con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 # wlan ac # return con 0 authentication-mode password user-interface vty 0 4 authentication-mode aaa user-interface vty con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 # wlan ac # return con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 # wlan ac # return con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 # wlan ac # return
AAA:认证、授权、计费的作用 1、认证模式为AAA [Huawei]user-interface vty 0 4 [Huawei-ui-vty0-4]authentication-mode ? Huawei-ui-vty0-4]authentication-mode aaa --将telnet的认证模式改为AAA认证,默认时密码认证 [Huawei-ui-vty0-4]dis th [V200R003C00] # user-interface con 0 authentication-mode password user-interface vty 0 4 authentication-mode aaa user privilege level 3 user-interface vty 16 20 # return 2、在AAA视图下添加telnet用户huawei、guest [huawei]aaa --进入aaa视图 [Huawei-aaa
con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 # wlan ac # return con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 # wlan ac # return con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 # wlan ac # return con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 # wlan ac # return con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 # wlan ac # return
service-type telnet // 必须配置 ———————————- 示例:当有多个vty 时默认是从vty 0 3开始 在其中没有配置而只在vty4上配置 会导致tel 本机不成功,试验测试结论 user-interface vty 0 3 user-interface vty 4 authentication-mode aaa user privilege level 15 — ————————— ——————————————— 远程登录配置: user-interface maximum-vty 8 user-interface vty 0 7 authentication-mode aaa GigabitEthernet0/0/0 ip address 10.0.0.2 255.255.255.0 # # 使能Telnet服务器功能 telnet server enable(华为设备很多默认开启) user-interface user privilege level 15 idle-timeout 10 0 user-interface vty 4 user-interface vty 16 20 发布者:全栈程序员栈长
禁止分配的IP dhcp server forbidden-ip198.198.199.254 dhcp server forbidden-ip198.198.199.253 dhcp enable user-interface con 0 user-interface vty 0 4 authentication-mode scheme user privilege level 3 ##################### vlan all port link-aggregation group 1 # # ip route-static 137.78.6.0255.255.255.0 198.198.198.147 user-interface aux 0 user-interface vty 0 4 authentication-mode scheme user-interface vty 5 15 return
console 0 authentication-mode none //采用none进行认证 User privilege level 3 2、基于password的console的配置 User-interface console的配置 Local-user XXX Password simple/cipher h3c //密码认证方式二选一 Service-type terminal level 3 //终端登陆等级 User-interface console 0 Authentication-mode scheme H3c之VTY配置 1、 基于none的vty配置 User-interface vty 0 4 Authentication-mode none telnet server enable User privilege level 3 2、 基于password的vty配置 User-interface vty 0 4 Authentication-mode User privilege level 3 telnet server enable 3、 基于scheme的vty配置 Local-user XXX Password cipher cisco User-interface
255.255.255.255 # ip route-static 0.0.0.0 0.0.0.0 10.1.1.2 # load xml-configuration # user-interface con 0 user-interface vty 0 4 # Return [R1]dis nat session There are currently 4 NAT sessions: Protocol con 0 user-interface vty 0 4 # Return [R2]dis ip routing-table Routing Tables: Public Destinations con 0 user-interface vty 0 4 # Return [R3] dis ip routing-table Routing Tables: Public con 0 user-interface vty 0 4 # Return [R4] dis ip routing-table Routing Tables: Public
ospf 1 area 0.0.0.0 network 1.1.1.1 0.0.0.0 network 11.11.11.11 0.0.0.0 # FTP server enable # user-interface con 0 user-interface aux 0 user-interface vty 0 4 authentication-mode scheme # return -------------- ip route-static ***-instance B 192.168.10.0 255.255.255.0 ***-instance A 1.1.1.6 preference 60 # user-interface con 0 user-interface aux 0 user-interface vty 0 4 authentication-mode scheme # return -------------- con 0 user-interface aux 0 user-interface vty 0 4 authentication-mode scheme # return [MCE] ------
255.255.0.0 # interface NULL0 # ip route-static 0.0.0.0 0.0.0.0 电信给的外网网关 # load xml-configuration # user-interface con 0 user-interface tty 13 user-interface aux 0 user-interface vty 0 4 user privilege level 3 authentication-mode
FTP server enable # ip route-static 0.0.0.0 0.0.0.0 10.10.10.5 preference 60 --创建默认路由,华为默认优先级为60 # user-interface con 0 user-interface aux 0 user-interface vty 0 4 set authentication password simple admin
% # 配置用户认证方式telnet(vty 0-4)[H3C_TEST]user-interface vty 0 4[H3C_TEST-ui-vty0-4]authentication-mode scheme 1监控display、debugging 2配置所有配置命令(管理级的命令除外) 3管理文件系统命令、FTP命令、TFTP命令、XMODEM命令 telnet仅用密码登录,管理员权限[Router]user-interface simple manage[Router]local-user manage service-type telnet[Router]local-user manage level 2[Router]user-interface vty 0 4[Router-ui-vty0-4]authentication-mode local对console口设置密码,登录后使用管理员权限[Router]user-interface con simple manage[Router]local-user manage service-type terminal[Router]local-user manage level 2[Router]user-interface
con 0 authentication-mode aaa user-interface vty 0 4 authentication-mode aaa protocol inbound ssh user-interface vty 16 20 # pki realm default # sa # location # multi-linkif mode proportion-of-weight con 0 authentication-mode aaa user-interface vty 0 4 authentication-mode aaa protocol inbound ssh user-interface vty 16 20 # pki realm default # sa # location # multi-linkif mode proportion-of-weight con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 # wlan ac # return
# interface GigabitEthernet0/0/23 # interface GigabitEthernet0/0/24 # interface NULL0 # user-interface con 0 user-interface vty 0 4 # return [S5700-A] 2.S5700-B交换机配置 [S5700-B]dis cur # sysname con 0 user-interface vty 0 4 # return [S5700-B] [S5700-B] 3.AC6005无线网络控制器配置 <AC6005>dis cur port hybrid pvid vlan 1050 # interface NULL0 # ip route-static 0.0.0.0 0.0.0.0 10.128.254.1 # user-interface con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 # wlan
con 0 authentication-mode aaa user-interface vty 0 4 authentication-mode aaa protocol inbound ssh con 0 authentication-mode aaa user-interface vty 0 4 authentication-mode aaa protocol inbound ssh con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 # wlan ac # return con 0 authentication-mode password user-interface vty 0 4 user-interface vty 16 20 # wlan ac # return con 0 user-interface vty 0 4 # return PC1 PC2
route-static 0.0.0.0 0.0.0.0 218.24.140.65 静态路由 # load xml-configuration # load tr069-configuration # user-interface con 0 user-interface tty 13 user-interface aux 0 user-interface vty 0 4 authentication-mode scheme
Unspecified * 35 VTY 1 00:00:00 TEL 10.135.18.91 pass yes Unspecified 使用display user-interface <HUAWEI> display user-interface Idx Type Tx/Rx Modem Privi ActualPrivi Auth Int <HUAWEI> system-view [~HUAWEI] user-interface console 0 [~HUAWEI-ui-console0] authentication-mode password <HUAWEI> system-view [~HUAWEI] user-interface console 0 [~HUAWEI-ui-console0] authentication-mode password
VRP系统 已经配置好了交换机的vlanif 2端口ip (两台都在同段) 具体配置 配置Telnet登录所用的VTY用户界面的终端属性,指定VTY 0\~4这5条VTY虚拟通道可以用于登录 [SW1]user-interface authentication-mode aaa [SW1-ui-vty0-4]user privilege level 15 [SW1-ui-vty0-4]q 配置控制通过Telnet访问交换机的用户ACL策略 [SW1]user-interface ]acl 2001 [SW1-acl-basic-2001]rule permit source xxx //配置仅允许IP地址xx的主机访问 [SW1-acl-basic-2001]q [SW1]user-interface
tcp-flag { ack | fin | syn } * | time-range time-name ] * 配置R3为telent服务器 [R3]telent server enable user-interface vty 0 4 user-interface 用来进入一个用户界面或者多个用户界面试图 VTY 用户界面 用来管理或者 监控通过的telent或者ssh方式登录的用户 在R3上配置acl permit 是允许通过该报文 deny是抛弃该报文 [R3]user-interface vty 0 4 user privilege level 3 set authentication password 10.4.1.1 0.0.0.0 destination 10.1.3.3 0.0.0.0 destination-port eq 23 rule 10 deny tcp source any user-interface
AAA认证 测试 测试telnet连接 实验拓扑图: 实验配置思路: 配置路由器的接口IP地址 前提需要两台设备可以ping通 然后在服务端配置认证模式,用户名密码等信息 实验摘要重点命令: [R2]user-interface vty 0 4 //用户界面vty 0 4 //user-interface 是指用户界面 //vty ,全称为Virtual Teletype Terminal,指虚拟终端 10.1.1.2 24 //设置IP地址 [R2-GigabitEthernet0/0/0]quit //退出 [R2] 配置虚拟终端用户数量 R2——配置虚拟终端用户数量,使用AAA认证 [R2]user-interface vty 0 4 //用户界面vty 0 4 //user-interface 是指用户界面 //vty ,全称为Virtual Teletype Terminal,指虚拟终端
H3C 2126 进入系统视图 system-view 配置Web网管用户 localuser user_name password 1 进入VTY界面视图 user-interface vty snmp-agent community read plublic 退出,保存 save H3C 2126-EI 进入系统视图 system-view 进入VTY0用户界面视图 user-interface