D-Link DGS-3000 series Reference Manual

i Table of Contents Chapter 1 Using Command Line Interface ............................................................................................. 1 Chapter 2 Basic Command List ............................................................................................................. 8 Chapter 3 802.1Q VLAN Command List .............................................................................................. 23 Chapter 4 802.1X Command List ......................................................................................................... 39 Chapter 5 Access Authentication Control Command List .................................................................... 58 Chapter 6 Access Control List (ACL) Command List ........................................................................... 87 Chapter 7 Address Resolution Protocol (ARP) Command List .......................................................... 107 Chapter 8 ARP Spoofing Prevention Command List ......................................................................... 112 Chapter 9 Auto-Configuration Command List .................................................................................... 114 Chapter 10 Basic Commands Command List ...................................................................................... 117 Chapter 11 BPDU Attack Protection Command List ............................................................................ 134 Chapter 12 Cable Diagnostics Command List ..................................................................................... 139 Chapter 13 Command Logging Command List.................................................................................... 141 Chapter 14 Compound Authentication Command List ........................................................................ 143 Chapter 15 Configuration Command List ............................................................................................. 154 Chapter 16 Connectivity Fault Management (CFM) Command List .................................................... 159 Chapter 17 CPU Interface Filtering Command List ............................................................................. 189 Chapter 18 Debug Software Command List ........................................................................................ 198 Chapter 19 DHCP Local Relay Command List .................................................................................... 210 Chapter 20 DHCP Relay Command List .............................................................................................. 218 Chapter 21 DHCP Server Command List ............................................................................................ 243 Chapter 22 DHCP Server Screening Command List ........................................................................... 273 Chapter 23 DHCPv6 Relay Command List .......................................................................................... 285 Chapter 24 DHCPv6 Server Command List ........................................................................................ 297 Chapter 25 Digital Diagnostic Monitoring (DDM) Command List ......................................................... 311 Chapter 26 D-Link Unidirectional Link Detection (DULD) Command List ........................................... 318 Chapter 27 Domain Name System (DNS) Resolver Command List.................................................... 320 Chapter 28 DoS Attack Prevention Command List .............................................................................. 327 Chapter 29 Energy Efficient Ethernet (EEE) Command List ............................................................... 331 Chapter 30 Ethernet Ring Protection Switching (ERPS) Command List ............................................. 333 Chapter 31 External Alarm Command List .......................................................................................... 345 Chapter 32 Filter Command List .......................................................................................................... 347 Chapter 33 Filter Database (FDB) Command List ............................................................................... 350 Chapter 34 Flash File System (FFS) Command List ........................................................................... 360 Chapter 35 FTP Client Command List ................................................................................................. 369 Chapter 36 Gratuitous ARP Command List ......................................................................................... 377 Chapter 37 Historical Counter Command List ..................................................................................... 383 Chapter 38 IGMP Snooping Command List ......................................................................................... 388 Chapter 39 IP-MAC-Port Binding (IMPB) Command List .................................................................... 415 Chapter 40 IPv6 Neighbor Discover Command List ............................................................................ 439 Chapter 41 IPv6 Route Command List ................................................................................................ 443

ii Chapter 42 Japanese Web-Based Access Control (JWAC) Command List ....................................... 446 Chapter 43 Jumbo Frame Command List ............................................................................................ 472 Chapter 44 Layer 2 Protocol Tunneling (L2PT) Command List ........................................................... 474 Chapter 45 Link Aggregation Command List ....................................................................................... 478 Chapter 46 Link Layer Discovery Protocol (LLDP) Command List ...................................................... 485 Chapter 47 Loop Back Detection (LBD) Command List ...................................................................... 511 Chapter 48 MAC Notification Command List ....................................................................................... 517 Chapter 49 MAC-based Access Control Command List ...................................................................... 522 Chapter 50 MAC-based VLAN Command List..................................................................................... 539 Chapter 51 Mirror Command List ......................................................................................................... 542 Chapter 52 MLD Snooping Command List .......................................................................................... 545 Chapter 53 MSTP debug enhancement Command List ...................................................................... 568 Chapter 54 Multicast Filter Command List ........................................................................................... 574 Chapter 55 Multicast VLAN Command List ......................................................................................... 587 Chapter 56 Multiple Spanning Tree Protocol (MSTP) Command List ................................................. 608 Chapter 57 ND Spoofing Prevention Command List ........................................................................... 621 Chapter 58 Network Load Balancing (NLB) Command List ................................................................ 623 Chapter 59 Network Monitoring Command List ................................................................................... 628 Chapter 60 OAM Command List .......................................................................................................... 634 Chapter 61 Password Recovery Command List .................................................................................. 641 Chapter 62 Peripherals Command List ................................................................................................ 643 Chapter 63 Ping Command List ........................................................................................................... 646 Chapter 64 Port Security Command List ............................................................................................. 649 Chapter 65 Power Saving Command List ............................................................................................ 657 Chapter 66 PPPoE Circuit ID Insertions Command List ...................................................................... 664 Chapter 67 Protocol VLAN Command List .......................................................................................... 668 Chapter 68 QinQ Command List .......................................................................................................... 674 Chapter 69 Quality of Service (QoS) Command List ........................................................................... 682 Chapter 70 RADIUS Client Command List .......................................................................................... 701 Chapter 71 Remote Copy Protocol (RCP) Command List ................................................................... 707 Chapter 72 RSPAN Command List ...................................................................................................... 716 Chapter 73 Safeguard Engine Command List ..................................................................................... 722 Chapter 74 Secure Shell (SSH) Command List ................................................................................... 724 Chapter 75 Secure Sockets Layer (SSL) Command List .................................................................... 733 Chapter 76 Show Technical Support Command List ........................................................................... 739 Chapter 77 Simple Mail Transfer Protocol (SMTP) Command List ..................................................... 742 Chapter 78 Simple Network Management Protocol (SNMP) Command List ...................................... 748 Chapter 79 Simple RED Command List .............................................................................................. 776 Chapter 80 Single IP Management Command List ............................................................................. 781 Chapter 81 Super VLAN Command List .............................................................................................. 792 Chapter 82 Syslog and Trap Source-interface Command List ............................................................ 798 Chapter 83 System Log Command List ............................................................................................... 802 Chapter 84 System Severity Command List ........................................................................................ 814

iii Chapter 85 Telnet Client Command List .............................................................................................. 816 Chapter 86 TFTP Client Command List ............................................................................................... 817 Chapter 87 Time and SNTP Command List ........................................................................................ 824 Chapter 88 Trace Route Command List .............................................................................................. 832 Chapter 89 Traffic Control Command List ........................................................................................... 835 Chapter 90 Traffic Segmentation Command List ................................................................................. 840 Chapter 91 Trusted Host Command List ............................................................................................. 842 Chapter 92 Unicast Routing Command List ......................................................................................... 846 Chapter 93 VLAN Trunking Command List .......................................................................................... 849 Chapter 94 Voice VLAN Command List ............................................................................................... 854 Chapter 95 Web-based Access Control (WAC) Command List .......................................................... 865 Appendix A Password Recovery Procedure ......................................................................................... 881 Appendix B System Log Entries ........................................................................................................... 883 Appendix C Trap Log Entries ................................................................................................................ 895 Appendix D RADIUS Attributes Assignment ......................................................................................... 903

1 Chapter 1 Using Command Line Interface The Switch can be managed through the Switch’s serial port, Telnet, SNMP or the Web-based management agent. The Command Line Interface (CLI) can be used to configure and manage the Switch via the serial port or Telnet interfaces. This manual provides a reference for all of the commands contained in the CLI. Every command will be introduced in terms of purpose, format, description, parameters, and examples. Configuration and management of the Switch via the Web-based management agent are discussed in the Web UI Reference Guide. For detailed information on installing hardware please also refer to the Hardware Installation Guide. Accessing the Switch via the Serial Port 1-1 The Switch’s serial port’s default settings are as follows: • 115200 baud • no parity • 8 data bits • 1 stop bit A computer running a terminal emulation program capable of emulating a VT-100 terminal and a serial port configured as above are then connected to the Switch’s Console port via an included RS-232 to RJ-45 convertor cable. With the serial port properly connected to a management computer, the following screen should be visible. If this screen does not appear, try pressing Ctrl+r to refresh the console screen. DGS-3000-26TC Gigabit Ethernet Switch Command Line Interface Firmware: Build 1.10.0012 Copyright(C) 2014 D-Link Corporation. All rights reserved. UserName: PassWord: DGS-3000-26TC:admin# There is no initial username or password. Just press the Enter key twice to display the CLI input cursor − DGS-3000-26TC:admin#. This is the command line where all commands are input. Setting the Switch’s IP Address 1-2 Each Switch must be assigned its own IP Address, which is used for communication with an SNMP network manager or other TCP/IP application (for example BOOTP, TFTP). The Switch’s default IP address is 10.90.90.90. You can change the default Switch IP address to meet the specification of your networking address scheme. The Switch is also assigned a unique MAC address by the factory. This MAC address cannot be changed, and can be found on the initial boot console screen – shown below.

2 Boot Procedure V1.00.002 ------------------------------------------------------------------------------- Power On Self Test ........................................ 100 % MAC Address : B0-C5-54-30-00-A0 H/W Version : A1 Please Wait, Loading V1.10.013 Runtime Image .............. 100 % UART init ................................................. 100 % Starting runtime image Device Discovery .......................................... 100 % Configuration init ........................................ 100 % The Switch’s MAC address can also be found in the Web management program on the Switch Information (Basic Settings) window on the Configuration menu. The IP address for the Switch must be set before it can be managed with the Web-based manager. The Switch IP address can be automatically set using BOOTP or DHCP protocols, in which case the actual address assigned to the Switch must be known. Starting at the command line prompt, enter the commands config ipif System ipaddress xxx.xxx.xxx.xxx/yyy.yyy.yyy.yyy. Where the x’s represent the IP address to be assigned to the IP interface named System and the y’s represent the corresponding subnet mask. Alternatively, you can enter config ipif System ipaddress xxx.xxx.xxx.xxx/z. Where the x’s represent the IP address to be assigned to the IP interface named System and the z represents the corresponding number of subnets in CIDR notation. The IP interface named System on the Switch can be assigned an IP address and subnet mask which can then be used to connect a management station to the Switch’s Telnet or Web-based management agent. DGS-3000-26TC:admin#config ipif System ipaddress 10.24.22.100/255.0.0.0 Command: config ipif System ipaddress 10.24.22.100/8 Success. DGS-3000-26TC:admin# In the above example, the Switch was assigned an IP address of 10.24.22.100 with a subnet mask of 255.0.0.0. The system message Success indicates that the command was executed successfully. The Switch can now be configured and managed via Telnet, SNMP MIB browser and the CLI or via the Web-based management agent using the above IP address to connect to the Switch. There are a number of helpful features included in the CLI. Entering the ? command will display a list of all of the top-level commands.

3 DGS-3000-26TC:admin# ? Command:? .. ? cable_diag ports cd cfm linktrace cfm lock md cfm loopback clear clear address_binding dhcp_snoop binding_entry ports clear address_binding nd_snoop binding_entry ports clear arptable clear attack_log clear cfm pkt_cnt clear counters clear ethernet_oam ports clear fdb clear historical_counters ports clear igmp_snooping data_driven_group clear igmp_snooping statistics counter clear jwac auth_state clear log clear mac_based_access_control auth_state clear mld_snooping data_driven_group clear mld_snooping statistics counter CTRL+C ESC q Quit SPACE n Next Page ENTER Next Entry a All When entering a command without its required parameters, the CLI will prompt you with a Next possible completions: message. DGS-3000-26TC:admin#config account Command: config account Next possible completions: DGS-3000-26TC:admin# In this case, the command config account was entered with the parameter . The CLI will then prompt to enter the with the message, Next possible completions:. Every command in the CLI has this feature, and complex commands have several layers of parameter prompting. In addition, after typing any given command plus one space, users can see all of the next possible sub-commands, in sequential order, by repeatedly pressing the Tab key. To re-enter the previous command at the command prompt, press the up arrow cursor key. The previous command will appear at the command prompt.

4 DGS-3000-26TC:admin#config account Command: config account Next possible completions: DGS-3000-26TC:admin#config account In the above example, the command config account was entered without the required parameter , the CLI returned the Next possible completions: prompt. The up arrow cursor control key was pressed to re-enter the previous command (config account) at the command prompt. Now the appropriate username can be entered and the config account command re-executed. All commands in the CLI function in this way. In addition, the syntax of the help prompts are the same as presented in this manual − angle brackets < > indicate a numerical value or character string, braces { } indicate optional parameters or a choice of parameters, and brackets [ ] indicate required parameters. If a command is entered that is unrecognized by the CLI, the top-level commands will be displayed under the Available commands: prompt. DGS-3000-26TC:admin#the Available commands: .. ? cable_diag cd cfm clear config copy create debug del delete dir disable download enable erase login logout md move no ping ping6 rd reboot reconfig rename reset save show smtp telnet traceroute traceroute6 upload DGS-3000-26TC:admin# The top-level commands consist of commands such as show or config. Most of these commands require one or more parameters to narrow the top-level command. This is equivalent to show what? or config what? Where the what? is the next parameter. For example, entering the show command with no additional parameters, the CLI will then display all of the possible next parameters.

5 DGS-3000-26TC:admin#show Command: show Next possible completions: 802.1p 802.1x aaa access_profile account accounting acct_client address_binding arp_spoofing_prevention arpentry attack_log auth_client auth_diagnostics auth_session_statistics auth_statistics authen authen_enable authen_login authen_policy authentication authorization autoconfig bandwidth_control boot_file bpdu_protection cfm command command_history community_encryption config control_pkt cpu cpu_filter current_config ddm device_status dhcp dhcp_local_relay dhcp_relay dhcp_server dhcpv6 dhcpv6_local_relay dhcpv6_relay dhcpv6_server dos_prevention dot1v_protocol_group dscp duld eee environment erps error ethernet_oam external_alarm fdb filter flow_meter gratuitous_arp greeting_message gvrp historical_counter historical_utilization host_name igmp igmp_snooping ipif ipif_ipv6_link_local_auto iproute ipv6 ipv6route jumbo_frame jwac l2protocol_tunnel lacp_port led limited_multicast_addr link_aggregation lldp lldp_med log log_save_timing log_software_module loopdetect mac_based_access_control mac_based_access_control_local mac_based_vlan mac_notification max_mcast_group mcast_filter_profile mirror mld_snooping multicast multicast_fdb name_server nd_spoofing_prevention nlb packet password_recovery per_queue port port_security port_security_entry port_vlan ports power_saving pppoe private_vlan pvid qinq radius rcp rmon router_ports rspan safeguard_engine scheduling scheduling_mechanism serial_port session sim smtp snmp sntp sred ssh ssl storage_media_info stp sub_vlan super_vlan switch syslog system_severity tech_support terminal tftp time time_range traffic traffic_segmentation trap trusted_host utilization vlan vlan_translation vlan_trunk voice_vlan wac DGS-3000-26TC:admin# In the above example, all of the possible next parameters for the show command are displayed. At the next command prompt, the up arrow was used to re-enter the show command, followed by the account parameter. The CLI then displays the user accounts configured on the Switch.

6 Command Syntax Symbols 1-3 Syntax Description angle brackets < > Encloses a variable or value. Users must specify the variable or value. For example, in the command create ipif {} {secondary | state [enable | disable] | proxy_arp [enable | disable] {local [enable | disable]}} users must supply an IP interface name for ,a VLAN name for and an address for when entering the command. DO NOT TYPE THE ANGLE BRACKETS. square brackets [ ] Encloses a required value or list of required arguments. Only one value or argument must be specified. For example, in the command create account [admin | operator | power_user | user] {encrypt [plain_text | sha_1] } users must specify either the admin-level, power-user-level or user-level account when entering the command. DO NOT TYPE THE SQUARE BRACKETS. vertical bar | Separates mutually exclusive items in a list, one of which must be entered. For example, in the command create ipif {} {secondary | state [enable | disable] | proxy_arp [enable | disable] {local [enable | disable]}} users must specify either the community or trap receiver in the command. DO NOT TYPE THE VERTICAL BAR. braces { } Encloses an optional value or a list of optional arguments. One or more values or arguments can be specified. For example, in the command reset {[config | system]} {force_agree} users may choose to reset the configuration or the system in the command. DO NOT TYPE THE BRACES. parentheses ( ) Indicates at least one or more of the values or arguments in the preceding syntax enclosed by braces must be specified. For example, in the command config bpdu_protection ports [ | all] {state [enable | disable] | mode [drop | block | shutdown]}(1) users have the option to specify to configure the state or the mode. The (1) following the set of braces indicates at least one argument or value within the braces must be specified. DO NOT TYPE THE PARENTHESES. ipif metric 12 means the maximum length of the IP interface name. 1-31 means the legal range of the metric value. Line Editing Keys 1-4 Keys Description Delete Delete character under cursor and shift remainder of line to left.

7 Keys Description Backspace Delete character to left of cursor and shift remainder of line to left. Insert Toggle on and off. When toggled on, inserts text and shifts previous text to right. Left Arrow Move cursor to left. Right Arrow Move cursor to right Tab Help user to select appropriate token. P Display the previous page. n or Space Display the next page. CTRL+C Escape from displayed pages. ESC Escape from displayed pages. q Escape from displayed pages. r refresh the displayed pages a Display the remaining pages. (The screen display will not pause again.) Enter Display the next line. The screen display pauses when the show command output reaches the end of the page. In the above example, all of the possible next parameters for the show command are displayed. At the next command prompt, the up arrow was used to re-enter the show command, followed by the account parameter. The CLI then displays the user accounts configured on the Switch.

8 Chapter 2 Basic Command List show session show serial_port config serial_port {baud_rate [9600 | 19200 | 38400 | 115200] | auto_logout [never | 2_minutes | 5_minutes | 10_minutes | 15_minutes]} enable clipaging disable clipaging login logout ? clear show command_history config command_history config greeting_message {default} show greeting_message config command_prompt [ | username | default] config terminal width [default | ] show terminal width config ports [ | all] {medium_type [fiber | copper]} {speed [auto {capability_advertised {10_half | 10_full | 100_half | 100_full | 1000_full}} | 10_half | 10_full | 100_half | 100_full | 1000_full {[master | slave]} | 10g_full ] | auto_negotiation [restart_an | remote_fault_advertised [disable | offline | link_fault | auto_negotiation_error]] | flow_control [enable | disable] | learning [enable | disable ] | state [enable | disable] | mdix [auto | normal | cross] | [description | clear_description] | auto_speed_downgrade [enable | disable]}(1) show ports {} {[description | err_disabled | auto_negotiation | details | media_type]} show session 2-1 Description This command is used to display a list of current users logged into the Switch. Format show session Parameters None. Restrictions Only administrators and Operators can issue this command. Example To display the session entries:

9 DGS-3000-26TC:admin#show session Command: show session ID Live Time From Level Name --- ------------ --------------------------------------- ----- --------------- 0 00:01:46.360 10.90.90.10 puser puser 8 00:05:49.340 Serial Port admin admin Total Entries: 2 CTRL+C ESC q Quit SPACE n Next Page p Previous Page r Refresh show serial_port 2-2 Description This command is used to display the current serial port settings. Format show serial_port Parameters None. Restrictions None. Example To display the serial port setting: DGS-3000-26TC:admin#show serial_port Command: show serial_port Baud Rate : 115200 Data Bits : 8 Parity Bits : None Stop Bits : 1 Auto-Logout : 10 mins DGS-3000-26TC:admin#

10 config serial_port 2-3 Description This command is used to configure the serial bit rate used to communicate with the management host and the idle connection auto logout time. Format config serial_port {baud_rate [9600 | 19200 | 38400 | 115200] | auto_logout [never | 2_minutes | 5_minutes | 10_minutes | 15_minutes]} Parameters baud_rate - (Optional) The serial bit rate that will be used to communicate with the management host. The default baud rate is 115200. 9600 - Specify the serial bit rate to be 9600. 19200 - Specify the serial bit rate to be 19200. 38400 - Specify the serial bit rate to be 38400. 115200 - Specify the serial bit rate to be 115200. auto_logout - (Optional) The auto logout time out setting. never - Never timeout. 2_minutes - When idle over 2 minutes, the device will auto logout. 5_minutes - When idle over 5 minutes, the device will auto logout. 10_minutes - When idle over 10 minutes, the device will auto logout. 15_minutes - When idle over 15 minutes, the device will auto logout. Restrictions Only Administrators and Operators can issue this command. Example To configure baud rate: DGS-3000-26TC:admin#config serial_port baud_rate 9600 Command: config serial_port baud_rate 9600 Success. DGS-3000-26TC:admin# enable clipaging 2-4 Description This command is used to enable the pausing of the screen display when the show command output reaches the end of the page. The default setting is enabled. Format enable clipaging

11 Parameters None. Restrictions Only Administrators and Operators can issue this command. Example To enable pausing of the screen display when show command output reaches the end of the page: DGS-3000-26TC:admin#enable clipaging Command: enable clipaging Success. DGS-3000-26TC:admin# disable clipaging 2-5 Description This command is used to disable the pausing of the screen display when the show command output reaches the end of the page. The default setting is enabled. Format disable clipaging Parameters None. Restrictions Only Administrators and Operators can issue this command. Example To disable pausing of the screen display when show command output reaches the end of the page: DGS-3000-26TC:admin#disable clipaging Command: disable clipaging Success. DGS-3000-26TC:admin#

12 login 2-6 Description This command is used to allow user login to the Switch. Format login Parameters None. Restrictions None. Example To login the Switch with a user name dlink: DGS-3000-26TC:admin#login Command: login UserName:dlink PassWord:**** DGS-3000-26TC:admin# logout 2-7 Description This command is used to logout from the command prompt. Format logout Parameters None. Restrictions None. Example To logout from the current user:

13 DGS-3000-26TC:admin#logout Command: logout ********** * Logout * ********** DGS-3000-26TC Gigabit Ethernet Switch Command Line Interface Firmware: Build 1.10.013 Copyright(C) 2014 D-Link Corporation. All rights reserved. UserName: ? 2-8 Description This command is used to display a description of a specific command or general command. Format ? Parameters None. Restrictions None. Example To get “ping” command usage, descriptions: DGS-3000-26TC:admin#? ping Command: ? ping Command: ping Usage: [ | ] { times | timeout } Description: Used to test the connectivity between network devices. DGS-3000-26TC:admin# clear 2-9 Description This command is used to clear the screen.

14 Format clear Parameters None. Restrictions None. Example To clear screen: DGS-3000-26TC:admin#clear Command: clear DGS-3000-26TC:admin# show command_history 2-10 Description This command is used to display command history. Format show command_history Parameters None. Restrictions None. Example To display command history:

15 DGS-3000-26TC:admin#show command_history Command: show command_history ? ping login show serial_port show session ? config bpdu_protection ports ? reset ? create account ? create ipif show the ? DGS-3000-26TC:admin# config command_history 2-11 Description This command is used to configure the number of commands that the Switch can recall. The Switch “remembers” upto the last 40 commands you entered. Format config command_history Parameters - Enter the number of commands that the Switch can recall. This value must be between 1 and 40. Restrictions Only Administrators and Operators can issue this command. Example To configure the number of command history: DGS-3000-26TC:admin#config command_history 25 Command: config command_history 25 Success. DGS-3000-26TC:admin#

16 config greeting_message 2-12 Description This command is used to configure the greeting message (or banner). Format config greeting_message {default} Parameters default - (Optional) Add this parameter to the config greeting_message command will return the greeting message (banner) to its original factory default entry. Restrictions Only Administrators and Operators can issue this command. Example To edit the banner: DGS-3000-26TC:admin#config greeting_message Command: config greeting_message Greeting Messages Editor =============================================================================== DGS-3000-26TC Gigabit Ethernet Switch Command Line Interface Firmware: Build 1.10.013 Copyright(C) 2014 D-Link Corporation. All rights reserved. =============================================================================== Ctrl+C Quit without save left/right/ Ctrl+W Save and quit up/down Move cursor Ctrl+D Delete line Ctrl+X Erase all setting Ctrl+L Reload original setting ------------------------------------------------------------------------------- show greeting_message 2-13 Description This command is used to display a greeting message.

17 Format show greeting_message Parameters None. Restrictions Only Administrators and Operators can issue this command. Example To display greeting message: DGS-3000-26TC:admin#show greeting_message Command: show greeting_message =============================================================================== = DGS-3000-26TC Gigabit Ethernet Switch Command Line Interface Firmware: Build 1.10.013 Copyright(C) 2014 D-Link Corporation. All rights reserved. =============================================================================== = DGS-3000-26TC:admin# config command_prompt 2-14 Description This command is used to modify the command prompt. When users issue the “reset” command, the current command prompt will remain in tact. Yet, issuing the “reset system” will return the command prompt to its original factory default value. Format config command_prompt [ | username | default] Parameters - Enter the new command prompt string of no more than 16 characters. username - Enter this command to set the login username as the command prompt. default - Enter this command to return the command prompt to its original factory default value.

18 Restrictions Only Administrators and Operators can issue this command. Example To edit the command prompt: DGS-3000-26TC:admin#config command_prompt Prompt# Command: config command_prompt Prompt# Success. Prompt#:admin# config terminal width 2-15 Description This command is used to set current terminal width. The usage is described as below: 1. Users login and configure the terminal width to 120, this configuration take effect on this login section. If users implement “save” command, the configuration is saved. After users log out and log in again, the terminal width is 120. 2. If user did not save the configuration, another user login, the terminal width is default value. 3. If at the same time, two CLI sessions are running, once section configure to 120 width and save it, the other section will not be effected, unless it log out and then log in. Format config terminal width [default | ] Parameters default - Specify the default terminal width setting. The default value is 80. - Enter the configured terminal width. The width is between 80 and 200 characters. Restrictions None. Example To configure the current terminal width: DGS-3000-26TC:admin#config terminal width 120 Command: config terminal width 120 Success. DGS-3000-26TC:admin#

19 show terminal width 2-16 Description This command is used to display the configuration of current terminal width. Format show terminal width Parameters None. Restrictions None. Example To display the configuration of current terminal width: DGS-3000-26TC:admin#show terminal width Command: show terminal width Global terminal width : 80 Current terminal width : 80 DGS-3000-26TC:admin# config ports 2-17 Description This command is used to configure the Switch's Ethernet port settings. Format config ports [ | all] {medium_type [fiber | copper]} {speed [auto {capability_advertised {10_half | 10_full | 100_half | 100_full | 1000_full}} | 10_half | 10_full | 100_half | 100_full | 1000_full {[master | slave]} | 10g_full] | auto_negotiation [restart_an | remote_fault_advertised [disable | offline | link_fault | auto_negotiation_error]] | flow_control [enable | disable] | learning [enable | disable] | state [enable | disable] | mdix [auto | normal | cross] | [description | clear_description] | auto_speed_downgrade [enable | disable]}(1) Parameters - Enter a range of ports to be configured. all - Specify all ports in the system, you may use the “all” parameter command. medium_type - (Optional) Specify the medium type for the combo ports. This parameter is

20 optional. For non combo ports, the user doesn't need to specify medium_type in the command. fiber - Specify the fiber port. copper - Specify the copper port speed - Specify the port speed. auto - Specify the port auto negotiation speed. capability_advertised - Specify that the capability will be advertised. 10_half - Specify the port speed to 10_half. 10_full - Specify the port speed to 10_full. 100_half - Specify the port speed to 100_half. 100_full - Specify the port speed to 100_full. 1000_full - Specify the port speed to 1000_full. Using master or slave mode in this mode is optional. 10_half - Specify the port speed to 10_half. 10_full - Specify the port speed to 10_full. 100_half - Specify the port speed to 100_half. 100_full - Specify the port speed to 100_full. 1000_full - Specify the port speed to 1000_full. While set port speed to 1000_full,user should specify master or slave mode for 1000BASE-T interface, and leave the 1000_full without any master or slave setting for other interface. master - (Optional) Specify that the port(s) will be set to master. slave - (Optional) Specify that the port(s) will be set to slave. 10g_full - Specify the port speed to 10g_full. auto_negotiation - Specify that the auto-negotiation option will be configured. restart_an - Specify to restart the auto-negotiation process. remote_fault_advertised - Specify that the remote fault advertisement option will be configured. disable - Specify to disable remote fault advertisement. offline - Specify that a local device may indicate Offline prior to powering off, running transmitter tests, or removing the local device from the active configuration. If it is set and detected offline, it will advertise at the next auto-negotiation. It interacted for 1000Mbps MAUs. link_fault - Specify that if set and local device was detected, a Link_Failure condition indicated by the loss of synchronization, will advertise at the next auto-negotiation. It interacted for 1000Mbps MAUs. auto_negotiation_error - Specify the resolution which precludes operation between a local device and link partner advertised at the next auto-negotiation. It interacted for 1000Mbps MAUs. flow_control - Turns on or turns off the flow control on one or more ports by enabling or disabling this function. enable - Specify that the flow control option will be enabled. disable - Specify that the flow control option will be disabled. learning - Turns on or turns off the MAC address learning on one or more ports. enable - Specify that the learning option will be enabled. disable - Specify that the learning option will be disabled. state - Enables or disables the specified port. If the specificed ports are in error-disabled status, configure their state to enable will recover these ports from disabled to enable state. enable - Specify that the port state will be enabled. disable - Specify that the port state will be disabled. mdix - The MDIX mode can be specified as auto, normal, and cross. If set to the normal state, the port is in the MDIX mode and can be connected to PC NIC using a straight cable. If set to the cross state, the port is in the MDI mode, and can be connected to a port (in the MDIX mode) on another switch through a straight cable. auto - Specify that the MDIX mode for the port will be set to auto. normal - Specify that the MDIX mode for the port will be set to normal. cross - Specify that the MDIX mode for the port will be set to cross. description - Specify the description of the port interface. - Enter the port interface description. This value can be up to 32 characters long. clear description - (Optional) Specify that the description field will be cleared. auto_speed_downgrade - Specify to enable or disable the option to automatically downgrade

21 the advertised speed. This setting has no effect when the port is working in the forced mode. enable - Specify to enable the option to automatically downgrade the advertised speed. disable - Specify to disable the option to automatically downgrade the advertised speed. Restrictions Only Administrators and Operators can issue this command. Example To configure the ports: DGS-3000-26TC:admin# config ports 1-3 speed 10_full learning enable state enable flow_control enable Command: config ports 1-3 speed 10_full learning enable state enable flow_control enable Success. DGS-3000-26TC:admin# show ports 2-18 Description This command is used to display the current configurations of a range of ports. No parameter will show all ports. Format show ports {} {[description | err_disabled | auto_negotiation | details | media_type]} Parameters - (Optional) Enter a range of ports to be displayed. description - (Optional) Specify to display the port description. err_disabled - (Optional)Specify to display disabled information. auto_negotiation - (Optional) Specify to display detailed auto-negotiation information. details - (Optional) Specify if port information is included in the display. media_type - (Optional) Displays SFP information. Restrictions None. Example To display the port details:

22 DGS-3000-26TC:admin#show ports details Command: show ports details Port : 1 -------------------- Port Status : Link Up Description : HardWare Type : Gigabits Ethernet MAC Address : B0-C5-54-30-00-A1 Bandwidth : 100000Kbit Auto-Negotiation : Enabled Duplex Mode : Full Duplex Flow Control : Disabled MDI : Cross Address Learning : Enabled Last Clear of Counter : 3 hours 9 mins ago BPDU Hardware Filtering Mode: Disabled Queuing Strategy : FIFO TX Load : 0/100, 0 bits/sec, 0 packets/sec RX Load : 0/100, 0 bits/sec, 0 packets/sec CTRL+C ESC q Quit SPACE n Next Page p Previous Page r Refresh

23 Chapter 3 802.1Q VLAN Command List create vlan tag {type [1q_vlan | private_vlan]} {advertisement} create vlan vlanid {type [1q_vlan | private_vlan]} {advertisement} delete vlan delete vlan vlanid config vlan {[add [tagged | untagged | forbidden] | delete] | advertisement [enable | disable]}(1) config vlan vlanid {[add [tagged | untagged | forbidden] | delete] | advertisement [enable | disable] | name }(1) config port_vlan [ | all] {gvrp_state [enable | disable] | ingress_checking [enable | disable] | acceptable_frame [tagged_only | admit_all] | pvid }(1) show vlan {} show vlan ports {} show vlan vlanid show port_vlan {} enable pvid auto_assign disable pvid auto_assign show pvid auto_assign config gvrp [timer {join < value 100-100000> | leave < value 100-100000> | leaveall } | nni_bpdu_addr [dot1d | dot1ad]] show gvrp enable gvrp disable gvrp config private_vlan [ | vid ] [add [isolated | community] | remove] [ | vlanid ] show private_vlan {[ | vlanid]} create vlan 3-1 Description This command is used to create a VLAN on the Switch. The VLAN ID must be always specified for creating a VLAN. Format create vlan tag {type [1q_vlan | private_vlan]} {advertisement} Parameters - Enter the VLAN name to be created. The VLAN name can be up to 32 characters long. tag - Creates the VLAN ID. - Enter the VLAN ID. The VLAN ID value must be between 2 and 4094. type - (Optional) Specify the type of VLAN here. 1q_vlan - (Optional) Specify that the type of VLAN used is based on the 802.1Q standard.

24 private_vlan - (Optional) Specify that the private VLAN type will be used. advertisement - (Optional) Specify the VLAN as being able to be advertised out. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To create a VLAN with name “p1” and VLAN ID 2: DGS-3000-26TC:admin#create vlan p1 tag 2 type private_vlan advertisement Command: create vlan p1 tag 2 type private_vlan advertisement Success. DGS-3000-26TC:admin# create vlan vlanid 3-2 Description This command is used to create more than one VLANs at a time. A unique VLAN name (e.g. VLAN10) will be automatically assigned by the system. The automatic assignment of VLAN name is based on the following rule: “VLAN”+ID. For example, for VLAN ID 100, the VLAN name will be VLAN100. If this VLAN name is conflict with the name of an existing VLAN, then it will be renamed based on the following rule: “VLAN”+ID+”ALT”+ collision count. For example, if this conflict is the second collision, then the name will be VLAN100ALT2. Format create vlan vlanid {type [1q_vlan | private_vlan]} {advertisement} Parameters - Enter the VLAN ID list to be created. type - (Optional) Specify the type of VLAN to be created. 1q_vlan - (Optional) Specify that the VLAN created will be a 1Q VLAN. private_vlan - (Optional) Specify that the private VLAN type will be used. advertisement - (Optional) Specify the VLAN as being able to be advertised out. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To create some VLANs using VLAN ID:

25 DGS-3000-26TC:admin#create vlan vlanid 10-30 Command: create vlan vlanid 10-30 Success. DGS-3000-26TC:admin# delete vlan 3-3 Description This command is used to delete a previously configured VLAN by the name on the Switch. Format delete vlan Parameters vlan - The VLAN name of the VLAN to be deleted. - Enter the VLAN name here. This name can be up to 32 characters long. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To remove a vlan v1: DGS-3000-26TC:admin#delete vlan v1 Command: delete vlan v1 Success. DGS-3000-26TC:admin# delete vlan vlanid 3-4 Description This command is used to delete one or a number of previously configured VLAN by VID list. Format delete vlan vlanid Parameters vlanid - The VLAN ID list to be deleted.

26 - Enter the VLAN ID list here. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To remove VLANs from 10-30: DGS-3000-26TC:admin#delete vlan vlanid 10-30 Command: delete vlan vlanid 10-30 Success. DGS-3000-26TC:admin# config vlan 3-5 Description This command is used to configure a VLAN based on the name. Format config vlan {[add [tagged | untagged | forbidden] | delete] | advertisement [enable | disable]}(1) Parameters - Enter the VLAN name you want to add ports to. This name can be up to 32 characters long. add - (Optional) Specify to add tagged, untagged or forbidden ports to the VLAN. tagged - Specify the additional ports as tagged. untagged - Specify the additional ports as untagged. forbidden - Specify the additional ports as forbidden. delete - (Optional) Specify to delete ports from the VLAN. - (Optional) Enter the list of ports used for the configuration here. advertisement - (Optional) Specify the GVRP state of this VLAN. enable - Specify to enable advertisement for this VLAN. disable - Specify to disable advertisement for this VLAN. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To add 4 through 8 as tagged ports to the VLAN v2:

27 DGS-3000-26TC:admin#config vlan v2 add tagged 4-8 Command: config vlan v2 add tagged 4-8 Success. DGS-3000-26TC:admin# config vlan vlanid 3-6 Description This command is used to configure multiple VLANs at one time. But conflicts will be generated if you configure the name of multiple VLANs at one time. Format config vlan vlanid {[add [tagged | untagged | forbidden] | delete] | advertisement [enable | disable] | name }(1) Parameters - Enter a list of VLAN IDs to configure. add - (Optional) Specify to add tagged, untagged or forbidden ports to the VLAN. tagged - Specify the additional ports as tagged. untagged - Specify the additional ports as untagged. forbidden - Specify the additional ports as forbidden. delete - (Optional) Specify to delete ports from the VLAN. - (Optional) Enter the list of ports used for the configuration here. advertisement - (Optional) Specify the GVRP state of this VLAN. enable - Specify to enable advertisement for this VLAN. disable - Specify to disable advertisement for this VLAN. name - (Optional) The new name of the VLAN. - Enter the VLAN name here. This name can be up to 32 characters long. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To add 4 through 8 as tagged ports to the VLAN ID from 10-20: DGS-3000-26TC:admin#config vlan vlanid 10-20 add tagged 4-8 Command: config vlan vlanid 10-20 add tagged 4-8 Success. DGS-3000-26TC:admin#

28 config port_vlan 3-7 Description This command is used to set the ingress checking status, the sending and receiving GVRP information. Format config port_vlan [ | all] {gvrp_state [enable | disable] | ingress_checking [enable | disable] | acceptable_frame [tagged_only | admit_all] | pvid }(1) Parameters - Enter a range of ports for which you want ingress checking. The port list is specified by listing the beginning port number on the Switch, separated by a colon. Then highest port number of the range (also separated by a colon) are specified. The beginning and end of the port list range are separated by a dash. all - Specify all ports for ingress checking. gvrp_state - (Optional) Enables or disables the GVRP for the ports specified in the port list. enable - Specify that GVRP for the specified ports will be enabled. disable - Specify that GVRP for the specified ports will be disabled. ingress_checking - (Optional) Enables or disables ingress checking for the specified portlist. enable - Specify that ingress checking will be enabled for the specified portlist. disable - Specify that ingress checking will be disabled for the specified portlist. acceptable_frame - (Optional) The type of frame will be accepted by the port. There are two types: tagged_only - Only tagged packets can be accepted by this port. admit_all - All packets can be accepted. pvid - (Optional) Specify the PVID of the ports. - Enter the VLAN ID here. The VLAN ID value must be between 1 and 4094. Restrictions Only Administrators and Operators can issue this command. Example To sets the ingress checking status, the sending and receiving GVRP information: DGS-3000-26TC:admin#config port_vlan 1-5 gvrp_state enable ingress_checking enable acceptable_frame tagged_only pvid 2 Command: config port_vlan 1-5 gvrp_state enable ingress_checking enable acceptable_frame tagged_only pvid 2 Success. DGS-3000-26TC:admin# show vlan 3-8 Description This command is used to display the vlan information including of parameters setting and operational value.

29 Format show vlan {} Parameters - (Optional) Enter the VLAN name to be displayed. The VLAN name can be up to 32 characters long. Restrictions None. Example To display VLAN settings: DGS-3000-26TC:admin#show vlan Command: show vlan VLAN Trunk State : Disabled VLAN Trunk Member Ports : VID : 1 VLAN Name : default VLAN Type : Static Advertisement : Enabled Member Ports : 1-26 Static Ports : 1-26 Current Tagged Ports : Current Untagged Ports: 1-26 Static Tagged Ports : Static Untagged Ports : 1-26 Forbidden Ports : Total Static VLAN Entries: 1 Total GVRP VLAN Entries: 0 DGS-3000-26TC:admin# show vlan ports 3-9 Description This command is used to display the vlan information per ports. Format show vlan ports {}

30 Parameters - (Optional) Enter the list of ports for which the VLAN information will be displayed. Restrictions None. Example To display the VLAN configuration for port 6: DGS-3000-26TC:admin#show vlan ports 6 Command: show vlan ports 6 Port VID Untagged Tagged Dynamic Forbidden ----- ---- -------- ------ ------- --------- 6 1 X - - - 6 2 - X - - DGS-3000-26TC:admin# show vlan vlanid 3-10 Description This command is used to display the vlan information using the VLAN ID. Format show vlan vlanid Parameters - Enter the VLAN ID to be displayed. Restrictions None. Example To display the VLAN configuration for VLAN ID 1:

31 DGS-3000-26TC:admin#show vlan vlanid 1 Command: show vlan vlanid 1 VID : 1 VLAN Name : default VLAN Type : Static Advertisement : Enabled Member Ports : 1-26 Static Ports : 1-26 Current Tagged Ports : Current Untagged Ports: 1-26 Static Tagged Ports : Static Untagged Ports : 1-26 Forbidden Ports : Total Entries : 1 DGS-3000-26TC:admin# show port_vlan 3-11 Description This command is used to display the ports’ VLAN attributes on the Switch. Format show port_vlan {} Parameters - (Optional) Enter a range of ports to be displayed. If no parameter specified, system will display all ports gvrp information. Restrictions None. Example To display 802.1Q port setting:

32 DGS-3000-26TC:admin#show port_vlan Command: show port_vlan Port PVID GVRP Ingress Checking Acceptable Frame Type ------- ---- -------- ---------------- --------------------------- 1 2 Enabled Enabled Only VLAN-tagged Frames 2 2 Enabled Enabled Only VLAN-tagged Frames 3 2 Enabled Enabled Only VLAN-tagged Frames 4 2 Enabled Enabled Only VLAN-tagged Frames 5 2 Enabled Enabled Only VLAN-tagged Frames 6 1 Disabled Enabled All Frames 7 1 Disabled Enabled All Frames 8 1 Disabled Enabled All Frames 9 1 Disabled Enabled All Frames 10 1 Disabled Enabled All Frames 11 1 Disabled Enabled All Frames 12 1 Disabled Enabled All Frames 13 1 Disabled Enabled All Frames 14 1 Disabled Enabled All Frames 15 1 Disabled Enabled All Frames 16 1 Disabled Enabled All Frames 17 1 Disabled Enabled All Frames 18 1 Disabled Enabled All Frames 19 1 Disabled Enabled All Frames 20 1 Disabled Enabled All Frames CTRL+C ESC q Quit SPACE n Next Page ENTER Next Entry a All enable pvid auto assign 3-12 Description This command is used to enable the auto-assignment of PVID. If “Auto-assign PVID” is enabled, PVID will be possibly changed by PVID or VLAN configuration. When user configures a port to VLAN X’s untagged membership, this port’s PVID will be updated with VLAN X. In the form of VLAN list command, PVID is updated with last item of VLAN list. When user removes a port from the untagged membership of the PVID’s VLAN, the port’s PVID will be assigned with “default VLAN”. The default setting is enabled. Format enable pvid auto_assign Parameters None. Restrictions Only Administrators, Operators and Power-Users can issue this command.

33 Example To enable the auto-assign PVID: DGS-3000-26TC:admin#enable pvid auto_assign Command: enable pvid auto_assign Success. DGS-3000-26TC:admin# disable pvid auto assign 3-13 Description This command is used to disable auto assignment of PVID. Format disable pvid auto_assign Parameters None. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To disable the auto-assign PVID: DGS-3000-26TC:admin#disable pvid auto_assign Command: disable pvid auto_assign Success. DGS-3000-26TC:admin# show pvid auto_assign 3-14 Description This command is used to display the PVID auto-assignment state. Format show pvid auto_assign

34 Parameters None. Restrictions None. Example To display PVID auto-assignment state: DGS-3000-26TC:admin#show pvid auto_assign Command: show pvid auto_assign PVID Auto-assignment: Enabled DGS-3000-26TC:admin# config gvrp 3-15 Description This command is used to set the GVRP timer’s value. The default value for Join time is 200 milliseconds; for Leave time is 600 milliseconds; for LeaveAll time is 10000 milliseconds. Format config gvrp [timer {join < value 100-100000> | leave < value 100-100000> | leaveall } | nni_bpdu_addr [dot1d | dot1ad]] Parameters timer - Specify that the GVRP timer parameter will be configured. join - (Optional) Specify the Join time will be set. - Enter the time used here. This value must be between 100 and 100000. leave - (Optional) Specify the Leave time will be set. - Enter the time used here. This value must be between 100 and 100000. leaveall - (Optional) Specify the LeaveAll time will be set. - Enter the time used here. This value must be between 100 and 100000. nni_bpdu_addr - This address is used to determine the BPDU protocol address for GVRP at a service provider's site. It can use either an 802.1d GVRP address (0180C2000021) or an 802.1ad service provider GVRP address (0180C200000D). dot1d - Specify that the NNI BPDU protocol address value will be set to Dot1d. dot1ad - Specify that the NNI BPDU protocol address value will be set to Dot1ad. Restrictions Only Administrators, Operators and Power-Users can issue this command.

35 Example To set the Join time to 200 milliseconds: DGS-3000-26TC:admin#config gvrp timer join 200 Command: config gvrp timer join 200 Success. DGS-3000-26TC:admin# show gvrp 3-16 Description This command is used to display the GVRP global setting. Format show gvrp Parameters None. Restrictions None. Example To display the global setting of GVRP: DGS-3000-26TC:admin#show gvrp Command: show gvrp Global GVRP : Disabled Join Time : 200 Milliseconds Leave Time : 600 Milliseconds LeaveAll Time : 10000 Milliseconds NNI BPDU Address: dot1d DGS-3000-26TC:admin# enable gvrp 3-17 Description This commands is used to enable the Generic VLAN Registration Protocol (GVRP).

36 Format enable gvrp Parameters None. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To enable the generic VLAN Registration Protocol (GVRP): DGS-3000-26TC:admin#enable gvrp Command: enable gvrp Success. DGS-3000-26TC:admin# disable gvrp 3-18 Description This command is used to disable the Generic VLAN Registration Protocol (GVRP). Format disable gvrp Parameters None. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To disable the Generic VLAN Registration Protocol (GVRP): DGS-3000-26TC:admin#disable gvrp Command: disable gvrp Success. DGS-3000-26TC:admin#

37 config private_vlan 3-19 Description This command is used to add or remove a secondary VLAN from a private VLAN. Format config private_vlan [ | vid ] [add [isolated | community] | remove] [ | vlanid ] Parameters - Enter the name of the private VLAN. vid - Specify the VLAN ID of the private VLAN. - Enter the VLAN ID used here. This value must be between 2 and 4094. add - Specify that a secondary VLAN will be added to the private VLAN. isolated - Specify the secondary VLAN as isolated VLAN. community - Specify the secondary VLAN as community VLAN. remove - Specify that a secondary VLAN will be removed from the private VLAN. - Enter the secondary VLAN name used. This name can be up to 32 characters long. vlanid - A range of secondary VLAN to add or remove to the private VLAN. - Enter the secondary VLAN ID used here. Restrictions Only Administrators and Operators can issue this command. Example To associate secondary vlan to private vlan p1: DGS-3000-26TC:admin#config private_vlan p1 add community vlanid 3 Command: config private_vlan p1 add community vlanid 3 Success. DGS-3000-26TC:admin# show private_vlan 3-20 Description This command is used to show the private VLAN information. Format show private_vlan {[ | vlanid]} Parameters - (Optional) Enter the name of the private VLAN or its secondary VLAN. This

38 name can be up to 32 characters long. vlanid - (Optional) Specify the VLAN ID of the private VLAN or its secondary VLAN. - Enter the VLAN ID used here. Restrictions Only Administrators and Operators can issue this command. Example To display private VLAN settings: DGS-3000-26TC:admin#show private_vlan Command: show private_vlan Primary VLAN 3 ------------------------------------------ Promiscuous Ports : Trunk Ports : Total Entries: 1 DGS-3000-26TC:admin#

39 Chapter 4 802.1X Command List enable 802.1x disable 802.1x create 802.1x user delete 802.1x user show 802.1x user config 802.1x auth_protocol [local | radius_eap] config 802.1x fwd_pdu system [enable | disable] config 802.1x fwd_pdu ports [ | all] [enable | disable] config 802.1x authorization attributes radius [enable | disable] show 802.1x {[auth_state | auth_configuration] ports {}} config 802.1x capability ports [ | all] [authenticator | none] config 802.1x max_users [ | no_limit] config 802.1x auth_parameter ports [ | all] [default | {direction [both | in] | port_control [force_unauth | auto | force_auth] | quiet_period | tx_period | supp_timeout | server_timeout | max_req | reauth_period | max_users [ | no_limit] | enable_reauth [enable | disable]}(1)] config 802.1x init [port_based ports [ | all] | mac_based ports [ | all] {mac_address }] config 802.1x auth_mode [port_based | mac_based] config 802.1x reauth [port_based ports [ | all] | mac_based ports [ | all] {mac_address }] create 802.1x guest_vlan delete 802.1x guest_vlan config 802.1x guest_vlan ports [ | all] state [enable | disable] config 802.1x trap state [enable | disable] show 802.1x guest_vlan show auth_statistics {ports } show auth_diagnostics {ports } show auth_session_statistics {ports } enable 802.1x 4-1 Description This command is used to enable the 802.1X function. Format enable 802.1x Parameters None.

40 Restrictions Only Administrators, Operators and Power-Users can issue this command. Example Used to enable the 802.1X function: DGS-3000-26TC:admin#enable 802.1x Command: enable 802.1x Success. DGS-3000-26TC:admin# disable 802.1x 4-2 Description This command is used to disable the 802.1X function. Format disable 802.1x Parameters None. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To disable the 802.1X function: DGS-3000-26TC:admin#disable 802.1x Command: disable 802.1x Success. DGS-3000-26TC:admin# create 802.1x user 4-3 Description This command is used to create an 802.1X user.

41 Format create 802.1x user Parameters - Enter the username to be added. This value can be up to 15 characters long. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To create a 802.1x user “test”: DGS-3000-26TC:admin#create 802.1x user test Command: create 802.1x user test Enter a case-sensitive new password:**** Enter the new password again for confirmation:**** Success. DGS-3000-26TC:admin# delete 802.1x user 4-4 Description This command is used to delete an 802.1X user. Format delete 802.1x user Parameters - Enter the username to be deleted. This value can be up to 15 characters long. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To delete user “test”:

42 DGS-3000-26TC:admin#delete 802.1x user test Command: delete 802.1x user test Success. DGS-3000-26TC:admin# show 802.1x user 4-5 Description This command is used to display the 802.1X user. Format show 802.1x user Parameters None. Restrictions None. Example To display the 802.1X user information: DGS-3000-26TC:admin#show 802.1x user Command: show 802.1x user Current Accounts: Username Password --------------- --------------- test test Total Entries:1 DGS-3000-26TC:admin# config 802.1x auth_protocol 4-6 Description This command is used to configure the 802.1X auth protocol. Format config 802.1x auth_protocol [local | radius_eap]

43 Parameters local - Specify the authentication protocol as local. radius_eap - Specify the authentication protocol as RADIUS EAP. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To configure the 802.1X authentication protocol to RADIUS EAP: DGS-3000-26TC:admin#config 802.1x auth_protocol radius_eap Command: config 802.1x auth_protocol radius_eap Success. DGS-3000-26TC:admin# config 802.1x fwd_pdu system 4-7 Description This command is used to globally control the forwarding of EAPOL PDU. When 802.1X functionality is disabled globally or for a port, and if 802.1X fwd_pdu is enabled both globally and for the port, a received EAPOL packet on the port will be flooded in the same VLAN to those ports for which 802.1X fwd_pdu is enabled and 802.1X is disabled (globally or just for the port). The default state is disabled. Format config 802.1x fwd_pdu system [enable | disable] Parameters enable - Enables the forwarding of EAPOL PDU. disable - Disables the forwarding of EAPOL PDU. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To configure forwarding of EAPOL PDU system state enable:

44 DGS-3000-26TC:admin#config 802.1x fwd_pdu system enable Command: config 802.1x fwd_pdu system enable Success. DGS-3000-26TC:admin# config 802.1x fwd_pdu ports 4-8 Description This command is used to control the forwarding of EAPOL PDU. When 802.1X functionality is disabled globally or for a port, and if 802.1X fwd_pdu is enabled both globally and for the port, a received EAPOL packet on the port will be flooded in the same VLAN to those ports for which 802.1X fwd_pdu is enabled and 802.1X is disabled (globally or just for the port). The default state is disabled. Format config 802.1x fwd_pdu ports [ | all] [enable | disable] Parameters - Enter the list of ports used for the configuration. all - Specify that all the ports will be used. enable - Enables forwarding EAPOL PDU receive on the ports. disable - Disables forwarding EAPOL PDU receive on the ports. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To configure 802.1X fwd_pdu for ports: DGS-3000-26TC:admin#config 802.1x fwd_pdu ports 1-2 enable Command: config 802.1x fwd_pdu ports 1-2 enable Success. DGS-3000-26TC:admin# config 802.1x authorization attributes 4-9 Description This command is used to enable or disable acception of authorized configuration. When the authorization is enabled for 802.1X’s RADIUS authentication, the authorized attributes (for example VLAN, 802.1p default priority, and ACL) assigned by the RADUIS server will be accepted.

45 Format config 802.1x authorization attributes radius [enable | disable] Parameters radius - If specified to enable, the authorization attributes (for example VLAN, 802.1p default priority, and ACL) assigned by the RADUIS server will be accepted. The default state is enabled. enable - Specify to enable the authorization attributes. disable - Specify to disable the authorization attributes. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example The following example will disable to accept the authorized data assigned from the RADIUS server: DGS-3000-26TC:admin#config 802.1x authorization attributes radius disable Command: config 802.1x authorization attributes radius disable Success. DGS-3000-26TC:admin# show 802.1x 4-10 Description This command is used to display the 802.1X state or configurations. Format show 802.1x {[auth_state | auth_configuration] ports {}} Parameters auth_state - (Optional) Displays 802.1X authentication state machine of some or all ports. auth_configuration - (Optional) Used to display 802.1X configurations of some or all ports. port - (Optional) Specify a range of ports to be displayed. If no port is specified, all ports will be displayed. - Enter the list of ports used for the configuration here. If no parameter is specified, the 802.1X system configurations will be displayed. Restrictions None.

46 Example To display the 802.1X port level configurations: DGS-3000-26TC:admin#show 802.1x auth_configuration ports 1 Command: show 802.1x auth_configuration ports 1 Port Number : 1 Capability : None AdminCrlDir : Both OpenCrlDir : Both Port Control : Auto QuietPeriod : 60 sec TxPeriod : 30 sec SuppTimeout : 30 sec ServerTimeout : 30 sec MaxReq : 2 times ReAuthPeriod : 3600 sec ReAuthenticate : Disabled Forward EAPOL PDU On Port : Enabled Max User On Port : 16 CTRL+C ESC q Quit SPACE n Next Page p Previous Page r Refresh config 802.1x capability 4-11 Description This command is used to configure the port capability. Format config 802.1x capability ports [ | all] [authenticator | none] Parameters ports - Specify a range of ports to be configured. - Enter the list of ports used for the configuration here. all - Specify all ports to be configured. authenticator - Specify the port that will enforce authentication before allowing access to services that are accessible from that port. This port will adopt the authenticator role. none - Disables authentication on the specified ports. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To configure the port capability:

47 DGS-3000-26TC:admin#config 802.1x capability ports 1-10 authenticator Command: config 802.1x capability ports 1-10 authenticator Success. DGS-3000-26TC:admin# config 802.1x max_users 4-12 Description This command is used to limit the maximum number of users that can be learned via 802.1X authentication. In addition to the global limitation, maximum user for per port is also limited. It is specified by config 802.1x auth_parameter command. Format config 802.1x max_users [ | no_limit] Parameters - Enter the maximum number of users. This value must be between 1 and 448. no_limit - Specify that the maximum user limit will be set to 448. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To configure 802.1X number of users to be limited to 200: DGS-3000-26TC:admin#config 802.1x max_users 200 Command: config 802.1x max_users 200 Success. DGS-3000-26TC:admin# config 802.1x auth_parameter 4-13 Description This command is used to configure the parameters that control the operation of the authenticator associated with a port. Format config 802.1x auth_parameter ports [ | all] [default | {direction [both | in] | port_control [force_unauth | auto | force_auth] | quiet_period | tx_period | supp_timeout | server_timeout | max_req

48 | reauth_period | max_users [ | no_limit] | enable_reauth [enable | disable]}(1)] Parameters ports - Specify a range of ports to be configured. - Enter the list of ports used for the configuration here. all - Specify that all the ports will be used. default - Sets all parameter to be default value. direction - (Optional) Sets the direction of access control. both - For bidirectional access control. in - For unidirectional access control. port_control - (Optional) You can force a specific port to be unconditionally authorized or unauthorized by setting the parameter of port_control to be force_auth or force_unauth. Besides, the controlled port will reflect the outcome of authentication if port_control is auto. force_unauth - Forces a specific port to be unconditionally unauthorized. auto - The controlled port will reflect the outcome of authentication. force_auth - Forces a specific port to be unconditionally authorized. quiet_period - (Optional) It is the initialization value of the quietWhile timer. The default value is 60 seconds and can be any value among 0 to 65535. - Enter the quiet period value here. This value must be between 0 and 65535 seconds. tx_period - (Optional) It is the initialization value of the transmit timer period. The default value is 30 seconds and can be any integer value among 1 to 65535. - Enter the tx period value here. This value must be between 1 and 65535 seconds. supp_timeout - (Optional) The initialization value of the aWhile timer when timing out the supplicant. Its default value is 30 seconds and can be any integer value among 1 to 65535. - Enter the supplicant timeout value here. This value must be between 1 and 65535 seconds. server_timeout - (Optional) The initialization value of the aWhile timer when timing out the authentication server. Its default value is 30 seconds and can be any integer value among 1 to 65535. - Enter the server timeout value here. This value must be between 1 and 65535 seconds. max_req - (Optional) The maximum number of times that the authentication PAE state machine will retransmit an EAP Request packet to the supplicant. Its default value is 2 and can be any integer number among 1 to 10. - Enter the maximum required value here. This value must be between 1 and 10. reauth_period - (Optional) It’s a nonzero number of seconds, which is used to be the re- authentication timer. The default value is 3600. - Enter the re-authentication period value here. This value must be between 1 and 65535 seconds. max_users - (Optional) Specify per port maximum number of users. The default value is 16. - Enter the maximum users value here. This value must be between 1 and 448. no_limit - Specify that no limit is enforced on the maximum users used. enable_reauth - (Optional) You can enable or disable the re-authentication mechanism for a specific port. enable - Specify to enable the re-authentication mechanism for a specific port. disable - Specify to disable the re-authentication mechanism for a specific port. Restrictions Only Administrators, Operators and Power-Users can issue this command.

49 Example To configure the parameters that control the operation of the authenticator associated with a port: DGS-3000-26TC:admin#config 802.1x auth_parameter ports 1-20 direction both Command: config 802.1x auth_parameter ports 1-20 direction both Success. DGS-3000-26TC:admin# config 802.1x init 4-14 Description This command is used to initialize the authentication state machine of some or all ports. Format config 802.1x init [port_based ports [ | all] | mac_based ports [ | all] {mac_address }] Parameters port_based ports - Specify the authentication as the port-based mode. - Enter the list of ports used for the configuration here. all - Specify that all ports will be used. mac_based ports - Specify the authentication as the MAC-based mode. - Enter the list of ports used for the configuration here. all - Specify that all ports will be used. mac_address - (Optional) Specify the MAC address of client. - Enter the MAC address used here. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To initialize the authentication state machine of some or all: DGS-3000-26TC:admin#config 802.1x init port_based ports all Command: config 802.1x init port_based ports all Success. DGS-3000-26TC:admin# config 802.1x auth_mode 4-15 Description This command is used to configure 802.1X authentication mode.

50 Format config 802.1x auth_mode [port_based | mac_based] Parameters port_based - Specifies the authentication as the port-based mode. mac_based - Specifies the authentication as the MAC-based mode. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To configure the authentication mode: DGS-3000-26TC:admin#config 802.1x auth_mode port_based Command: config 802.1x auth_mode port_based Success. DGS-3000-26TC:admin# config 802.1x reauth 4-16 Description This command is used to re-authenticate the device connected to the port. During the re- authentication period, the port status remains authorized until failed re-authentication. Format config 802.1x reauth [port_based ports [ | all] | mac_based ports [ | all] {mac_address }] Parameters port_based ports - Specify the authentication as the port-based mode. - Enter the list of ports used for the configuration here. all - Specify that all ports will be used. mac_based ports - Specify the authentication as the MAC-based mode. - Enter the list of ports used for the configuration here. all - Specify that all ports will be used. mac_address - (Optional) Specify the MAC address of client. - Enter the MAC address used here. Restrictions Only Administrators, Operators and Power-Users can issue this command.

51 Example To re-authenticate the device connected to the port: DGS-3000-26TC:admin#config 802.1x reauth port_based ports all Command: config 802.1x reauth port_based ports all Success. DGS-3000-26TC:admin# create 802.1x guest_vlan 4-17 Description This command is used to assign a static VLAN to be guest VLAN. The specific VLAN which assigned to guest VLAN must be existed. The specific VLAN which assigned to guest VLAN can’t be deleting. Format create 802.1x guest_vlan Parameters - Enter the VLAN to be guest VLAN. The VLAN name can be up to 32 characters long. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To create a VLAN named “guestVLAN” as 802.1X guest VLAN: DGS-3000-26TC:admin#create 802.1x guest_vlan guestVLAN Command: create 802.1x guest_vlan guestVLAN Success. DGS-3000-26TC:admin# delete 802.1x guest_vlan 4-18 Description This command is used to delete guest VLAN setting, but not delete the static VLAN. All ports which enabled guest VLAN will remove to original VLAN after deleted guest VLAN.

52 Format delete 802.1x guest_vlan Parameters - Enter the VLAN name here. The VLAN name can be up to 32 characters long. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To delete the guest VLAN named “guestVLAN”: DGS-3000-26TC:admin#delete 802.1x guest_vlan guestVLAN Command: delete 802.1x guest_vlan guestVLAN Success. DGS-3000-26TC:admin# config 802.1x guest_vlan 4-19 Description This command is used to configure guest VLAN setting. If the specific port state is changed from enabled state to disable state, this port will move to its original VLAN. Format config 802.1x guest_vlan ports [ | all] state [enable | disable] Parameters ports - A range of ports enable or disable guest VLAN function. - Enter the list of ports used for the configuration here. all - Specify that all the port will be included in this configuration. state - Specify the guest VLAN port state of the configured ports. enable - Specify to join the guest VLAN. disable - Specify to be removed from the guest VLAN. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example Enable on port 2 to 8 to configure 802.1x guest VLAN:

53 DGS-3000-26TC:admin#config 802.1x guest_vlan ports 2-8 state enable Command: config 802.1x guest_vlan ports 2-8 state enable Warning, The ports are moved to Guest VLAN. Success. DGS-3000-26TC:admin# config 802.1x trap state 4-20 Description This command is used to enable or disable the sending of 802.1X traps. Format config 802.1x trap state [enable | disable] Parameters enable - Specify to enable the sending of 802.1x traps. disable - Specify to disable the sending of 802.1x traps. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example This example shows how to enable the trap state for 802.1x. DGS-3000-26TC:admin# config 802.1x trap state enable Command: config 802.1x trap state enable Success. DGS-3000-26TC:admin# show 802.1x guest_vlan 4-21 Description This command is used to show the information of guest VLANs. Format show 802.1x guest_vlan

54 Parameters None. Restrictions None. Example To show 802.1x guest VLAN on the Switch: DGS-3000-26TC:admin#show 802.1x guest_vlan Command: show 802.1x guest_vlan Guest VLAN Setting ----------------------------------------------------------- Guest VLAN : guestVLAN Enabled Guest VLAN Ports : 2-8 DGS-3000-26TC:admin# show auth_statistics 4-22 Description This command is used to display information of authenticator statistics. Format show auth_statistics {ports } Parameters ports - (Optional) Specify a range of ports to be displayed. - Enter the list of ports that will be displayed here. Restrictions None. Example To display authenticator statistics information for port 1:

55 DGS-3000-26TC:admin#show auth_statistics ports 1 Command: show auth_statistics ports 1 MAC Address : 00—01-02-03-04-05 Port Number : 1 EapolFramesRx 0 EapolFramesTx 9 EapolStartFramesRx 0 EapolReqIdFramesTx 6 EapolLogoffFramesRx 0 EapolReqFramesTx 0 EapolRespIdFramesRx 0 EapolRespFramesRx 0 InvalidEapolFramesRx 0 EapLengthErrorFramesRx 0 LastEapolFrameVersion 0 LastEapolFrameSource 00-00-00-00-00-00 CTRL+C ESC q Quit SPACE n Next Page p Previous Page r Refresh show auth_diagnostics 4-23 Description This command is used to display information of authenticator diagnostics. Format show auth_diagnostics {ports } Parameters ports - (Optional) Specify a range of ports to be displayed. - Enter the list of ports that will be displayed here. Restrictions None. Example To display authenticator diagnostics information for port 1:

56 DGS-3000-26TC:admin#show auth_diagnostics ports 1 Command: show auth_diagnostics ports 1 Mac Address : 00-01-02-03-04-05 Port Number : 1 EntersConnecting 11 EapLogoffsWhileConnecting 0 EntersAuthenticating 0 SuccessWhileAuthenticating 0 TimeoutsWhileAuthenticating 0 FailWhileAuthenticating 0 ReauthsWhileAuthenticating 0 EapStartsWhileAuthenticating 0 EapLogoffWhileAuthenticating 0 ReauthsWhileAuthenticated 0 EapStartsWhileAuthenticated 0 EapLogoffWhileAuthenticated 0 BackendResponses 0 BackendAccessChallenges 0 BackendOtherRequestsToSupplicant 0 BackendNonNakResponsesFromSupplicant 0 BackendAuthSuccesses 0 BackendAuthFails 0 CTRL+C ESC q Quit SPACE n Next Page p Previous Page r Refresh show auth_session_statistics 4-24 Description This command is used to display information of authenticator session statistics. Format show auth_session_statistics {ports } Parameters ports - (Optional) Specify a range of ports to be displayed. - Enter the list of ports that will be displayed here. Restrictions None. Example To display authenticator session statistics information for port 1:

57 DGS-3000-26TC:admin#show auth_session_statistics ports 1 Command: show auth_session_statistics ports 1 Mac Address : 00-01-02-03-04-05 Port Number : 1 SessionOctetsRx 0 SessionOctetsTx 0 SessionFramesRx 0 SessionFramesTx 0 SessionId SessionAuthenticMethod Remote Authentication Server SessionTime 0 SessionTerminateCause SupplicantLogoff SessionUserName CTRL+C ESC q Quit SPACE n Next Page p Previous Page r Refresh

58 Chapter 5 Access Authentication Control Command List enable password encryption disable password encryption enable authen_policy disable authen_policy enable authen_policy_encryption disable authen_policy_encryption show authen_policy create authen_login method_list_name config authen_login [default | method_list_name ] method {tacacs | xtacacs | tacacs+ | radius | server_group | local | none} delete authen_login method_list_name show authen_login [default | method_list_name | all] create authen_enable method_list_name config authen_enable [default | method_list_name ] method {tacacs | xtacacs | tacacs+ | radius | server_group | local _enable | none} delete authen_enable method_list_name show authen_enable [default | method_list_name | all] config authen application [console | telnet | ssh | http | all] [login | enable] [default | method_list_name ] show authen application create authen server_group config authen server_group [tacacs | xtacacs | tacacs+ | radius | ] [add | delete] server_host [ | ipv6 ] protocol [tacacs | xtacacs | tacacs+ | radius] delete authen server_group show authen server_group {} create authen server_host [ | ipv6 ] protocol [tacacs | xtacacs | tacacs+| radius] {port | [key [ | none] | encryption_key ] | timeout | retransmit } config authen server_host [ | ipv6 ] protocol [tacacs | xtacacs | tacacs+| radius] {port | [key [ | none] | encryption_key ] | timeout | retransmit } delete authen server_host [ | ipv6 ] protocol [tacacs | xtacacs | tacacs+ | radius] show authen server_host config authen parameter response_timeout config authen parameter attempt show authen parameter enable admin config admin local_enable {encrypt [plain_text | sha_1] } create accounting method_list_name config accounting [default | method_list_name ] method {tacacs+ | radius | server_group | none} delete accounting method_list_name show accounting [default | method_list_name | all] config accounting service command {administrator | operator | power_user | user} [method_list_name | none]

59 config accounting service [network | shell | system] state [enable {[radius_only | method_list_name | default_method_list]} | disable] show accounting service show aaa enable password encryption 5-1 Description This command is used to enable password encryption. The user account configuration information will be stored in the configuration file, and can be applied to the system later. If the password encryption is enabled, the password will be in encrypted form. Format enable password encryption Parameters None. Restrictions Only Administrators can issue this command. Example To enable the password encryption: DGS-3000-26TC:admin#enable password encryption Command: enable password encryption Success. DGS-3000-26TC:admin# disable password encryption 5-2 Description This command is used to disable password encryption. The user account configuration information will be stored in the configuration file, and can be applied to the system later. When password encryption is disabled, if the user Specify the password in plain text form, the password will be in plan text form. However, if the user Specify the password in encrypted form, or if the password has been converted to encrypted form by the last enable password encryption command, the password will still be in the encrypted form. It can not be reverted to the plaintext. Format disable password encryption

60 Parameters None. Restrictions Only Administrators can issue this command. Example To disable the password encryption: DGS-3000-26TC:admin#disable password encryption Command: disable password encryption Success. DGS-3000-26TC:admin# enable authen_policy 5-3 Description This command is used to enable system access authentication policy. Enable system access authentication policy. When authentication is enabled, the device will adopt the login authentication method list to authenticate the user for login, and adopt the enable authentication method list to authenticate the enable password for promoting the user‘s privilege to Admin level. Format enable authen_policy Parameters None. Restrictions Only Administrators can issue this command. Example To enable system access authentication policy:

61 DGS-3000-26TC:admin#enable authen_policy Command: enable authen_policy Success. DGS-3000-26TC:admin# disable authen_policy 5-4 Description This command is used to disable system access authentication policy. Disable system access authentication policy. When authentication is disabled, the device will adopt the local user account database to authenticate the user for login, and adopt the local enable password to authenticate the enable password for promoting the user‘s privilege to Admin level. Format disable authen_policy Parameters None. Restrictions Only Administrators can issue this command. Example To disable system access authentication policy: DGS-3000-26TC:admin#disable authen_policy Command: disable authen_policy Success. DGS-3000-26TC:admin# enable authen_policy_encryption 5-5 Description This command is used to enable the authentication policy encryption. When enabled, TACACS+ and RADIUS key will be in the encrypted form. Format enable authen_policy_encryption

62 Parameters None. Restrictions Only Administrators can issue this command. Example To enable the authentication policy encryption: DGS-3000-26TC:admin#enable authen_policy_encryption Command: enable authen_policy_encryption Success. DGS-3000-26TC:admin# disable authen_policy_encryption 5-6 Description This command is used to disable the authentication policy encryption. When disabled, TACACS+ and RADIUS key will be in the plain text form. Format disable authen_policy_encryption Parameters None. Restrictions Only Administrators can issue this command. Example To disable the authentication policy encryption: DGS-3000-26TC:admin#disable authen_policy_encryption Command: disable authen_policy_encryption Success. DGS-3000-26TC:admin#

63 show authen_policy 5-7 Description This command is used to display that system access authentication policy is enabled or disabled. Format show authen_policy Parameters None. Restrictions Only Administrators can issue this command. Example To display system access authentication policy: DGS-3000-26TC:admin#show authen_policy Command: show authen_policy Authentication Policy : Enabled DGS-3000-26TC:admin# create authen_login 5-8 Description This command is used to create a user-defined method list of authentication methods for user login. The maximum supported number of the login method lists is 8. Format create authen_login method_list_name Parameters - Enter the user-defined method list name. This value can be up to 15 characters long. Restrictions Only Administrators can issue this command. Example To create a user-defined method list for user login:

64 DGS-3000-26TC:admin#create authen_login method_list_name login_list_1 Command: create authen_login method_list_name login_list_1 Success. DGS-3000-26TC:admin# config authen_login 5-9 Description This command is used to configure a user-defined or default method list of authentication methods for user login. The sequence of methods will effect the altercation result. For example, if the sequence is TACACS+ first, then TACACS and local, when user trys to login, the authentication request will be sent to the first server host in TACACS+ built-in server group. If the first server host in TACACS+ group is missing, the authentication request will be sent to the second server host in TACACS+ group, and so on. If all server hosts in TACACS+ group are missing, the authentication request will be sent to the first server host in TACACS group. If all server hosts in TACACS group are missing, the local account database in the device is used to authenticate this user. When user logins the device successfully while using methods like TACACS/XTACACS/TACACS+/RADIUS built-in or user-defined server groups or none, the “user” privilege level is assigned only. If user wants to get admin privilege level, user must use the “enable admin” command to promote his privilege level. But when local method is used, the privilege level will depend on this account privilege level stored in the local device. Format config authen_login [default | method_list_name ] method {tacacs | xtacacs | tacacs+ | radius | server_group | local | none} Parameters default - The default method list of authentication methods. method_list_name - The user-defined method list of authentication methods. - Enter the method list name here. This value can be up to 15 characters long. method - Specify the authentication method used. tacacs - (Optional) Specify to authenticate by using the built-in server group called “TACACS”. xtacacs - (Optional) Specify to authenticate by using the built-in server group called “XTACACS”. tacacs+ - (Optional) Specify to authenticate by using the built-in server group called “TACACS+”. radius - (Optional) Specify to authenticate by using the built-in server group called “RADIUS”. server_group - (Optional) Specify to authenticate by using the user-defined server group. - Enter the server group value here. This value can be up 15 characters long. local - (Optional) Specify to authenticate by local user account database in device. none - (Optional) No authentication. Restrictions Only Administrators can issue this command.

65 Example To configure a user-defined method list for user login: DGS-3000-26TC:admin#config authen_login method_list_name login_list_1 method tacacs+ tacacs local Command: config authen_login method_list_name login_list_1 method tacacs+ tacacs local Success. DGS-3000-26TC:admin# delete authen_login 5-10 Description This command is used to delete a user-defined method list of authentication methods for user login. Format delete authen_login method_list_name Parameters - Enter the user-defined method list name. This value can be up to 15 characters long. Restrictions Only Administrators can issue this command. Example To delete a user-defined method list for user login: DGS-3000-26TC:admin#delete authen_login method_list_name login_list_1 Command: delete authen_login method_list_name login_list_1 Success. DGS-3000-26TC:admin# show authen_login 5-11 Description This command is used to display the method list of authentication methods for user login. Format show authen_login [default | method_list_name | all]

66 Parameters default - Displays default user-defined method list for user login. method_list_name - Displays the specific user-defined method list for user login. - Enter the method list name here. This value can be up to 15 characters long. all - Displays all method lists for user login. Restrictions Only Administrators can issue this command. Example To display a user-defined method list for user login: DGS-3000-26TC:admin#show authen_login method_list_name login_list_1 Command: show authen_login method_list_name login_list_1 Method List Name Priority Method Name Comment ---------------- -------- --------------- ------------------ login_list_1 1 tacacs+ Built-in Group 2 tacacs Built-in Group 3 mix_1 User-defined Group 4 local Keyword DGS-3000-26TC:admin# create authen_enable 5-12 Description This command is used to create a user-defined method list of authentication methods for promoting user's privilege to Admin level. Format create authen_enable method_list_name Parameters - Enter the user-defined method list name. This value can be up to 15 characters long. Restrictions Only Administrators can issue this command. Example To create a user-defined method list for promoting user's privilege to Admin level:

67 DGS-3000-26TC:admin#create authen_enable method_list_name enable_list_1 Command: create authen_enable method_list_name enable_list_1 Success. DGS-3000-26TC:admin# config authen_enable 5-13 Description This command is used to configure a user-defined or default method list of authentication methods for promoting user's privilege to Admin level. The sequence of methods will affect the altercation result. For example, if the sequence is TACACS+ first, then TACACS and local_enable, when user try to promote user's privilege to Admin level, the authentication request will be sent to the first server host in TACACS+ built-in server group. If the first server host in TACACS+ group is missing, the authentication request will be sent to the second server host in TACACS+ group, and so on. If all server hosts in TACACS+ group are missing, the authentication request will be sent to the first server host in TACACS group. If all server hosts in a TACACS group is missing, the local enable password in the device is used to authenticate this user’s password. Format config authen_enable [default | method_list_name ] method {tacacs | xtacacs | tacacs+ | radius | server_group | local _enable | none} Parameters default - The default method list of authentication methods. method_list_name - The user-defined method list of authentication methods. - Enter the method list name here. This value can be up to 15 characters long. method - Specify the authentication method used. tacacs - (Optional) Specify to authenticate by using the built-in server group called “TACACS”. xtacacs - (Optional) Specify to authenticate by using the built-in server group called “XTACACS”. tacacs+ - (Optional) Specify to authenticate by using the built-in server group called “TACACS+”. radius - (Optional) Specify to authenticate by using the built-in server group called “RADIUS”. server_group - (Optional) Specify to authenticate by the user-defined server group. - Enter the server group name here. This value can be up to 15 characters long. local_enable - (Optional) Specify to authenticate by local enable password in device. none - (Optional) No authentication. Restrictions Only Administrators can issue this command. Example To configure a user-defined method list for promoting user's privilege to Admin level:

68 DGS-3000-26TC:admin#config authen_enable method_list_name enable_list_1 method tacacs+ tacacs local_enable Command: config authen_ enable method_list_name enable_list_1 method tacacs+ tacacs local_enable Success. DGS-3000-26TC:admin# delete authen_enable 5-14 Description This command is used to delete a user-defined method list of authentication methods for promoting user's privilege to Admin level. Format delete authen_enable method_list_name Parameters - Enter the user-defined method list name. This value can be up to 15 characters long. Restrictions Only Administrators can issue this command. Example To delete a user-defined method list for promoting user's privilege to Admin level: DGS-3000-26TC:admin#delete authen_enable method_list_name enable_list_1 Command: delete authen_enable method_list_name enable_list_1 Success. DGS-3000-26TC:admin# show authen_enable 5-15 Description This command is used to display the method list of authentication methods for promoting user's privilege to Admin level. Format show authen_enable [default | method_list_name | all]

69 Parameters default - Displays default user-defined method list for promoting user's privilege to Admin level. method_list_name - Displays the specific user-defined method list for promoting user's privilege to Admin level. - Enter the method list name here. This value can be up to 15 characters long. all - Displays all method lists for promoting user's privilege to Admin level. Restrictions Only Administrators can issue this command. Example To display all method lists for promoting user's privilege to Admin level: DGS-3000-26TC:admin#show authen_enable method_list_name enable_list_1 Command: show authen_enable method_list_name enable_list_1 Method List Name Priority Method Name Comment ---------------- -------- --------------- ------------------ enable_list_1 1 tacacs+ Built-in Group 2 tacacs Built-in Group 3 mix_1 User-defined Group 4 local_enable Keyword DGS-3000-26TC:admin# config authen application 5-16 Description This command is used to configure login or enable method list for all or the specified application. Format config authen application [console | telnet | ssh | http | all] [login | enable] [default | method_list_name ] Parameters console - Application: console. telnet - Application: Telnet. ssh - Application: SSH. http - Application: web. all - Application: console, Telnet, SSH, and web. login - Selects the method list of authentication methods for user login. enable - Selects the method list of authentication methods for promoting user's privilege to Admin level. default - Default method list. method_list_name - The user-defined method list name. - Enter the method list name here. This value can be up to 15 characters long.

70 Restrictions Only Administrators can issue this command. Example To configure the login method list for Telnet: DGS-3000-26TC:admin#config authen application telnet login method_list_name login_list_1 Command: config authen application telnet login method_list_name login_list_1 Success. DGS-3000-26TC:admin# show authen application 5-17 Description This command is used to display the login/enable method list for all applications. Format show authen application Parameters None. Restrictions Only Administrators can issue this command. Example To display the login/enable method list for all applications: DGS-3000-26TC:admin#show authen application Command: show authen application Application Login Method List Enable Method List ----------- ----------------- ------------------ Console default default Telnet login_list_1 default SSH default default HTTP default default DGS-3000-26TC:admin#

71 create authen server_group 5-18 Description This command is used to create a user-defined authentication server group. The maximum supported number of server groups including built-in server groups is 8. Each group consists of 8 server hosts as maximum. Format create authen server_group Parameters - Enter the user-defined server group name. This value can be up to 15 characters long. Restrictions Only Administrators can issue this command. Example To create a user-defined authentication server group: DGS-3000-26TC:admin#create authen server_group mix_1 Command: create authen server_group mix_1 Success. DGS-3000-26TC:admin# config authen server_group 5-19 Description This command is used to add or remove an authentication server host to or from the specified server group. Built-in server group “TACACS”, “XTACACS”, “TACACS+”, “RADIUS” accepts the server host with the same protocol only, but user-defined server group can accept server hosts with different protocols. Format config authen server_group [tacacs | xtacacs | tacacs+ | radius | ] [add | delete] server_host [ | ipv6 ] protocol [tacacs | xtacacs | tacacs+ | radius] Parameters tacacs - Built-in server group “TACACS”. xtacacs - Built-in server group “XTACACS”. tacacs+ - Built-in server group “TACACS+”. radius - Built-in server group “RADIUS”. - Enter the server group name here. This value can be up to 15 characters long.

72 add - Adds a server host to a server group. delete - Removes a server host from a server group. server_host - Specify the IP address of the server host. - Enter the server host IPv4 address. ipv6 - Specify the server host IPv6 address. - Enter the server host IPv6 address. protocol - Specify the authentication protocol used. tacacs - Specify that the TACACS authentication protocol will be used. xtacacs - Specify that the XTACACS authentication protocol will be used. tacacs+ - Specify that the TACACS+ authentication protocol will be used. radius - Specify that the RADIUS authentication protocol will be used. Restrictions Only Administrators can issue this command. Example To add an authentication server host to an server group: DGS-3000-26TC:admin#config authen server_group mix_1 add server_host 10.1.1.222 protocol tacacs+ Command: config authen server_group mix_1 add server_host 10.1.1.222 protocol tacacs+ Success. DGS-3000-26TC:admin# delete authen server_group 5-20 Description This command is used to delete a user-defined authentication server group. Format delete authen server_group Parameters - Enter the user-defined server group name. This value can be up to 15 characters long. Restrictions Only Administrators can issue this command. Example To delete a user-defined authentication server group:

73 DGS-3000-26TC:admin#delete authen server_group mix_1 Command: delete authen server_group mix_1 Success. DGS-3000-26TC:admin# show authen server_group 5-21 Description This command is used to display the authentication server groups. Format show authen server_group {} Parameters - (Optional) Enter the built-in or user-defined server group name. This value can be up to 15 characters long. Restrictions Only Administrators can issue this command. Example To display all authentication server groups: DGS-3000-26TC:admin#show authen server_group Command: show authen server_group Group Name IP Address Protocol --------------- --------------- -------- mix_1 10.1.1.222 tacacs+ 10.1.1.223 tacacs radius 10.1.1.224 RADIUS tacacs 10.1.1.225 tacacs tacacs+ 10.1.1.226 tacacs+ xtacacs 10.1.1.227 xtacacs Total Entries : 5 DGS-3000-26TC:admin#

74 create authen server_host 5-22 Description This command is used to create an authentication server host. When an authentication server host is created, IP address and protocol are the index. That means over 1 authentication protocol services can be run on the same physical host. The maximum supported number of server hosts is 16. Format create authen server_host [ | ipv6 ] protocol [tacacs | xtacacs | tacacs+| radius] {port | [key [ | none] | encryption_key ] | timeout | retransmit } Parameters - Enter the server host IP address. ipv6 - Specify the server host IPv6 address. - Enter the server host IPv6 address. protocol - Specify the host's authentication protocol. tacacs - Server host’s authentication protocol. xtacacs - Server host’s authentication protocol. tacacs+ - Server host’s authentication protocol. radius - Server host’s authentication protocol. port - (Optional) The port number of authentication protocol for server host. Default value for TACACS/XTACACS/TACACS+ is 49. Default value for RADIUS is 1812. - Enter the authentication protocol port number here. This value must be between 1 and 65535. key - (Optional) The key for TACACS+ and RADIUS authentication. If the value is null, no encryption will apply. This value is meaningless for TACACS and XTACACS. - Enter the TACACS+ or the RADIUS key here. This key can be up to 254 characters long. none - No encryption for TACACS+ and RADIUS authentication. This value is meaningless for TACACS and XTACACS. encryption_key - (Optional) Specify the encrypted form key string for TACACS+ and RADIUS authentication. This value is meaningless for TACACS and XTACACS. The encryption algorithm is based on DES. - Enter the encrypted form key string for TACACS+ and RADIUS authentication. timeout - (Optional) The time in second for waiting server reply. Default value is 5 seconds. - Enter the timeout value here. This value must be between 1 and 255 seconds. retransmit - (Optional) The count for re-transmit. This value is meaningless for TACACS+. Default value is 2. - Enter the re-transmit value here. This value must be between 1 and 20. Restrictions Only Administrators can issue this command. Example To create a TACACS+ authentication server host, its listening port number is 15555 and timeout value is 10 seconds:

75 DGS-3000-26TC:admin#create authen server_host 10.1.1.222 protocol tacacs+ port 15555 timeout 10 Command: create authen server_host 10.1.1.222 protocol tacacs+ port 15555 timeout 10 Key is empty for tacacs+ or RADIUS. Success. DGS-3000-26TC:admin# config authen server_host 5-23 Description This command is used to configure an authentication server host. Format config authen server_host [ |ipv6 ] protocol [tacacs | xtacacs | tacacs+ | radius] {port | [ key [ | none] | encryption_key ] | timeout | retransmit } Parameters - Enter the server host IP address. ipv6 - Specify the server host IPv6 address. - Enter the server host IPv6 address. protocol - Specify the server host's authentication protocol. tacacs - Server host’s authentication protocol. xtacacs - Server host’s authentication protocol. tacacs+ - Server host’s authentication protocol. radius - Server host’s authentication protocol. port - (Optional) The port number of authentication protocol for server host. Default value for TACACS/XTACACS/TACACS+ is 49. Default value for RADIUS is 1812. - Enter the port number here. This value must be between 1 and 65535. key - (Optional) The key for TACACS+ and RADIUS authentication. If the value is null, no encryption will apply. This value is meaningless for TACACS and XTACACS. - Enter the TACACS+ key here. This value can be up to 254 characters long. none - No encryption for TACACS+ and RADIUS authentication. This value is meaningless for TACACS and XTACACS. encryption_key - (Optional) Specify the encrypted form key string for TACACS+ and RADIUS authentication. This value is meaningless for TACACS and XTACACS. The encryption algorithm is based on DES. - Enter the encrypted form key string for TACACS+ and RADIUS authentication. timeout - (Optional) The time in second for waiting server reply. Default value is 5 seconds. - Enter the timeout value here. This value must be between 1 and 255 seconds. retransmit - (Optional) The count for re-transmit. This value is meaningless for TACACS+. Default value is 2. - Enter the re-transmit value here. This value must be between 1 and 20. Restrictions Only Administrators can issue this command.

76 Example To configure a TACACS+ authentication server host’s key value: DGS-3000-26TC:admin#config authen server_host 10.1.1.222 protocol tacacs+ key "This is a secret." Command: config authen server_host 10.1.1.222 protocol tacacs+ key "This is a secret." Success. DGS-3000-26TC:admin# delete authen server_host 5-24 Description This command is used to delete an authentication server host. Format delete authen server_host [ | ipv6 ] protocol [tacacs | xtacacs | tacacs+ | radius] Parameters - Enter the server host's IP address. ipv6 - Specify the server host IPv6 address. - Enter the server host IPv6 address. protocol - Specify that server host's authentication protocol. tacacs - Server host’s authentication protocol. xtacacs - Server host’s authentication protocol. tacacs+ - Server host’s authentication protocol. radius - Server host’s authentication protocol. Restrictions Only Administrators can issue this command. Example To delete an authentication server host: DGS-3000-26TC:admin#delete authen server_host 10.1.1.222 protocol tacacs+ Command: delete authen server_host 10.1.1.222 protocol tacacs+ Success. DGS-3000-26TC:admin#

77 show authen server_host 5-25 Description This command is used to display the authentication server hosts. Format show authen server_host Parameters None. Restrictions Only Administrators can issue this command. Example To display all authentication server hosts: DGS-3000-26TC:admin#show authen server_host Command: show authen server_host IP Address Protocol Port Timeout Retransmit Key --------------- -------- ----- ------- ---------- ------------------------- 10.1.1.222 tacacs+ 15555 10 ------ This is a secret. Total Entries : 1 DGS-3000-26TC:admin# config authen parameter response_timeout 5-26 Description This command is used to configure the amount of time waiting or user input on console, Telnet, SSH application. Format config authen parameter response_timeout Parameters - Enter the timeout response time for user input on console, Telnet or SSH. 0 means there is no time out. This value must be between 0 and 255. Default value is 30 seconds. Restrictions Only Administrators can issue this command.

78 Example To configure the amount of time waiting or user input to be 60 seconds: DGS-3000-26TC:admin#config authen parameter response_timeout 60 Command: config authen parameter response_timeout 60 Success. DGS-3000-26TC:admin# config authen parameter attempt 5-27 Description This command is used to configure the maximum attempts for user's trying to login or promote the privilege on console, Telnet, or SSH application. Format config authen parameter attempt Parameters - Enter the amount of attempts for user's trying to login or promote the privilege on console, Telnet or SSH. This value must be between 1 and 255. Default value is 3. Restrictions Only Administrators can issue this command. Example To configure the maximum attempts for user's trying to login or promote the privilege to be 9: DGS-3000-26TC:admin#config authen parameter attempt 9 Command: config authen parameter attempt 9 Success. DGS-3000-26TC:admin# show authen parameter 5-28 Description This command is used to display the parameters of authentication. Format show authen parameter

79 Parameters None. Restrictions Only Administrators can issue this command. Example To display the parameters of authentication: DGS-3000-26TC:admin#show authen parameter Command: show authen parameter Response Timeout : 60 seconds User Attempts : 9 DGS-3000-26TC:admin# enable admin 5-29 Description This command is used to enter the administrator level privilege. Promote the "user" privilege level to "admin" level. When the user enters this command, the authentication method TACACS, XTACACS, TACACS+, user-defined server groups, local_enable or none will be used to authenticate the user. Because TACACS, XTACACS and RADIUS don't support "enable" function in itself, if user wants to use either one of these 3 protocols to do enable authentication, user must create a special account on the server host first, which has a username "enable" and then configure its password as the enable password to support "enable" function. This command can not be used when authentication policy is disabled. Format enable admin Parameters None. Restrictions None. Example To enable administrator lever privilege:

80 DGS-3000-26TC:puser#enable admin Command: enable admin PassWord:***** Success. DGS-3000-26TC:admin# config admin local_enable 5-30 Description This command is used to config the local enable password of administrator level privilege. When the user chooses the “local_enable” method to promote the privilege level, the enable password of local device is needed. When the password information is not specified in the command, the system will prompt the user to input the password interactively. For this case, the user can only input the plain text password. If the password is present in the command, the user can select to input the password in the plain text form or in the encrypted form. The encryption algorithm is based on SHA-1. Format config admin local_enable {encrypt [plain_text | sha_1] } Parameters encrypt - (Optional) Specify the password form. plain_text - Specify the password in plain text form. sha_1 - Specify the password in SHA-1 encrypted form. - (Optional) Enter the password for promoting the privilege level. The length for a password in plain-text form and SHA-1 encrypted form are different. Restrictions Only Administrators can issue this command. Example To configure the administrator password: DGS-3000-26TC:admin#config admin local_enable Command: config admin local_ebable Enter the old password: Enter the case-sensitive new password:****** Enter the new password again for confirmation:****** Success. DGS-3000-26TC:admin#

81 create accounting method_list_name 5-31 Description This command is used to create a user-defined list of accounting methods for accounting services on the Switch. The maximum supported number of accounting method lists is 8. Format create accounting method_list_name Parameters - Enter the built-in or user-defined method list. Restrictions Only Administrators can issue this command. Example To create a user-defined accounting method list called “shell_acct”: DGS-3000-26TC:admin#create accounting method_list_name shell_acct Command: create accounting method_list_name shell_acct Success. DGS-3000-26TC:admin# config accounting 5-32 Description This command is used to configure a user-defined or default method list of accounting methods. Format config accounting [default | method_list_name ] method {tacacs+ | radius | server_group | none} Parameters default - Specify the default method list of accounting methods. method_list_name - Specify the user-defined method list of accounting methods. - Enter the name of the method list. method - Specify the protocol. tacacs+ - Specify the built-in TACACS+ server group. radius – Specify the built-in RADIUS server group. server_group - Specify the user-defined server group. If the group contains TACACS and XTACACS server, it will be skipped in accounting. - Enter the name of server group. none - Specify no accounting.

82 Restrictions Only Administrators can issue this command. Example To configure a user-defined method list called “shell_acct”, that Specify a sequence of the built-in TACACS+ server group, followed by the RADIUS server group for accounting service on the Switch: DGS-3000-26TC:admin#config accounting method_list_name shell_acct method tacacs+ radius Command: config accounting method_list_name shell_acct method tacacs+ radius Success. DGS-3000-26TC:admin# delete accounting method_list_name 5-33 Description This command is used to delete a user-defined method list of accounting methods. Format delete accounting method_list_name Parameters - Enter the built-in or user-defined method list. Restrictions Only Administrators can issue this command. Example To delete the user-defined accounting method list called “shell_acct” from the Switch: DGS-3000-26TC:admin#delete accounting method_list_name shell_acct Command: delete accounting method_list_name shell_acct Success. DGS-3000-26TC:admin#

83 show accounting 5-34 Description This command is used to display the list of accounting methods on the Switch. Format show accounting [default | method_list_name | all] Parameters default - Displays the user-defined list of default accounting methods. method_list_name - Specify the user-defined list of specific accounting methods. - Enter the name of the method list. all - Displays all accounting method lists on the Switch. Restrictions Only Administrators can issue this command. Example To display the user-defined accounting method list called “shell_acct”: DGS-3000-26TC:admin#show accounting method_list_name shell_acct Command: show accounting method_list_name shell_acct Method List Name Priority Method Name Comment ---------------- -------- --------------- ------------------ shell_acct 1 tacacs+ Built-in Group 2 radius Built-in Group DGS-3000-26TC:admin# config accounting service command 5-35 Description This command is used to configure the state of the specified accounting service. Format config accounting service command {administrator | operator | power_user | user} [method_list_name | none] Parameters administrator - Accounting service for all administrator level commands. operator - Accounting service for all operator level commands. power_user - Accounting service for all power-user level commands. user - Accounting service for all user level commands. method_list_name - Specify accounting service by the AAA user-defined method list specified

84 by the create accounting method_list_name command. - Enter the name of the method list. none - Disables AAA command accounting services by specified command level. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To enable AAA accounting methodlist “shell_acct” to configure accounting shell state: DGS-3000-26TC:admin#config accounting service command method_list_name shell_acct Command: config accounting service command method_list_name shell_acct Success. DGS-3000-26TC:admin# config accounting service 5-36 Description This command is used to configure the state of the specified RADIUS accounting service. Format config accounting service [network | shell | system] state [enable {[radius_only | method_list_name | default_method_list]} | disable] Parameters network - Accounting service for 802.1X, JWAC and WAC port access control. By default, the service is disabled. shell - Accounting service for shell events: When user logs on or out the Switch (via the console, Telnet, or SSH) and timeout occurs, accounting information will be collected and sent to RADIUS server. By default, the service is disabled. system - Accounting service for system events: reset, reboot. By default, the service is disabled. state - Specify the state of the specified service. enable - Specify to enable the specified accounting service. radius_only - (Optional) Specify accounting service to only use RADIUS group specified by the config radius add command. method_list_name - (Optional) Specify accounting service by the AAA user-defined method list specified by the “create accounting method_list_name ” command. - Enter the method list name. default_method_list - - (Optional) Specify accounting service by the AAA default method list. disable - Specify to disable the specified accounting service. Restrictions Only Administrators, Operators and Power-Users can issue this command.

85 Example Enable it to configure accounting shell state: DGS-3000-26TC:admin#config accounting service shell state enable Command: config accounting service shell state enable Success. DGS-3000-26TC:admin# show accounting service 5-37 Description This command is used to show the status of RADIUS accounting services. Format show accounting service Parameters None. Restrictions None. Example To show information of RADIUS accounting services: DGS-3000-26TC:admin#show accounting service Command: show accounting service Accounting State Method ------------------- --------------- Network : Disabled Shell : Disabled System : Disabled DGS-3000-26TC:admin# show aaa 5-38 Description This command is used to display AAA global configuration

86 Format show aaa Parameters None. Restrictions Only Administrators can issue this command. Example To display AAA global configuration: DGS-3000-26TC:admin#show aaa Command: show aaa Authentication Policy: Enabled Accounting Network Service State: Disabled Accounting Network Service Method: Accounting Shell Service State: Disabled Accounting Shell Service Method: Accounting System Service State: Disabled Accounting System Service Method: Accounting Admin Command Service Method: Accounting Operator Command Service Method: Accounting PowerUser Command Service Method: Accounting User Command Service Method: DGS-3000-26TC:admin#

87 Chapter 6 Access Control List (ACL) Command List create access_profile profile_id {profile_name } [ethernet {vlan {} | source_mac | destination_mac | 802.1p | ethernet_type} | ip {vlan {} | source_ip_mask | destination_ip_mask | dscp | [icmp {type | code } | igmp {type } | tcp {src_port_mask | dst_port_mask | flag_mask [all | {urg | ack | psh | rst | syn | fin}]} | udp {src_port_mask | dst_port_mask } | protocol_id_mask {user_define_mask }]} | packet_content_mask { offset_chunk_1 | offset_chunk_2 | offset_chunk_3 | offset_chunk_4 } | ipv6 {class | flowlabel | source_ipv6_mask | destination_ipv6_mask | [tcp {src_port_mask | dst_port_mask } | udp { src_port_mask | dst_port_mask } | icmp {type | code }]}] delete access_profile [profile_id | profile_name |all] config access_profile [profile_id | profile_name ] [add access_id [auto_assign | ][ethernet {[vlan | vlan_id ] {mask } | source_mac {mask } | destination_mac {mask } | 802.1p | ethernet_type } | ip {[vlan | vlan_id ] {mask } | source_ip {mask } | destination_ip {mask } | dscp | [icmp {type | code } | igmp {type } | tcp {src_port {mask } | dst_port {mask } | flag [all | {urg | ack | psh | rst | syn | fin}]} | udp {src_port {mask } | dst_port {mask }} | protocol_id {user_define {mask }}]} | packet_content {offset_chunk_1 {mask } | offset_chunk_2 {mask } | offset_chunk_3 {mask } | offset_chunk_4 {mask }} | ipv6 {class | flowlabel | source_ipv6 {mask} | destination_ipv6 {mask } | [tcp {src_port {mask } | dst_port {mask }} | udp {src_port {mask } | dst_port {mask }} | icmp {type | code }]}] [port [ | all] | vlan_based [vlan | vlan_id ]] [permit {priority {replace_priority} | [replace_dscp_with | replace_tos_precedence_with ] | counter[enable | disable]} | mirror | deny] {time_range } | delete access_id ] show access_profile {[profile_id | profile_name ]} config flow_meter [profile_id | profile_name ] access_id [rate [] {burst_size []} rate_exceed [drop_packet | remark_dscp ] | tr_tcm cir {cbs } pir {pbs } {[color_blind | color_aware]} {conform [permit | replace_dscp ] {counter [enable | disable]}} exceed [permit {replace_dscp } | drop] {counter [enable | disable]} violate [permit {replace_dscp } | drop] {counter [enable |disable]} | sr_tcm cir cbs ebs {[color_blind | color_aware]} {conform [permit | replace_dscp ] {counter [enable | disable]}} exceed [permit {replace_dscp } | drop] {counter [enable | disable]} violate [permit {replace_dscp } | drop] {counter [enable | disable]} | delete] show flow_meter {[profile_id | profile_name ] {access_id }} config time_range [hours start_time end_time weekdays | delete]

88 show time_range show current_config access_profile create access_profile 6-1 Description This command is used to create access control list profiles. When creating ACL, each profile can have 256 rules/access IDs. However, when creating ACL type as Ethernet or IPv4 at the first time, 62 rules are reserved for the system. In this case, only 194 rules are available to configure. You can use the show access_prfile command to see the available rules. Support for field selections can have additional limitations that are project dependent. For example, for some hardware, it may be invalid to specify a destination and source IPv6 address at the same time. The user will be prompted with these limitations. The Switch supports the following profile types: 1. MAC DA, MAC SA, Ethernet Type, Outer VLAN Tag 2. Outer VLAN Tag, Source IPv4, Destination IPv4, DSCP, Protocol ID, TCP/UDP Source Port, TCP/UDP Destination Port, ICMP type/code, IGMP type, TCP flags 3. Source IPv6 Address, Class, Flow Label, IPv6 Protocol (Next Header) 4. Destination IPv6 Address, Class, Flow Label, IPv6 Protocol (Next Header) 5. Class, Flow Label, IPv6 Protocol (Next Header), TCP/UDP source port, TCP/UDP destination port, ICMP type/code, Outer VLAN Tag 6. Packet Content, Outer VLAN Tag 7. MAC SA, Ethernet Type, Source IPv4/ARP sender IP, Outer VLAN Tag 8. LLC Header/SNAP Header, Outer VLAN Tag 9. Source IPv6 Address, Class, IPv6 Protocol (Next Header), Outer VLAN Tag 10. Destination IPv6 Address, Class, IPv6 Protocol (Next Header), Outer VLAN Tag NOTE: Profile Types 7 and 8 are not user configurable. Only system applications are allowed to create this type of profiles. Format create access_profile profile_id {profile_name } [ethernet {vlan {} | source_mac | destination_mac | 802.1p | ethernet_type} | ip {vlan {} | source_ip_mask | destination_ip_mask | dscp | [icmp {type | code } | igmp {type } | tcp {src_port_mask | dst_port_mask | flag_mask [all | {urg | ack | psh | rst | syn | fin}]} | udp {src_port_mask | dst_port_mask } | protocol_id_mask {user_define_mask }]} | packet_content_mask { offset_chunk_1 | offset_chunk_2 | offset_chunk_3 | offset_chunk_4 } | ipv6 {class | flowlabel | source_ipv6_mask | destination_ipv6_mask | [tcp {src_port_mask | dst_port_mask } | udp { src_port_mask | dst_port_mask } | icmp {type | code }]}] Parameters profile_id - Specify the index of the access list profile. - Enter the profile ID here. This value must be between 1 and 512.

89 profile_name - The name of the profile must be specified. The maximum length is 32 characters. - Enter the profile name here. ethernet - Specify this is an ethernet mask. vlan - (Optional) Specify a VLAN mask. Only the last 12 bits of the mask will be considered. - Enter the VLAN mask value here. source_mac - (Optional) Specify the source MAC mask. - Enter the source MAC address used here. destination_mac - (Optional) Specify the destination MAC mask. - Enter the destination MAC address used here. 802.1p - (Optional) Specify the 802.1p priority tag mask. ethernet_type - (Optional) Specify the Ethernet type mask. ip - Specify this is a IPv4 mask. vlan - (Optional) Specify a VLAN mask. Only the last 12 bits of the mask will be considered. -Enter the VLAN mask value here. source_ip_mask - (Optional) Specify a source IP address mask. - Enter the source IP address mask here. destination_ip_mask - (Optional) Specify a destination IP address mask. - Enter the destination IP address mask here. dscp - (Optional) Specify the DSCP mask. icmp - (Optional) Specify that the rule applies to ICMP traffic. type - Specify the type of ICMP traffic. code - Specify the code of ICMP traffic igmp - (Optional) Specify that the rule applies to IGMP traffic. type - Specify the type of IGMP traffic. tcp - (Optional) Specify that the rule applies to TCP traffic. src_port_mask - (Optional) Specify the TCP source port mask. - Enter the TCP source port mask here. dst_port_mask - (Optional) Specify the TCP destination port mask. - Enter the TCP destination port mask here. flag_mask - (Optional) Specify the TCP flag field mask. all – Specify that all the flags will be used for the TCP mask. urg – (Optional) Specify that the TCP flag field will be set to ‘urg’. ack - (Optional) Specify that the TCP flag field will be set to ‘ack’. psh - (Optional) Specify that the TCP flag field will be set to ‘psh’. rst - (Optional) Specify that the TCP flag field will be set to ‘rst’. syn - (Optional) Specify that the TCP flag field will be set to ‘syn’. fin - (Optional) Specify that the TCP flag field will be set to ‘fin’. udp - (Optional) Specify that the rule applies to UDP traffic. src_port_mask - (Optional) Specify the UDP source port mask. - Enter the UDP source port mask here. dst_port_mask - (Optional) Specify the UDP destination port mask. - Enter the UDP destination port mask here. protocol_id_mask - (Optional) Specify that the rule applies to IP protocol ID traffic. <0x0-0xff> - Enter the protocol ID mask here. user_define_mask - (Optional) Specify that the rule applies to the IP protocol ID, and that the mask option behind the IP header length is 4 bytes. - Enter a user-defined mask value here. packet_content_mask - Specify the packet content mask. Only one packet_content_mask profile can be created. offset_chunk_1 - (Optional) Specify that the offset chunk 1 will be used. - Enter the offset chunk 1 value here. This value must be between 0 and 31. - Enter the offset chunk 1 mask here. offset_chunk_2 - (Optional) Specify that the offset chunk 2 will be used. - Enter the offset chunk 2 value here. This value must be between 0 and 31. - Enter the offset chunk 2 mask here. offset_chunk_3 - (Optional) Specify that the offset chunk 3 will be used. - Enter the offset chunk 3 value here. This value must be between 0 and 31. - Enter the offset chunk 3 mask here. offset_chunk_4 - (Optional) Specify that the offset chunk 4 will be used. - Enter the offset chunk 4 value here. This value must be between 0 and 31.

90 - Enter the offset chunk 4 mask here. ipv6 - Specify this is the IPv6 mask. class - (Optional) Specify the IPv6 class. flowlabel - (Optional) Specify the IPv6 flow label. source_ipv6_mask - (Optional) Specify an IPv6 source sub-mask. - Enter the source IPv6 mask value here. destination_ipv6_mask - (Optional) Specify an IPv6 destination sub-mask. -Enter the destination IPv6 mask value here. tcp - (Optional) Specify that the rule applies to TCP traffic. src_port_mask - (Optional) Specify an IPv6 TCP source port mask. - Enter the TCP source port mask value here. dst_port_mask - (Optional) Specify an IPv6 TCP destination port mask. - Enter the TCP destination port mask value here. udp - (Optional) Specify that the rule applies to UDP traffic. src_port_mask - Specify the UDP source port mask. - Enter the UDP source port mask value here. dst_port_mask - Specify the UDP destination port mask. - Enter the UDP destination port mask value here. icmp - (Optional) Specify a mask for ICMP filtering. type - (Optional) Specify the inclusion of the ICMP type field in the mask. code - (Optional) Specify the inclusion of the ICMP code field in the mask. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To create three access profiles: DGS-3000-26TC:admin#create access_profile profile_id 1 profile_name t1 ethernet vlan source_mac 00-00-00-00-00-01 destination_mac 00-00-00-00-00-02 802.1p ethernet_type Command: create access_profile profile_id 1 profile_name 1 ethernet vlan source_mac 00-00-00-00-00-01 destination_mac 00-00-00-00-00-02 802.1p ethernet_type Success. DGS-3000-26TC:admin#create access_profile profile_id 2 profile_name 2 ip vlan source_ip_mask 20.0.0.0 destination_ip_mask 10.0.0.0 dscp icmp type code Command: create access_profile profile_id 2 profile_name t2 ip vlan source_ip_mask 20.0.0.0 destination_ip_mask 10.0.0.0 dscp icmp type code Success. DGS-3000-26TC:admin#create access_profile profile_id 4 profile_name 4 packet_content_mask offset_chunk_1 3 0xFFFF offset_chunk_2 5 0xFF00 offset_chunk_3 14 0xFFFF0000 offset_chunk_4 16 0xFF000000 Command: create access_profile profile_id 4 profile_name 4 packet_content_mask offset_chunk_1 3 0xFFFF offset_chunk_2 5 0xFF00 offset_chunk_3 14 0xFFFF0000 offset_chunk_4 16 0xFF000000 Success. DGS-3000-26TC:admin#

91 delete access_profile 6-2 Description This command is used to delete access list profiles. This command can only delete profiles that were created using the ACL module. Format delete access_profile [profile_id | profile_name |all] Parameters profile_id - Specify the index of the access list profile. - Enter the profile ID value here. This value must be between 1 and 512. profile_name - Specify the name of the profile. - Enter the profile name.. The maximum length is 32 characters. all - Specify that the whole access list profile will be deleted. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To delete the access list rule with a profile ID of 1: DGS-3000-26TC:admin#delete access_profile profile_id 1 Command: delete access_profile profile_id 1 Success. DGS-3000-26TC:admin# config access_profile 6-3 Description This command is used to configure an access list entry. The ACL mirror function works after the mirror has been enabled and the mirror port has been configured using the mirror command. When applying an access rule to a target, the setting specified in the VLAN field will not take effect if the target is a VLAN. Format config access_profile [profile_id | profile_name ] [add access_id [auto_assign | ][ethernet {[vlan | vlan_id ] {mask } | source_mac {mask } | destination_mac {mask } | 802.1p | ethernet_type } | ip {[vlan | vlan_id ] {mask } | source_ip {mask } | destination_ip {mask } | dscp | [icmp {type | code } | igmp {type } | tcp {src_port {mask } | dst_port {mask

92 0x0-0xffff>} | flag [all | {urg | ack | psh | rst | syn | fin}]} | udp {src_port {mask } | dst_port {mask }} | protocol_id {user_define {mask }}]} | packet_content {offset_chunk_1 {mask } | offset_chunk_2 {mask } | offset_chunk_3 {mask } | offset_chunk_4 {mask }} | ipv6 {class | flowlabel | source_ipv6 {mask} | destination_ipv6 {mask } | [tcp {src_port {mask } | dst_port {mask }} | udp {src_port {mask } | dst_port {mask }} | icmp {type | code }]}] [port [ | all] | vlan_based [vlan | vlan_id ]] [permit {priority {replace_priority} | [replace_dscp_with | replace_tos_precedence_with ] | counter[enable | disable]} | mirror | deny] {time_range } | delete access_id ] Parameters profile_id - Specify the index of the access list profile. - Enter the profile ID value here. This value must be between 1 and 512. profile_name - Specify the name of the profile. - Enter the profile name here. This name can be up to 32 characters long. add - Specify that a profile or a rule will be added. access_id - Specify the index of the access list entry. The value range is 1-256, but the supported maximum number of entries depends on the project. If the auto_assign option is selected, the access ID is automatically assigned, when adding multiple ports. auto_assign - Specify that the access ID will automatically be assigned. - Enter the access ID used here. This value must be between 1 and 256. ethernet - Specify to configure the ethernet access profile. vlan - (Optional) Specify the VLAN name. - Enter the name of the VLAN here. This name can be up to 32 characters long. vlan_id - (Optional) Specify the VLAN ID used. - Enter the VLAN ID used here. This value must be between 1 and 4094. mask - (Optional) Specify an additional mask parameter that can be configured. - Enter the mask value here. source_mac - (Optional) Specify the source MAC address. - Enter the source MAC address used for this configuration here. mask - (Optional) Specify an additional mask parameter that can be configured. - Enter the source MAC mask used here. destination_mac - (Optional) Specify the destination MAC address. - Enter the destination MAC address used for this configuration here. mask - (Optional) Specify an additional mask parameter that can be configured. - Enter the destination MAC mask here. 802.1p - (Optional) Specify the value of the 802.1p priority tag. - Enter the 802.1p priority tag value. The priority tag ranges from 1 to 7. ethernet_type - (Optional) Specify the Ethernet type. - Enter the Ethernet type mask here. ip - Specify to configure the IP access profile. vlan - (Optional) Specify a VLAN name. - Enter the name of the VLAN here. This name can be up to 32 characters long. vlan_id - (Optional) Specify that VLAN ID used. - Enter the VLAN ID used here. This value must be between 1 and 4094. mask – (Optional) Specify an additional mask parameter that can be configured. - Enter the mask value here. source_ip - (Optional) Specify an IP source address. - Enter the source IP address used for this configuration here. mask - (Optional) Specify an additional mask parameter that can be configured.

93 - Enter the source netmask used here. destination_ip - (Optional) Specify an IP destination address. - Enter the destination IP address used for this configuration here. mask - (Optional) Specify an additional mask parameter that can be configured. - Enter the destination netmask used here. dscp - (Optional) Specify the value of DSCP. The DSCP value ranges from 0 to 63. - Enter the DSCP value here. icmp - (Optional) Specify to configure the ICMP parameters. type - (Optional) Specify that the rule will apply to the ICMP Type traffic value. - Enter the ICMP type traffic value here. This value must be between 0 and 255. code - (Optional) Specify that the rule will apply to the ICMP Code traffic value. - Enter the ICMP code traffic value here. This value must be between 0 and 255. igmp - (Optional) Specify to configure the IGMP parameters. type - (Optional) Specify that the rule will apply to the IGMP Type traffic value. - Enter the IGMP type traffic value here. This value must be between 0 and 255. tcp - Specify to configure the TCP parameters. src_port - (Optional) Specify that the rule will apply to a range of TCP source ports. - Enter the TCP source port value here. This value must be between 0 and 65535. mask - (Optional) Specify an additional mask parameter that can be configured. - Enter the source port mask here. dst_port - (Optional) Specify that the rule will apply to a range of TCP destination ports. - Enter the TCP destination port value here. This value must be between 0 and 65535. mask - (Optional) Specify an additional mask parameter that can be configured. - Enter the destination port mask here. flag - (Optional) Specify the TCP flag fields. all - Specify that all the TCP flags will be used in this configuration. urg - (Optional) Specify that the TCP flag field will be set to 'urg'. ack - (Optional) Specify that the TCP flag field will be set to 'ack'. psh - (Optional) Specify that the TCP flag field will be set to 'psh'. rst - (Optional) Specify that the TCP flag field will be set to 'rst'. syn - (Optional) Specify that the TCP flag field will be set to 'syn'. fin - (Optional) Specify that the TCP flag field will be set to 'fin'. udp - Specify to configure the UDP parameters. src_port - (Optional) Specify the UDP source port range. - Enter the UDP source port value here. This value must be between 0 and 65535. mask - (Optional) Specify an additional mask parameter that can be configured. - Enter the source port mask here. dst_port - (Optional) Specify the UDP destination port range. - Enter the UDP destination port value here. This value must be between 0 and 65535. mask - (Optional) Specify an additional mask parameter that can be configured. - Enter the destination port mask here. protocol_id - Specify that the rule will apply to the value of IP protocol ID traffic. - Enter the protocol ID used here. user_define - (Optional) Specify that the rule will apply to the IP protocol ID and that the mask options behind the first 4 bytes of the IP payload. - Enter the user-defined mask value here. mask - Specify an additional mask parameter that can be configured. - Enter the mask value here. packet_content - A maximum of 4 offsets can be specified. Each offset defines 4 bytes of data which is identified as a single UDF field. offset_chunk_1 – (Optional) Specify the value of the packet bytes to be matched. Offset chunk 1 will be used. - Enter the offset chunk 1 mask here.

94 offset_chunk_2 - (Optional) Specify the value of the packet bytes to be matched. Offset chunk 2 will be used. - Enter the offset chunk 2 mask here. offset_chunk_3 - (Optional) Specify the value of the packet bytes to be matched. Offset chunk 3 will be used. - Enter the offset chunk 3 mask here. offset_chunk_4 - (Optional) Specify the value of the packet bytes to be matched. Offset chunk 4 will be used. - Enter the offset chunk 4 mask here. ipv6 - Specify that the rule applies to IPv6 fields. class - (Optional) Specify the value of the IPv6 class. - Enter the IPv6 class value here. This value must be between 0 and 255. flowlabel - (Optional) Specify the value of the IPv6 flow label. - Enter the IPv6 flow label mask used here. source_ipv6 - (Optional) Specify the value of the IPv6 source address. - Enter the source IPv6 address used for this configuration here. mask - (Optional) Specify an additional mask parameter that can be configured. - Enter the source IPv6 mask here. destination_ipv6 - (Optional) Specify the value of the IPv6 destination address. - Enter the destination IPv6 address used for this configuration here. mask - (Optional) Specify an additional mask parameter that can be configured. - Enter the destination IPv6 mask here. tcp - (Optional) Specify to configure the TCP parameters. src_port - Specify the value of the IPv6 Layer 4 TCP source port. - Enter the TCP source port value here. This value must be between 0 and 65535. mask - Specify an additional mask parameter that can be configured. - Enter the TCP source port mask value here. dst_port - (Optional) Specify the value of the IPv6 Layer 4 TCP destination port. - Enter the TCP destination port value here. This value must be between 0 and 65535. mask - Specify an additional mask parameter that can be configured. - Enter the TCP destination port mask value here. udp - (Optional) Specify to configure the UDP parameters. src_port - Specify the value of the IPv6 Layer 4 UDP source port. - Enter the UDP source port value here. This value must be between 0 and 65535. mask - Specify an additional mask parameter that can be configured. - Enter the UDP source port mask value here. dst_port - Specify the value of the IPv6 Layer 4 UDP destination port. - Enter the UDP destination port value here. This value must be between 0 and 65535. mask - Specify an additional mask parameter that can be configured. - Enter the UDP destination port mask value here. icmp - (Optional) Specify to configure the ICMP parameters used. type - (Optional) Specify that the rule applies to the value of ICMP type traffic. - Enter the ICMP type traffic value here. This value must be between 0 and 255. code - (Optional) Specify that the rule applies to the value of ICMP code traffic. - Enter the ICMP code traffic value here. This value must be between 0 and 255. port - Specify the port list used for this configuration. - Enter a list of ports used for the configuration here. all - Specify that all the ports will be used for this configuration. vlan_based - Specify that the rule will be VLAN based. vlan - Specify the VLAN name used for this configuration. - Enter the VLAN name used for this configuration here. vlan_id - Specify the VLAN ID used for this configuration. - Enter the VLAN ID used here. This value must be between 1 and 4094.

95 permit - Specify that packets matching the access rule are permitted by the Switch. priority - (Optional) Specify that the priority of the packet will change if the packet matches the access rule. - Enter the priority value here. This value must be between 0 and 7. replace_priority - (Optional) Specify that the 802.1p priority of the outgoing packet will be replaced. replace_dscp_with - (Optional) Specify that the DSCP of the outgoing packet is changed with the new value. If using this action without an action priority, the packet will be sent to the default TC. - Enter the replace DSCP with value here. This value must be between 0 and 63. replace_tos_precedence_with - (Optional) Specify that the IP precedence of the outgoing packet is changed with the new value. If used without an action priority, the packet is sent to the default TC. - Enter the replace ToS precedence with value here. This value must be between 0 and 7. counter - (Optional) Specify whether the ACL counter feature is enabled or disabled. This parameter is optional. The default option is disabled. If the rule is not bound with the flow_meter, all matching packets are counted. If the rule is bound with the flow_meter, then the “counter” is overridden. enable - Specify that the ACL counter feature will be enabled. disable - Specify that the ACL counter feature will be disabled. mirror - Specify that packets matching the access rules are copied to the mirror port. deny - Specify that packets matching the access rule are filtered by the Switch. time_range - (Optional) Specify the name of the time range entry. - Enter the time range name here. This name can be up to 32 characters long. delete - Specify that a profile or a rule will be deleted. access_id - Specify the index of the access list entry. The value range is 1-256, but the supported maximum number of entries depends on the project. - Enter the access ID used here. This value must be between 1 and 256. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To configure a rule entry for a packet content mask profile: DGS-3000-26TC:admin#config access_profile profile_id 3 add access_id auto_assign packet_content offset_chunk_3 0xF0 port all deny Command: config access_profile profile_id 3 add access_id auto_assign packet_content offset_chunk_3 0xF0 port all deny Success. DGS-3000-26TC:admin# show access_profile 6-4 Description This command is used to display the current access list table.

96 Format show access_profile {[profile_id | profile_name ]} Parameters profile_id - (Optional) Specify the index of the access list profile. - Enter the profile ID used here. This value must be between 1 and 512. profile_name - (Optional) Specify the name of the profile. - Enter the profile name used here. This name can be up to 32 characters long. Restrictions None. Example To display the current access list table: DGS-3000-26TC:admin#show access_profile Command: show access_profile Access Profile Table Total User Set Rule Entries : 4 Total Used HW Entries : 128 Total Available HW Entries : 896 ============================================================================== Profile ID: 1 Profile name: EtherACL Type: Ethernet MASK on VLAN : 0xFFF 802.1p Ethernet Type Available HW Entries : 193 ------------------------------------------------------------------------------ Rule ID : 1 Ports: 1 Match on VLAN ID : 1 802.1p : 0 Ethernet Type : 0xFFFE Action: Permit ============================================================================== ============================================================================== Profile ID: 2 Profile name: IPv4ACL Type: IPv4