains a public key
and a private key. The length of the two key pairs ranges from 512 bits to 2048 bits.
The default length is 2048 bits.
– When the local DSA key pair is generated, only the host key pair is generated. The
length of the host key pair can be 512, 1024, or 2048 bits. The default length is
2048 bits.
– When the local ECC key pair is generated, only the host key pair is generated. The
length of the host key pair can be 256, 384, or 521 bits. The default length is 521
bits.
l Configure SSH user information.
Configure SSH user information including the authentication mode. Authentication
modes including RSA, password, password-rsa, DSA, password-dsa, ECC, password-
ecc, and all are supported.
– The password-rsa authentication mode consists of the password and RSA
authentication modes.
– The password-dsa authentication mode consists of the password and DSA
authentication modes.
– The password-ecc authentication mode consists of the password and ECC
authentication modes.
– The all authentication mode indicates that SSH users only need to authenticated by
DSA, ECC, password, or RSA.

Table 7-14 Configuring SSH user information

Operation Command Description

Enter the system

system-view -
view.

Create SSH users. ssh user user-name -

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 260

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

If SSH users are not created

using the ssh user command,
directly run the ssh
ssh user user-name authentication-type default
authentication-type password command to
Configure the
{ password | rsa | configure the default
authentication mode
password-rsa | all | dsa | password authentication mode
for SSH users.
password-dsa | ecc | for users. This mode
password-ecc } simplifies the configurations
when a large number of users
exist, because you need to
configure only AAA users.

Set the service type

ssh user user-name service- By default, the service type of
to SFTP or all for
type { sftp | all } SSH users is empty.
SSH users.

Configure the By default, the authorized

ssh user user-name sftp-
authorized directory directory of SSH users on the
directory directoryname
for SSH users. SFTP server is flash:.

Submit the
commit -
configurations.

– The password authentication mode is implemented based on the AAA. To log in to

the device in the password-dsa, password-ecc, password, or password-rsa
authentication mode, create a local user with the same user name in the AAA view.
– If the SSH user uses the password authentication mode, only the SSH server needs
to generate the RSA, DSA, or ECC key. If the SSH user uses the RSA, DSA, or
ECC authentication mode, both the SSH server and client need to generate the RSA,
DSA, or ECC key and configure the public key of the peer end locally.
Perform any of the following configurations according to authentication mode:
– To configure password authentication for the SSH user, see Table 7-15.
– To configure RSA, DSA, or ECC authentication for the SSH user, see Table 7-16.
– To configure password-RSA, password-dsa, or password-ecc authentication for the
SSH user, configure an AAA user and set the RSA, DSA, or ECC public key. For
details, see Table 7-15 and Table 7-16.

Table 7-15 Configuring password, password-dsa, password-ecc, or password-rsa

authentication for the SSH user
Operation Command Description

Enter the system view. system-view -

Enter the AAA view. aaa -

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 261

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

local-user user-name
Configure the local user password irreversible-
-
name and password. cipher irreversible-cipher-
password

Configure the service type local-user user-name

-
for the local user. service-type ssh

Configure the level for the local-user user-name level

-
local user. level

Return to the system view. quit -

Commit the
commit -
configurations.

NOTE

The level for the local user must be set to 3 or higher to ensure successful connection
establishment.

Table 7-16 Configuring DSA, ECC, RSA, password-dsa, password-ecc, or password-rsa

authentication for the SSH user
Operation Command Description

Enter the system view. system-view -

By default, the
authentication type for the
SSH connection is AAA.
When the authentication
type is AAA, only the
password authentication
mode can be configured. If
the public key
authentication mode is
Configure the used, perform either of the
ssh authorization-type following operations to
authentication type for the
default root implement successful
SSH connection.
login of the SSH user:
l Run this command to
set the authentication
type for the SSH
connection to root.
l In the AAA view,
create a local user with
the same name as the
SSH user.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 262

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

rsa peer-public-key key-

name [ encoding-type
{ der | openssh | pem } ]
or
Display the RSA, DSA, or dsa peer-public-key key-
-
ECC public key view. name encoding-type { der
| openssh | pem }
or
ecc peer-public-key key-
name

Display the public key

public-key-code begin -
editing view.

l The public key must be

a hexadecimal
character string in the
public key encoding
format, and generated
by the client software
that supports SSH. For
Edit the public key. hex-data detailed operations, see
the SSH client software
help.
l You must enter the
RSA, DSA, or ECC
public key on the
device that works as
the SSH server.

l If no key public code

hex-data is entered, the
public key cannot be
generated after you run
this command.
l If the specified key
Exit the public key editing key-name has been
public-key-code end deleted in another view,
view.
the system displays a
message indicating that
the key does not exist
and returns to the
system view directly
when you run this
command.

Return to the system view

peer-public-key end -
from the public key view.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 263

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

Assign an RSA, DSA, or ssh user user-name assign

ECC public key to an SSH { rsa-key | dsa-key | ecc- -
user. key } key-name

Commit the
commit -
configurations.

l Connect to the device using SFTP.

The SSH client software supporting SFTP must be installed on the terminal to ensure
that the terminal can connect to the device using SFTP to manage files. The following
describes how to connect to the device using the OpenSSH and the Windows CLI.

– For details how to install the OpenSSH, see the OpenSSH installation description.
– To use the OpenSSH to connect to the device using SFTP, run the OpenSSH
commands. For details about OpenSSH commands, see OpenSSH help.
– Windows command prompt can identify commands supported by the OpenSSH
only when the OpenSSH is installed on the terminal.

Access the Windows CLI and run the commands supported by the OpenSSH to connect
to the device using SFTP to manage files.

If command prompt sftp> is displayed in the SFTP client view, the user accesses the
working directory on the SFTP server. (The following information is only for reference.)
C:/Documents and Settings/Administrator> sftp client001@[Link]
Connecting to [Link]...
The authenticity of host "[Link] ([Link])" can't be established.
DSA key fingerprint is 0d:48:82:fd:2f:52:1c:f0:c4:22:70:80:8f:7b:fd:78.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added "[Link]" (DSA) to the list of known hosts.
client001@[Link]'s password:
sftp>

l Run SFTP commands to perform file-related operations.

In the SFTP client view, you can perform one or more file-related operations listed in
Table 7-17 in any sequence.

Table 7-17 Running SFTP commands to perform file-related operations

Operation Command Description

Change the user's

current working cd [ remote-directory ] -
directory.

Change the current

working directory to its cdup -
parent directory.

Display the user's

current working pwd -
directory.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 264

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

Display the file list in a dir/ls [ -l | -a ] [ remote- Outputs of the dir and ls
specified directory. directory ] commands are the same.

A maximum of 10
directories can be deleted at
one time.
Delete directories from rmdir remote-directory Before running the rmdir
the server. &<1-10> command to delete
directories, ensure that the
directories do not contain
any files. Otherwise, the
deletion fails.

Create a directory on
mkdir remote-directory -
the server.

Change the name of a

specified file on the rename old-name new-name -
server.

Download a file from get remote-filename [ local-

-
the remote server. filename ]

Upload a local file to put local-filename [ remote-

-
the remote server. filename ]

A maximum of 10 files can

Delete files from the remove remote-filename be deleted at one time.
server. &<1-10> remove and delete have the
same effect.

View the help about

help [ command-name ] -
SFTP commands.

l Disconnect the SFTP client from the SSH server.

Operation Command Description

The bye or exit command

Disconnect the SFTP
quit can also disconnect the
client from the SSH server.
SFTP client.

----End

Checking the Configurations

l Run the display ssh user-information [ username ] command to view SSH user
information on the SSH server.
l Run the display ssh server status command to view global configuration of the SSH
server.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 265

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

l Run the display ssh server session command to view session information of the SSH
client on the SSH server.

7.3.4 Managing Files When the Device Functions as an SCP Server

SCP allows a user terminal to upload or download files while connecting to the SCP server
based on SSH.

Pre-configuration Tasks
Before connecting to the SCP server to manage files, complete the following tasks:

l Ensuring that routes are reachable between the terminal and the device
l Ensuring that the SSH client software supporting SCP has been installed on the terminal

NOTICE
To ensure high security, do not use the RSA key pair whose length is less than 2048 digits.

Configuration Process
Table 7-18 describes the procedure for managing files when the device functions as an SCP
server.

Table 7-18 Managing files when the device functions as an SCP server

No. Task Description Remarks

1 Generate local key pair,

enable the SCP server, and
configure SCP server
parameters, including the
Set SCP server
listening port number, key
parameters
pair updating time, SSH Steps 1 and 2 can be
authentication timeout performed in any
duration, and number of sequence.
SSH authentication retries.

2 Create SSH users and set the

Configure SSH user authentication mode and
information service type on the SCP
server.

3 Manage files when the —

Upload and download files
device functions as an
on the SCP client.
SCP server

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 266

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Default Parameter Settings

Table 7-19 Default parameter settings

Parameter Default Value

SCP server function Disabled

Listening port number 22

Time for updating the key pair of the server 0, indicating the key pair of the server is
never updated

SSH authentication timeout duration 60 seconds

Number of SSH authentication retries 3

SSH user No SSH user is created.

Type of service for SSH users No service type is supported.

Procedure
l Set SCP server parameters.

Table 7-20 Setting SCP server parameters

Operation Command Description

Enter the system

system-view -
view.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 267

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

Generate a local key Method 1: In method 1:

pair. Run the rsa local-key- After the key pair is generated, you
pair create, dsa local- can run the display rsa local-key-
key-pair create, or ecc pair public, display dsa local-
local-key-pair create key-pair public, or display ecc
command to generate a local-key-pair public command to
local RSA, DSA, or ECC view the public key in the local
key pair. RSA, DSA, or ECC key pair.
Method 2: In method 2:
1. Run the rsa key-pair After the key pair is generated, you
label label-name can run the display rsa key-pair
[ modulus modulus- [ brief | label label-name ],
bits ], dsa key-pair display dsa key-pair [ brief |
label label-name label label-name ], or display ecc
[ modulus modulus- key-pair [ brief | label label-
bits ], or ecc key-pair name ] command to view the RSA,
label label-name DSA, or ECC key pair with a
[ modulus modulus- specific label.
bits ] command to NOTE
generate an RSA, a Because a longer key pair provides
higher security, you are advised to use
DSA, or an ECC key
key pairs of the largest length.
pair with a specific
label name.
2. Run the ssh server
assign { rsa-host-key
| dsa-host-key | ecc-
host-key } label-
name command to
assign the generated
RSA host key, RSA
server key, DSA host
key, or ECC host key
to the SSH server.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 268

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

NOTE
l The device can
generate a maximum
of 20 key pairs in
method 2. You can use
different key pairs in
different periods to
ensure higher
communication
security. The
maximum number of
key pairs the device
can generate is
specified by the rsa
key-pair maximum,
dsa key-pair
maximum, and ecc
key-pair maximum
commands.
l You can also run the
rsa key-pair label
load private private-
key public public-key
or dsa key-pair label
load private private-
key public public-key
command to load the
local RSA or DSA key
pair file to the server.

Enable the SCP By default, the SCP server function

scp server enable
server function. is disabled.

ssh server key-

exchange
{ dh_group14_sha1 |
dh_group1_sha1 |
(Optional) Set the dh_group_exchange_sh
key exchange a1 | By default, an SSH server supports
algorithm list of the dh_group_exchange_sh all key exchange algorithms.
SSH server. a256 |
ecdh_sha2_nistp256 |
ecdh_sha2_nistp384 |
ecdh_sha2_nistp521 |
sm2_kep } *

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 269

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

By default, an SSH server supports

encryption algorithms
ssh server cipher AES256_CTR and AES128_CTR
{ des_cbc | 3des_cbc | when the device starts with no
(Optional) Set the
aes128_cbc | configuration. When the device
encryption
aes256_cbc | aes128_ctr starts with configuration, an SSH
algorithm list of the
| aes256_ctr | server supports encryption
SSH server.
arcfour128 | arcfour256 algorithms 3DES_CBC,
| blowfish_cbc } * AES128_CBC, AES256_CBC,
AES128_CTR, AES256_CTR,
Arcfour128 and Arcfour256.

By default, an SSH server supports

HMAC algorithms sha2_256_96,
(Optional) Set the sha2_256 and sha1_96 when the
ssh server hmac { md5 |
HMAC device starts with no configuration.
md5_96 | sha1 | sha1_96
authentication When the device starts with
| sha2_256 |
algorithm list of the configuration, an SSH server
sha2_256_96 } *
SSH server. supports HMAC algorithms MD5,
MD5_96, SHA1, SHA1_96,
SHA2_256, and SHA2_256_96.

(Optional) Set the

maximum number
By default, a maximum of two
of SCP clients scp max-sessions max-
SCP clients are allowed to connect
allowed to connect session-count
to an SCP server concurrently.
to a SCP server
concurrently.

By default, the listening port

number is 22.
If a new port number is configured,
(Optional) the SSH server disconnects from
Configure the ssh server port port- all SSH clients and uses the new
listening port number port number to listen to connection
number. requests. Attackers do not know
the port number and cannot access
the listening port of the SSH
server.

By default, the interval for

updating the key pair is 0. The
(Optional) value 0 indicates that the key pair
Configure the is never updated.
ssh server rekey-
interval for updating After the interval for updating the
interval hours
the key pair of the SSH server key pair is set using
server. this command, the system will
automatically update the key pair
at intervals, which ensures security.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 270

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

(Optional)
Configure the SSH ssh server timeout By default, the SSH authentication
authentication seconds timeout duration is 60 seconds.
timeout duration.

(Optional)
Configure the ssh server
By default, the number of SSH
number of SSH authentication-retries
authentication retries is 3.
authentication times
retries.

(Optional) Enable By default, the server's

ssh server compatible-
earlier versions to compatibility with earlier versions
ssh1x enable
be compatible. is disabled.

By default, no ACL is configured

ssh [ ipv6 ] server acl for the SSH server.
(Optional)
{ acl-number | acl- An ACL is configured to
Configure an ACL.
name } determine which clients can log in
to the current device through SSH.

By default, the keepalive function

is enabled on the SSH server.
After the keepalive function is
enabled on the SSH server, the
(Optional) Enable server responds to keepalive
the keepalive undo ssh server packets received from the SSH
function on the SSH keepalive disable client. If the keepalive function is
server. disabled on the SSH server, the
server will disconnect from the
SSH client when there is no data
exchange, which causes server
resource waste due to
reconnections.

By default, the source interface of

an SSH server is not specified.
NOTE
(Optional)
ssh server-source -i Before running this command to
Configure the specify the source interface, ensure
interface-type interface-
source IP address of that the physical interface exists on the
number
the SSH server. device or the logical interface has
been created successfully; otherwise,
this command cannot be run
successfully.

Submit the
commit -
configurations.

– When the local RSA key pair is generated, two key pairs (a server key pair and a
host key pair) are generated at the same time. Each key pair contains a public key

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 271

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

and a private key. The length of the two key pairs ranges from 512 bits to 2048 bits.
The default length is 2048 bits.
– When the local DSA key pair is generated, only the host key pair is generated. The
length of the host key pair can be 512, 1024, or 2048 bits. The default length is
2048 bits.
– When the local ECC key pair is generated, only the host key pair is generated. The
length of the host key pair can be 256, 384, or 521 bits. The default length is 521
bits.
l Configure SSH user information.
Configure SSH user information including the authentication mode. Authentication
modes including RSA, password, password-rsa, DSA, password-dsa, ECC, password-
ecc, and all are supported.
– The password-rsa authentication mode consists of the password and RSA
authentication modes.
– The password-dsa authentication mode consists of the password and DSA
authentication modes.
– The password-ecc authentication mode consists of the password and ECC
authentication modes.
– The all authentication mode indicates that SSH users only need to authenticated by
DSA, ECC, password, or RSA.

Table 7-21 Configuring SSH user information

Operation Command Description

Enter the system

system-view -
view.

Create SSH users. ssh user user-name -

If SSH users are not

created using the ssh user
command, directly run the
ssh authentication-type
default password
ssh user user-name command to configure the
Configure the authentication-type default password
authentication mode { password | rsa | password-rsa authentication mode for
for SSH users. | all | dsa | password-dsa | ecc | users. This mode
password-ecc } simplifies the
configurations when a
large number of users
exist, because you need to
configure only AAA
users.

By default, the service

Set the service type to ssh user username service-type
type of SSH users is
all for SSH users. all
empty.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 272

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

Submit the
commit -
configurations.

– The password authentication mode is implemented based on the AAA. To log in to

the device in the password-dsa, password-ecc, password, or password-rsa
authentication mode, create a local user with the same user name in the AAA view.
– If the SSH user uses the password authentication mode, only the SSH server needs
to generate the RSA, DSA, or ECC key. If the SSH user uses the RSA, DSA, or
ECC authentication mode, both the SSH server and client need to generate the RSA,
DSA, or ECC key and configure the public key of the peer end locally.
Perform any of the following configurations according to authentication mode:
– To configure password authentication for the SSH user, see Table 7-22.
– To configure RSA, DSA or ECC authentication for the SSH user, see Table 7-23.
– To configure password-rsa, password-dsa or password-ecc authentication for the
SSH user, configure an AAA user and set the RSA, DSA or ECC public key. For
details, see Table 7-22 and Table 7-23.

Table 7-22 Configuring password, password-dsa, password-ecc, or password-rsa

authentication for the SSH user
Operation Command Description

Enter the system view. system-view -

Enter the AAA view. aaa -

local-user user-name
Configure the local user password irreversible-
-
name and password. cipher irreversible-cipher-
password

Configure the service type local-user user-name

-
for the local user. service-type ssh

Configure the level for the local-user user-name level

-
local user. level

Return to the system view. quit -

Commit the
commit -
configurations.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 273

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Table 7-23 Configuring DSA, ECC, RSA, password-dsa, password-ecc, or password-rsa

authentication for the SSH user
Operation Command Description

Enter the system view. system-view -

By default, the
authentication type for the
SSH connection is AAA.
When the authentication
type is AAA, only the
password authentication
mode can be configured. If
the public key
authentication mode is
Configure the used, perform either of the
ssh authorization-type following operations to
authentication type for the
default root implement successful
SSH connection.
login of the SSH user:
l Run this command to
set the authentication
type for the SSH
connection to root.
l In the AAA view,
create a local user with
the same name as the
SSH user.

rsa peer-public-key key-

name [ encoding-type
{ der | openssh | pem } ]
or
Display the RSA, DSA, or dsa peer-public-key key-
-
ECC public key view. name encoding-type { der
| openssh | pem }
or
ecc peer-public-key key-
name

Display the public key

public-key-code begin -
editing view.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 274

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

l The public key must be

a hexadecimal
character string in the
public key encoding
format, and generated
by the client software
that supports SSH. For
Edit the public key. hex-data detailed operations, see
the SSH client software
help.
l You must enter the
RSA, DSA, or ECC
public key on the
device that works as
the SSH server.

l If no key public code

hex-data is entered, the
public key cannot be
generated after you run
this command.
l If the specified key
Exit the public key editing key-name has been
public-key-code end deleted in another view,
view.
the system displays a
message indicating that
the key does not exist
and returns to the
system view directly
when you run this
command.

Return to the system view

peer-public-key end -
from the public key view.

Assign an RSA, DSA, or ssh user user-name assign

ECC public key to an SSH { rsa-key | dsa-key | ecc- -
user. key } key-name

Commit the
commit -
configurations.

l Manage files when the device functions as an SCP server.

The SSH client software supporting SCP must be installed on the terminal to ensure that
the terminal can connect to the device using SCP to upload or download files. The
following describes how to connect to the device using the OpenSSH and the Windows
CLI.
– For details how to install the OpenSSH, see the OpenSSH installation description.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 275

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

– To use the OpenSSH to connect to the device using SFTP, run the OpenSSH
commands. For details about OpenSSH commands, see OpenSSH help.
– Windows command prompt can identify commands supported by the OpenSSH
only when the OpenSSH is installed on the terminal.

Access the Windows CLI and run the commands supported by the OpenSSH to connect
to the device using SCP to manage files. (The following information is only for
reference.)
C:\Documents and Settings\Administrator> scp scpuser@[Link]:flash:/
[Link] [Link]
The authenticity of host '[Link] ([Link])' can't be established.
DSA key fingerprint is 46:b2:8a:52:88:42:41:d4:af:8f:4a:41:d9:b8:4f:ee.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[Link]' (DSA) to the list of known hosts.
scpuser@[Link]'s password:
[Link] 100% 1257 1.2KB/s 00:00
Read from remote host [Link]: Connection reset by peer

C:\Documents and Settings\Administrator>

The user terminal uploads or downloads files while connecting to the SCP server and
access the user local directory.

----End

Checking the Configurations

l Run the display ssh user-information [ username ] command to view SSH user
information on the SSH server.
l Run the display ssh server status command to view global configuration of the SSH
server.
l Run the display ssh server session command to view session information of the SSH
client on the SSH server.

7.4 File Management on Other Devices

7.4.1 Managing Files When the Device Functions as a TFTP Client

The device can function as a TFTP client to log in to the TFTP server remotely to upload or
download files.

Pre-configuration Tasks
Before connecting to a device as a TFTP client to manage files, complete the following tasks:

l Ensuring that routes are reachable between the current device and the TFTP server
l Obtaining the IP address of the TFTP server and the directory for storing files to be
downloaded or uploaded

Configuration Process
NOTE

The TFTP protocol will bring risk to device security. The SFTPv2 or SCP mode is recommended.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 276

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Table 7-24 describes the procedure for managing files when the device functions as a TFTP
client.

Table 7-24 Procedure for managing files when the device functions as a TFTP client

No. Task Description Remarks

Configure the TFTP

client source address.
To ensure
(Optional) Configure the
communication
1 TFTP client source
security, the source
address
address can be set to a You can configure the
source IP address or TFTP client source
source interface. address and TFTP ACL
rule in any sequence.
Configure the ACL rule
(Optional) Configure the
2 to improve TFTP
TFTP ACL
access security.

Run TFTP commands to Upload and download

3
upload or download files files.

Procedure
l (Optional) Configure the TFTP client source address.

When you specify the source address in an ACL, use the address of an interface in stable
state, for example, a loopback interface. This simplifies the ACL rule and security policy
configuration. After the client source address is configured as the source or destination
address in the ACL rule, IP address differences and interface status impact are shielded,
and incoming and outgoing packets are filtered.

The TFTP client source address must be set to the loopback interface IP address or
loopback interface.

Table 7-25 (Optional) Configuring the TFTP client source address

Operation Command Description

Enter the system view. system-view -

The TFTP client source

address can be set to a
source IP address or
source interface. If the
tftp client source { -a source-
Configure the TFTP source address is set to
ip-address | -i interface-type
client source address. source interface,
interface-number }
configure an IP address
for the interface for
establishing TFTP
connections.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 277

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

Submit the
commit -
configurations.

l (Optional) Configure the TFTP ACL.

An ACL is composed of a list of rules such as the source address, destination address,
and port number of packets. ACL rules are used to classify packets. After these rules are
applied to routing devices, the routing devices determine the packets to be received and
rejected.

An ACL can define multiple rules. ACLs are classified into basic ACLs, advanced
ACLs, and Layer 2 ACLs.

NOTE

TFTP supports only the basic ACL whose number ranges from 2000 to 2999.
ACL rule:
l When permit is used in the ACL rule, the local device can establish TFTP connections with
devices that match the ACL rule.
l When deny is used in the ACL rule, the local device cannot establish TFTP connections
with devices that match the ACL rule.
l When the ACL rule is configured but packets from devices do not match the rule, the local
device cannot establish TFTP connections with the devices.
l When the ACL contains no rule, the local device can establish TFTP connections with any
devices.

Table 7-26 Configuring the TFTP ACL

Operation Command Description

Enter the system view. system-view -

Create an ACL and acl { [ number ] acl-number | By default, no ACL is

enter the ACL view. name acl-name } created.

rule [ rule-id ] { deny | permit }

[ fragment-type fragment |
source { source-ip-address
Configure the ACL By default, no ACL rule
{ source-wildcard | 0 | src-
rule. is configured.
netmask } | any } | time-range
time-name | vpn-instance vpn-
instance-name | logging ] *

Return to the system

quit -
view.

Configure the TFTP tftp server [ ipv6 ] acl acl-

-
ACL. number

Submit the
commit -
configurations.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 278

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

l Run TFTP commands to upload or download files.

Operation Command Description

tftp [ -a source-ip-address | -i interface-

type interface-number ] tftp-server
IPv4 address [ vpn-instance vpn-instance-name ]
{ get | put } source-filename
[ destination-filename ] l get: downloads a file.
l put: uploads a file.
tftp ipv6 [ -a source-ipv6-address ] tftp-
server-ipv6 [ -oi interface-type
IPv6 address
interface-number ] { get | put } source-
filename [ destination-filename ]

The source address or interface specified in the tftp command has a higher priority than
that specified in the tftp client source command. If you specify different source
addresses or interfaces in the tftp client source and tftp commands, the source address
or interface specified in the tftp command takes effect. The source address or interface
specified in the tftp client source command applies to all TFTP connections. The source
address or interface specified in the tftp command applies only to the current TFTP
connection.
----End

Checking the Configuration

l Run the display tftp client command to check source address of the TFTP client.

7.4.2 Managing Files When the Device Functions as an FTP Client

The device functions as an FTP client and connects to an FTP server remotely to transfer files
and manage files and directories on the FTP server.

Pre-configuration Tasks
Before connecting to a device as an FTP client to manage files, complete the following tasks:
l Ensuring that routes are reachable between the current device and the FTP server
l Obtaining the IP address of the FTP server, FTP user name, and password
l Obtaining the listening port number of the FTP server if the default listening port number
is not used

Configuration Process

NOTICE
The FTP protocol will bring risk to device security. The SFTPv2 or SCP mode is
recommended.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 279

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Table 7-27 describes the procedure for managing files when the device functions as an FTP
client.

Table 7-27 Procedure for managing files when the device functions as an FTP client
No. Task Description Remarks

Configure the FTP

client source address.
To ensure
(Optional) Configure the
communication
1 FTP client source
security, the source
address
address can be set to a
source IP address or
source interface.

Run FTP commands to

2 connect to the FTP - Perform steps 1 and 2
server in sequence. After the
FTP connection is
Run FTP commands to
established, perform
perform file-related
steps 3 and 4 in any
operations including
sequence. To disconnect
Run FTP commands to performing operations
from the FTP server,
3 perform file-related on directories and files,
perform step 5.
operations configuring the file
transfer mode, and
viewing the online help
about FTP commands.

(Optional) Change the

4 -
login user

Disconnect the FTP

5 client from the FTP -
server

Procedure
l (Optional) Configure the FTP client source address.
When you specify the source address in an ACL, use the address of an interface in stable
state, for example, a loopback interface. This simplifies the ACL rule and security policy
configuration. After the client source address is configured as the source or destination
address in the ACL rule, IP address differences and interface status impact are shielded,
and incoming and outgoing packets are filtered.
The FTP client source address must be set to the loopback interface IP address or
loopback interface.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 280

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Table 7-28 Configuring the FTP client source address

Operation Command Description

Enter the system view. system-view -

You are advised to use

the loopback interface
IP address.
ftp client source { -a source-ip- When the FTP client
Configure the FTP source address is set to
address | -i interface-type
client source address. loopback interface,
interface-number }
configure an IP address
for the loopback
interface for establishing
FTP connections.

Submit the
commit -
configurations.

l Run FTP commands to connect to the FTP server.

Run the corresponding command in the user view or FTP client view to connect to the
FTP server.

NOTE

If the device only needs to upload files to or download files from the FTP server, you can complete
a file transfer at one time by running the ftp { put | get } [ -a source-ip-address | -i interface-type
interface-number ] host-ip host-ip [ port portnumber ] [ public-net | vpn-instance vpn-instance-
name ] username username sourcefile local-filename [ destination remote-filename ] or ftp { put
| get } ipv6 [ -i interface-type interface-number ] host-ip host-ipv6 [ port portnumber ] username
username sourcefile local-filename [ destination remote-filename ] command in the user view.
This command cannot perform other FTP operations.

Perform the following operations based on the server IP address types.

Table 7-29 Running FTP commands to connect to the FTP server (with an IPv4 address)

Operation Command Description

Connect to the FTP ftp [ [ -a source-ip-address | -i

server in the user interface-type interface-number ]
view when the host-ip [ port-number ] [ public-net
server uses an IPv4 | vpn-instance vpn-instance-
Select one of them.
address. name ] ]
To enter the FTP client
Connect to the FTP ftp view, run the ftp
server in the FTP command.
open [ -a source-ip-address | -i
client view when interface-type interface-number ]
the server uses an host-ip [ port-number ] [ public-net
IPv4 address. | vpn-instance vpn-instance-name ]

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 281

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

NOTE

Before connecting to the FTP server, run the set net-manager vpn-instance command to set the
VPN instance to the default VPN instance.
The source address specified in the ftp command has a higher priority than that specified in the ftp
client source command. If you specify different source addresses in the ftp client source and ftp
commands, the source address specified in the ftp command takes effect. The source address
specified in the ftp client source command applies to all TFTP connections. The source address
specified in the ftp command applies only to the current TFTP connection.

Table 7-30 Running FTP commands to connect to the FTP server (with an IPv6 address)
Operation Command Description

Connect to the FTP

server in the user
view when the ftp ipv6 host-ipv6 [ port-number ]
server uses an IPv6 Select one of them.
address.
To enter the FTP client
Connect to the FTP ftp view, run the ftp
server in the FTP command.
client view when
the server uses an open ipv6 host-ipv6 [ port-number ]
IPv6 address.

Users must enter the correct user name and password to connect to the server.
l Run FTP commands to perform file-related operations.
After connecting to the FTP server, users can run FTP commands to perform file-related
operations including performing operations on directories and files, configuring the file
transfer mode, and viewing the online help about FTP commands.

NOTE

User rights are configured on the FTP server.

Users can perform the following operations in any sequence.

Table 7-31 Running FTP commands to perform file-related operations

Operation Command Description

Change the
working directory cd remote-directory -
on the server.

Change the -
current working
cdup
directory to its
parent directory.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 282

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

Display the -
working directory pwd
on the server.

The lcd command displays the

Display or change local working directory on the
the local working lcd [ local-directory ] client, and the pwd command
directory. displays the working directory on
the remote server.

The directory name can consist of

Create a directory letters and digits. The following
mkdir remote-directory
on the server. special characters are not
supported: < > ? \ :

Delete a directory
rmdir remote-directory -
from the server.

l The ls command displays only

the directory or file name, and
the dir command displays
Display detailed directory or file
information about information such as name, size,
dir/ls [ remote-filename and date when the directory or
the specified
[ local-filename ] ] file is created.
directory or file
on the server. l If no directory is specified in
the command, the system
searches for the file in user's
authorized directories.

Delete a file from

delete remote-filename -
the server.

put local-filename l To upload a file, run the put

Upload one or [ remote-filename ] command.
more files. Or l To upload multiple files, run
mput local-filenames the mput command.

get remote-filename l To download a file, run the get

Download one or [ local-filename ] command.
more files. Or l To download multiple files, run
mget remote-filenames the mget command.

Set the file Select one of them.

transfer mode to ascii l The default file transfer mode
ASCII. is ASCII.
l The ASCII mode is used to
Set the file transfer text files, and the
transfer mode to binary binary mode is used to transfer
Binary. programs, system software, and
database files.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 283

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

Set the data

transmission passive
mode to passive. Select one of them.
The default data transmission
Set the data undo passive mode is active.
transmission
mode to active.

View the online

help about FTP remotehelp [ command ] -
commands.

Enable the system By default, the prompt function is

prompt
prompt function. disabled.

After the verbose function is

Enable the enabled, all FTP response
verbose
verbose function. messages are displayed on the FTP
client.

l (Optional) Change the login user.

The current user can switch to another user in the FTP client view. The new FTP
connection is the same as that established by running the ftp command.

Operation Command Description

When the login user is

switched to another user,
Change the current user in
user user-name the original user is
the FTP client view.
disconnected from the FTP
server.

l Disconnect the FTP client from the FTP server.

Users can run different commands in the FTP client view to disconnect the FTP client
from the FTP server.

Operation Command Description

Disconnect the FTP

client from the FTP
bye or quit
server and return to the
user view.
Select one of them.
Disconnect the FTP
client from the FTP
close or disconnect
server and retains the
FTP client view.

----End

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 284

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Checking the Configurations

l Run the display ftp client command to check source interface of the FTP client.

7.4.3 Managing Files When the Device Functions as an SFTP

Client
SFTP is an SSH-based protocol that provides a secure file transfer capability. After you
configure the device as an SFTP client, the remote SSH server authenticates the SFTP client
and encrypts data in bidirectional mode. This ensures secure file transfer and management of
directories on the SSH server.

Pre-configuration Tasks
Before connecting to a device as an SFTP client to manage files, complete the following
tasks:

l Ensuring that routes are reachable between the current device and the SSH server
l Obtaining the IP address of the SSH server and SSH user information
l Obtaining the listening port number of the SSH server if the default listening port
number is not used

NOTICE
To ensure high security, do not use the RSA key pair whose length is less than 2048 digits.

Configuration Process
Table 7-32 describes the procedure for managing files when the device functions as an SFTP
client.

Table 7-32 Procedure for managing files when the device functions as an SFTP client
No. Task Description Remark
s

Configure the SFTP client source Steps 1,

(Optional) Configure the address. To ensure communication 2, and 3
1 SFTP client source security, the source address can be set can be
address to a source IP address or source performe
interface. d in any
sequence
Generate a local key pair and . Steps
configure the public key on the SSH 4-6 need
server. to be
2 Generate a local key pair Perform this step only when the device performe
logs in to the SSH server in RSA, d in
DSA, or ECC authentication mode, sequence
not the password authentication mode. .

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 285

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

No. Task Description Remark

s

To configure the initial SSH

connection, enable the initial
Configure the initial SSH
3 authentication function or save the
connection
public key of the SSH server on the
SSH client.

Run SFTP commands to

4 connect to the SSH -
server

Users can perform operations on

Run SFTP commands to
directories and files on the SSH server
5 perform file-related
and view the help about SFTP
operations
commands on the SFTP client.

Disconnect the SFTP

6 client from the SSH -
server

Procedure
l (Optional) Configure the SFTP client source address.
When you specify the source address in an ACL, use the address of an interface in stable
state, for example, a loopback interface. This simplifies the ACL rule and security policy
configuration. After the client source address is configured as the source or destination
address in the ACL rule, IP address differences and interface status impact are shielded,
and incoming and outgoing packets are filtered.
The SFTP client source address must be set to the loopback interface IP address or
loopback interface.

Table 7-33 Configuring the SFTP client source address

Operation Command Description

Enter the system view. system-view -

sftp client-source { -a source-

Configure the SFTP ip-address [ -vpn-instance vpn- The default source
client source address. instance-name ] | -i interface- address is [Link].
type interface-number }

Submit the
commit -
configurations.

l Generating a local key pair

NOTE

Perform this step only when the device logs in to the SSH server in RSA, DSA, or ECC
authentication mode, not the password authentication mode.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 286

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Table 7-34 Generating a local key pair

Action Command Description

Enter the system

system-view -
view.

Perform one of the

operations based on
the key type.
Run the display rsa
local-key-pair
public, display dsa
local-key-pair
Generate a local rsa local-key-pair create, dsa local-key- public, or display
key pair. pair create, or ecc local-key-pair create ecc local-key-pair
public command to
view the public key
in the local RSA,
DSA, or ECC key
pair. Configure the
public key on the
SSH server.

Commit the
commit -
configurations.

l Configure the initial SSH connection.

By default, the client cannot connect to the SSH server because the client does not save
the public key of the SSH server. Configure the initial SSH connection in either of the
following ways:
– Enable the initial authentication function on the client. With the function enabled,
the client connects to the SSH server without checking the public key of the SSH
server. When the initial SSH connection succeeds, the client automatically saves the
public key of the SSH server for the next SSH connection. For details, see Table
7-35.
– Save the public key of the SSH server on the client so that the client can
authenticate the SSH server successfully. For details, see Table 7-36. This method
ensures higher security but becomes more complex than the first method.

Table 7-35 Enabling first authentication for the SSH client

Action Command Description

Enter the system

system-view -
view.

Enable first
By default, first authentication is
authentication for ssh client first-time enable
disabled on the SSH client.
the SSH client.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 287

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Action Command Description

Commit the
commit -
configurations.

Table 7-36 Configuring the SSH client to assign the RSA, DSA, or ECC public key to
the SSH server
Action Command Description

Enter the system

system-view -
view.

rsa peer-public-key key-

name [ encoding-type { der |
openssh | pem } ]
or
Enter the RSA,
dsa peer-public-key key- Perform one of the operations
DSA, or ECC
name encoding-type { der | based on the key type.
public key view.
openssh | pem }
or
ecc peer-public-key key-
name

Enter the public

public-key-code begin -
key editing view.

l The public key must be a

hexadecimal character string
in the public key encoding
format, and generated by the
Edit the public SSH server.
hex-data
key. l After entering the public key
editing view, you must enter
the RSA, DSA, or ECC
public key that is generated
on the server to the client.

l If the key public hex-data is

invalid, the public key cannot
be generated after you run
this command.
Exit from the l If the specified key key-name
public key editing public-key-code end has been deleted, the system
view. displays a message indicating
that the key does not exist
and returns to the system
view directly when you run
this command.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 288

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Action Command Description

Return to the
peer-public-key end -
system view.

If the SSH server public key

saved in the SSH client does not
take effect, run the undo ssh
client server-ip-address assign
Bind the RSA,
ssh client server-ip-address { rsa-key | dsa-key | ecc-key }
DSA, or ECC
assign { rsa-key | dsa-key | command to cancel the binding
public key to the
ecc-key } key-name between the SSH server and
SSH server.
RSA, DSA, or ECC public key,
and run this command to assign
a new RSA, DSA, or ECC
public key to the SSH server.

Commit the
commit -
configurations.

l Run SFTP commands to connect to the SSH server.

The command for connecting an SFTP client is similar to that for connecting the STelnet
client. Both the clients can carry the source address, support the keepalive function, and
select a key exchange algorithm, an encryption algorithm, and an HMAC algorithm.

Table 7-37 Running SFTP commands to connect to the SSH server

Operatio
Command Description
n

Enter the
system system-view -
view.

(Optional)
ssh client key-exchange
Set a key
{ dh_group14_sha1 | dh_group1_sha1 |
exchange By default, an SSH
dh_group_exchange_sha1 |
algorithm client supports all key
dh_group_exchange_sha256 |
list on the exchange algorithms.
ecdh_sha2_nistp256 | ecdh_sha2_nistp384 |
SSH
ecdh_sha2_nistp521 | sm2_kep } *
client.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 289

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operatio
Command Description
n

By default, an SSH
client supports
(Optional) encryption algorithms
Set an including DES_CBC,
encryption ssh client cipher { des_cbc | 3des_cbc | 3DES_CBC,
algorithm aes128_cbc | aes256_cbc | aes128_ctr | AES128_CBC,
list for the aes256_ctr | arcfour128 | arcfour256 } * AES256_CBC,
SSH AES128_CTR,
client. AES256_CTR,
Arcfour128, and
Arcfour256.

(Optional)
Set an By default, an SSH
HMAC client supports HMAC
authenticat authentication
ssh client hmac { md5 | md5_96 | sha1 |
ion algorithms including
sha1_96 | sha2_256 | sha2_256_96 } *
algorithm MD5, MD5_96, SHA1,
list for the SHA1_96, SHA2_256,
SSH and SHA2_256_96.
client.

sftp [ -a source-address | -i interface-type

interface-number | -force-receive-pubkey ]
host-ip [ port ] [ [ public-net | -vpn-instance
vpn-instance-name ] | prefer_kex kex-type |
prefer_ctos_cipher cipher-type |
prefer_stoc_cipher cipher-type |
IPv4
prefer_ctos_hmac hmac-type | Run either of the
address
prefer_stoc_hmac hmac-type | commands based on the
prefer_ctos_compress compress-type | IP address type.
prefer_stoc_compress compress-type | -ki
In most cases, only the
aliveinterval | -kc alivecountmax | identity-
IP address is specified
key { dsa | ecc | rsa } | user-identity-key
in the commands.
{ dsa | ecc | rsa } ] *
If the source interface is
sftp ipv6 [ -force-receive-pubkey ] [ -a specified using -i
source-address ] host-ipv6 [ -oi interface-type interface-type interface-
interface-number ] [ port ] [ prefer_kex kex- number, the -vpn-
type | prefer_ctos_cipher cipher-type | instance vpn-instance-
prefer_stoc_cipher cipher-type | name parameters are not
IPv6 prefer_ctos_hmac hmac-type | supported.
address prefer_stoc_hmac hmac-type |
prefer_ctos_compress compress-type |
prefer_stoc_compress compress-type | -ki
aliveinterval | -kc alivecountmax | identity-
key { dsa | ecc | rsa } | user-identity-key
{ dsa | ecc | rsa } ] *

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 290

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Command example:
[~HUAWEI] sftp [Link]

When the SSH connection succeeds, sftp-client> is displayed, indicating the SFTP client
view is displayed.
l Run SFTP commands to perform file-related operations.
In the SFTP client view, you can perform one or more file-related operations listed in
Table 7-38 in any sequence.

Table 7-38 Running SFTP commands to perform file-related operations

Operation Command Description

Change the user's

current working cd [ remote-directory ] -
directory.

Change the current

working directory to its cdup -
parent directory.

Display the user's

current working pwd -
directory.

Display the file list in a dir/ls [ -l | -a ] [ remote- Outputs of the dir and ls
specified directory. directory ] commands are the same.

A maximum of 10
directories can be deleted at
one time.
Delete directories from rmdir remote-directory Before running the rmdir
the server. &<1-10> command to delete
directories, ensure that the
directories do not contain
any files. Otherwise, the
deletion fails.

Create a directory on
mkdir remote-directory -
the server.

Change the name of a

specified file on the rename old-name new-name -
server.

Download a file from get remote-filename [ local-

-
the remote server. filename ]

Upload a local file to put local-filename [ remote-

-
the remote server. filename ]

A maximum of 10 files can

Delete files from the remove remote-filename be deleted at one time.
server. &<1-10> remove and delete have the
same effect.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 291

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

View the help about

help [ command-name ] -
SFTP commands.

l Disconnect the SFTP client from the SSH server.

Operation Command Description

The bye or exit command

Disconnect the SFTP
quit can also disconnect the
client from the SSH server.
SFTP client.

----End

Checking the Configuration

l Run the display sftp client command to check source interface of the SFTP client.
l Run the display ssh server-info command to check the mappings between the SSH
server and the public key.

7.4.4 Managing Files When the Device Functions as an SCP Client

SCP is a means of securely transferring computer files between a local host and a remote host
or between two remote hosts. It is based on the Secure Shell (SSH) protocol. When
configured as an SCP client, the device can securely upload and download files when
connecting to the server.

Pre-configuration Tasks
Before connecting to a device as an SCP client to manage files, complete the following tasks:

l Ensuring that routes are reachable between the current device and the SSH server.
l Obtaining the host name or IP address of the SSH server and SSH user information.
l Obtaining the listening port number of the SSH server if the default listening port
number is not used.

NOTICE
To ensure high security, do not use the RSA key pair whose length is less than 2048 digits.

Configuration Process
Table 7-39 describes the procedure for managing files when the device functions as an SCP
client.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 292

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Table 7-39 Procedure for managing files when the device functions as an SCP client
No. Task Description Remarks

Configure the SCP

client source address.
The source address can
(Optional) Configure the be set to a source IP
1 SCP client source address or source
address interface information,
ensuring
communication
security.

Generate a local key

pair and configure the
public key on the SSH
server.
Perform this step only
2 Generate a local key pair when the device logs in Steps 1, 2, and 3 can be
to the SSH server in performed in any
RSA, DSA, or ECC sequence.
authentication mode,
not the password
authentication mode.

To configure the initial

SSH connection, enable
the initial
Configure the initial SSH
3 authentication function
connection
or save the public key
of the SSH server on
the SSH client.

Run SCP commands to

4 connect to the SSH -
server

Procedure
l (Optional) Configure the SCP client source address.

Table 7-40 (Optional) Configuring the SCP client source address

Operation Command Description

Enter the system view. system-view -

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 293

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operation Command Description

By default, the source IP

address of an SCP client
scp client-source { -a source- is [Link].
ip-address [ public-net | -vpn- If you use -i to specify a
Configure the SCP
instance vpn-instance-name ] | - logical interface as the
client source address.
i interface-type interface- source interface, ensure
number } that the logical interface
has been created
successfully.

Submit the
commit -
configurations.

l Generate a local key pair

NOTE

Perform this step only when the device logs in to the SSH server in RSA, DSA, or ECC
authentication mode, not the password authentication mode.

Table 7-41 Generating a local key pair

Action Command Description

Enter the system

system-view -
view.

Perform one of the

operations based on
the key type.
Run the display rsa
local-key-pair
public, display dsa
local-key-pair
Generate a local rsa local-key-pair create, dsa local-key- public, or display
key pair. pair create, or ecc local-key-pair create ecc local-key-pair
public command to
view the public key
in the local RSA,
DSA, or ECC key
pair. Configure the
public key on the
SSH server.

Commit the
commit -
configurations.

l Configure the initial SSH connection.

By default, the client cannot connect to the SSH server because the client does not save
the public key of the SSH server. Configure the initial SSH connection in either of the
following ways:

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 294

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

– Enable the initial authentication function on the client. With the function enabled,
the client connects to the SSH server without checking the public key of the SSH
server. When the initial SSH connection succeeds, the client automatically saves the
public key of the SSH server for the next SSH connection. For details, see Table
7-35.
– Save the public key of the SSH server on the client so that the client can
authenticate the SSH server successfully. For details, see Table 7-36. This method
ensures higher security but becomes more complex than the first method.

Table 7-42 Enabling first authentication for the SSH client

Action Command Description

Enter the system

system-view -
view.

Enable first
By default, first authentication is
authentication for ssh client first-time enable
disabled on the SSH client.
the SSH client.

Commit the
commit -
configurations.

Table 7-43 Configuring the SSH client to assign the RSA, DSA, or ECC public key to
the SSH server
Action Command Description

Enter the system

system-view -
view.

rsa peer-public-key key-

name [ encoding-type { der |
openssh | pem } ]
or
Enter the RSA,
dsa peer-public-key key- Perform one of the operations
DSA, or ECC
name encoding-type { der | based on the key type.
public key view.
openssh | pem }
or
ecc peer-public-key key-
name

Enter the public

public-key-code begin -
key editing view.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 295

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Action Command Description

l The public key must be a

hexadecimal character string
in the public key encoding
format, and generated by the
Edit the public SSH server.
hex-data
key. l After entering the public key
editing view, you must enter
the RSA, DSA, or ECC
public key that is generated
on the server to the client.

l If the key public hex-data is

invalid, the public key cannot
be generated after you run
this command.
Exit from the l If the specified key key-name
public key editing public-key-code end has been deleted, the system
view. displays a message indicating
that the key does not exist
and returns to the system
view directly when you run
this command.

Return to the
peer-public-key end -
system view.

If the SSH server public key

saved in the SSH client does not
take effect, run the undo ssh
client server-ip-address assign
Bind the RSA,
ssh client server-ip-address { rsa-key | dsa-key | ecc-key }
DSA, or ECC
assign { rsa-key | dsa-key | command to cancel the binding
public key to the
ecc-key } key-name between the SSH server and
SSH server.
RSA, DSA, or ECC public key,
and run this command to assign
a new RSA, DSA, or ECC
public key to the SSH server.

Commit the
commit -
configurations.

l Run SCP commands to connect to the SSH server.

Different from the SFTP mode, after the SCP connection is established, the client can
directly upload files to or download files from the server.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 296

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Table 7-44 Running SCP commands to connect to the SSH server

Operatio
Command Description
n

Enter the
system system-view -
view.

(Optional)
Set a key ssh client key-exchange { dh_group14_sha1 |
By default, an SSH
exchange dh_group1_sha1 | dh_group_exchange_sha1 |
client supports all
algorithm dh_group_exchange_sha256 |
key exchange
list on the ecdh_sha2_nistp256 | ecdh_sha2_nistp384 |
algorithms.
SSH ecdh_sha2_nistp521 | sm2_kep } *
client.

By default, an SSH
client supports
(Optional) encryption
Set an algorithms including
encryptio DES_CBC,
ssh client cipher { des_cbc | 3des_cbc |
n 3DES_CBC,
aes128_cbc | aes256_cbc | aes128_ctr |
algorithm AES128_CBC,
aes256_ctr | arcfour128 | arcfour256 } *
list for the AES256_CBC,
SSH AES128_CTR,
client. AES256_CTR,
Arcfour128, and
Arcfour256.

(Optional) By default, an SSH

Set an client supports
HMAC HMAC
authentica authentication
ssh client hmac { md5 | md5_96 | sha1 |
tion algorithms including
sha1_96 | sha2_256 | sha2_256_96 } *
algorithm MD5, MD5_96,
list for the SHA1, SHA1_96,
SSH SHA2_256, and
client. SHA2_256_96.

Run either of the

commands based on
the IP address type.
scp [ -a source-ip-address | -i interface-type
interface-number ] [ -force-receive-pubkey ] [ - If the source
port port-number | { public-net | vpn-instance interface is specified
IPv4 using -i interface-
vpn-instance-name } | -c | -cipher cipher-type | -
address type interface-
prefer-kex kex-type | -r | identity-key { dsa | ecc
number, the public-
| rsa } | user-identity-key { dsa | ecc | rsa } ] *
net and vpn-instance
source-filename destination-filename
vpn-instance-name
parameters are not
supported.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 297

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Operatio
Command Description
n

scp ipv6 [ -a source-ipv6-address | -oi interface-

type interface-number ] [ -force-receive-
pubkey ] [ -port port-number | -c | -cipher
IPv6
cipher-type | -prefer-kex kex-type | -r | identity-
address
key { dsa | ecc | rsa } | user-identity-key { dsa |
ecc | rsa } ] * source-filename destination-
filename

----End

Checking the Configurations

l Run the display scp client command to check source configurations on the SCP client.
l Run the display ssh server-info command to check the mappings between the SSH
server and the public key.

7.5 Configuration Examples

This section only provides configuration examples for single features. For details about multi-
feature configuration cases, feature-specific configuration cases, interconnection cases,
protocol or hardware replacement cases, and industry application cases, see the Typical
Configuration Cases.

7.5.1 Example of Logging In to the Device to Manage Files

Networking Requirements
After logging in to the device through the console interface, Telnet, or STelnet, perform the
following operations:
l View files and subdirectories in the current directory.
l Create the test directory, copy the [Link] file to test, and rename [Link] as
[Link].
l View files in the test directory.

Procedure
Step 1 View files and subdirectories in the current directory.
<HUAWEI> system-view
[~HUAWEI] sysname Switch
[*Switch] commit
[~Switch] quit
<Switch> dir
Directory of flash:/

Idx Attr Size(Byte) Date Time FileName

0 -rw- 889 Mar 01 2012 14:41:56 [Link]

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 298

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

1 -rw- 6,311 Feb 17 2012 14:05:04 [Link]

2 -rw- 2,393 Mar 06 2012 17:20:10 [Link]
3 -rw- 812 Dec 12 2011 15:43:10 hostkey
4 drw- - Mar 01 2012 14:41:46 compatible
5 -rw- 540 Dec 12 2011 15:43:12 serverkey
...
670,092 KB total (569,904 KB free)

Step 2 Create the test directory, copy the [Link] file to test, and rename [Link] as
[Link].
# Create the test directory.
<Switch> mkdir test
Info: Create directory flash:/test/......Done.

# Copy the [Link] file to test and rename [Link] as [Link].

<Switch> copy [Link] flash:/test/[Link]
Info: Are you sure to copy flash:/[Link] to flash:/test/[Link]?[Y/N]:y
100% complete
Info: Copied file flash:/[Link] to flash:/test/[Link]...Done.

NOTE

If no target file name is specified, the source file and target file have the same name.

Step 3 View files in the test directory.

# Access the test directory.
<Switch> cd test

# View the current working directory.

<Switch> pwd
flash:/test/

# View files in the test directory.

<Switch> dir
Directory of flash:/test/

Idx Attr Size(Byte) Date Time FileName

0 -rw- 2,399 Mar 12 2012 11:16:44 [Link]

670,092 KB total (569,900 KB free)

----End

Configuration File
Configuration file of the Switch
#
sysname Switch
#
return

7.5.2 Example for Managing Files When the Device Functions as

an FTP Server

Networking Requirements
As shown in Figure 7-1, PC1 connects to the device, and the IP address of the management
network interface on the device is [Link]. The device needs to be upgraded. The device

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 299

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

is required to function as the FTP server to upload the system software from PC1 to the
device and save the configuration file to PC1 for backup. A security policy is configured to
ensure that only PC1 is allowed to access the FTP server.

Figure 7-1 Networking diagram for managing files when the device functions as an FTP
server

[Link]/24 [Link]/24

PC1

[Link]/24 FTP Server

PC2

Configuration Roadmap
The configuration roadmap is as follows:

1. Configure the FTP function and FTP user information including user name, password,
user level, service type, and authorized directory on the FTP server.
2. Configure access permissions on the FTP server.
3. Save the [Link] file on the FTP server.
4. Connect to the FTP server from the PC1.
5. Upload [Link] to and download [Link] from the FTP server.

Procedure
Step 1 Configure the FTP function and FTP user information on the FTP server.
<HUAWEI> system-view
[~HUAWEI] sysname FTP_Server
[*HUAWEI] commit
[~FTP_Server] ftp server enable
[*FTP_Server] aaa
[*FTP_Server-aaa] local-user admin1234 password irreversible-cipher
Helloworld@6789
[*FTP_Server-aaa] local-user admin1234 level 3
[*FTP_Server-aaa] local-user admin1234 service-type ftp
[*FTP_Server-aaa] local-user admin1234 ftp-directory flash:/
[*FTP_Server-aaa] commit
[~FTP_Server-aaa] quit

Step 2 Configure access permissions on the FTP server.

[~FTP_Server] acl number 2001
[*FTP_Server-acl4-basic-2001] rule permit source [Link] 32
[*FTP_Server-acl4-basic-2001] rule deny source [Link] 32
[*FTP_Server-acl4-basic-2001] commit
[~FTP_Server-acl4-basic-2001] quit
[~FTP_Server] ftp server acl 2001
[*FTP_Server] commit
[~FTP_Server] quit

Step 3 Save the [Link] file on the FTP server.

<FTP_Server> save

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 300

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Step 4 Connect to the FTP server from the PC1 as the admin1234 user whose password is
Helloworld@6789 and transfer files in binary mode.

Assume that the PC runs the Window XP operating system.

C:\Documents and Settings\Administrator> ftp [Link]
Connected to [Link].
220 FTP service ready.
User ([Link]:(none)): admin1234
331 Password required for admin1234.
Password:
230 User logged in.
ftp> binary
200 Type set to I.
ftp>

Step 5 Upload [Link] to and download [Link] from the FTP server.

# Upload the [Link] file to the FTP server.

ftp> put [Link]
200 Port command okay.
150 Opening BINARY mode data connection for /[Link]
226 Transfer complete.
ftp: 107973953 bytes sent in 151.05Seconds 560.79Kbytes/sec.

# Download the [Link] file.

ftp> get [Link]
200 Port command okay.
150 Opening BINARY mode data connection for /[Link].
226 Transfer complete.
ftp: 1257 bytes received in 0.03Seconds 40.55Kbytes/sec.

NOTE
The [Link] file to be uploaded and the [Link] file to be downloaded are stored in the local
directory on the FTP client. Before uploading and downloading files, obtain the local directory on the
client. The default FTP user's local directory on the Windows 7 operating system is C:\Windows
\System32.

Step 6 Verify the configuration.

# Run the dir command on the FTP server to check the [Link] file.
<FTP_Server> dir
Directory of flash:/

Idx Attr Size(Byte) Date Time FileName

0 -rw- 14 Mar 13 2012 14:13:38 back_time_a
1 drw- - Mar 11 2012 00:58:54 logfile
2 -rw- 4 Nov 17 2011 09:33:58 [Link]
3 -rw- 11,238 Mar 12 2012 21:15:56 [Link]
4 -rw- 1,257 Mar 12 2012 21:15:54 [Link]
5 -rw- 14 Mar 13 2012 14:13:38 back_time_b
6 -rw- 107,973,953 Mar 13 2012 14:24:24 [Link]
7 drw- - Oct 31 2011 10:20:28 sysdrv
8 drw- - Feb 21 2012 17:16:36 compatible
9 drw- - Feb 09 2012 14:20:10 selftest
10 -rw- 19,174 Feb 20 2012 18:55:32 [Link]
11 -rw- 23,496 Dec 15 2011 20:59:36 [Link]
12 -rw- 588 Nov 04 2011 13:54:04 [Link]
13 -rw- 320 Nov 04 2011 13:54:26 [Link]
14 drw- - Nov 04 2011 13:58:36 security
...
670,092 KB total (569,904 KB free)
# Access the FTP user's local directory on the PC and check the [Link] file.

----End

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 301

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Configuration File
#
sysname Switch
#
FTP server enable
FTP server acl 2001
#
acl number 2001
rule 5 permit source [Link] 0
rule 10 deny source [Link] 0
#
aaa
local-user admin1234 password irreversible-cipher $1c$g8wLJ`LjL!
$CyE(V{3qg5DdU:PM[6=6O$[Link],Q}>^)OBzgoU$
local-user admin1234 service-type ftp
local-user admin1234 level 3
local-user admin1234 ftp-directory flash:
#
interface MEth0/0/0
ip address [Link] [Link]
#
return

7.5.3 Example for Managing Files Using SFTP When the Device
Functions as an SSH Server

Networking Requirements
As shown in Figure 7-2, PC1 connects to the device, and the IP address of the management
network interface on the device is [Link]. Files need to be securely transferred between
PC1 and the device. Configure the device as the SSH server to provide the SFTP service so
that the SSH server can authenticate the client and encrypt data in bidirectional mode,ensuring
secure file transfer. A security policy is configured to ensure that only PC1 is allowed to
access the SSH server.

Figure 7-2 Networking diagram for managing files using SFTP when the device functions as
an SSH server

[Link]/24 [Link]/24

PC1

[Link]/24 SSH Server

PC2

Configuration Roadmap
The configuration roadmap is as follows:
1. Generate a local key pair and enable the SFTP server function on the SSH server so that
the server and client can securely exchange data.
2. Configure SSH user information including the authentication mode, service type,
authorized directory, user name, and password.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 302

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

3. Configure access permissions on the SSH server to control SSH users.

4. Connect to the SSH server using the third-party software OpenSSH on the PC.

Procedure
Step 1 Generate a local key pair on the SSH server, and enable the SFTP server.
<HUAWEI> system-view
[~HUAWEI] sysname SSH Server
[*HUAWEI] commit
[~SSH Server] dsa local-key-pair create
Info: The key name will be: SSH
Server_Host_DSA

Info: The key modulus can be any one of the following : 2048.
Info: Key pair generation will take a short while.
Info: Generating keys...
Info: Succeeded in creating the DSA host keys.
[*SSH Server] sftp server enable

Step 2 Configure SSH user information including the authentication mode, service type, authorized
directory, user name, and password.
[*SSH Server] ssh user client001 authentication-type password
[*SSH Server] ssh user client001 service-type sftp
[*SSH Server] ssh user client001 sftp-directory flash:
[*SSH Server] aaa
[*SSH Server-aaa] local-user client001 password irreversible-cipher
Helloworld@6789
[*SSH Server-aaa] local-user client001 level 15
[*SSH Server-aaa] local-user client001 service-type ssh
[*SSH Server-aaa] quit

Step 3 Configure access permissions on the SSH server.

[*SSH Server] acl 2001
[*SSH Server-acl4-basic-2001] rule permit source [Link] 32
[*SSH Server-acl4-basic-2001] rule deny source [Link] 32
[*SSH Server-acl4-basic-2001] quit
[*SSH Server] ssh server acl 2001
[*SSH Server] commit

Step 4 Connect to the SSH server using the third-party software OpenSSH on the PC.
The Windows CLI can identify OpenSSH commands only when the OpenSSH is installed on
the PC.
C:/Documents and Settings/Administrator> sftp client001@[Link]
Connecting to [Link]...
The authenticity of host "[Link] ([Link])" can't be established.
DSA key fingerprint is 0d:48:82:fd:2f:52:1c:f0:c4:22:70:80:8f:7b:fd:78.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added "[Link]" (DSA) to the list of known hosts.
client001@[Link]'s password:
sftp>

After you connect to the SSH server through third-party software, the SFTP view is displayed.
Then you can perform file-related operations in the SFTP view.

----End

Configuration File
#
sysname SSH Server
#
acl number 2001

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 303

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

rule 5 permit source [Link] 0

rule 10 deny source [Link] 0
#
aaa
local-user client001 password irreversible-cipher $1c$g8wLJ`LjL!
$CyE(V{3qg5DdU:PM[6=6O$[Link],Q}>^)OBzgoU$
local-user client001 service-type ssh
local-user client001 level 15
#
sftp server enable
ssh server acl 2001
ssh user client001
ssh user client001 authentication-type password
ssh user client001 service-type sftp
ssh user client001 sftp-directory flash:
#
return

7.5.4 Example for Managing Files When the Device Functions as a

TFTP Client

Networking Requirements
As shown in Figure 7-3, the remote device at [Link]/24 functions as the TFTP server. The
device at [Link]/24 functions as the TFTP client. Routes between the device and the server
are reachable.
The device needs to be upgraded. To upgrade the device, you must download system software
[Link] from and upload the configuration file [Link] to the TFTP server.

Figure 7-3 Networking diagram for managing files when the device functions as a TFTP
client

[Link]/24 [Link]/24
Internet

TFTP Client TFTP Server

Configuration Roadmap
The configuration roadmap is as follows:
1. Run the TFTP software on the TFTP server and configure the working directory.
2. Run TFTP commands to download [Link] from and upload [Link] to the
TFTP server.

Procedure
Step 1 Run the TFTP software on the TFTP server and configure the working directory. (For details,
see related third-party documentation.)
Step 2 Run TFTP commands to download [Link] from and upload [Link] to the TFTP
server.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 304

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

<HUAWEI> tftp [Link] get [Link]

Info: Transfer file in binary mode.
Please wait for a while...
/ 107973953 bytes transferred
Info: Downloaded the file successfully.
<HUAWEI> tftp [Link] put [Link]
Info: Transfer file in binary mode.
Please wait for a while...
/ 100% [***********]
Info: Uploaded the file successfully.

Step 3 Verify the configuration.

# Run the dir command on the TFTP client to check the [Link] file.
<HUAWEI> dir
Directory of flash:/

Idx Attr Size(Byte) Date Time FileName

0 -rw- 14 Mar 13 2012 14:13:38 back_time_a
1 drw- - Mar 11 2012 00:58:54 logfile
2 -rw- 4 Nov 17 2011 09:33:58 [Link]
3 -rw- 11,238 Mar 12 2012 21:15:56 [Link]
4 -rw- 7,717 Mar 12 2012 21:15:54 [Link]
5 -rw- 14 Mar 13 2012 14:13:38 back_time_b
6 -rw- 107,973,953 Mar 13 2012 14:24:24 [Link]
7 drw- - Oct 31 2011 10:20:28 sysdrv
8 drw- - Feb 21 2012 17:16:36 compatible
9 drw- - Feb 09 2012 14:20:10 selftest
10 -rw- 19,174 Feb 20 2012 18:55:32 [Link]
11 -rw- 43,496 Dec 15 2011 20:59:36 [Link]
12 -rw- 588 Nov 04 2011 13:54:04 [Link]
13 -rw- 320 Nov 04 2011 13:54:26 [Link]
14 drw- - Nov 04 2011 13:58:36 security
...
670,092 KB total (569,904 KB free)

# Access the working directory on the TFTP server and check the [Link] file.

----End

Configuration File
None

7.5.5 Example for Managing Files When the Device Functions as

an FTP Client

Networking Requirements
As shown in Figure 7-4, the remote device at [Link]/24 functions as the FTP server. The
device at [Link]/24 functions as the FTP client. Routes between the device and the server
are reachable.
The device needs to be upgraded. To upgrade the device, you must download system software
[Link] from and upload the configuration file [Link] to the FTP server.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 305

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Figure 7-4 Networking diagram for managing files when the device functions as an FTP
client

[Link]/24 [Link]/24
Internet

FTP Client FTP Server

Configuration Roadmap
The configuration roadmap is as follows:
1. Run the FTP software on the FTP server and configure FTP user information.
2. Connect to the FTP server.
3. Run FTP commands to download [Link] from and upload [Link] to the FTP
server.

Procedure
Step 1 Run the FTP software on the FTP server and configure FTP user information. (For details, see
related third-party documentation.)
Step 2 Connect to the FTP server.
<HUAWEI> ftp [Link]
Trying [Link] ...
Press CTRL + K to abort
Connected to [Link].
220 FTP service ready.
User([Link]:(none)):admin
331 Password required for admin.
Enter password:
230 User logged in.

[ftp]

Step 3 Run FTP commands to download [Link] from and upload [Link] to the FTP
server.
[ftp] binary
[ftp] get [Link]
[ftp] put [Link]
[ftp] quit

Step 4 Verify the configuration.

# Run the dir command on the FTP client to check the [Link] file.
<HUAWEI> dir
Directory of flash:/

Idx Attr Size(Byte) Date Time FileName

0 -rw- 14 Mar 13 2012 14:13:38 back_time_a
1 drw- - Mar 11 2012 00:58:54 logfile
2 -rw- 4 Nov 17 2011 09:33:58 [Link]
3 -rw- 11,238 Mar 12 2012 21:15:56 [Link]
4 -rw- 7,717 Mar 12 2012 21:15:54 [Link]
5 -rw- 14 Mar 13 2012 14:13:38 back_time_b
6 -rw- 107,973,953 Mar 13 2012 14:24:24 [Link]
7 drw- - Oct 31 2011 10:20:28 sysdrv

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 306

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

8 drw- - Feb 21 2012 17:16:36 compatible

9 drw- - Feb 09 2012 14:20:10 selftest
10 -rw- 19,174 Feb 20 2012 18:55:32 [Link]
11 -rw- 43,496 Dec 15 2011 20:59:36 [Link]
12 -rw- 588 Nov 04 2011 13:54:04 [Link]
13 -rw- 320 Nov 04 2011 13:54:26 [Link]
14 drw- - Nov 04 2011 13:58:36 security
...
670,092 KB total (569,904 KB free)

# Access the working directory on the FTP server and check the [Link] file.

----End

Configuration File
None

7.5.6 Example for Managing Files When the Device Functions as

an SFTP Client

Networking Requirements
SSH secures file transfer on a traditional insecure network by authenticating the client and
encrypting data in bidirectional mode. The client uses SFTP to securely connect to the SSH
server and transfer files.

As shown in Figure 7-5, routes between the SSH server and clients client001 and client002
are reachable. In this example, Huawei device functions as an SSH server.

Client001 connects to the SSH server using the password authentication mode, and client002
using the DSA authentication mode.

Figure 7-5 Networking diagram for managing files when the device functions as an SFTP
client

[Link]/24

client001 [Link]/24
Internet

SSH Server
[Link]/24
client002

Configuration Roadmap
The configuration roadmap is as follows:

1. Generate a local key pair and enable the SFTP server function on the SSH server so that
the server and client can securely exchange data.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 307

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

2. Create users client001 and client002 and set their authentication modes on the SSH
server.
3. Generate a local key pair on client002 and configure the DSA public key of client002 on
the SSH server so that the server can authenticate the client when the client connects to
the server.
4. Log in to the SSH server as users client001 and client002 using SFTP and manage files.

Procedure
Step 1 Generate a local key pair and enable the SFTP server function on the SSH server.
<HUAWEI> system-view
[~HUAWEI] sysname SSH Server
[*HUAWEI] commit
[~SSH Server] dsa local-key-pair create
Info: The key name will be: SSH
Server_Host_DSA

Info: The key modulus can be any one of the following : 2048.
Info: Key pair generation will take a short while.
Info: Generating keys...
Info: Succeeded in creating the DSA host keys.
[*SSH Server] sftp server enable

Step 2 Create SSH users on the SSH server.

NOTE

There are eight authentication modes for an SSH user: password, RSA, password-RSA, DSA, password-
DSA, ECC, password-ECC, and all.

# Create the client001 user and set the authentication mode to password for the user.
[*SSH Server] ssh user client001
[*SSH Server] ssh user client001 authentication-type password
[*SSH Server] ssh user client001 service-type sftp
[*SSH Server] ssh user client001 sftp-directory flash:
[*SSH Server] aaa
[*SSH Server-aaa] local-user client001 password irreversible-cipher
Helloworld@6789
[*SSH Server-aaa] local-user client001 service-type ssh
[*SSH Server-aaa] local-user client001 level 3
[*SSH Server-aaa] quit

# Create an SSH user client002 and set the authentication mode to dsa for the user.
[*SSH Server] ssh user client002
[*SSH Server] ssh user client002 authentication-type dsa
[*SSH Server] ssh authorization-type default root
[*SSH Server] ssh user client002 service-type sftp
[*SSH Server] ssh user client002 sftp-directory flash:
[*SSH Server] commit

Step 3 Generate a local key pair on client002 and configure the DSA public key of client002 on the
SSH server.
# Generate a local key pair on client002.
<HUAWEI> system-view
[~HUAWEI] sysname client002
[*HUAWEI] commit
[~client002] dsa local-key-pair create
Info: The key name will be: client002_Host_DSA
Info: The key modulus can be any one of the following : 2048.
Info: Key pair generation will take a short while.
Info: Generating keys...

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 308

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Info: Succeeded in creating the DSA host keys.

[*client002] commit

# Check the DSA public key of the client.

[~client002] display dsa local-key-pair public
========================================================

Time of key pair created : 2016-06-25

02:10:40

Key name :
client002_Host_DSA

Key modulus :
2048

Key type : DSA encryption

key

========================================================

Key code:
3082010A
02820101
00BBB7A0 4924AF13 04F2662D 2ED43B9D 589967EB
D8A4F785 5AD1F662 13845081 0C65F6B3 88A9C415
D81C34BD 41A4B580 70DC7460 E4A5407B 9B95630F
E211F4B3 1115772D FB95D3DC 915A1858 D0DE49F7
F39DD7A7 7795F2B9 C9562E8B 598CB50F 6D39240D
B5C6F1D3 33A218D0 98C30104 F8F3A8CA 7172C95B
03AEC0A0 8A7E99F6 6C1939AA 52CC2E31 B6703278
AEE1BCD8 DC21FCA2 041C9A4C 1856A935 6894998D
FBFA88FF 1708C3A6 7E092368 ACE983D7 C8DDCDF5
26F5D4E5 16A15C5C D6D0018E 4EAFE055 B93FCB87
2BB46EFB 02C04C3B F167A417 380CD0B0 0BC59493
646CBE96 BCAF3DB7 AD0AFA0A 5D14155E D7F97DC1
32693DE5 4B103442 8E0F4DAD 2598BE5E 19
0203
010001

Host public key for PEM format code:

---- BEGIN SSH2 PUBLIC KEY ----
AAAAB3NzaC1yc2EAAAADAQABAAABAQC7t6BJJK8TBPJmLS7UO51YmWfr2KT3hVrR
9mIThFCBDGX2s4ipxBXYHDS9QaS1gHDcdGDkpUB7m5VjD+IR9LMRFXct+5XT3JFa
GFjQ3kn3853Xp3eV8rnJVi6LWYy1D205JA21xvHTM6IY0JjDAQT486jKcXLJWwOu
wKCKfpn2bBk5qlLMLjG2cDJ4ruG82Nwh/KIEHJpMGFapNWiUmY37+oj/FwjDpn4J
I2is6YPXyN3N9Sb11OUWoVxc1tABjk6v4FW5P8uHK7Ru+wLATDvxZ6QXOAzQsAvF
lJNkbL6WvK89t60K+gpdFBVe1/l9wTJpPeVLEDRCjg9NrSWYvl4Z
---- END SSH2 PUBLIC KEY ----

Public key code for pasting into OpenSSH authorized_keys file:

ssh-dsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7t6BJJK8TBPJmLS7UO51YmWfr2KT3hVrR9mIThFCB
DGX2s4ipxBXYHDS9QaS1gHDcdGDkpUB7m5VjD+IR9LMRFXct+5XT3JFaGFjQ3kn3853Xp3eV8rnJVi6L
WYy1D205JA21xvHTM6IY0JjDAQT486jKcXLJWwOuwKCKfpn2bBk5qlLMLjG2cDJ4ruG82Nwh/KIEHJpM
GFapNWiUmY37+oj/FwjDpn4JI2is6YPXyN3N9Sb11OUWoVxc1tABjk6v4FW5P8uHK7Ru+wLATDvxZ6QX
OAzQsAvFlJNkbL6WvK89t60K+gpdFBVe1/l9wTJpPeVLEDRCjg9NrSWYvl4Z== dsa-key

# Configure the DSA public key of client002 on the SSH server. (Information in bold in the
display command output is the DSA public key of client002. Copy the information to the
server.)
[~SSH Server] dsa peer-public-key dsakey001 encoding-type der
[*SSH Server-dsa-public-key] public-key-code begin
[*SSH Server-dsa-public-key-dsa-key-code] 3082010A
[*SSH Server-dsa-public-key-dsa-key-code] 02820101
[*SSH Server-dsa-public-key-dsa-key-code] 00BBB7A0 4924AF13 04F2662D 2ED43B9D
589967EB
[*SSH Server-dsa-public-key-dsa-key-code] D8A4F785 5AD1F662 13845081 0C65F6B3

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 309

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

88A9C415
[*SSH Server-dsa-public-key-dsa-key-code] D81C34BD 41A4B580 70DC7460 E4A5407B
9B95630F
[*SSH Server-dsa-public-key-dsa-key-code] E211F4B3 1115772D FB95D3DC 915A1858
D0DE49F7
[*SSH Server-dsa-public-key-dsa-key-code] F39DD7A7 7795F2B9 C9562E8B 598CB50F
6D39240D
[*SSH Server-dsa-public-key-dsa-key-code] B5C6F1D3 33A218D0 98C30104 F8F3A8CA
7172C95B
[*SSH Server-dsa-public-key-dsa-key-code] 03AEC0A0 8A7E99F6 6C1939AA 52CC2E31
B6703278
[*SSH Server-dsa-public-key-dsa-key-code] AEE1BCD8 DC21FCA2 041C9A4C 1856A935
6894998D
[*SSH Server-dsa-public-key-dsa-key-code] FBFA88FF 1708C3A6 7E092368 ACE983D7
C8DDCDF5
[*SSH Server-dsa-public-key-dsa-key-code] 26F5D4E5 16A15C5C D6D0018E 4EAFE055
B93FCB87
[*SSH Server-dsa-public-key-dsa-key-code] 2BB46EFB 02C04C3B F167A417 380CD0B0
0BC59493
[*SSH Server-dsa-public-key-dsa-key-code] 646CBE96 BCAF3DB7 AD0AFA0A 5D14155E
D7F97DC1
[*SSH Server-dsa-public-key-dsa-key-code] 32693DE5 4B103442 8E0F4DAD 2598BE5E 19
[*SSH Server-dsa-public-key-dsa-key-code] 0203
[*SSH Server-dsa-public-key-dsa-key-code] 010001
[*SSH Server-dsa-public-key-dsa-key-code] public-key-code end
[*SSH Server-dsa-public-key] peer-public-key end

# Bind the client002 user to the DSA public key of client002.

[*SSH Server] ssh user client002 assign dsa-key dsakey001
[*SSH Server] commit

Step 4 Connect SFTP clients to the SSH server.

# If the clients connect to the SSH server for the first time, enable the initial authentication
function on the clients.
Enable the initial authentication function on client001.
<HUAWEI> system-view
[~HUAWEI] sysname client001
[*HUAWEI] commit
[~client001] ssh client first-time enable
[*client001] commit

Enable the initial authentication function on client002.

[~client002] ssh client first-time enable
[*client002] commit

# Log in to the SSH server from client001 in password authentication mode.

[~client001] sftp [Link]
Trying [Link] ...
Press CTRL+K to abort
Connected to [Link] ...
The server's public key does not match the one cached before.
The server is not authenticated. Continue to access it? [Y/N]: y
The keyname:[Link] already exists. Update it? [Y/N]: n

Please input the username: client001

Enter password:
sftp-client>

# Log in to the SSH server from client002 in DSA authentication mode.

[~client001] sftp [Link]
Trying [Link] ...
Press CTRL+K to abort

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 310

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Connected to [Link] ...

The server's public key does not match the one cached before.
The server is not authenticated. Continue to access it? [Y/N]: y
The keyname:[Link] already exists. Update it? [Y/N]: n

Please input the username: client002

sftp-client>

Step 5 Verify the configurations.

Run the display ssh server status command. You can see that the SFTP service has been
enabled. Run the display ssh user-information command. Information about the configured
SSH users is displayed.
# Check the SSH server status.
[~SSH Server] display ssh server status
SSH Version : 2.0
SSH authentication timeout (Seconds) : 60
SSH authentication retries (Times) : 3
SSH server key generating interval (Hours) : 0
SSH version 1.x compatibility : Disable
SSH server keepalive : Enable
SFTP server : Enable
STelnet server : Enable
SNETCONF server : Disable
SNETCONF server port(830) : Enable
SCP server : Disable
SSH server DES : Disable
SSH server port : 22
SSH server source address : [Link]
ACL name : --
ACL number : --
ACL6 name : --
ACL6 number : --

# Check information about SSH users.

[~SSH Server] display ssh user-information
--------------------------------------------------------------------------------
User Name : client001
Authentication type : password
User public key name : --
User public key type : --
Sftp directory : flash:
Service type : sftp

User Name : client002

Authentication type : dsa
User public key name : --
User public key type : --
Sftp directory : flash:
Service type : sftp
--------------------------------------------------------------------------------
Total 2, 2 printed

----End

Configuration Files
l Configure file on the SSH server
#
sysname SSH Server
#
dsa peer-public-key dsakey001 encoding-type der
public-key-code begin

3082010A

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 311

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

02820101
00BBB7A0 4924AF13 04F2662D 2ED43B9D 589967EB D8A4F785 5AD1F662
13845081
0C65F6B3 88A9C415 D81C34BD 41A4B580 70DC7460 E4A5407B 9B95630F
E211F4B3
1115772D FB95D3DC 915A1858 D0DE49F7 F39DD7A7 7795F2B9 C9562E8B
598CB50F
6D39240D B5C6F1D3 33A218D0 98C30104 F8F3A8CA 7172C95B 03AEC0A0
8A7E99F6
6C1939AA 52CC2E31 B6703278 AEE1BCD8 DC21FCA2 041C9A4C 1856A935
6894998D
FBFA88FF 1708C3A6 7E092368 ACE983D7 C8DDCDF5 26F5D4E5 16A15C5C
D6D0018E
4EAFE055 B93FCB87 2BB46EFB 02C04C3B F167A417 380CD0B0 0BC59493
646CBE96
BCAF3DB7 AD0AFA0A 5D14155E D7F97DC1 32693DE5 4B103442 8E0F4DAD
2598BE5E

19

0203
010001
public-key-code end
peer-public-key end
#
aaa
local-user client001 password irreversible-cipher $1c$g8wLJ`LjL!
$CyE(V{3qg5DdU:PM[6=6O$[Link],Q}>^)OBzgoU$
local-user client001 service-type ssh
local-user client001 level 3
#
sftp server enable
ssh user client001
ssh user client001 authentication-type password
ssh user client001 service-type sftp
ssh user client001 sftp-directory flash:
ssh user client002
ssh user client002 authentication-type dsa
ssh user client002 assign dsa-key dsakey001
ssh user client002 service-type sftp
ssh user client002 sftp-directory flash:
#
return

l Configuration file on client001

#
sysname client001
#
ssh client first-time enable
#
return

l Configuration file on client002

#
sysname client002
#
ssh client first-time enable
#
return

7.5.7 Example for Managing Files When the Device Functions as

an SCP Client

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 312

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Networking Requirements
Compared with the SFTP protocol, the SCP protocol authenticates user identity while
transferring files, improving configuration efficiency.
As shown in Figure 7-6, routes between the device functioning as the SCP client and the SSH
server are reachable. The SCP client can download files from the SSH server.

Figure 7-6 Networking diagram for managing files when the device functions as an SCP
client
[Link]/24 [Link]/24

Internet

PC SCP Client SSH Server

Configuration Roadmap
The configuration roadmap is as follows:
1. Generate a local key pair on the SSH server.
2. Create an SSH user on the SSH server.
3. Enable the SCP function on the SSH server.
4. Download files from the SSH server.

Procedure
Step 1 Generate a local key pair on the SSH server.
<HUAWEI> system-view
[~HUAWEI] sysname SSH Server
[*HUAWEI] commit
[~SSH Server] rsa local-key-pair create
The key name will be: SSH Server_Host
The range of public key size is (2048 ~ 2048).
NOTE: Key pair generation will take a short while.

Step 2 Create an SSH user on the SSH server.

# Configure the VTY user interface.
[*SSH Server] user-interface vty 0 4
[*SSH Server-ui-vty0-4] authentication-mode aaa
[*SSH Server-ui-vty0-4] protocol inbound ssh
[*SSH Server-ui-vty0-4] quit

# Create an SSH user client001 and set the authentication mode to password and service type
to all.
[*SSH Server] ssh user client001
[*SSH Server] ssh user client001 authentication-type password
[*SSH Server] ssh user client001 service-type all

# Set the password of the client001 user to HuaWei@123.

[*SSH Server] aaa
[*SSH Server-aaa] local-user client001 password irreversible-cipher HuaWei@123
[*SSH Server-aaa] local-user client001 service-type ssh
[*SSH Server-aaa] local-user client001 level 3
[*SSH Server-aaa] quit

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 313

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Step 3 Enable the SCP function on the SSH server.

[*SSH Server] scp server enable
Info: Succeeded in starting the SCP server.
[*SSH Server] commit

Step 4 Download the [Link] file from the SSH server.

# If the client connects to the SSH server for the first time, enable the initial authentication
function on the client.
<HUAWEI> system-view
[~HUAWEI] sysname SCP Client
[*HUAWEI] commit
[~SCP Client] ssh client first-time enable
[*SCP Client] commit

# Use the 3des encryption algorithm to download the [Link] file from the remote SSH
server with IP address [Link] to the local user's directory.
[~SCP Client] scp -cipher 3des client001@[Link]:[Link] [Link]
Trying [Link] ...
Press CTRL+K to abort
Connected to [Link] ...
Continue to access it? [Y/N]:y
[Y/N]:y
The server's public key will be saved with the name [Link]. Please wait...

Enter password:
[Link] 100% 19174Bytes 7Kb/s

----End

Configuration File
l Configuration file on the SSH server
#
sysname SSH Server
#
aaa
local-user client001 password irreversible-cipher $#z$!9S<a#>H7{7dI>
%0S{AcKGC=t:zjv14LlQqHO\\P.*=<x1]u;y*P`'GR3[m}$
local-user client001 service-type ssh
local-user client001 level 3
#
scp server enable
ssh user client001
ssh user client001 authentication-type password
ssh user client001 service-type all
#
user-interface vty 0 4
authentication-mode aaa
protocol inbound ssh
#
return

l Configuration file on the SCP client

#
sysname SCP Client
#
ssh client first-time enable
#
return

7.6 Common Misconfigurations

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 314

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

7.6.1 FTP Login Failure

Cause Analysis
l The FTP server is not running.
l The listening port number of the FTP server is not the default one, and no port number is
specified when you log in to the FTP server.
l The authentication information, authorized directory, and user level of the FTP user are
not configured.
l The number of online FTP users who have logged in to the FTP server reaches the upper
threshold 15.
l An ACL is configured on the FTP server, and the FTP client IP address is not specified
in the ACL.

Procedure
Step 1 Check whether the FTP server is running properly.
Run the display ftp server command in any view to check the FTP server status.
l The following information indicates that the FTP server is not running:
<HUAWEI> display ftp server
Server state : Disabled
IPv6 server state : Disabled
Timeout value (mins) : 30
IPv6 Timeout value (mins) : 30
Listen port : 21
IPv6 listen port : 21
ACL name :
ACL number :
Current user count : 0
Max user number : 15
Source IPv4 address : [Link]
Run the ftp server enable command in the system view to start the FTP server.
<HUAWEI> system-view
[~HUAWEI] ftp server enable
Info: Succeeded in starting the FTP server.
[*HUAWEI] commit

l The following information indicates that the FTP server is running properly:
<HUAWEI> display ftp server
Server state : Enabled
IPv6 server state : Disabled
Timeout value (mins) : 30
IPv6 Timeout value (mins) : 30
Listen port : 21
IPv6 listen port : 21
ACL name :
ACL number :
Current user count : 0
Max user number : 15
Source IPv4 address : [Link]

Step 2 Check whether the listening port number of the FTP server is the default port number 21.
1. Run the display tcp status command in any view to check the current TCP port listening
status.
<HUAWEI> display tcp status
------------------------------------------------------------------------------
--

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 315

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

Pid/SocketID Local Addr:Port Foreign Addr:Port VPNID

State
------------------------------------------------------------------------------
--
0x8093272F/4 [Link]:22 [Link]:0 4294967295
LISTEN
0x80C82739/8 [Link]:23 [Link]:0 4294967295
LISTEN
0x80130402/21 [Link]:179 [Link]:0 0
LISTEN
0x80130402/91 [Link]:42589 [Link]:179 0
ESTABLISHED
0x80C82739/22117 [Link]:23 [Link]:1342 0
ESTABLISHED
0x80C82739/22176 [Link]:23 [Link]:1585 0
ESTABLISHED
0x80C82739/22405 [Link]:23 [Link]:2441 0
ESTABLISHED
0x80C82739/22497 [Link]:23 [Link]:2757 0
ESTABLISHED
0x80952731/22563 [Link]:21 [Link]:0 4294967295
LISTEN
------------------------------------------------------------------------------
--

2. Run the display ftp server command in any view to check the listening port number of
the FTP server.
<HUAWEI> display ftp server
Server state : Enabled
IPv6 server state : Disabled
Timeout value (mins) : 10
IPv6 Timeout value (mins) : 10
Listen port : 21
IPv6 listen port : 21
ACL name :
IPv6 ACL name :
ACL number :
IPv6 ACL number :
Current user count : 0
Max user number : 15
Source IPv4 address : [Link]
Source IPv6 Address : ::
Source IPv6 VpnName :

If the listening port number is not 21, run the ftp server port command to set the listening
port number to 21.
<HUAWEI> system-view
[~HUAWEI] undo ftp server
Info: Succeeded in closing the FTP server.
[*HUAWEI] ftp server port 21
[*HUAWEI] ftp server enable
Info: Succeeded in starting the FTP server.
[*HUAWEI] commit

Alternatively, enter the port number configured on the server when you set up an FTP
connection on the FTP client.

Step 3 Check whether the authentication information, authorized directory, and user level of the FTP
user are correctly configured.

The FTP user name, password, authorized directory, and user level must be configured. If the
FTP authorized directory and user level are not configured, login fails.

1. Run the aaa command to enter the AAA view.

2. Run the local-user user-name password irreversible-cipher irreversible-cipher-
password command to configure the local FTP user name and password.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 316

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 7 File Management

3. Run the local-user user-name ftp-directory directory command to specify an FTP

authorized directory for the FTP user.
4. Run the local-user user-name level level command to set the FTP user level. The user
level must be set to 3 or higher to ensure successful connection establishment.
The service type is optional. By default, the system does not support any service type.
Run the local-user user-name service-type ftp command to set the service types for the FTP
user.
Step 4 Check whether the number of online FTP users who have logged in to the FTP server reaches
the upper threshold.
Run the display ftp server users command to check the number of online FTP users.
Step 5 Check the ACL rule on the FTP server.
Run the display ftp server command to check the ACL rule on the FTP server.
If an ACL is configured on the FTP server, only IP addresses specified in the ACL can log in
to the FTP server.

----End

7.6.2 Failure in Uploading Files to the FTP Server

Cause Analysis
l The FTP source or destination directory name consists of unsupported characters.
l The storage space of the FTP root directory is insufficient.

Procedure
Step 1 Check whether the FTP source and destination directory names consist of unsupported
characters.
The following characters and spaces are not supported: ~ */ \ : ' "
If the directory names consist of any unsupported characters, modify the directory names.
Step 2 Check whether the storage space of the FTP root directory is sufficient.
Run the dir command on the FTP server to check the free space of the FTP root directory.
If the space of the FTP root directory is insufficient, run the delete /unreserved command in
the user view to delete unnecessary files.

----End

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 317

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

8 Configuring System Startup

About This Chapter

This chapter describes how to configure system startup.

8.1 System Startup Overview

8.2 Managing Configuration Files
8.3 Configuring System Startup Files
8.4 Configuring Dynamic Module Loading
Dynamic module loading allows you to load and uninstall modules without interrupting
services.
8.5 Restarting the Device
8.6 Configuration Examples

8.1 System Startup Overview

The system loads the system software and configuration file during a startup. If a patch file is
specified for next startup, the system also loads the specified patch file.
System startup scenarios are as follows:
l Version upgrade: Upgrade the system software to a later version.
To add new features, optimize existing features, or solve problems in the current version,
you need to upgrade the device. To upgrade the device, load the upgrade system software
and restart the device.
l Version rollback: Degrade the software to an earlier version.
If an error occurs after the upgrade, perform version rollback to restore normal service
operating. You need to load earlier version system software and restart the device.
l First startup: When a new device is deployed on a network, you can load an existing
configuration file on the device to meet user needs.
A new device contains only factory configurations. To connect a new device to the
network and deploy services on it, you have to spend a lot of time on device

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 318

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

configuration. To save time on device configuration, specify a configuration file that

meets user needs for the device and restart the device.
l Patch update: Specify the patch file to be loaded after an upgrade.
You can specify a new patch file when upgrading the device. The patch takes effect
immediately when the upgrade is complete.
NOTE

l The upgrade of a device is closely related to the released software versions. The corresponding
upgrade guide is released with each new version and you can upgrade the device according to the
guide. To obtain the upgrade guides, visit [Link] and download the
upgrade guide based on the product name and version.
l For details about commands used for device upgrade, see "Basic Configurations Commands -
Upgrade Commands" in the CloudEngine 8800&7800&6800&5800 Series Switches Command
Reference.

System Software
The device software includes BIOS software and system software. After the device is
powered on, it runs the BIOS software to initialize the hardware and display the hardware
parameters. Then the device runs the system software. The system software provides drivers
and adaptation functions for hardware, and offers services features. The BIOS software and
system software are prerequisite for device startup and operation, providing support,
management, and services for the device.

A device upgrade includes BIOS software upgrade and system software upgrade.

NOTE

The BIOS software is included in the system software package (.cc file) of the device. The BIOS
software is automatically upgraded in system software upgrade.

Configuration File
A configuration file is a collection of command lines. The current configurations are saved in
configuration files, and continue to take effect after the device restarts. You can view
configurations in configuration files or upload the files to other devices to implement batch
configuration.

A configuration file is in the text format and meets the following requirements:

l A configuration file can contain only configuration commands, view switching

commands, # symbols (used to switch to the system view), and the quit command. If
you load other types of commands, such as display commands used for query, reset/save/
ping commands used for maintenance, commit, return, and upgrade-compatible
commands, the device reports an error and continues the loading of follow-up
commands.
l A configuration file can not contain repeated commands.
l The command indentation must be correct.
l The configuration sequence and dependency must be correct.
l Interactive commands in the configuration file only support automatic interaction in Y/N
mode, the default is Y.
l The extension of the configuration file name must be .zip, .cfg or .dat. The system
configuration file must be saved in the root directory of the storage device.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 319

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

– A .cfg file is a text file. You can directly view the content of a .cfg file. After a .cfg
file is specified as the configuration file, the system restores the commands in the
file one by one when startup.
– A .zip file is the compression of a .cfg file, occupying less space. After a .zip file is
specified as the configuration file, the system decompresses the file into a .cfg file,
and then restores the commands in the file one by one when startup.
– A .dat file is a binary file. If the startup software version and the .dat file version are
the same, the system restores all configurations in the .dat file in batches when the
device starts. This speeds up the system startup.
The following table describes the configuration file, current configuration, and offline
configuration.

Concept Description Command

Configuratio When the device is powered on, the l Run the display startup
n file device reads the configuration file command to check the current
from the default directory to boot and next startup configuration
the system. Therefore, the files.
configuration in the file is called the l Run the display saved-
initial configuration. If no configuration command to
configuration file is stored in the check the configuration file for
default directory, the device uses the next startup.
default parameters for initialization.

Current The configurations that are valid Run the display current-
configuration during the device running are called configuration command to check
current configurations. the current configuration.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 320

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

Concept Description Command

Offline The system supports offline Offline configuration is marked with

Configuratio configuration. Specifically, after a *. To view the offline configuration,
n device quits a stack system, the run the display current-
configurations on the device are not configuration inactive or display
affected and you can continue to current-configuration all
configure its interfaces in the stack command.
system. If another device of the NOTE
same type joins the stack system, The symbol * has two meanings:
the configurations are restored on 1. When * is displayed in an
the new device. interactive operation, it indicates the
configurations that have not been
If another device joins the stack
submitted.
system, the impacts on the previous
configurations are as follows: 2. When * is displayed in
configuration information, it
l The new device has the same indicates the offline configurations.
type and stack ID as the
previous device.
The system automatically
restores the configurations of all
interfaces on the new device.
Then, users can view interface
configurations and configure the
interfaces on the new device.
l The new device has interfaces of
a different type by the same
stack ID as the previous device.
The system deletes the
configurations of all interfaces
on the previous device. The
deleted configurations cannot be
restored.
For example, device A has
interfaces of type P and
configuration information on its
interfaces.
1. Remove device A and then
add device C with interfaces
of type E to the stack system.
2. Remove device C from the
stack system without
configuring its interfaces. If
you run the display this
command in the interface
view on device C, the
command output does not
contain original
configurations on device A.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 321

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

Concept Description Command

3. Add device A or another

device with interfaces of type
P. If you run the display this
command in the interface
view on device A or the
device with interfaces of type
P, the command does not
contain original
configurations on device A,
either.
l The new device has a different
number of interfaces of the same
type as those on the previous
device.
– If the new device has more
interfaces than the previous
device does, the system
performs the following
operations:
– Restores the
configuration information
on the interfaces that are
the same as those on the
previous device.
– Keeps default
configuration information
on the other interfaces of
the new device.
– If the new device has fewer
interfaces than the previous
device does, the system
performs the following
operations:
– Restores the
configuration information
on the interfaces that are
the same as those on the
previous device.
– Delete the other interfaces
of the previous device
and their configuration
information.

If you modify the current configuration and want to use the modified configuration as the next
startup configuration, run the save command to save the new configuration to the default
storage device.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 322

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

NOTE

If a command in incomplete form is configured, the system saves the command to the configuration file
in its complete form, which may cause the command to have more than 1022 characters. (The maximum
length of a command supported by the system is 1022 characters.) The incomplete command cannot be
recovered after the system restarts.

Patch File
A patch is a kind of software compatible with the system software. It is used to remove a few
issues in the software that need to be solved immediately. Patches can also fix errors or
improve adaptation of the system software. For example, patches can fix defects of the system
and optimize some functions to meet service requirements.

The patches are released in patch files. A patch file may contain one or more patches with
different functions. When patch files are loaded from the storage device to the patch area in
the memory, they are assigned unique sequence number for users to identify, manage, and
operate the patches.

Patch classification

According to impact on services, patches can be classified into hot patch and cold patch.
l Hot patch (HP): The services are not interrupted when the HP is loaded and activated,
which reduces upgrade costs and eliminates upgrade risks.
l Cold Patch (CP): You must restart the device for the CP to take effect. Services are
interrupted during the restart.

According to patch dependency, patches can be classified into incremental and non-
incremental patches.
l An incremental patch is dependent on previous patches. A new patch file contains all the
patch information in the previous patch file. You can install the patch file without
uninstalling the original patch file.
l A non-incremental patch is exclusive in the current system. To install another patch file
when there is already one, uninstall the existing patch file, and then install and run the
new patch file.
NOTE

The currently released patches are hot patches and incremental patches. All the patches mentioned in the
subsequent sections are hot patches and incremental patches unless otherwise specified.

Status of Patches

Each patch has its own state that can only be changed with command line.

Table 8-1 describes the patch status.

Table 8-1 Status of patches

Status Description Patch Status Transition

Idle The patch file is saved to the When a patch in the storage
storage device but has not been device is loaded to the patch area,
loaded to the patch area. the patch is in the deactive state.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 323

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

Status Description Patch Status Transition

Deactive When a patch is loaded to the You can perform either of the
patch area or stops running, the following operations on the patch
patch is in the deactive state. that is in the deactive state:
l Uninstall the patch to delete it
from the patch area.
l Run the patch file temporarily
to change the state to active.

Active When a patch is stored in the You can perform one of the
patch area and runs temporarily, following operations on the patch
the patch is in the active state. that is in the active state:
The active patch changes to the l Uninstall the patch to delete it
deactive state when the device is from the patch area.
restarted. l Stop running the patch to
change the patch to the
deactive state.
l Run the patch permanently to
change the patch to the running
state.

Running When a patch is stored in the You can unload the patch that is in
patch area and runs permanently, the running state so that it can be
the patch is in the running state. deleted from the patch area.
The running patch remains in the
running state when the device is
restarted.

Figure 8-1 shows patch status transition.

Figure 8-1 Patch status transition

Load a patch

Idle Deactive
Delete a patch

De
let
e Deactive a patch Activate a patch
a
Delete a patch pa
tch

Running Active
Run a patch

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 324

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

Installing Patches
Installing patches is a way of upgrading a device. Patches can be installed in the following
ways:
l The hot patches are generally installed while the device is running without interrupting
services. This is an advantage of hot patches.
For details on how to install patches, see the corresponding patch installation guide. For
details about commands used for device upgrade, see "Basic Configurations Commands
- Upgrade Commands" in the CloudEngine 8800&7800&6800&5800 Series Switches
Command Reference.
l Another way is to specify a patch file for next startup, which is described in this chapter.
The patch file takes effect after the device reboots. The method is often used during a
system upgrade.

8.2 Managing Configuration Files

Pre-configuration Tasks
You can perform operations such as saving the configuration file and backing up the
configuration file.
Before managing configuration files, complete the following task:
l Logging in to the device.

Configuration Process
Perform one or multiple of the following tasks:

8.2.1 Saving the Configuration File

Context
You can run commands to modify the current configuration of the device, but the modified
configuration will be lost after the device restarts. To enable the new configuration to still take
effect after a restart, save the current configuration in the configuration file before restarting
the device. Use either of the following methods to save the current configuration:
l Configure the automatic save function.
l Manually save the configuration.

Procedure
l Save the configurations automatically.
a. Run:
system-view

The system view is displayed.

b. Run:
configuration file auto-save [ interval interval | cpu-limit cpu-usage |
delay delay-interval ] *

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 325

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

The system is configured to periodically save the configurations.

By default, the system does not periodically save configurations.
The system cancels the automatic save operation when:
n Content is being written into the configuration file.
n The configurations are being recovered.
n The CPU usage is excessively high.
c. (Optional) Run:
configuration file auto-save backup-to-server server server-ip [ vpn-
instance vpn-instance-name ] transport-type { { ftp | sftp } user user-
name password password | tftp } [ path folder ]

The server information is configured. The information includes the IP address of the
server to which the configuration is automatically saved, user name and password,
the path to save the configuration file, and the mode in which the configuration file
is transmitted to the server.
NOTE

SFTP has higher security and is therefore recommended for saving the configuration file in the
file server.
The configuration file is saved on the server as a compressed package. The package is named in
the format of [Link] [Link], for example,
[Link]. After the package is decompressed, the file with the file
name extension of .cfg is the configuration file.
d. (Optional) Run:
configuration current backup-to-server monthly date date-value [ time
time-value ]

The function to upload a configuration file to the server on a specific date and time
every month is enabled.
By default, the function to upload a configuration file to the server on a specific
date and time every month is disabled.
e. Run:
commit

The configuration is committed.

l Save the configurations manually.
– Run:
save [ configuration-file ]

The current configuration is saved.

The configuration file name extension must be .zip, .dat, or .cfg. The system startup
file must be stored in the root directory of the storage device.
n If you do not specify configuration-file when saving the configuration file for
the first time, the system asks you whether to save the configuration file as
[Link]. The [Link] file is the default system configuration file with
empty configurations in initial state.
n If you do not specify configuration-file, configurations are saved to the current
startup configuration file. You can run the display startup command to check
the name of the current startup configuration file.
n You can run the pwd (user view) command in the user view to check the
current storage directory.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 326

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

n You can run the cd (user view) command in the user view to modify the
current storage directory.
----End

8.2.2 Comparing Configuration Files

Context
You can compare the current configuration file with the specified configuration file to check
whether they are consistent and determine whether to set the specified configuration file as
the next startup configuration file.

NOTE

The configuration file name extension must be .cfg ,.dat, or .zip.

Procedure
l Run:
display configuration changes [ running file file-name | file file-name
running ]

The system starts to check whether the current running configurations are identical with
the specified configuration file.
l Run:
display configuration changes [ running label label | label label running ]

The system starts to check whether the current running configurations are identical with
the configuration based on a specific user label.
l Run:
compare configuration [ configuration-file ]

The system starts to check whether the current configurations are identical with the next
startup configuration file or a specified configuration file.
After completing a series of operations, you can compare whether the current
configurations are the same as the configurations in the next startup configuration file or
a specified configuration file starting from the first line of the current configurations.
You can determine whether to save the current configurations based on the comparison
result and specify the current configurations as the next startup configuration file.
After you run this command to compare the current configurations with the next startup
configuration file or a specified configuration file, the system displays the different
content starting from the first different line to the ninth different line. If the different
content contains fewer than nine lines, the system displays only the content from the first
different line to the end of the file.
----End

8.2.3 Backing Up the Configuration File

Context
If the device is damaged unexpectedly, the configuration file cannot be recovered. You can
back up the configuration file in advance using one of the following methods:

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 327

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

l Copying the content in the display on the screen

l Backing up the configuration file to the storage device
l Backing up the configuration file using FTP, TFTP, SFTP, or SCP

Procedure
l Copying the content in the display on the screen
Run the display current-configuration command and copy all command outputs to
a .txt file. The configuration file is backed up in the hard disk of the maintenance
terminal.

NOTE

If a configuration is too long, it may be displayed in two lines on the terminal screen, depending
on the terminal software. When copying a two-line configuration from the screen to a .txt file,
ensure that the configuration is displayed in only one line. Otherwise, configuration restoration
may fail when the .txt file is used.
l Backing up the configuration file to the storage device
The current configuration file can be backed up immediately to the flash memory of the
device. After the device starts, run the following commands to back up the configuration
file to the flash memory of the device:
<HUAWEI> save [Link]
<HUAWEI> copy [Link] [Link]

l Backing up the configuration file using FTP, TFTP, SFTP, or SCP

The device supports configuration file backup through FTP, TFTP, SFTP, or SCP.
Configuration file backup through FTP or TFTP is simple, but there are security risks. In
scenarios with high security requirements, configuration file backup through SFTP or
SCP is recommended. The following describes the configuration file backup process
using FTP as an example. For details about TFTP, SFTP, and SCP, see "File
Management" in CloudEngine 8800&7800&6800&5800 Series Switches Configuration
Guide - Basic Configurations.
a. Start the FTP service when the device works as the FTP server.
Enable the FTP server function on the device. Create an FTP user with the name
huawei and password Helloworld@6789. The user is authorized to access the flash
directory.
<HUAWEI> system-view
[~HUAWEI] ftp server enable
Warning: FTP is not a secure protocol, and it is recommended to use SFTP.
[*HUAWEI] aaa
[*HUAWEI-aaa] local-user huawei password irreversible-cipher
Helloworld@6789
[*HUAWEI-aaa] local-user huawei ftp-directory flash:
[*HUAWEI-aaa] local-user huawei service-type ftp
[*HUAWEI-aaa] local-user huawei level 15
[*HUAWEI-aaa] commit

b. On the maintenance terminal, initiate an FTP connection to the device.

On the PC, set up an FTP connection to the device through the FTP client. Assume
that the device IP address is [Link].
C:\Documents and Setting\Administrator> ftp [Link]
Connected to [Link].
220 FTP service ready.
User ([Link]:(none)): huawei

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 328

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

331 Password required for huawei.

Password:
230 User logged in.

c. Configure transfer parameters.

If the FTP user is authenticated, the FTP client displays the prompt character of
ftp>. Enter binary following the prompt character, and specify the path the
uploaded file is to be saved on the FTP client.
ftp> binary
200 Type set to I.
ftp> lcd c:\temp
Local directory now C:\temp.

d. Transfer the configuration file.

On the PC, run the get command to load the configuration file to the specified path
and save the file as [Link].
ftp> get [Link] [Link]

e. Check whether the [Link] and [Link] files have the same size. If they have
the same size, the backup is successful.

----End

8.2.4 Recovering the Configuration File

Context
When incorrect configurations are performed and functions are abnormal, you can use one of
the following methods:
l Recovering the configuration file that is backed up in the storage device
l Recovering the configuration file using FTP, TFTP, SFTP, or SCP

Procedure
l Recovering the configuration file that is backed up in the flash.
a. Recover the backup configuration file stored in the of the device to the current
system configuration file. When the device is working properly, run the following
command.
<HUAWEI> copy flash:/[Link] flash:/[Link]

b. Run: startup saved-configuration configuration-file, specify the next startup

configuration file.
c. Run: reboot, restart the device to make the file take effect.
l Recovering the configuration file using FTP, TFTP, SFTP, or SCP
The device supports configuration file recovery through FTP, TFTP, SFTP, or SCP.
Configuration file recovery through FTP or TFTP is simple, but there are security risks.
In scenarios with high security requirements, configuration file recovery through SFTP
or SCP is recommended. The following describes how to recover the configuration file
that is backed up on a PC through FTP. For details about TFTP, SFTP, and SCP, see "File
Management" in CloudEngine 8800&7800&6800&5800 Series Switches Configuration
Guide - Basic Configurations.
a. Start the FTP service when the device works as the FTP server.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 329

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

Enable the FTP server function on the device. Create an FTP user with the name
huawei and password Helloworld@6789. The user is authorized to access the flash
directory.
<HUAWEI> system-view
[~HUAWEI] ftp server enable
Warning: FTP is not a secure protocol, and it is recommended to use SFTP.
[*HUAWEI] aaa
[*HUAWEI-aaa] local-user huawei password irreversible-cipher
Helloworld@6789
[*HUAWEI-aaa] local-user huawei ftp-directory flash:
[*HUAWEI-aaa] local-user huawei service-type ftp
[*HUAWEI-aaa] local-user huawei level 15
[*HUAWEI-aaa] commit

b. On the maintenance terminal, initiate an FTP connection to the device.

On the PC, set up an FTP connection to the device through the FTP client. Assume
that the device IP address is [Link].
C:\Documents and Setting\Administrator> ftp [Link]
Connected to [Link].
220 FTP service ready.
User ([Link]:(none)): huawei
331 Password required for huawei.
Password:
230 User logged in.

c. Configure transfer parameters.

If the FTP user is authenticated, the FTP client displays the prompt character of
ftp>. Enter binary following the prompt character, and specify the path where the
uploaded file is to be saved on the FTP client.
ftp> binary
200 Type set to I.
ftp> lcd c:\temp
Local directory now C:\temp.

d. Transfer the configuration file.

On the PC, run the put command to upload the configuration file to the specified
path and save the file as [Link].
ftp> put [Link] [Link]

e. Check whether the [Link] file is successfully uploaded. If the [Link] file
exists on the device and has the correct size, the configuration file recovery is
successful.

----End

8.2.5 Clearing the Configuration File

Context
You need to delete the configuration file when:

l The software and configuration file do not match after the device software is upgraded.
l The configuration file is damaged or an incorrect configuration file is loaded.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 330

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

NOTICE
Exercise caution when you run the reset saved-configuration command. You are advised to
run this command under the guide of technical support personnel.

To configure an interface on a device for other use, original configurations on the interface
need to be deleted one by one. If the interface has a large number of configurations, deleting
these configurations one-by-one takes a long time and increases the maintenance workload.
To reduce the maintenance workload and simplify the deletion operation, you can perform
one-touch configuration clearance on an interface.

Procedure
l Run the reset saved-configuration command to cancel the configuration file used for
next startup. The default device configurations are restored.
NOTE

If the next startup configuration file is empty, the device displays a message indicating that the file
does not exist.
l Delete configurations on an interface at a time to restore the default configurations.
For details, see Table 8-2.

Table 8-2 Commands for deleting configurations on an interface at a time to restore the
default configurations
View Command Description Precautions

Syste clear configuration Deletes the Deletes the

m interface interface-type configuration configuration
view interface-number information on the information on an
specified interface or interface. Therefore,
restores the default exercise caution when
settings. Make sure that running the two
the command is run in commands.
the system view and the This command takes
specified interface type effect immediately in
and number are correct. two-stage mode, and
Otherwise, the you do not need to run
configuration the commit command
information on other to commit the
interfaces may be configuration.
deleted and services are
interrupted.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 331

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

View Command Description Precautions

Interf clear configuration Deletes the

ace this configuration
view information on the
current interface or
restores the default
settings. The command
is directly run in the
interface view, which
simplifies the operation.

l Clear the inactive configurations of the device that have not been installed.
a. Run:
system-view

The system view is displayed.

b. Run:
clear inactive-configuration { slot slot-id | all | chassis chassis-id }

The non-activated configurations on a specified device that is not installed are

cleared.

NOTE

This command is available only in stack scenarios.

----End

8.2.6 Rolling Back Configurations

Context
If faults are caused by incorrect configurations or an unexpected configuration result occurs
on the network after the configuration is submitted, you can roll back the configuration.

Before you roll back the configuration, the device has used either of two modes to submit the
configuration and generated a configuration rollback point.
l Immediate mode: After you enter the command and press Enter, the system checks
whether the current configuration is the same as the historical configuration. If they are
different, the system submits the configuration and generates the configuration rollback
point. Therefore, multiple configuration rollback points may be generated when one
feature is deployed.
l Two-stage mode: When running a series of configuration commands, you must use the
commit [ label label ] [ description description ] command to enable the system to
compare the current configuration with the historical configuration and generate a
configuration rollback point. In this way, all configurations for a certain service using a
series of commands can take effect. To quickly find the required configuration rollback
point, specify description description to configure the point description. You are advised
to use this mode to edit and submit the configuration.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 332

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

Procedure
Step 1 Check the configuration rollback points and the latest configuration changes.
1. Run:
display configuration commit list [ verbose ] [ number-of-commits | label ]

All configuration rollback points and their details are displayed.

To check one or more configuration rollback points, specify number-of-commits.
2. Run:
display configuration commit changes [ at commit-id | since commit-id | last
number-of-commits ]

The configuration change for a specified configuration rollback point is displayed.

Based on the configuration change, you can determine whether to roll back the
configuration and the possible effects on the system.
– To check the configuration changes at all configuration rollback points, do not
specify any parameters in the command.
– To check the configuration change at a specified configuration rollback point,
specify at commit-id.
– To check the configuration change from a specified configuration rollback point to
the current state, specify since commit-id.
– To check one or multiple of the latest configuration changes, specify last number-
of-commits.
Step 2 Roll back the configuration based on the required historical configuration state.
1. Run:
return

Return to the user view to ensure that all data has been submitted before rollback.
2. Run:
rollback configuration { to { commit-id commit-id | label label | file file-
name } | last number-of-commits }

The system is rolled back to the historical configuration state based on the specified
configuration rollback point , a user label for a configuration rollback point, a
configuration file for configuration rollback, or the number of configuration changes.
Based on the configured rollback rule, run this command to delete the created
configuration, re-create the deleted configuration, or recover the quondam configuration.
– To roll back the system to the historical configuration state at a certain
configuration rollback point, specify commit-id commit-id.
– To roll back the system to the historical configuration state at a user label for a
configuration rollback point, specify label label.
– To roll back the system to the historical configuration state at a configuration file
for configuration rollback, specify file file-name.
– To roll back the system to the historical configuration state before one or more
latest configuration rollback points, specify last number-of-commits.
NOTE

After the configuration rollback operation is complete, you can run the display configuration
rollback result command to view the result of the latest configuration rollback operation.

Step 3 (Optional) Run:

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 333

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

set configuration commit commit-id label label-string

A label is set for a configuration rollback point.

Step 4 (Optional) Run:
clear configuration commit { commit-id label | oldest number-of-commits }

The earliest configuration rollback points are deleted.

----End

Checking the Configuration

l Run the display configuration commit list [ verbose ] [ number-of-commits | label ]
command to view the configuration rollback point list.
l Run the display configuration commit changes [ at commit-id | since commit-id | last
number-of-commits ] command to view information about configuration changes.
l Run the display configuration rollback result command to view information about the
latest configuration rollback operation, including prompt messages and failure messages.

8.3 Configuring System Startup Files

Pre-configuration Tasks
Specify the system software and configuration file for system startup so that the device will
start and initialize with the specified software and configuration file. Specify new patch file if
the system needs to load new patches.
Before configuring the system startup files, complete the following tasks:
l Starting the device and logging in to the device locally or remotely.
l Saving the system startup files in the root directory of the device.

Context
Before specifying the files for next startup, you can run the display startup command to view
the specified files for next startup.
l If no system software is specified for next startup, the device will start with current
system software. To change the system software to be loaded for next startup (during an
upgrade for example), upload the new system software to the device and specify it as the
system file for next startup. The system software package must use .cc as the file name
extension and be saved to the root directory of the storage device.
l If no configuration file is specified for next startup, the device will start with the default
configuration file ([Link] for example). If no configuration file is stored in the
default directory, the device uses the default parameters for initialization. The
configuration file name extension must be .cfg, .dat, or .zip. In addition, the
configuration file must be saved to the root directory of the storage device.
l A patch file uses .pat as the file name extension. The specified patch file to be loaded for
next startup must also be saved to the root directory of the storage device.

Procedure
l Run:

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 334

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

startup system-software system-file

The system software to be loaded for next startup is specified.

l Run:
startup saved-configuration configuration-file

The configuration file for next startup is specified.

The device reads the configuration file from the root directory of the storage device for
initialization when powered on.
l (Optional) Run:
startup patch patch-name { all | slot slot-id }

The patch file for next startup is specified.

To make the patch file take effect after the device restarts, run this command to specify
the patch file for next startup.

----End

Checking the Configuration

After the configuration is complete, run the display startup command to view the system
software, configuration file and patch file for next startup.

8.4 Configuring Dynamic Module Loading

Dynamic module loading allows you to load and uninstall modules without interrupting
services.

Context
If a required module does not exist in the system, you can use dynamic module loading to
successfully load the module file of the required module to the system, and use functions
corresponding to the module. You can also dynamically uninstall the module if the module
functions are not required.

Pre-configuration Tasks
Obtain the .mod or .MOD file and upload the file to the switch.

Procedure
l Load a module dynamically.
Run:
install-module file-name [ next-startup ]

A specified module file is dynamically loaded.

l Uninstall a module dynamically.

Run:
uninstall-module { file-name [ next-startup ] | all }

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 335

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

A specified module file is uninstalled.

----End

Checking the Configuration

l Run the display module-information [ [ file-name ] verbose | next-startup ] command
to view information about modules dynamically loaded to the system.

8.5 Restarting the Device

Pre-configuration Tasks
To make sure the specified system software and files take effect, restart the device after
system startup configuration is complete.

Before restarting the device, complete the following tasks:

l Configuring system startup files.

Context
Use either of the following methods to restart the device:
l Restart the device immediately after configuration: The device restarts immediately after
the reboot command is run.
l Restart the device at scheduled time: The device can be restarted at a specified time later.
When the configuration is complete, you can configure the device to restart at time when
few services are running to minimize the impact of device restart on services.

The device restarts with the specified startup software. If the specified startup software is
damaged, the device restarts with the startup software that works last time. If the software for
last startup does not exist, the device searches for a valid startup software package on the
storage devices.
NOTE

In a stack, when the system startup configuration file is large, member devices may register slowly during the
system startup.

NOTICE
l Do not restart the device unless necessary because device restart causes service
interruption in a short time.
l Save the current configuration so that it will take effect after the device restarts.

Procedure
l Restart the Device Immediately

In the user view, run the reboot [ fast | save diagnostic-information ] command to
restart the device.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 336

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

– The fast parameter indicates quick restart of the device. The system does not ask
you whether to save the configuration file in fast startup.
– save diagnostic-information indicates that the system will save the diagnostic
information to root directory of the storage device before restarting.
l Restart the Device at Scheduled Time

In the user view, run the schedule reboot { at time | delay interval [ force ] } command
to restart the device at scheduled time.

– at time specifies the specific time to restart the device.

– delay interval specifies the waiting time before restarting the device.
If the force parameter is not specified, the system compares the configuration file
with the current configuration. If the current configuration is different from the
configuration file, the system asks you whether to save the current configuration.
After you complete the selection, the system prompts you to confirm the configured
restart time. Enter Y or y to make the configured restart time take effect. If the force
parameter is specified, the system does not display any message, and the restart
time takes effect directly. The current configuration is not compared or saved.

----End

8.6 Configuration Examples

This section only provides configuration examples for single features. For details about multi-
feature configuration cases, feature-specific configuration cases, interconnection cases,
protocol or hardware replacement cases, and industry application cases, see the Typical
Configuration Cases.

8.6.1 Example for Backing Up the Configuration File

Networking Requirements
As shown in Figure 8-2, a user logs in to the device and backs up the configuration file to the
TFTP server. So the configuration file can be recovered in case that the device is damaged.

Figure 8-2 Networking diagram of backing up the configuration file

Switch TFTP Server

Network

Configuration Roadmap
The configuration roadmap is as follows:

1. Save the configuration file.

2. Back up the configuration file through TFTP.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 337

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

NOTICE
Configuration file backup through TFTP is simple, but there are security risks. In
scenarios with high security requirements, configuration file backup through SFTP or
SCP is recommended. The following describes the configuration file backup process
using TFTP as an example.

Procedure
Step 1 Save configurations to the [Link] file.
<HUAWEI> save [Link]

Step 2 Back up the configuration file through TFTP.

1. Start the TFTP server program.

Start the TFTP server program on the PC. Set the path for transmitting the configuration
file, and the IP address and port number of the TFTP server.
2. Transfer the configuration file.

# Run the tftp command in the user view to back up the specified configuration file.
<HUAWEI> tftp [Link] put flash:/[Link] [Link]

----End

8.6.2 Example for Recovering the Configuration File

Networking Requirements
As shown in Figure 8-3, a user logs in to the device and finds that some incorrect
configurations cause errors in the system. To recover the original configuration, the user
downloads the configuration file saved in the TFTP server to the device and specifies the
configuration file for the next startup.

Figure 8-3 Network diagram of recovering the configuration file

Switch TFTP Server

Network

Configuration Roadmap
The configuration roadmap is as follows:

1. Recover the configuration file that is backed up on the PC through TFTP.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 338

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

NOTICE
Configuration file recovery through TFTP is simple, but there are security risks. In
scenarios with high security requirements, configuration file recovery through SFTP or
SCP is recommended. The following describes how to recover the configuration file that
is backed up on a PC through TFTP.

2. Specify the recovered configuration file for the next startup.

Procedure
Step 1 Recover the configuration file that is backed up on the PC through TFTP.
1. Start the TFTP server program.

Start the TFTP server program on the PC. Set the path for transmitting the configuration
file, and the IP address and port number of the TFTP server.
2. Transfer the configuration file.

# Run the tftp command in the user view.

<HUAWEI> tftp [Link] get [Link] [Link]

Step 2 Specify the recovered configuration file for the next startup.
<HUAWEI> startup saved-configuration [Link]

----End

8.6.3 Example for Rolling Back Configurations

Networking Requirements
As shown in Figure 8-4, a user logs in to the switch and configures an IP address for each
switch interface. Generally, after submitting the configuration, the user cannot check the latest
configurations and can only check the current configuration file. When the configurations are
incorrect or an unexpected configuration result occurs on the network, the user can only
manually delete or modify the configurations one by one and cannot perform the batch
recovery operation.

Figure 8-4 Network diagram of rolling back configurations

Network0 Network2
Switch
10GE1/0/1 10GE1/0/3
10GE1/0/2 10GE1/0/4

Network1 Network3

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 339

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

To solve the preceding problem, the user can check the difference between the historical and
current configurations and roll back the system configuration to the appropriate configuration
point without restarting the system or interrupting services.
In this example, the user finds that IP addresses are incorrectly configured for interfaces and
wants to reconfigure them. By using the traditional method, the user must enter each interface
view to delete the corresponding IP address and reconfigure the IP address. By using the
configuration rollback function, the user can recover the configurations to the configuration
state when the IP addresses have not been configured, which greatly simplifies configuration
recovery.

Configuration Roadmap
The configuration roadmap is as follows:
l Check the configuration rollback points and the latest configuration changes.
l Determine the configuration rollback point or the number of configuration changes to
roll back the configuration.

Procedure
Step 1 Configure IP addresses for 10GE1/0/1, 10GE1/0/2, 10GE1/0/3, and 10GE1/0/4 on the switch.
<HUAWEI> system-view
[~HUAWEI] sysname Switch
[*HUAWEI] commit
[~Switch] vlan batch 77 to 80
[*Switch] interface vlanif 77
[*Switch-Vlanif77] ip address [Link] 24
[*Switch] quit
[*Switch] interface vlanif 78
[*Switch-Vlanif78] ip address [Link] 24
[*Switch] quit
[*Switch] interface vlanif 79
[*Switch-Vlanif79] ip address [Link] 24
[*Switch] quit
[*Switch] interface vlanif 80
[*Switch-Vlanif80] ip address [Link] 24
[*Switch] quit
[*Switch] interface 10ge 1/0/1
[*Switch-10GE1/0/1] port link-type trunk
[*Switch-10GE1/0/1] port trunk allow-pass vlan 77
[*Switch-10GE1/0/1] quit
[*Switch] interface 10ge 1/0/2
[*Switch-10GE1/0/2] port link-type trunk
[*Switch-10GE1/0/2] port trunk allow-pass vlan 78
[*Switch-10GE1/0/2] quit
[*Switch] interface 10ge 1/0/3
[*Switch-10GE1/0/3] port link-type trunk
[*Switch-10GE1/0/3] port trunk allow-pass vlan 79
[*Switch-10GE1/0/3] quit
[*Switch] interface 10ge 1/0/4
[*Switch-10GE1/0/4] port link-type trunk
[*Switch-10GE1/0/4] port trunk allow-pass vlan 80
[*Switch-10GE1/0/4] quit
[*Switch] commit
[~Switch] quit

Step 2 Check the configuration rollback points and the difference between the historical and current
configurations.
# Check the configuration rollback points.
<Switch> display configuration commit list verbose

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 340

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

1) CommitId: 1000000006
Label: -
User: root
User-Intf: VTY 1
Type: CLI
TimeStamp: 2012-06-29 15:55:20
Description:

2) CommitId: 1000000005
Label: -
User: root
User-Intf: VTY 1
Type: CLI
TimeStamp: 2012-06-29 15:50:05
Description:

3) CommitId: 1000000004
Label: -
User: root
User-Intf: VTY 0
Type: CLI
TimeStamp: 2012-06-29 09:57:34
Description:

4) CommitId: 1000000003
Label: -
User: root
User-Intf: VTY 0
Type: CLI
TimeStamp: 2012-06-29 09:57:21
Description:

5) CommitId: 1000000002
Label: -
User: anonymous
User-Intf: CON 0
Type: CLI
TimeStamp: 2012-06-28 16:31:48
Description:

6) CommitId: 1000000001
Label: -
User: anonymous
User-Intf: CON 0
Type: CLI
TimeStamp: 2012-06-28 16:31:48
Description:

# Check the latest configuration change.

<Switch> display configuration commit changes last 1
Building configuration
#
+ vlan batch 77 to 80
#
+ interface Vlanif77
+ ip address [Link] [Link]
#
+ interface Vlanif78
+ ip address [Link] [Link]
#
+ interface Vlanif79
+ ip address [Link] [Link]
#
+ interface Vlanif80
+ ip address [Link] [Link]
#
interface 10GE1/0/1
+ port link-type trunk
+ port trunk allow-pass vlan 77

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 341

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

#
interface 10GE1/0/2
+ port link-type trunk
+ port trunk allow-pass vlan 78
#
interface 10GE1/0/3
+ port link-type trunk
+ port trunk allow-pass vlan 79
#
interface 10GE1/0/4
+ port link-type trunk
+ port trunk allow-pass vlan 80
#

Step 3 Roll back configurations.

# Roll system configurations back to what they were before the most recent configuration
rollback point was created.
<Switch> rollback configuration last 1
Warning: This operation will revert configuration changes to the previous status.
Continue? [Y/N]:y
Loading rollback changes
Committing
Check rollback result
Configuration rollback succeeded.
Please use 'display configuration commit changes last 1' to view the changes.

# Check whether a configuration rollback point is generated after the configuration rollback is
completed.
<Switch> display configuration commit list verbose
1) CommitId: 1000000007
Label: -
User: root
User-Intf: VTY 1
Type: ROLLBACK
TimeStamp: 2012-06-29 15:58:22
Description:

2) CommitId: 1000000006
Label: -
User: root
User-Intf: VTY 1
Type: CLI
TimeStamp: 2012-06-29 15:55:20
Description:

3) CommitId: 1000000005
Label: -
User: root
User-Intf: VTY 1
Type: CLI
TimeStamp: 2012-06-29 15:50:05
Description:

4) CommitId: 1000000004
Label: -
User: root
User-Intf: VTY 0
Type: CLI
TimeStamp: 2012-06-29 09:57:34
Description:

5) CommitId: 1000000003
Label: -
User: root
User-Intf: VTY 0
Type: CLI

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 342

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

TimeStamp: 2012-06-29 09:57:21

Description:

6) CommitId: 1000000002
Label: -
User: anonymous
User-Intf: CON 0
Type: CLI
TimeStamp: 2012-06-28 16:31:48
Description:

7) CommitId: 1000000001
Label: -
User: anonymous
User-Intf: CON 0
Type: CLI
TimeStamp: 2012-06-28 16:31:48
Description:

Step 4 Verify the configuration.

# Check the configuration file to verify that the configuration rollback is successful.
<Switch> display current-configuration interface
#
interface 10GE1/0/1
#
interface 10GE1/0/2
#
interface 10GE1/0/3
#
interface 10GE1/0/4
return

----End

Configuration Files
Switch configuration file
#
sysname Switch
#
interface 10GE1/0/1
#
interface 10GE1/0/2
#
interface 10GE1/0/3
#
interface 10GE1/0/4
#
return

8.6.4 Example of Configuring System Startup

Networking Requirements
As shown in Figure 8-5, the current system software cannot meet user needs. The device
must load new software version with more features. Then the device software needs to be
upgraded remotely.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 343

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

Figure 8-5 Configuring System Startup Networking

[Link]/24
Network

PC Device

Configuration Roadmap
The configuration roadmap is as follows:

1. Upload the new system software to the root directory of the device.
2. Save the current configuration so that it remains active after upgrade.
3. Specify the system software for next startup.
4. Specify the configuration file for next startup of the device.
5. Restart the device to complete upgrade.

Procedure
Step 1 Upload the new system software to the root directory of the device.

Before configuration, run the display startup command to view the files for next startup.
<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] quit
<Switch> display startup
MainBoard:
Configured startup system software: flash:/[Link]
Startup system software: flash:/[Link]
Next startup system software: flash:/[Link]
Startup saved-configuration file: flash:/[Link]
Next startup saved-configuration file: flash:/[Link]
Startup paf file: default
Next startup paf file: default
Startup patch package: NULL
Next startup patch package: NULL

# Upload the new system software to the device. This example uses FTP to transfer the
system software. Configure the device as an FTP server and upload the system software to the
device from the FTP client. Make sure there is enough space in the storage device before
uploading files. If the space is insufficient, delete unnecessary files to free up space in the
storage device.
<Switch> system-view
[Switch] ftp server enable
[Switch] aaa
[Switch-aaa] local-user huawei password irreversible-cipher Helloworld@6789
[Switch-aaa] local-user huawei service-type ftp
[Switch-aaa] local-user huawei ftp-directory flash:
[Switch-aaa] local-user huawei level 15
[Switch-aaa] commit
[Switch-aaa] quit
[Switch] quit

# Run the ftp [Link] command in the command line window of the PC to set up an FTP
connection with the device. Run the put command to upload new system software

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 344

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

[Link]. After the upload completes, run the dir command to check the system
software.
<Switch> dir
Directory of flash:/

Idx Attr Size(Byte) Date Time FileName

0 drw- - Apr 16 2012 13:19:58 logfile
1 -rw- 85,925,409 Apr 16 2012 13:18:02 [Link]
2 -rw- 4 Oct 27 2011 17:25:22 [Link]
3 -rw- 6,033 Jul 16 2012 16:40:02 [Link]
4 -rw- 3,275 Jul 14 2012 14:18:08 [Link]
5 drw- - Nov 14 2011 19:14:26 sysdrv
6 drw- 88,239,759 Jul 16 2012 19:14:26 [Link]
...

670,092 KB total (569,904 KB free)

Step 2 Save the current configuration to the default storage device.

<Switch> save
The current configuration will be written to the device.
Are you sure to continue? [Y/N]y
Now saving the current configuration to the slot 0 .
Info: Save the configuration successfully.

Step 3 Specify the system software to be loaded for next startup.

<Switch> startup system-software [Link]

Step 4 Specify the configuration file for next startup.

<Switch> startup saved-configuration [Link]

NOTE

In step 1, you can run the display startup command to check the configuration file for next startup. The
message "Next startup saved-configuration file: flash:/[Link]" will be displayed. This means the
[Link] configuration file has been specified for next startup, so you do not need to perform this step.
To specify another file for next startup, perform this step.

Step 5 Checking the configuration

# Run the following command to view the system software and configuration file for next
startup.
<Switch> display startup
MainBoard:
Configured startup system software: flash:/[Link]
Startup system software: flash:/[Link]
Next startup system software: flash:/[Link]
Startup saved-configuration file: flash:/[Link]
Next startup saved-configuration file: flash:/[Link]
Startup paf file: default
Next startup paf file: default
Startup patch package: NULL
Next startup patch package: NULL

Step 6 Restart the device.

# Since the configuration file has been saved, run the reboot fast command to restart the
device quickly.
<Switch> reboot fast
System will reboot! Continue? [Y/N]:y
Info: system is rebooting ,please wait...

Step 7 Verify the configuration.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 345

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 8 Configuring System Startup

# Wait for several minutes until the device restart is complete. Run the display version
command to check the current system version. If the current system software is new, the
upgrading has succeeded.
The display version command output is not provided here.

----End

Configuration File
#
FTP server enable
#
vlan batch 10
#
aaa
local-user huawei password irreversible-cipher $1c$g8wLJ`LjL!
$CyE(V{3qg5DdU:PM[6=6O$[Link],Q}>^)OBzgoU$
local-user huawei service-type ftp
local-user huawei level 15
local-user huawei ftp-directory flash:
#
interface Vlanif10
ip address [Link] [Link]
#
interface 10GE1/0/1
port link-type trunk
port trunk allow-pass vlan 10
#
return

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 346

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 9 ISSU Configuration

9 ISSU Configuration

About This Chapter

In-Service Software Upgrade (ISSU) minimizes the service interruption time during a system
upgrade to improve service reliability.

9.1 Introduction to ISSU

9.2 Principles
9.3 Configuration Notes
9.4 Configuring ISSU
9.5 Configuration Examples

9.1 Introduction to ISSU

Definition
In-Service Software Upgrade (ISSU) is a mechanism that upgrades the system software of a
stack or super virtual fabric (SVF) system while services are running. This mechanism
minimizes the service interruption time during system upgrades.

Purpose
On most networks, a device must be restarted after its system software is upgraded. The
restart interrupts services and traffic forwarding on the device. To relieve the impact of system
upgrades on services, you can set up multiple equal-cost links. Services can then be switched
to the backup links during a software upgrade. In this case, network configurations must be
modified, which increases the error probability and upgrade time. Additionally, services may
still be interrupted because some links may be too busy to transmit services.

ISSU provides a mechanism that allows a stack or SVF system to be upgraded while services
are running. This mechanism reduces the service interruption time during system upgrades.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 347

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 9 ISSU Configuration

Benefits
ISSU has the following advantages:
l Provides a simple and controllable upgrade mode.
l Effectively reduces the service interruption time caused by system upgrades.

9.2 Principles

ISSU Upgrade Process and Status

An ISSU upgrade goes through three phases:
1. ISSU check: The system checks whether the ISSU upgrade conditions are met. At the
ISSU check phase, the system performs compatibility checks, such as the environment
check, hardware and software compatibility check, and version file integrity and validity
check to determine whether the ISSU upgrade can be performed.
2. ISSU start: All member switches in a stack or SVF system upgrade their software to the
new version.
3. ISSU confirm: The system checks whether the upgrade is successful. The ISSU upgrade
is complete.

Figure 9-1 and Figure 9-2 show the ISSU upgrade processes in a stack and the SVF system
respectively.

Figure 9-1 ISSU upgrade flowchart in a stack

Master Master Standby Standby
1 2 3
Standby Standby Master Master
Slave Slave Slave Slave
Slave Slave Slave Slave

Slave Standby
4
Master Master
Standby Slave
Slave Slave

Old Version
New Version

The ISSU upgrade process in a stack is as follows:

1. The standby switch is upgraded. The standby switch restarts with the new system
software and retains its role after the start.
2. An active/standby switchover is performed. The master switch restarts internal processes
and becomes the standby switch. The original standby switch becomes the master switch.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 348

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 9 ISSU Configuration

3. Slave switches restart with the new system software in turn.

4. The standby switch (original master switch before the upgrade) restarts with the new
system software.

Figure 9-2 ISSU upgrade flowchart in an SVF system

Master Master Standby Standby
1 2 3
Standby Standby Master Master
Leaf Leaf Leaf Leaf
Leaf Leaf Leaf Leaf

Standby Standby
Master Master
Leaf Leaf
Leaf Leaf

Old Version
New Version

The ISSU upgrade process in an SVF system is as follows:

1. The standby parent switch is upgraded.
2. An active/standby switchover is performed. The master parent switch restarts internal
processes and becomes the standby parent switch. The original standby parent switch
becomes the master parent switch.
3. The standby parent switch (original master parent switch before the upgrade) restarts
with the new system software.
4. Leaf switches restart with the new system software in turn.

Version Rollback
ISSU provides a version rollback mechanism to allow a system to restore the previous version
during an ISSU upgrade. This mechanism reduces risks of version upgrades.

Currently, the following version rollback modes are supported:

l Rollback upon a failure
During an ISSU upgrade, the system rolls back to the previous version if the upgrade
fails.
l Rollback upon timeout
The rollback timer is activated when the upgrade enters the ISSU start phase. If the
upgrade is not complete before the rollback timer expires, the system rolls back to the
previous version.
l Manual rollback
After the ISSU start phase ends, you can run the issu abort command to terminate the
ISSU upgrade. The system then rolls back to the previous version.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 349

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 9 ISSU Configuration

9.3 Configuration Notes

Involved Network Elements

Other network elements are not required.

License Support
ISSU is a basic feature of a switch and is not under license control.

Version Support
For details, see Software Upgrade Path.

Feature Dependencies and Limitations

Features not supporting ISSU
When ISSU is used to upgrade the system software, services may be interrupted during an
ISSU upgrade or ISSU may fail because some features listed in Table 9-1 do not support
ISSU. You are advised to delete the configurations of these features before an ISSU upgrade.

Table 9-1 Features not supporting ISSU

Source Version Feature ISSU Support

V100R003C00SP GRE, FCoE, DCB, M-LAG These features do not support

C600 ISSU.

V100R005C00SP FCoE, DCB, M-LAG

C300
V100R005C10SP
C100
V100R005C10SP
C200

V100R006C00SP FCoE, DCB, M-LAG, Open

C600 System based on Linux container
V200R001C00SP technology
C700

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 350

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 9 ISSU Configuration

Source Version Feature ISSU Support

Notes:
l In V200R002C50 and later versions and VXLAN active-active or all-active access
scenarios, devices that have VXLAN active-active or all-active access configured can
be upgraded using ISSU.
l In TRILL active-active access scenarios, devices that have TRILL active-active access
configured cannot be upgraded using ISSU.
l Since V200R001C00, the remote mirroring function cannot be used with ISSU. The
remote mirroring function needs to be deleted from the switch in either of the following
situations:
– The switch needs to be upgraded from a version earlier than V200R001C00 to
V200R001C00 or later using ISSU.
– The switch needs to be upgraded from V200R001C00 or later using ISSU.

Precautions
Before performing an ISSU upgrade, ensure the following:
l The target system software has been uploaded to all member switches in a stack or to all
parent switches in an SVF system.
l Do not remove or reinstall optical module or power cycle the switch during an ISSU
upgrade.
l Ensure network stability and do not perform other service configurations on the network
during an ISSU upgrade.
l A standalone device cannot be upgraded using ISSU.
l A stack contains at least two member devices. If a stack contains three or more member
switches, only a stack connected in a ring topology can be upgraded using ISSU.
l In V100R006C00 and earlier versions, a stack of CE5855EI switches cannot be
upgraded using ISSU.
l A stack with more than two CE7850EI or CE6850HI switches cannot be upgrade from
V100R005C00SPC300 or V100R005C10SPC100 to V100R005C10SPC200 using ISSU.
l During the ISSU upgrade of a stack system, to ensure nonstop traffic forwarding, you
must use dual-homing networking. That is, connect ports on different cards to each other.
l During the ISSU upgrade of an SVF system, all the leaf switches must be dual-homed to
two parent switches.
l After the system resource mode is set to configurable in V100R003C00SPC600, a stack
of CE5850EIs cannot be upgraded to V100R005C00SPC300 using ISSU.
l When 40GE QSFP+ AOC cables are used for stack connections, the stack cannot be
upgraded using ISSU upgraded from a version earlier than V100R005C10 to
V100R005C10 or a later version.
l During an ISSU upgrade from V100R003C00 or V100R003C10 to a later version, after
port split is configured, the device is restarted to make the configuration take effect. If
the device is not restarted, the ISSU upgrade fails.
l When Layer 2 interconnection is implemented between data centers using EVN, backup
will be achieved among gateways of multiple data centers using VRRP, and VRRP
packets will be transparently transmitted over the EVN network. If you perform an ISSU

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 351

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 9 ISSU Configuration

upgrade, run the vrrp vrid 1 timer advertise 5 command to set the interval at which the
master and backup devices in the VRRP group send VRRP packets to 5s before
upgrading EVN devices. This configuration prevents the backup device from becoming
the master device during the ISSU upgrade.

Software Upgrade Path

An ISSU upgrade may fail due to differences in software versions. Table 9-2 describes the
software upgrade path.

Table 9-2 ISSU software upgrade path

Source Version Target Version System ISSU Support

V100R003C00SPC Stack system Supported

V100R003C00SPC500
600 SVF system Not supported

V100R003C10SPC Stack system Supported

100 SVF system Not supported
V100R003C00SPC600
V100R005C00SPC Stack system Supported
300 SVF system Not supported

V100R005C10SPC Stack system Supported

200 SVF system Not supported
V100R005C00SPC300
V100R006C00SPC Stack system Supported
600 SVF system Not supported

V100R005C10SPC Stack system Supported

200 SVF system Supported

V100R006C00SPC Stack system Supported

V100R005C10SPC100
600 SVF system Supported

V200R001C00SPC Stack system Supported

700 SVF system Supported

V200R001C00SPC Stack system Supported

700 SVF system Supported
V100R006C00SPC600
V200R002C50SPC Stack system Supported
800 SVF system Supported

V200R002C50SPC Stack system Supported

V200R001C00SPC700
800 SVF system Supported

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 352

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 9 ISSU Configuration

Source Version Target Version System ISSU Support

Notes
l If the upgrade path is not provided, ISSU upgrade is not supported.

9.4 Configuring ISSU

Pre-configuration Tasks
Before configuring ISSU, complete the following tasks:
l Uploading the target system software to all member switches in a stack or to all parent
switches in an SVF system

Configuration Process
Perform the following configuration tasks in sequence.

9.4.1 (Optional) Adding a Device to a Group

Context
During an ISSU upgrade of an SVF system, the system groups leaf switches and upgrades the
leaf switches in ascending order of their group IDs.

By default, the system adds a device to a default group. You can manually add a device to a
different group to change the sequence in which devices are restarted. Upstream and
downstream devices then connect to devices in different groups, reducing the service
interruption time.

NOTE

You can add only leaf switches in an SVF system but not slave switches in a stack to a specified group.

Procedure
Step 1 (Optional) Run the display issu group command in the user view to check to which group the
current device belongs.

Step 2 Run the issu group group-id add slot slot-id command in the user view to add a device to the
specified group.

By default, the system adds a device to a default group. You can run the issu group reset
command to restore the group to which the current device belongs to the default group.

----End

9.4.2 Checking ISSU Upgrade

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 353

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 9 ISSU Configuration

Context
At the ISSU check phase, the system performs compatibility checks, such as the environment
check, hardware and software compatibility check, and version file integrity and validity
check to determine whether the ISSU upgrade can be performed.

Procedure
Step 1 Run the issu check system-file [ patch patch-name ] command in the user view to check
whether the ISSU upgrade can be performed.
After the ISSU pre-upgrade check is complete, run the display issu check-result command in
the user view to view the ISSU pre-upgrade check result.

----End

9.4.3 Starting the ISSU Upgrade

Context
Two ISSU upgrade modes are available according to the upgrade confirmation mode:
l Automatically confirmed upgrade: The system confirms the ISSU upgrade after the
ISSU start phase ends, so you do not need to run the issu confirm command to confirm
the ISSU upgrade. This mode implements one-click upgrade.
l Manually confirmed upgrade: After the ISSU start phase ends, you need to run the issu
confirm command to confirm the ISSU upgrade before the rollback timer expires.
Otherwise, the system rolls back to the previous software version after the rollback timer
expires.

NOTE

During the ISSU upgrade, the remote connection will be interrupted. Wait for about 20 seconds and then log
in the device again.

Procedure
l Configure automatically confirmed upgrade.
a. Run the issu start system-file [ patch patch-name ] command in the user view to
start the ISSU upgrade.
l Configure manually confirmed upgrade.
a. Run the issu start rollback-timer [ time ] system-file [ patch patch-name ]
command in the user view to start the ISSU upgrade.
By default, the ISSU rollback timer is 120 minutes.
b. (Optional) Run the issu reset rollback-timer [ time | limitless ] command in the
user view to reset the value of the ISSU rollback timer.
The ISSU rollback timer starts timing when the ISSU upgrade enters the ISSU start
phase. If the timer expires before the ISSU upgrade enters the ISSU confirm phase,
the system rolls back to the previous software version. After the ISSU upgrade
enters the ISSU start phase, you can reset the value of the timer according to
network requirements. After the rollback timer value is set, the new timer value
takes effect and the old timer value does not take effect.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 354

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 9 ISSU Configuration

c. (Optional) Run the issu abort command in the user view to abort the ISSU upgrade
so that the system can roll back to the previous software version.

To abort an ISSU upgrade, run the issu abort command to abort the ISSU upgrade
after the ISSU start phase ends. You can run the display issu state command to
check whether the ISSU start phase ends. If the issu start field displays finished,
the ISSU start phase ends. The system then restarts and rolls back to the previous
software version.
d. Run the issu confirm command in the user view to confirm the ISSU upgrade.
NOTE

In a manually confirmed upgrade, run this command to confirm the ISSU upgrade before the
rollback timer expires. Otherwise, the system rolls back to the previous version.

----End

9.4.4 Checking the Configuration

Procedure
l Run the display issu state command in the user view to check which phase the ISSU
upgrade enters.
l Run the display issu rollback-timer command in the user view to check remaining time
of the ISSU rollback timer.
l Run the display issu report command in the user view to check detailed information
about the ISSU upgrade.

----End

9.5 Configuration Examples

This section only provides configuration examples for single features. For details about multi-
feature configuration cases, feature-specific configuration cases, interconnection cases,
protocol or hardware replacement cases, and industry application cases, see the Typical
Configuration Cases.

9.5.1 Example for Performing an ISSU Upgrade

Networking Requirements
As shown in Figure 9-3, a stack has two member devices, SwitchA and SwitchB, which
function as the master switch and standby switch. SwitchA at [Link]/24 functions as the
FTP server, and the PC at [Link]/24 functions as the FTP client. There are reachable routes
between the FTP server and client.

NOTE

FTP cannot ensure secure file transfer. If you require high network security, use SFTP.

The current system software version cannot meet users requirements and needs to be
upgraded, and the service interruption time caused by the upgrade must be minimized.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 355

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 9 ISSU Configuration

Figure 9-3 Networking of configuring the ISSU upgrade

FTP Server FTP Client

[Link]/24
Internet

SwitchA SwitchB PC
Master Standby [Link]/24

Configuration Roadmap
The configuration roadmap is as follows:
1. Upload the target system software to SwitchA and SwitchB.
2. Perform a pre-upgrade check to confirm that the system meets ISSU upgrade
requirements.
3. Start the ISSU upgrade.

Procedure
Step 1 Upload the target system software to SwitchA and SwitchB.
# Start FTP in the stack and set the FTP user name to ftpuser and password to
pWD@123456.
<HUAWEI> system-view
[~HUAWEI] ftp server enable
[*HUAWEI] commit
[~HUAWEI] aaa
[~HUAWEI-aaa] local-user ftpuser password irreversible-cipher pWD@123456
[*HUAWEI-aaa] local-user ftpuser service-type ftp
[*HUAWEI-aaa] local-user ftpuser level 3
[*HUAWEI-aaa] local-user ftpuser ftp-directory flash:/
[*HUAWEI-aaa] quit
[*HUAWEI] commit
[~HUAWEI] quit

# On the PC, initiate an FTP connection with SwitchA, enter the FTP user name and
password, and set the file transfer format to binary and the working directory to c:\temp.
C:\Documents and Settings\Administrator> ftp [Link]
Connected to [Link].
220 FTP service ready.
User ([Link]:(none)): ftpuser
331 Password required for ftpuser.
Password:
230 User logged in.
ftp> binary
200 Type set to I.
ftp> lcd c:\temp
Local directory now C:\temp.

# On the PC, upload the target system software and patch file from c:\temp to SwitchA.
ftp> put [Link]
200 Port command okay.
150 Opening BINARY mode data connection for /[Link].
226 Transfer complete
ftp> put [Link]
200 Port command okay.
150 Opening BINARY mode data connection for /[Link].
226 Transfer complete

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 356

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 9 ISSU Configuration

# Copy the target system software and patch file on SwitchA to SwitchB and SwitchC.
<HUAWEI> copy flash:/[Link] all#flash:/CE6850EI-
[Link]
Info: Are you sure to copy flash:/[Link] to all#flash:/
[Link]? [Y/N]:y
100% complete
Info: Copying file flash:/[Link] to all#flash:/CE6850EI-
[Link]...Done.
<HUAWEI> copy flash:/[Link] all#flash:/CE6850EI-
[Link]
Info: Are you sure to copy flash:/[Link] to all#flash:/
[Link]? [Y/N]:y
100% complete
Info: Copying file flash:/[Link] to all#flash:/CE6850EI-
[Link]...Done.

Step 2 Perform a pre-upgrade check.

<HUAWEI> issu check [Link] patch CE6850EI-
[Link]
Info: The system is prechecking...
.........
Info: The operation of prechecking is complete.
Info: The system is checking hardware compatibility...
Info: The operation of checking hardware compatibility is complete.
Info: The system is checking device state...
Info: The operation of checking device state is complete.
Info: The system is checking switchover state...
.
Info: The operation of checking switchover state is complete.
Info: The system is checking startup system software...
Info: The operation of checking startup system software is complete.
Info: The system is checking saved-configuration file...
Info: The operation of checking saved-configuration file is complete.
Info: The system is checking paf file...
Info: The operation of checking paf file is complete.
Info: The system is checking patch package...
Info: The operation of checking patch package is complete.
Info: The system is checking cpu performance...
Info: The operation of checking cpu performance is complete.
Info: The system is checking memory performance...
Info: The operation of checking memory performance is complete.
Info: The system is checking storage space...
Info: The operation of checking storage space is complete.
Info: The system is checking service compatibility...
............................
Info: The operation of checking service compatibility is complete.
Info: The system is checking the upgrade system software consistency...
......
...............................................
Info: The operation of checking the upgrade system software consistency is
complete.
Info: The upgrade procedure is:
Reboot the slave board with the upgrade system software.
Create standby process with the upgrade system software, and detailed process
groups are as follows:
process group: 10005 slot: 1
process group: 10006 slot: 1
Upgrade process with the upgrade system software, and detailed process groups
are as follows:
process group: 10005 slot: 1
process group: 10006 slot: 1
process group: 3 slot: 1
process group: 1000 slot: 1
process group: 10001 slot: 1
process group: 1002 slot: 1
process group: 1001 slot: 1
process group: 2 slot: 1

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 357

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 9 ISSU Configuration

process group: 10002 slot: 1

Reboot the master board with the upgrade system software.

# Check the ISSU check result after the check is complete.

<HUAWEI> display issu check
------------------------------ISSU CHECK RESULT-------------------------------
Check Date : 2015/08/15 15:10:15
Check Result : success
Upgrade type : lossy
Base package : [Link]
Upgrade package : [Link]
Upgrade patch : [Link]
Base paf : default
Upgrade paf : default

------------------------------------------------------------------------------
Info: The upgrade procedure is:
Reboot the slave board with the upgrade system software.
Create standby process with the upgrade system software, and detailed process
groups are as follows:
process group: 10005 slot: 1
process group: 10006 slot: 1
Upgrade process with the upgrade system software, and detailed process groups
are as follows:
process group: 10005 slot: 1
process group: 10006 slot: 1
process group: 3 slot: 1
process group: 1000 slot: 1
process group: 10001 slot: 1
process group: 1002 slot: 1
process group: 1001 slot: 1
process group: 2 slot: 1
process group: 10002 slot: 1
Reboot the master board with the upgrade system software.
------------------------------------------------------------------------------

Step 3 Start the ISSU upgrade.

# Start the ISSU upgrade and set the ISSU rollback timer value to 120 minutes.
<HUAWEI> issu start rollback-timer 120 [Link] patch
[Link]
Warning: The system upgrade will start, and the current configuration will be
saved as the next startup configuration file. Continue?
Please select [Y/N]: y
Now saving the current configuration............
Save the configuration successfully.
Info: The system is prechecking...
........
Info: The operation of prechecking is complete.
Info: The system is checking hardware compatibility...
Info: The operation of checking hardware compatibility is complete.
Info: The system is checking device state...
Info: The operation of checking device state is complete.
Info: The system is checking switchover state...
..
Info: The operation of checking switchover state is complete.
Info: The system is checking startup system software...
Info: The operation of checking startup system software is complete.
Info: The system is checking saved-configuration file...
Info: The operation of checking saved-configuration file is complete.
Info: The system is checking paf file...
Info: The operation of checking paf file is complete.
Info: The system is checking patch package...
Info: The operation of checking patch package is complete.
Info: The system is checking cpu performance...
Info: The operation of checking cpu performance is complete.
Info: The system is checking memory performance...
Info: The operation of checking memory performance is complete.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 358

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 9 ISSU Configuration

Info: The system is checking storage space...

Info: The operation of checking storage space is complete.
Info: The system is checking service compatibility...
............................
Info: The operation of checking service compatibility is complete.
Info: The system is checking the upgrade system software consistency...
...............................................
Info: The operation of checking the upgrade system software consistency is
complete.
Info: The upgrade procedure is:
Reboot the slave board with the upgrade system software.
Create standby process with the upgrade system software, and detailed process
groups are as follows:
process group: 10005 slot: 1
process group: 10006 slot: 1
Upgrade process with the upgrade system software, and detailed process groups
are as follows:
process group: 10005 slot: 1
process group: 10006 slot: 1
process group: 3 slot: 1
process group: 1000 slot: 1
process group: 10001 slot: 1
process group: 1002 slot: 1
process group: 1001 slot: 1
process group: 2 slot: 1
process group: 10002 slot: 1
Reboot the master board with the upgrade system software.
Warning: Do not deliver configuration or maintenance information, nor swap boards
in the system during upgrade phase.
Warning: The value of the upgrade rollback timer is 120 minutes. Please complete
the upgrade within 120 minutes.
Info: The system will roll back to the previous version if timeout or upgrade
failed.
Warning: The system upgrade will start. Continue?
Please select [Y/N]: y
Info: The system is preparing for issu...

NOTE

During the ISSU upgrade, the remote connection will be interrupted. Wait for about 20 seconds and then log
in the device again.

# After logging in to the device again, run the display issu state command to check the
upgrade progress.
<SwitchA> display issu state
--------------------------------------------------------------------------------
Phase State Progress
--------------------------------------------------------------------------------
[Link] check : finished 100%
[Link] start : finished 100%
[Link] confirm : - 0%
--------------------------------------------------------------------------------

# When the issu start status displays finished, the ISSU start phase ends. You can run the
issu confirm command to confirm the ISSU upgrade.

NOTE

During the ISSU upgrade, if the rollback timer value is set, confirm the ISSU upgrade before the rollback
timer expires. Otherwise, the system rolls back to the previous version.
<SwitchA> issu confirm
Info: Operating, please wait for a
moment............................................
Info: The upgrade is complete, and the system is running target system software.
done.

Step 4 Verify the configuration.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 359

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 9 ISSU Configuration

# Check the ISSU upgrade report.

<HUAWEI> display issu report
-----------------------------ISSU REPORT-----------------------------------
Upgrade number : 20150815164424
Upgrade result : success
Base package : [Link]
Upgrade package : [Link]
Upgrade patch : [Link]
Base paf : default
Upgrade paf : default
Upgrade rollback time(min) : 120

Upgrade start begin time : 2015/08/15 16:44:24

Upgrade start end time : 2015/08/15 17:02:11
Upgrade start total duration : 0 Hours 17 Minutes 47 Seconds

Upgrade confirm time : 2015/08/15 17:02:42

Upgrade abort time : --

---------------------------------------------------------------------------
Upgrade procedure details:
slot: 1 [reboot]
begin time: 2015/08/15 16:46:07
end time: 2015/08/15 16:54:26
duration: 0 Hours 8 Minutes 19 Seconds
slot: 2 [upgrade process]
process group: 10003
begin time: 2015/08/15 16:54:32
end time: 2015/08/15 16:56:04
duration: 0 Hours 1 Minutes 32 Seconds
slot: 2 [upgrade process]
process group: 10004
begin time: 2015/08/15 16:54:33
end time: 2015/08/15 16:56:04
duration: 0 Hours 1 Minutes 31 Seconds
slot: 2 [reset process]
process group: 3
begin time: 2015/08/15 16:54:59
end time: 2015/08/15 16:55:52
duration: 0 Hours 0 Minutes 53 Seconds
slot: 2 [reset process]
process group: 1000
begin time: 2015/08/15 16:54:59
end time: 2015/08/15 16:55:53
duration: 0 Hours 0 Minutes 54 Seconds
slot: 2 [reset process]
process group: 10001
begin time: 2015/08/15 16:54:59
end time: 2015/08/15 16:55:54
duration: 0 Hours 0 Minutes 55 Seconds
slot: 2 [reset process]
process group: 1002
begin time: 2015/08/15 16:54:59
end time: 2015/08/15 16:55:55
duration: 0 Hours 0 Minutes 56 Seconds
slot: 2 [reset process]
process group: 1001
begin time: 2015/08/15 16:54:59
end time: 2015/08/15 16:55:56
duration: 0 Hours 0 Minutes 57 Seconds
slot: 2 [reset process]
process group: 2
begin time: 2015/08/15 16:54:59
end time: 2015/08/15 16:55:57
duration: 0 Hours 0 Minutes 58 Seconds
slot: 2 [reset process]
process group: 10002
begin time: 2015/08/15 16:54:59
end time: 2015/08/15 16:55:58

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 360

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 9 ISSU Configuration

duration: 0 Hours 0 Minutes 59 Seconds

slot: 2 [reset process]
process group: 10003
begin time: 2015/08/15 16:54:59
end time: 2015/08/15 16:55:50
duration: 0 Hours 0 Minutes 51 Seconds
slot: 2 [reset process]
process group: 10004
begin time: 2015/08/15 16:54:59
end time: 2015/08/15 16:55:51
duration: 0 Hours 0 Minutes 52 Seconds
slot: 2 [reboot]
begin time: 2015/08/15 16:56:13
end time: 2015/08/15 17:00:09
duration: 0 Hours 3 Minutes 56 Seconds
---------------------------------------------------------------------------

# Run the display startup command to check whether the current system software version is
correct.
<HUAWEI> display startup
MainBoard:
Configured startup system software: flash:/[Link]
Startup system software: flash:/[Link]
Next startup system software: flash:/[Link]
Startup saved-configuration file: flash:/[Link]
Next startup saved-configuration file: flash:/[Link]
Startup paf file: default
Next startup paf file: default
Startup patch package: flash:/[Link]
Next startup patch package: flash:/[Link]
SlaveBoard:
Configured startup system software: flash:/[Link]
Startup system software: flash:/[Link]
Next startup system software: flash:/[Link]
Startup saved-configuration file: flash:/[Link]
Next startup saved-configuration file: flash:/[Link]
Startup paf file: default
Next startup paf file: default
Startup patch package: flash:/[Link]
Next startup patch package: flash:/[Link]

----End

Configuration Files
None

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 361

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

10 BIOS Menu

About This Chapter

The basic input/output system (BIOS) provides the configuration restoration and software
upgrade functions to ensure device security and implement basic device maintenance.
10.1 BIOS Menu Description
10.2 BIOS Memory Test Menu
10.3 BIOS Main Menu
10.4 Update from serial interface
10.5 Update from ethernet interface
10.6 Modify startup parameters
10.7 File system
10.8 DFX Submenu
10.9 Modify stack parameters

10.1 BIOS Menu Description

The basic input/output system (BIOS) is a firmware stored in the read-only memory (ROM)
chip of the device main board. The BIOS contains basic input/output programs, system
settings, power on self-test (POST) programs, and system automatic startup program.
You can use the BIOS menu to perform the following operations:
l Restore or upgrade the system when the system stops responding and the command line
interface (CLI) cannot be displayed.
l Back up the configuration file to prevent configuration loss.
l Change the password for accessing the BIOS menu, preventing unauthorized users from
accessing the BIOS menu.
l Access the BIOS menu to change the password for logging in to the device through the
console port when the login fails due to password loss.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 362

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

10.2 BIOS Memory Test Menu

You have logged in to the device using the console port.
NOTE

For details about how to log in to the device using the console port, see 6.2.1 Logging In to the Device
Through a Console Port. To use third-party terminal emulation software, set the communication
parameters correctly. If the parameter settings are incorrect, the BIOS menu operations will be abnormal
if you enter excess characters when operating the third party software through the BIOS menu.

Restart the device. When the following information is displayed, press CTRL+T within 3
seconds to enter the BIOS memory test menu for a system memory test.
Press CTRL+T for full memory test .............. 3

Memory Test Menu

1. Using default algorithm

2. Selecting specific algorithm (ECC off)
3. Selecting specific algorithm (ECC on)
4. Reboot

You have 30 seconds to select the submenu, the system will reboot when time is up.
Enter your choice(1-4): 3
[a] MSCAN ( 186s) [b] MARCH_SR ( 620s) [c] MARCH_LA ( 885s)
[d] MARCH_G ( 873s) [e] MARCH_LR ( 517s) [f] MARCH_RAW ( 1309s)
[g] MARCH_SS ( 964s) [h] MARCH_SL ( 1665s) [i] MARCH_U ( 516s)
[j] MARCH_B ( 493s) [k] MARCH_Y ( 117s) [l] MARCH_C- ( 346s)
[m] MOVI ( 582s) [n] MATS+ ( 157s) [o] MATS++ ( 240s)
[p] CHECKER ( 262s) [q] BUTTERFLY ( 801s) [r] SURROUND ( 1404s)
[s] PRBS-15 ( 21s) [t] PRBS-7 ( 3s) [u] QIOT ( 754s)
[v] PIN ( 0s) [w] ISSI ( 6186s) [x] NINESTEP ( 362s)
[y] INCREASE ( 101s) [0] Return To Upper Menu

You have 60 seconds to select the algorithm, the system will reboot when time is
up.
k t
NOW FULL MEMORY TEST ...........................start
Memory pin test start.
Memory pin DataBus test...........pass
Memory pin AddrBus test...........pass
Memory March y test start.
Memory March y test...............pass
Memory Prbs 7 test start.
Memory prbs 7 test................pass
Took time: 374s

The system will reboot after memory test ...

NOTICE
When the device is running normally, it not recommended to perform a memory test.
After a memory test is complete, the device restarts.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 363

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

Table 10-1 Description of output information on the memory test menu

Item Description

1. Using default algorithm The default algorithm is used to perform a

memory test.
By default, five types of algorithms are used to
perform a memory test, including
MARCH_LR, MARCH_SS, MARCH_C-,
PRBS-7, QIOT, and PIN.

2. Selecting specific algorithm (ECC off) A specified algorithm is selected to perform a

memory test, and error correcting code (ECC)
is disabled.
You can select one or multiple algorithms. To
select multiple algorithms, input the
corresponding algorithm options continuously,
and then press Enter. A memory test starts.

3. Selecting specific algorithm (ECC on) A specified algorithm is selected to perform a

memory test, and error correcting code (ECC)
is started.
You can select one or multiple algorithms. To
select multiple algorithms, input the
corresponding algorithm options continuously,
and then press Enter. A memory test starts.

4. Reboot The device restarts after this operation is

performed.

10.3 BIOS Main Menu

You have logged in to the device using the console port.
NOTE

For details about how to log in to the device using the console port, see 6.2.1 Logging In to the Device
Through a Console Port. To use third-party terminal emulation software, set the communication
parameters correctly. If the parameter settings are incorrect, the third-party software may enter excess
characters, leading to abnormal BIOS menu functions.

Restart the device. When the message Press CTRL+T for full memory test is displayed,
press Ctrl+T in 3 seconds to perform a memory test. If you do not need to test the memory,
no action is required. When the message Press CTRL+B to enter BIOS menu is displayed,
press Ctrl+B in 3 seconds to enter the BIOS main menu. The following example shows
information displayed on a CE6850EI. Information displayed on other models may be
different.

NOTICE
When the device is properly running, a memory test is not recommended.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 364

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

Press CTRL+T for full memory test .............. skip

Starting ...

Press CTRL+B to enter BIOS menu: 1

Password:
Info: The entered password is the same as the default one. You are advised to
change the password to ensure security.

BIOS Menu (Version: 281)

1. Continue to boot
2. Update from serial interface
3. Update from ethernet interface
4. Modify startup parameters
5. File system
6. Modify BIOS password
7. Modify console password
8. Restore factory defaults
9. Reboot

Enter your choice(1-9):

The leaf switches in a super virtual fabric (SVF) system support the 6. Modify stack
parameters menu. The menu is used to select the device's working mode. For details, see
10.9 Modify stack parameters. The BIOS menu is as follows:
BIOS Menu (Version: 281)

1. Continue to boot
2. Update from serial interface
3. Update from ethernet interface
4. Modify startup parameters
5. File system
6. Modify stack parameters
7. Modify BIOS password
8. Modify console password
9. Restore factory defaults
10. Reboot

Enter your choice(1-10):

NOTE

The description in Table 10-2 uses the information displayed on a CE6850EI as an example. Perform
operations according to the BIOS menu supported by the device.

Table 10-2 BIOS main menu

Item Description

Press CTRL+T for full memory test Press Ctrl+T in 3 seconds to perform a
memory test.
Perform this operation during the installation or
maintenance. The memory test is not a risky
operation but takes a long time. When the
device is properly running, a memory test is
not recommended.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 365

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

Item Description

Press CTRL+B to enter BIOS menu Press Ctrl+B within 3 seconds to access the
BIOS main menu.
You can access the BIOS main menu to
perform operations such as the device upgrade
when failing to access the CLI on the device.

Password Enter the password for accessing the BIOS

menu. The default password is
Admin@[Link].
If you enter incorrect passwords for three
consecutive times, the system restarts.
To change the password, select Modify BIOS
password.
NOTE
You can run the reset boot password command in
the CLI to restore the default password of the BIOS
menu.
You are advised to change the password in a timely
manner and update the password periodically after
login to prevent unauthorized users from entering the
BIOS menu.

1. Continue to boot Select this item to quickly start the device.

This operation does not restart the BIOS, but
continues to start the system.

2. Update from serial interface Access the serial interface submenu to update
the complex programmable logical device
(CPLD) or modify the serial interface rate.
This operation can be performed after a PC is
connected to the device using the serial
interface, without other configuration.
However, the file transfer speed is low.

3. Update from ethernet interface Access the Ethernet interface submenu to

change the system software or patch file.
This operation features fast file transfer, but
you must configure network parameters and
Trivial File Transfer Protocol (TFTP) server to
ensure that the route between the device and
TFTP server is reachable.

4. Modify startup parameters Access the startup submenu to view or modify

startup configuration.

5. File system Access the file system submenu to view or

back up files in the file system.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 366

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

Item Description

6. Modify BIOS password Access this submenu to change the password

for accessing the BIOS menu, preventing
unauthorized users from accessing the BIOS
menu.

7. Modify console password Access this submenu to change the password

for logging in to the device through the console
port when the login fails due to password loss.
When a new console password must be set
after the restart information is displayed, press
Y. The device continues to start. After the
device starts, authentication is not required
when logging in to the device through the
console port, but you need to change the
console port password in time.
NOTE
After the device starts, you can log in to the device
through the console port without entering the
password only this time. The original console port
login password is still saved in the configuration file.
After logging in to the device, configure a new
console port login password immediately; otherwise,
you still need to enter the original password when
logging in to the device through the console port the
next time.

8. Restore factory defaults Clear the current configuration of the device

and restore the factory settings in specified
scenarios, for example, when the device needs
to bear new services.
After you select this submenu, the device
performs the following operations:
l Clear the configuration file and data.
l Reserve the running system software and
patch file for the next startup.
When this operation will delete all data and
reset all settings information is displayed, press
Y. The factory settings are restored. Execute
caution when clearing the configuration file
and data, because they cannot be restored. You
are advised to perform this operation with the
instructions of technical support personnel.

9. Reboot After you select 9. Reboot, the BIOS restarts

and the system continues to start. In most
cases, you are advised not to perform this
operation.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 367

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

Item Description

DFX Submenu Enter Ctrl+E in the BIOS menu to enter the

DFX submenu. In the DFX submenu, you can
view the MAC address and electrical label of
the device.

Shortcut key The BIOS menu provides two shortcut keys:

Ctrl+M, Ctrl+J. The two shortcut keys can be
used in any BIOS menu to provide functions
similar to Enter.

10.4 Update from serial interface

Access the BIOS main menu and select 2 to access the serial interface submenu. The
following example shows information displayed on a CE6850EI. Information displayed on
other models may be different.
BIOS Menu (Version: 281)

1. Continue to boot
2. Update from serial interface
3. Update from ethernet interface
4. Modify startup parameters
5. File system
6. Modify BIOS password
7. Modify console password
8. Restore factory defaults
9. Reboot

Enter your choice(1-9): 2

Serial Submenu

1. Update CPLD
2. Modify baud rate
3. Return

Enter your choice(1-3):

Table 10-3 Serial interface submenu

Item Description

1. Update CPLD Update the CPLD through the serial interface.

NOTE
You are advised to update the CPLD with the instructions of
technical support personnel.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 368

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

Item Description

2. Modify baud rate Modify the transmission rate on the serial interface. The
default transmission rate is 9600 bit/s.
The serial interface supports the following transmission
rates:
l 9600 bit/s
l 19200 bit/s
l 38400 bit/s
l 57600 bit/s
l 115200 bit/s
After the transmission rate on the serial interface is
modified, synchronize the transmission rate on the PC to
that on the serial interface and re-establish the connection.

3. Return Return to the BIOS main menu.

10.5 Update from ethernet interface

Access the BIOS main menu and select 3 to access the Ethernet interface submenu. The
following example shows information displayed on a CE6850EI. Information displayed on
other models may be different.
BIOS Menu (Version: 281)

1. Continue to boot
2. Update from serial interface
3. Update from ethernet interface
4. Modify startup parameters
5. File system
6. Modify BIOS password
7. Modify console password
8. Restore factory defaults
9. Reboot

Enter your choice(1-9): 3

Ethernet Submenu

1. Update CPLD
2. Update system software
3. Update system software with disk format
4. Modify parameters
5. Return

Enter your choice(1-5):

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 369

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

Table 10-4 Ethernet interface submenu

Item Description

1. Update CPLD Update the CPLD through the Ethernet interface.

NOTE
You are advised to update the CPLD with the instructions of
technical support personnel.

2. Update system software Start the system software and patch file through the
Ethernet interface.
When no system software or patch file exists in the storage
medium, access this menu to download the required file
from the server and specify the downloaded file for the
next startup.

3. Update system software Format the storage medium and start the system software
with disk format and patch file through the Ethernet interface.
When the system version is incompatible or the device
cannot be started using the menu Update system software,
access this menu to format the system software or patch
file.

4. Modify parameters Set Ethernet interface parameters before downloading or

uploading files.

5. Return Return to the BIOS main menu.

10.5.1 Update system software

Access the Ethernet interface submenu and select 2 to access the menu for updating system
software. The following example shows information displayed on a CE6850EI. Information
displayed on other models may be different.
Ethernet Submenu

1. Update CPLD
2. Update system software
3. Update system software with disk format
4. Modify parameters
5. Return

Enter your choice(1-5): 2

Please check network parameters:
'.' = clear field; '-' = go to previous field; Ctrl+C = quit
FTP type : TFTP
Server IP address : [Link] -
Switch IP address : [Link] -
Network Mask : [Link] -

Current startup file is "[Link]".

Please input file name: [Link]

Current patch file is "[Link]".

Please input patch name: [Link]

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 370

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

If the device supports the combo interface, the menu for modifying parameters contains the
MEth port field, as shown in the following menu.
Please check network parameters:
'.' = clear field; '-' = go to previous field; Ctrl+C = quit
FTP type : TFTP
MEth port : MEth1 -
Server IP address : [Link] -
Switch IP address : [Link] -
Network Mask : [Link] -

Values of Ethernet interface parameters cannot contain spaces. The values must be numerals.
To delete the current setting, enter a period (.). To return to the preceding setting, enter a
hyphen (-). To cancel the configuration, press Ctrl+C. The Ethernet interface parameters are
as follows:
l MEth port: indicates a management interface. To select MEth1, enter 1. To select
MEth2, enter 2.
l Server IP address: indicates the IP address of the server.
l Switch IP address: indicates the IP address of the Ethernet interface on the device.
l Network Mask: indicates the subnet mask.
NOTE

The preceding Ethernet interface parameters (192.168.X.X is a private IP address.) are set during the
factory acceptance test. The output provided here is used for reference only. The actual output
information may differ from the preceding information. You can set the Ethernet interface parameters as
required.

Before accessing this menu, modify Ethernet interface parameters. After accessing this
menu, enter the required system software and patch file.
The device downloads the specified files from the server and starts using the specified system
software and patch file.

NOTE

If you do not need specify the new system software or patch file, press Enter and continue operations.
The device starts using the running system software or patch file.
When the device downloads a file, consecutive asterisks (#) are displayed. If the letter T is consecutively
displayed, the network is not properly connected. Check the network connectivity and try again.
Do not stop the TFTP server program when the device is loading a file.

10.5.2 Update system software with disk format

Access the Ethernet interface submenu and select 3 to access the menu for updating system
software in disk format mode. The following example shows information displayed on a
CE6850EI. Information displayed on other models may be different.

NOTICE
After the storage medium is formatted through the Ethernet interface, all data in the storage
medium, including history system software and configuration files, is deleted. Exercise
caution when formatting the storage medium.

Ethernet Submenu

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 371

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

1. Update CPLD
2. Update system software
3. Update system software with disk format
4. Modify parameters
5. Return

Enter your choice(1-5): 3

Warning: This operation will delete all system data in the flash.
Continue now? Yes(y) or No(n): y
Please check network parameters:
'.' = clear field; '-' = go to previous field; Ctrl+C = quit
FTP type : TFTP
Server IP address : [Link] -
Switch IP address : [Link] -
Network Mask : [Link] -

Current startup file is "[Link]".

Please input file name: [Link]

Current patch file is "[Link]".

Please input patch name: [Link]

If the device supports the combo interface, the menu for modifying parameters contains the
MEth port field, as shown in the following menu.
Please check network parameters:
'.' = clear field; '-' = go to previous field; Ctrl+C = quit
FTP type : TFTP
MEth port : MEth1 -
Server IP address : [Link] -
Switch IP address : [Link] -
Network Mask : [Link] -

Values of Ethernet interface parameters cannot contain spaces. The values must be numerals.
To delete the current setting, enter a period (.). To return to the preceding setting, enter a
hyphen (-). To cancel the configuration, press Ctrl+C. The Ethernet interface parameters are
as follows:
l MEth port: indicates a management interface. To select MEth1, enter 1. To select
MEth2, enter 2.
l Server IP address: indicates the IP address of the server.
l Switch IP address: indicates the IP address of the Ethernet interface on the device.
l Network Mask: indicates the subnet mask.
NOTE

The preceding Ethernet interface parameters (192.168.X.X is a private IP address.) are set during the
factory acceptance test. The output provided here is used for reference only. The actual output
information may differ from the preceding information. You can set the Ethernet interface parameters as
required.

Before accessing this menu, modify Ethernet interface parameters. After accessing this
menu, enter the required system software and patch file.

The storage medium is formatted, and then the device downloads the specified files from the
server and starts using the specified system software and patch file.

NOTE

When the device downloads a file, consecutive asterisks (#) are displayed. If the letter T is consecutively
displayed, the network is not properly connected. Check the network connectivity and try again.
Do not stop the TFTP server program when the device is loading a file.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 372

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

10.5.3 Modifying Parameters

Access the Ethernet interface submenu and select 4 to access the menu for modifying
parameters. The following example shows information displayed on a CE6850EI. Information
displayed on other models may be different.
Ethernet Submenu

1. Update CPLD
2. Update system software
3. Update system software with disk format
4. Modify parameters
5. Return

Enter your choice(1-5): 4

Please check network parameters:
'.' = clear field; '-' = go to previous field; Ctrl+C = quit
FTP type : TFTP
Server IP address : [Link] -
Switch IP address : [Link] -
Network Mask : [Link] -

If the device supports the combo interface, the menu for modifying parameters contains the
MEth port field, as shown in the following menu.
Please check network parameters:
'.' = clear field; '-' = go to previous field; Ctrl+C = quit
FTP type : TFTP
MEth port : MEth1 -
Server IP address : [Link] -
Switch IP address : [Link] -
Network Mask : [Link] -

l Values of Ethernet interface parameters cannot contain spaces. The values must be
numerals. To delete the current setting, enter a period (.). To return to the preceding
setting, enter a hyphen (-). To cancel the configuration, press Ctrl+C. The Ethernet
interface parameters are as follows:
– MEth port: indicates a management interface. To select MEth1, enter 1. To select
MEth2, enter 2.
– Server IP address: indicates the IP address of the server.
– Switch IP address: indicates the IP address of the Ethernet interface on the device.
– Network Mask: indicates the subnet mask.
NOTE

The preceding Ethernet interface parameters (192.168.X.X is a private IP address.) are set during
the factory acceptance test. The output provided here is used for reference only. The actual output
information may differ from the preceding information. You can set the Ethernet interface
parameters as required.
l Run the transfer protocol program on the PC and specify the directory where the system
software or patch file is stored. The following uses TFTP program as an example.
NOTE

The TFTP server program is not installed on the device. Customers need to buy the TFTP server
program and install it. The TFTPD32 program is recommended.
Run the TFTP server program on a PC and set the TFTP server parameters, as shown in
Figure 10-1.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 373

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

Figure 10-1 Setting the TFTP server

– Current Directory: Click Browse and specify the directory for storing files to be
uploaded or downloaded.
– Server interfaces: Enter the TFTP server IP address, for example, [Link].
Generally, the system automatically sets this IP address.

10.6 Modify startup parameters

Access the BIOS main menu and select 4 to access the startup submenu. The following
example shows information displayed on a CE6850EI. Information displayed on other models
may be different.
BIOS Menu (Version: 281)

1. Continue to boot
2. Update from serial interface
3. Update from ethernet interface
4. Modify startup parameters
5. File system
6. Modify BIOS password
7. Modify console password
8. Restore factory defaults
9. Reboot

Enter your choice(1-9): 4

Startup Submenu

1. Display current startup configuration

2. Modify startup configuration

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 374

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

3. Return

Enter your choice(1-3):

Table 10-5 Startup submenu

Item Description

1. Display current startup Display the system software, configuration file, and
configuration patch file for startup.
You can view the system software, configuration file,
and patch file for the next startup before system
upgrade or rollback.

2. Modify startup Modify the system software, configuration file, and

configuration patch file for startup.
You can specify the system software, configuration file,
and patch file for the next startup before system
upgrade or rollback.

3. Return Return to the BIOS main menu.

10.6.1 Display current startup configuration

Enter the startup submenu and select 1 to access the menu for displaying the current startup
configuration.
Startup Submenu

1. Display current startup configuration

2. Modify startup configuration
3. Return

Enter your choice(1-3): 1

Current boot disk : flash
Current startup file : [Link]
Current config file : [Link]
Current patch file : [Link]

The system software, configuration file, and patch file for device startup are displayed.

10.6.2 Modify startup configuration

Enter the startup submenu and select 2 to access the menu for modifying the startup
configuration.
Startup Submenu

1. Display current startup configuration

2. Modify startup configuration
3. Return

Enter your choice(1-3): 2

'.' = clear field; Ctrl+C = quit; Enter = use current
configuration

Current startup file is "[Link]", modify the file name if needed.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 375

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

Input the new file name: [Link]

The startup file has been modified from "[Link]" to "[Link]".

Current config file is "[Link]", modify the file name if needed.

Input the new file name: [Link]
The config file has been modified from "[Link]" to "[Link]".

Current patch file is "[Link]", modify the file name if needed.

Input the new file name: [Link]
The patch file has been modified from "[Link]" to "[Link]".

The system software, configuration file, and patch file must exist in the storage medium.
Otherwise, the configuration fails.
To clear the current value, enter a period (.). To cancel the operation under the Modify
startup configuration menu, press Ctrl+C. To make the configuration take effect, press
Enter.

NOTE

If you do not need specify the new system software, configuration file, or patch file, press Enter and
continue operations. The device starts using the running system software, configuration file, or patch
file.

10.7 File system

Access the BIOS main menu and select 5 to access the file system submenu. The following
example shows information displayed on a CE6850EI. Information displayed on other models
may be different.
BIOS Menu (Version: 281)

1. Continue to boot
2. Update from serial interface
3. Update from ethernet interface
4. Modify startup parameters
5. File system
6. Modify BIOS password
7. Modify console password
8. Restore factory defaults
9. Reboot

Enter your choice(1-9): 5

File system Submenu

1. List flash files

2. Upload file to server
3. Return

Enter your choice(1-3):

Table 10-6 File system submenu

Item Description

1. List flash files Display all files in the flash memory.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 376

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

Item Description

2. Upload file to server Back up files to the server through the Ethernet
interface.
You can select this item to back up the system software,
configuration file, and patch file in the storage medium
before formatting the storage medium.

3. Return Return to the BIOS main menu.

10.7.1 Upload file to server

Enter the file system submenu and select 2 to access the menu for uploading files to the
server. The following example shows information displayed on a CE6850EI. Information
displayed on other models may be different.
File system Submenu

1. List flash files

2. Upload file to server
3. Return

Enter your choice(1-3): 2

Please check network parameters:
'.' = clear field; '-' = go to previous field; Ctrl+C = quit
FTP type : TFTP
Server IP address : [Link] -
Switch IP address : [Link] -
Network Mask : [Link] -

Please input file name: [Link]

If the device supports the combo interface, the menu for modifying parameters contains the
MEth port field, as shown in the following menu.
Please check network parameters:
'.' = clear field; '-' = go to previous field; Ctrl+C = quit
FTP type : TFTP
MEth port : MEth1 -
Server IP address : [Link] -
Switch IP address : [Link] -
Network Mask : [Link] -

Values of Ethernet interface parameters cannot contain spaces. The values must be numerals.
To delete the current setting, enter a period (.). To return to the preceding setting, enter a
hyphen (-). To cancel the configuration, press Ctrl+C. The Ethernet interface parameters are
as follows:
l MEth port: indicates a management interface. To select MEth1, enter 1. To select
MEth2, enter 2.
l Server IP address: indicates the IP address of the server.
l Switch IP address: indicates the IP address of the Ethernet interface on the device.
l Network Mask: indicates the subnet mask.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 377

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

NOTE

The preceding Ethernet interface parameters (192.168.X.X is a private IP address.) are set during the
factory acceptance test. The output provided here is used for reference only. The actual output
information may differ from the preceding information. You can set the Ethernet interface parameters as
required.

Before uploading files in the storage medium to the server, check files in the storage medium
by referring to 1. List flash files and set Ethernet interface parameters. For details about
Ethernet interface parameters, see Modify parameters.

10.8 DFX Submenu

Enter the BIOS main menu. Press Ctrl+E to enter the DFX submenu. The following example
shows information displayed on a CE6850EI. Information displayed on other models may be
different.
BIOS Menu (Version: 281)

1. Continue to boot
2. Update from serial interface
3. Update from ethernet interface
4. Modify startup parameters
5. File system
6. Modify BIOS password
7. Modify console password
8. Restore factory defaults
9. Reboot

Enter your choice(1-9):

******************************************************************
* You have entered Engineering Mode. In this mode, any operation *
* may cause irreversible damage to the device. Please note! *
******************************************************************

DFX Submenu

1. Display board MAC address

2. Display board E-Label
3. Return

Enter your choice(1-3):

Table 10-7 DFX output information description

Item Description

1. Display board MAC address Display the MAC address of a device.

2. Display board E-Label Display the electronic label of a device.

3. Return Return to the main menu.

10.9 Modify stack parameters

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 378

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

NOTE

Only the leaf switches in a super virtual fabric (SVF) system have this menu.

Access the BIOS main menu and select 6 to access the submenu for selecting the working
mode. The following example shows information displayed on a CE6810EI. Information
displayed on other models may be different.
6

Stack Submenu

1. Display current stack configuration

2. Modify stack configuration
3. Return

Enter your choice(1-3): 1

Current stack mode : Leaf mode
Current leaf uplink-port type : Auto negotiation mode

Stack Submenu

1. Display current stack configuration

2. Modify stack configuration
3. Return

Enter your choice(1-3): 2

Ctrl+C = quit; Enter = use current configuration

Current stack mode is "Leaf mode", modify the mode if needed.

1. Auto negotiation mode

2. Stack mode
3. Leaf mode(current)

Enter your choice(1-3): 3

Current leaf uplink-port type is "Auto negotiation mode", modify the type if
needed.

1. Auto negotiation mode(current)

2. 10GE
3. 40GE

Enter your choice(1-3): 1

Stack Submenu

1. Display current stack configuration

2. Modify stack configuration
3. Return

Enter your choice(1-3):

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 379

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches
Configuration Guide - Basic Configuration 10 BIOS Menu

Table 10-8 Working mode selection submenu

Item Description

1. Display current stack configuration Display the current working mode

configuration, including two options:
l Current stack mode: indicates the current
working mode. Auto negotiation mode,
Stack mode indicates common switch
mode, Leaf mode indicates leaf switch
mode.
l Current leaf uplink-port type: indicates the
type of the current interface that uplink
connects the device to a parent switch.

2. Modify stack configuration Modify the working mode or type of the

interface that uplink connects the device to a
parent switch. After the modification, the
system returns to the working mode selection
submenu.
l Modify the working mode: Auto
negotiation mode, Stack mode indicates
common switch mode, Leaf mode indicates
leaf switch mode.
l Modify the type of the interface that uplink
connects the device to a parent switch.
NOTE
current indicates the current device status.

3. Return Return to the main menu.

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 380

Copyright © Huawei Technologies Co., Ltd.
CloudEngine 8800&7800&6800&5800 Series Switches 11 Checking Declaration Information of an Open Source
Configuration Guide - Basic Configuration Software

11 Checking Declaration Information of an

Open Source Software

Context
The declaration information of an open source software includes the following items:
l Warranty Disclaimer
l Copyright Notice
l Written Offer

Procedure
l Run the display copyright command to check declaration information of an open source
software.
----End

Issue 05 (2017-05-08) Huawei Proprietary and Confidential 381

Copyright © Huawei Technologies Co., Ltd.