Page 1 ZXR10 8900 Series 10G Routing Switch Command Manual (FW Volume) Version 2.8.02.C ZTE CORPORATION ZTE Plaza, Keji Road South, Hi-Tech Industrial Park, Nanshan District, Shenzhen, P. R. China 518057 Tel: (86) 755 26771900 800-9830-9830 Fax: (86) 755 26772236 URL: http://support.zte.com.cn...
Page 2 The contents of this document are protected by copyright laws and international treaties. Any reproduction or distribution of this document or any portion of this document, in any form by any means, without the prior written consent of ZTE CORPO- RATION is prohibited.
Page 3: Table Of Contents
Contents Preface............... i Overview ............1 Manual Instruction............1 Description of Man-Machine Commands ......1 Auxiliary Functions ............2 Command Modes............3 authentication ...........7 localdb ................7 localdb add ..............7 localdb modify............8 localdb delete ............9 localdb deleteall ............9 localdb show ..............
Page 4 usergroup deleteuser ..........19 debug .............. 21 dbfake .................21 dbfake add ...............21 dbfake modify ............22 dbfake start ..............23 dbfake delete ............23 dbfake show .............23 dbfilt................24 dbfilt add..............24 dbfilt modify .............26 dbfilt delete ..............27 dbfilt show..............28 define .............. 29 area ................29 area add ..............29 area modify ..............30 area delete ...............31 area rename .............31...
Page 5 host add..............39 host modify ..............40 host rename .............41 host delete ...............41 host clean ..............42 host show..............42 range................42 range add..............43 range modify ............43 range rename ............44 range delete .............45 range clean...............45 range show...............45 schedule ..............46 schedule add (Week Cycle) .........46 schedule add (Year Cycle)...........47 schedule modify (Week Cycle) ........47 schedule modify (Year Cycle) ........48 schedule rename ............49...
Page 6 subnet delete ............59 subnet clean .............60 subnet show .............60 virtual_server ...............60 virtual_server add .............60 virtual_server modify ..........61 virtual_server rename ..........62 virtual_server delete ..........63 virtual_server clean ...........63 virtual_server show ...........64 dpi..............65 policy................65 policy add..............66 policy modify ............66 policy clean ..............67 policy delete .............67 policy show...............68 policy reset...............68...
Page 7 alarmevent show (An Alarm Event) ......82 alarmevent show (All Alarm Events)......82 alarmnotice ..............83 alarmnotice add beep..........83 alarmnotice add mail..........84 alarmnotice add netbios ..........84 alarmnotice add console|snmp ........85 alarmnotice modify beep ..........85 alarmnotice modify mail ..........86 alarmnotice modify mail auth ........87 alarmnotice modify netbios .........88 alarmnotice delete .............89 alarmnotice clean ............89...
Page 8 session timeout close ..........108 session timeout established ........109 session timeout handshake ........109 session timeout never-expire ........109 session timeout other..........110 session timeout syn_proxy........110 session timeout udp..........111 session timeout default ..........111 session protocol ............111 session icmp-redirect ..........
Page 9 rule delete .............. 123 rule modify ............. 123 rule show ............... 125 rule move............... 125 service ............... 125 service add ............. 125 service modify............127 service delete ............128 service show ............128 service clean............129 snmp ............. 131 effect ................. 131 managehost..............
Page 10 authfail set show..........143 faillock ..............143 faillock set ............. 143 faillock show ..........144 managermaxlogin............ 144 managermaxlogin set maxnum ......144 managermaxlogin show ........144 maxonlineadm ............145 maxonlineadm set maxnum......145 maxonlineadm show........145 setdefault ............... 145 usermaxlogin ............145 usermaxlogin set maxnum .......
Page 11 probe-server-time show ........... 152 probe-time ..............153 probe-time set ............153 probe-time show ............. 153 reboot................ 153 save ................154 service ............... 154 service default ............154 service status ............154 show ................. 154 show_cardinfo............. 155 showprocess ............... 155 sshd ................155 sshd start ...............
Page 13 Preface ZXR10 8900 Series (V2.8.02.C) 10G Routing Switch Command About This Manual Manual (FW Volume) ZXR10 8900 Series (V2.8.02.C) 10G Rout- ing Switch Command Manual has 16 volumes. The details are as follows: Manual Summary ZXR10 8900 Series (V2.8.02.C) This manual describes volume...
Page 14 ZXR10 8900 Series Command Manual (FW Volume) Manual Summary ZXR10 8900 Series (V2.8.02.C) This manual describes interface 10G Routing Switch Command configuration, DHCP and Manual (Basic Configuration VRRP-related commands in Volume II) ZXR10 8900 series 10G routing switch. ZXR10 8900 Series (V2.8.02.C)
Page 15 This chapter describes configuration of DPI DPI Template template and command used to view DPI Configuration template. Chapter 8 Newly This chapter describes newly added commands in Added Commands DPI config mode. in DPI Config Mode Confidential and Proprietary Information of ZTE CORPORATION...
Page 16 ZXR10 8900 Series Command Manual (FW Volume) This page is intentionally blank. Confidential and Proprietary Information of ZTE CORPORATION...
Page 17: Overview
Manual includes 16 volumes. For details of each volume, please refer to preface of this manual. Commands in ZXR10 8900 Series (V2.8.02.C) 10G Routing Switch Command Manual (Command Index Volume) are listed in se- quence of from letter a to letter z and in form of table. Commands of all other volumes are classified and illustrated according to different function modules.
Page 18: Auxiliary Functions
ZXR10 8900 Series Command Manual (FW Volume) It describes the mode in which this command can be executed. � Command Format It describes the complete format of this command. If no for- mat is available, list it. � Parameter Description It describes parameters in this command in the form and pre- scribes the range and default value.
Page 19: Command Modes
Use show history command in any mode, and the latest sev- eral commands in this mode will be listed. Command Modes The command modes in this manual are as follows: Confidential and Proprietary Information of ZTE CORPORATION...
Page 20 ZXR10 8900 Series Command Manual (FW Volume) mode Prompt Admi Command Function ssion to Enter the Mode Mode User Enter this View simple ZXR10> Mode mode directly information after logging onto system Privil User enable ZXR10# Configure eged Mode system...
Page 21 Configure RIP address config -router-af)# ily ipv4 vrf VRF protocol mode uration parameters mode (RIP) Route address-fam Configure config ily vpnv4 BGP, VPN and uration address-fam VRF protocol mode ily ipv4 vrf parameters (BGP) Confidential and Proprietary Information of ZTE CORPORATION...
Page 22 ZXR10 8900 Series Command Manual (FW Volume) mode Prompt Admi Command Function ssion to Enter the Mode Mode IPv6 Route ZXR10(config address-fam It configures unicast config ily ipv6 BGP4+ unic -router-af)# address uration ast address family mode family. (BGP4) config...
Page 23: Authentication
5. Interface prompts "Choose user’s type[common]:", select user type and press Enter button. Note: common: This indicates common user. Common user is au- thenticated between TOPSEC authenticated client and FW de- vice through TOS encryption protocol. Confidential and Proprietary Information of ZTE CORPORATION...
Page 24: Localdb Modify
ZXR10 8900 Series Command Manual (FW Volume) 6. Interface prompts "Input the comment[y/n]:", asking user to input comments. 7. By inputting "y" and pressing Enter button, interface prompts "Input the comment:". After inputting comments and pressing Enter button, interface prompts "Add this user successfully".
Page 25: Localdb Delete
# localdb deleteall databasetype common localdb show This command is used to view all users of a specific type in local Command Function authentication database. localdb show type <common> Command Format Confidential and Proprietary Information of ZTE CORPORATION...
Page 26: Onlineuser
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description Parameter Description <common> This input the type of user to be viewed: common user. To view information of all common users in local authentication Example database, execute the following command: # localdb show type common...
Page 27: Onlineuser Deleteaddr
SecurID authentication server. As for local authentication server and cert authentication server, they are started when being added. server add name <string1> protocol <local|radius|tacacs Command Format |securid|cert|ldap|domain> timeout <string2>[ip_address <ipaddress>][port <number>][shared_sceret <string3>][se rver_dn <string4>] Confidential and Proprietary Information of ZTE CORPORATION...
Page 28 ZXR10 8900 Series Command Manual (FW Volume) Parameter Description Parameter Description Adding authentication server. name This specifies the name of authentication server. <string1> This is the type of string, which is the name of authentication server. Tips: 1. Local authentication...
Page 29: Server Modify
To add and start one OTP authentication server with keepalive timeout to be 100s, execute the following command: # server add name otp protocol local timeout 100 server modify This command is used to modify information of authentication Command Function server. Confidential and Proprietary Information of ZTE CORPORATION...
Page 30: Server Delete
ZXR10 8900 Series Command Manual (FW Volume) server modify name <sername>[timeout <string1>][ip Command Format _address <ipaddress>][port <number>][shared_sceret <string2>][server_dn <string3>] Parameter Description Parameter Description modify This modifies information of authentication server. name This specifies the name of authentication server. <sername> This is one string, which is the name of authentication server to be modified.
Page 31: Server Show_Config
This set of command is used to manage authenticated users by group. usergroup addgroup This command is used to add an authenticated user group. Command Function usergroup addgroup group_name <string1> server_name Command Format <string2>[name(list) <username>] Confidential and Proprietary Information of ZTE CORPORATION...
Page 32: Usergroup Adduser
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description Parameter Description addgroup This adds authenticated user group. group_name This sets name of user group. <string1> This is one string, which is the name of newly added user group. server_name This specifies the name of server that this user group belongs to.
Page 33: Usergroup Show
To view information of all authenticated user groups, execute the Example following command: # usergroup show To view details of authenticated user group "radius_users", exe- cute the following command: # usergroup show group_name radius_users Confidential and Proprietary Information of ZTE CORPORATION...
Page 34: Usergroup Show_Config
ZXR10 8900 Series Command Manual (FW Volume) usergroup show_config This command is used to view configuration information of authen- Command Function ticated user group. usergroup show_config Command Format usergroup clean This command is used to delete all authenticated user groups.
Page 35: Usergroup Deleteuser
’test1 test2’. To delete users test1 and test2 in authenticated user group ra- Example dius_users, execute the following command: # usergroup deleteuser group_name radius_users name(list) ‘test1 test2’ Confidential and Proprietary Information of ZTE CORPORATION...
Page 36 ZXR10 8900 Series Command Manual (FW Volume) This page is intentionally blank. Confidential and Proprietary Information of ZTE CORPORATION...
Page 37: Debug
This specifies source IP address. <ipaddress1> This is one standard IP address string. This specifies destination IP address. <ipaddress2> This is one standard IP address string. ipproto This specifies the type of transport layer protocol. Confidential and Proprietary Information of ZTE CORPORATION...
Page 38: Dbfake Modify
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description tcp|6|udp|17 This specifies the protocol type of packet. Both tcp and 6 indicate TCP protocol and both udp AND 17 indicate UDP protocol. icmp|1 This specifies the protocol type of packet.
Page 39: Dbfake Start
<number> Command Format Parameter Description Parameter Description <number> This is one number, indicating packet ID. dbfake show This command is used to view all virtual packet rules. Command Function dbfake show Command Format Confidential and Proprietary Information of ZTE CORPORATION...
Page 40: Dbfilt
ZXR10 8900 Series Command Manual (FW Volume) dbfilt This set of commands are used to manage packet capture rules of FW. User can use these commands to add, modify or delete packet capture rules. dbfilt add This command is used to add one packet capture rule.
Page 41 4000-5000 and destination port to be 8000-9000. # dbfilt add maxlen 500 dev eth0 smac 00:08:2E:1A:06:80 dmac 00:08:2D:1A:19:80 l2proto ip sip1 192.168.83.2 sip2 192.168.83.200 dip1 192.168.1.163 dip1 192.168.1.225 ipproto tcp sport1 4000 sport2 5000 dport1 8000 dport2 9000 Confidential and Proprietary Information of ZTE CORPORATION...
Page 42: Dbfilt Modify
ZXR10 8900 Series Command Manual (FW Volume) dbfilt modify This command is used to modify one packet capture rule. Command Function dbfilt modify <number1> maxlen <number2> Command Format <string1> smac <macaddress1> dmac <macaddress2> l2proto <arp|ip|number3>[sip1 <ipaddress1> sip2 <ipaddress2> dip1 <ipaddress3> dip2 <ipaddress4> ipproto <tcp|udp|icmp |number3>...
Page 43: Dbfilt Delete
00:08:2E:1A:06:80 dmac 00:08:2D:1A:19:80 l2proto ip sip1 192.168.83.2 sip2 192.168.83.200 dip1 192.168.1.163 dip1 192.168.1.225 ipproto tcp sport1 4000 sport2 5000 dport1 8000 dport2 9000 dbfilt delete This command is used to delete one packet capture rule. Command Function Confidential and Proprietary Information of ZTE CORPORATION...
Page 44: Dbfilt Show
ZXR10 8900 Series Command Manual (FW Volume) dbfilt delete id <number> Command Format Parameter Description Parameter Description <number> This is one number, which is the number of virtual packet rule. To delete one packet capture rule whose id is 8224, execute the...
Page 45: Define
This specifies area name. <string1> This is a string, indicating the name of area. access This specifies privilege for accessing one area. This permits accessing this area. This denies accessing this area. Confidential and Proprietary Information of ZTE CORPORATION...
Page 46: Area Modify
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description attribute This specifies new attribute or attribute group bound to this area. <string2> This is one string, which can be one or more pre-defined attributes or attribute groups. As for multiple ones, single quotes are used, and space is used between each two (such as ’aa...
Page 47: Area Delete
This specifies new area name. <string2> This is a string, indicating the name of area. To rename area_gei_5/1 to firstarea, execute the following com- Example mand: # area rename oldame area_gei_5/1 newname firstarea Confidential and Proprietary Information of ZTE CORPORATION...
Page 48: Area Show
ZXR10 8900 Series Command Manual (FW Volume) area show This command is used to show all areas in FW system. Command Function area show Command Format To show all areas, execute the following command: Example # area show area clean This command is used to clear unquoted areas in FW system.
Page 49: Group_Address Addmember
This renames address group. oldname This specifies the name of address group to be renamed. <string1> This is one string, indicating the name of address group (the name of address group has been defined). Confidential and Proprietary Information of ZTE CORPORATION...
Page 50: Group_Address Delete
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description newname This specifies new name for address group. <string2> This is one string, indicating the new name of address group. To rename groupaddr1 to groupaddr2, execute the following com- Example mand:...
Page 51: Group_Address Clean
Command Format Parameter Description Parameter Description <string> This is one string, indicating the name of address group. To delete all members in groupaddr1, execute the following com- Example mand: # group_address cleanmember groupame groupaddr1 Confidential and Proprietary Information of ZTE CORPORATION...
Page 52: Group_Address Show
ZXR10 8900 Series Command Manual (FW Volume) group_address show This command is used to show all address groups. Command Function group_address show Command Format This shows address group. Example # group_address show group_service User can add, modify and delete service group in management of FW service group.
Page 53: Group_Service Rename
To rename service group groupservice1 to groupservice2, execute Example the following command: # group_service rename oldname groupservice1 newname groupservice2 group_service delete This command is used to delete one service group. Command Function group_service delete [id <number1>][name <string>] Command Format Confidential and Proprietary Information of ZTE CORPORATION...
Page 54: Group_Service Delmember
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description Parameter Description delete This deletes one service group. This specifies ID of the service group to be deleted. <number1> This is one number, indicating ID of service group. name This specifies the name of service group to be deleted.
Page 55: Group_Service Clean
To show all service groups, execute the following command: Example # group_service show host User can add, modify and delete host in management of FW hosts. host add This command is used to add one host. Command Function Confidential and Proprietary Information of ZTE CORPORATION...
Page 56: Host Modify
ZXR10 8900 Series Command Manual (FW Volume) host add <name <string1>>[ipaddr <string2>][macaddr Command Format <macaddress>][session <number1>][halfsession <number 2>] Parameter Description Parameter Description This adds one host. name This sets name for the host to be added. <string1> This is one string, indicating name of the host.
Page 57: Host Rename
This is one string, indicating new name of the host. To rename host1 to host2, execute the following command: Example # host rename oldname host1 newname host2 host delete This command is used to delete one host. Command Function Confidential and Proprietary Information of ZTE CORPORATION...
Page 58: Host Clean
ZXR10 8900 Series Command Manual (FW Volume) host delete [id <number>][name <string>] Command Format Parameter Description Parameter Description delete This deletes one host. This specifies ID of the host to be deleted. <number> This is one number, indicating ID of host.
Page 59: Range Add
# range add name range1 ip1 172.16.1.10 ip2 172.16.1.80 range modify This command is used to modify one address range. Command Function range modify name <string1> ip1 <string2> ip2 <string3>[e Command Format xcept <string4>][session <number>] Confidential and Proprietary Information of ZTE CORPORATION...
Page 60: Range Rename
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description Parameter Description modify This modifies address range. name This sets name for address range to be modified. <string1> This is one string, indicating the name of address range. This sets a new start IP address for address range.
Page 61: Range Delete
Command Format To clear all unquoted address ranges in FW system, execute the Example following command: # range clean range show This command is used to show all address ranges. Command Function Confidential and Proprietary Information of ZTE CORPORATION...
Page 62: Schedule
ZXR10 8900 Series Command Manual (FW Volume) range show Command Format To show all address ranges, execute the following command: Example # range show schedule User can add, modify and delete schedule in management of FW schedules. schedule add (Week Cycle) This command is used to add one week cycle.
Page 63: Schedule Add (Year Cycle)
This command is used to modify one week cycle. Week cycle in- Command Function dicates this object contains multiple uncontinuous regular period such as 9am to 5pm each Tuesday. schedule modify name <string1>[type <weekcyc >][week Command Format <string2>][start <string3>][end <string4>] Confidential and Proprietary Information of ZTE CORPORATION...
Page 64: Schedule Modify (Year Cycle)
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description Parameter Description modify This modifies one cycle. name This specifies the name of cycle to be modified. <string1> This is one string, indicating name of cycle. type This sets type of cycle: weekcyc or yearcyc.
Page 65: Schedule Rename
To rename week1 to week2, execute the following command: Example # schedule rename oldname week1 newname week2 schedule delete This command is used to delete one cycle. Command Function schedule delete [id <number>][name <string>] Command Format Confidential and Proprietary Information of ZTE CORPORATION...
Page 66: Schedule Clean
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description Parameter Description delete This deletes one cycle. This specifies ID of the cycle to be deleted. <number> This is one number, indicating ID of cycle. name This specifies the name of cycle to be deleted.
Page 67: Server
To add server1 with host to be host1 and weight to be 20, and set Example service detection with probe port to be 8080, execute the following command: Confidential and Proprietary Information of ZTE CORPORATION...
Page 68: Server Modify
ZXR10 8900 Series Command Manual (FW Volume) # server add name server1 host host1 weight 20 probe service port 8080 server modify This command is used to modify one server. Command Function server modify name <string1>[host <string2>][weight<num Command Format ber1>][probe <none|host|service>][port <number2>]...
Page 69: Server Delete
This command is used to delete all servers not quoted by policy. Command Function server clean Command Format To clear all unquoted servers in FW system, execute the following Example command: # server clean Confidential and Proprietary Information of ZTE CORPORATION...
Page 70: Server Show
ZXR10 8900 Series Command Manual (FW Volume) server show This command is used to show all servers. Command Function server show Command Format To show all servers, execute the following command: Example # server show service Some servers use non-standard ports to provide services. For ex- ample, port 8080 is used to provide HTTP service.
Page 71: Service Modify
To modify port id of service http8080 to 8000, execute the follow- Example ing command: # service modify name http8080 port 8000 service rename This command is used to rename customized service. Command Function service rename oldname <string1> newname <string2> Command Format Confidential and Proprietary Information of ZTE CORPORATION...
Page 72: Service Delete
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description Parameter Description rename This renames one service. oldname This specifies the name of service to be renamed. <string1> This is one string, indicating the name of service (the service name has been defined).
Page 73: Service Show
This is one string, indicating name of the subnet. ipaddr This sets address for subnet. <ipaddress> This is one string, indicating ip address of subnet, such as 192.168.8.0. mask This sets subnet mask. Confidential and Proprietary Information of ZTE CORPORATION...
Page 74: Subnet Modify
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description <netmask> This is one string, indicating subnet mask, such as 255.255.255.0. except This sets except address in subnet. <string2> This is one string, indicating excepted IP address, in format of 0.0.0.0.
Page 75: Subnet Rename
However, in case subnet id and subnet name are inconsistent, subnet name shall apply. When no parameter is given, the subnet not quoted by policy is deleted. To delete subnet1, execute the following command: Example Confidential and Proprietary Information of ZTE CORPORATION...
Page 76: Subnet Clean
ZXR10 8900 Series Command Manual (FW Volume) # subnet delete name subnet1 subnet clean This command is used to delete all subnets not quoted by policy. Command Function subnet clean Command Format To clear all subnets on FW, execute the following command:...
Page 77: Virtual_Server Modify
To add virtual_server1, which contains server1 and server2, exe- Example cute the following command: # virtual_server add name virtual_server1 server ‘server1 server2’ virtual_server modify This command is used to modify one virtual server. Command Function Confidential and Proprietary Information of ZTE CORPORATION...
Page 78: Virtual_Server Rename
ZXR10 8900 Series Command Manual (FW Volume) virtual_server modify name <string1>[server <string2>][ba Command Format lance<rr|wrr|lc|wlc|sh|dh>][backup <number>] Parameter Description Parameter Description modify This modifies one virtual server. name This specifies the name of virtual server to be modified. <string1> This is one string, indicating the name of virtual server.
Page 79: Virtual_Server Delete
To delete virtual_server1, execute the following command: Example # virtual_server delete name virtual_server1 virtual_server clean This command is used to delete all virtual servers not quoted by Command Function policy. virtual_server clean Command Format Confidential and Proprietary Information of ZTE CORPORATION...
Page 80: Virtual_Server Show
ZXR10 8900 Series Command Manual (FW Volume) To clear all virtual servers on FW, execute the following command: Example # virtual_server clean virtual_server show This command is used to show all virtual servers. Command Function virtual_server show Command Format To show all virtual servers, execute the following command:...
Page 81: Dpi
System has the following default standard ports: Application Default Port Protocol Type Used Protocol Protocol Number Name 5060 SMTP TFTP HTTP: IMAP Telnet POP3 SUN ONE RPC MS DCE RPC SQLNET 1521 RTSP H225 1720 H225ras 1719 1755 Confidential and Proprietary Information of ZTE CORPORATION...
Page 82: Policy Add
ZXR10 8900 Series Command Manual (FW Volume) policy add This command is used to customize one application protocol port Command Function binding policy. policy add name <ftp|tftp|sun_rpc|ms_rpc|sqlnet|rtsp|h2 Command Format 25| h225ras| mms|sip|pptp > net <string1> mask <string2> protocol <udp|tcp> port <number>[enable <yes|no>]...
Page 83: Policy Clean
This command is used to clear all application protocol port binding Command Function policies. policy clean Command Format policy delete This command is used to delete one application protocol port bind- Command Function ing policy. policy delete id <number> Command Format Confidential and Proprietary Information of ZTE CORPORATION...
Page 84: Policy Show
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description Parameter Description <number> This is one number. Command policy show can be used to view ID of policy. Command Illustration To delete one application protocol port binding policy whose id is...
Page 85: Policy (Firewall)
’area_gei_5/1’. srcvlan This sets source VLAN. <string3> This is one string, indicating preset vlan number. Confidential and Proprietary Information of ZTE CORPORATION...
Page 86 ZXR10 8900 Series Command Manual (FW Volume) Parameter Description dstvlan This sets destination VLAN. <string4> This is one string, indicating preset vlan number. This is source address. <string5> This is one string, indicating preset address name. Multiple address names can be input...
Page 87: Policy Modify
This is one string. It must be one or more preset area name(s). As for multiple area names, space is used between each two area names and all addresses are quoted with single quotes, such as ’area_gei_5/1’. dstarea This sets destination area. Confidential and Proprietary Information of ZTE CORPORATION...
Page 88 ZXR10 8900 Series Command Manual (FW Volume) Parameter Description <string2> This is one string. It must be one or more preset area name(s). As for multiple area names, space is used between each two area names and all addresses are quoted with single quotes, such as ’area_gei_5/1’.
Page 89: Policy Delete
Command Format Parameter Description Parameter Description <number> This is one string, which must be ID of predefined rule. To delete one access control rule. execute the following command. Example # policy delete id 8503 Confidential and Proprietary Information of ZTE CORPORATION...
Page 90 ZXR10 8900 Series Command Manual (FW Volume) This page is intentionally blank. Confidential and Proprietary Information of ZTE CORPORATION...
Page 91: Dos
This command is used to add the host or subnet to be protected Command Function from intrusion. dos rule add protect_name <string> icmpflood <number1> Command Format ipsweep <number2> synflood <number3> udpflood <numb er4> portscan <number5>[log <yes|no>][action <pass|bloc k>] Confidential and Proprietary Information of ZTE CORPORATION...
Page 92 ZXR10 8900 Series Command Manual (FW Volume) Parameter Description Parameter Description This adds one host or subnet to be protected. protect_name This sets address resource to be protected, which can be host, subnet or address range. This address resource shall be added in command define in advance.
Page 93: Dos Rule Modify
<number2> This is one number, indicating ID of the rule to be referred to. In intrusion detection, match rules according to rule ids. User can Command Illustration move rules according to demands. Confidential and Proprietary Information of ZTE CORPORATION...
Page 94: Dos Rule Delete
ZXR10 8900 Series Command Manual (FW Volume) dos rule delete This command is used to delete intrusion detection rule. Command Function dos rule delete id <string> Command Format Parameter Description Parameter Description <string> This is one string, indicating id of one rule.
Page 95: Dos Type Delete
This shows various types of abnormal packet |pingofdeath |win attack. nuke |tcp_sscan |ip_option |teardrop |targa3 |ipspoof stattype This sets the type of statistics attacks to be deleted. synflood|udpflood|ic This shows various attacks of statistics type. mpflood|portscan|i psweep Confidential and Proprietary Information of ZTE CORPORATION...
Page 96 ZXR10 8900 Series Command Manual (FW Volume) This page is intentionally blank. Confidential and Proprietary Information of ZTE CORPORATION...
Page 97: Log
This sets id of alarming mode. <number> This is one number, indicating ID of alarming mode. noticename This sets name of alarming mode. <string> This is one string, indicating name of alarming mode. Confidential and Proprietary Information of ZTE CORPORATION...
Page 98: Alarmevent Show (An Alarm Event)
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description notice This specifies that no alarm event rule is contained in alarming mode and removes all alarm events. <empty> This indicates not generating alarms. To set one alarm rule, which specifies that beep1 alarming mode...
Page 99: Alarmnotice
This is one number, indicating beep interval, in micro-seconds, in range of 1-1000 micro-seconds. When the attribute of beep alarm is set to default, the default Command Illustration values of parameters are as follows: 440HZ frep length 200 micro-seconds Confidential and Proprietary Information of ZTE CORPORATION...
Page 100: Alarmnotice Add Mail
ZXR10 8900 Series Command Manual (FW Volume) reps 5 times delay 100 micro-seconds To add one default beep1, execute the following command: Example # alarmnotice add beep name beep1 default alarmnotice add mail This command is used to add one mail alarm.
Page 101: Alarmnotice Add Console|Snmp
# alarmnotice add console name console1 alarmnotice modify beep This command is used to modify one beep alarm. Command Function alarmnotice modify <beep> name <string>[<default>]|[freq Command Format <number1> length <number2> reps <number3> delay <numb er4>] Confidential and Proprietary Information of ZTE CORPORATION...
Page 102: Alarmnotice Modify Mail
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description Parameter Description modify This command is used to modify one beep alarm. <beep> This indicates the alarming mode is beep alarm. name This specifies the name of alarm to be modified.
Page 103: Alarmnotice Modify Mail Auth
This specifies the name of alarm to be modified. <string1> This is a string, indicating the name of alarm. auth This specifies if the mail server of mail alarm needs authentication. Confidential and Proprietary Information of ZTE CORPORATION...
Page 104: Alarmnotice Modify Netbios
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description on|off Off indicates authentication is not needed and when selecting this option, it doesn’t need to set the following parameters; on indicates authentication is needed. username This is the username of authentication on mail server.
Page 105: Alarmnotice Delete
To show the alarm named mail1, execute the following command: Example # alarmnotice show name mail1 To show all alarms, execute the following command: # alarmnotice show alarmnotice test This command is used to test one alarm. Command Function Confidential and Proprietary Information of ZTE CORPORATION...
Page 106: Log
ZXR10 8900 Series Command Manual (FW Volume) alarmnotice test Command Format For convenience of user, FW provides alarm testing function. User Command Illustration can verify effectiveness of alarm rules through testing after suc- cessfully adding alarming mode and setting alarm-triggered secu- rity event.
Page 107: Log Count
This is one string, indicating log type, including: mgmt, system, pf, conn, ac, secure, dpi, vpn, avse, sslvpn_conn, sslvpn_admin, sslvpn_system, all or none. To transmit vpn-typ logs to log server, execute the following com- Example mand: Confidential and Proprietary Information of ZTE CORPORATION...
Page 108: Log Type_Set Delete
ZXR10 8900 Series Command Manual (FW Volume) # log type_set add vpn log type_set delete This command is used to delete log type transmitted to log server. Command Function log type_set delete <string> Command Format Parameter Description Parameter Description <string>...
Page 109 Chapter 8 log To view information of no. 10 to no. 100 logs (containing string Example "log"), execute the following command: # log show from 10 to 100 keyword log Confidential and Proprietary Information of ZTE CORPORATION...
Page 110 ZXR10 8900 Series Command Manual (FW Volume) This page is intentionally blank. Confidential and Proprietary Information of ZTE CORPORATION...
Page 111: Policy (Nat)
As for multiple area names, space is used between each two area names and all area names are quoted with single quotes, such as ’area1 area2’. dstarea This sets destination area. Confidential and Proprietary Information of ZTE CORPORATION...
Page 112 ZXR10 8900 Series Command Manual (FW Volume) Parameter Description <dstarea_nam> This is one string and destination area resource name is input here. Tips: 1. This parameter value must be predef ined area name. One ore more area names can be input here. As for mult...
Page 113 2. Only one object can be input here. 3. This parameter is necessary when adding source address translation policy. trans_dst This sets destination object after translation. Confidential and Proprietary Information of ZTE CORPORATION...
Page 114 ZXR10 8900 Series Command Manual (FW Volume) Parameter Description <dst_addr2> This is one string and destination object name after translation is input here. Tips: 1. This parameter must be one predefi ned address object name or attribute name. 2. Only one object can be input here.
Page 115: Policy Modify
As for multiple area names, space is used between each two area names and all area names are quoted with single quotes, such as ’area1 area2’. dstarea This modifies one destination area. Confidential and Proprietary Information of ZTE CORPORATION...
Page 116 ZXR10 8900 Series Command Manual (FW Volume) Parameter Description <dstarea_nam> This is one string and destination area resource name after modification is input here. Tips: 1. This parameter value must be predef ined area name. One ore more area names can be input here. As for mult...
Page 117 1. This parameter must be one predefi ned address object name or attribute name. 2. Only one object can be input here. 3. This parameter is necessary when adding source address translation policy. Confidential and Proprietary Information of ZTE CORPORATION...
Page 118: Policy Delete
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description trans_dst This modifies destination object after translation. <dst_addr2> This is one string and destination object name after translation is input here. Tips: 1. This parameter must be one predefi ned address object name or attribute name.
Page 119: Policy Show
Values of parameters before and after cannot be set at the same time. <numbe3> This is one number, which is the ID of policy. Tips: Values of parameters before and after cannot be set at the same time. Confidential and Proprietary Information of ZTE CORPORATION...
Page 120 ZXR10 8900 Series Command Manual (FW Volume) Values of parameters before and after cannot be set at the same Command Illustration time. To move the policy whose id is 8144 before the one whose id is Example 8146, execute the following command:...
Page 121: Network
ARP entries of specific IP addresses can also be viewed according to parameters. arp show [num <number1> page <number2>]|[complete]|[t Command Format otal]|[ipaddress] Parameter Description Parameter Description <number1> This is one number, showing the number of ARP entries displayed on each page. Confidential and Proprietary Information of ZTE CORPORATION...
Page 122: Arp Detect
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description <number2> This is one number, which is the start page number of arp table. complete This shows all ARP entries. total This shows the total number of arp entries. ipaddress This is one standard IP address string. By specifying IP address, it is available to view in ARP table if there is any matched entry.
Page 123: Show (Network)
This is one string, specifying VLAN name, in format of vlan.xxxx. <string> This is one interface name string, such as gei_5/6. To show all details of MAC address table, execute the following Example command: # mac-address-table show Confidential and Proprietary Information of ZTE CORPORATION...
Page 124: Route Show
ZXR10 8900 Series Command Manual (FW Volume) route show This command is used to show route configuration. Command Function route show [total | dynamic num <number1> page <number Command Format 2>] Parameter Description Parameter Description total This shows the total number of entries in routing table.
Page 125: Session Timeout Established
This command is used to set the max percent to which timeout Command Function never expires. session timeout never-expire <number|default> Command Format Parameter Description Parameter Description number This is one number, ranging from 5 to 90. default This sets default timeout. Confidential and Proprietary Information of ZTE CORPORATION...
Page 126: Session Timeout Other
ZXR10 8900 Series Command Manual (FW Volume) To set the default max percent to which timeout never expires to Example 20%, execute the following command: # session timeout never-expire default To set the max percent to which timeout never expires to 40%,...
Page 127: Session Timeout Udp
In default cases, FW system only supports to establish TCP, UDP, Command Illustration ICMP and GRE sessions. When more IP protocols need to be sup- ported, this command can be used. To show protocol id, execute the following command: #define service show default. Confidential and Proprietary Information of ZTE CORPORATION...
Page 128: Session Icmp-Redirect
ZXR10 8900 Series Command Manual (FW Volume) To establish an FTP session, execute the following command: Example # session protocol add 21 To only establish sessions for default protocols, execute the fol- lowing command: # session protocol default session icmp-redirect...
Page 129: Session Syn-Reset
<on |off > Command Format Parameter Description Parameter Description on|off This sets whether to enable session-integrity inspection. To disable session-integrity inspection, execute the following com- Example mand: Confidential and Proprietary Information of ZTE CORPORATION...
Page 130: Session Show Configuration
ZXR10 8900 Series Command Manual (FW Volume) # session session-integrity off session show configuration This command is used to show session configuration information. Command Function session show configuration Command Format To show session configuration information, execute the following Example command:...
Page 131: Traffic
This is one number, ranging from 0 to 254. traffic This set of commands is used to show traffics on all interfaces. traffic statistic This command is used to show traffics on all interfaces. Command Function Confidential and Proprietary Information of ZTE CORPORATION...
Page 132: Traffic Clear
ZXR10 8900 Series Command Manual (FW Volume) traffic statistic Command Format traffic clear This command is used to clear traffics on all interfaces. Command Function traffic clear Command Format vlan show This command is used to view vlan configuration information.
Page 133: Idbprule
This command is used to clear IDBP dynamic rules. Command Function idbprule clean Command Format idbprule delete This command is used delete one IDBP dynamic rule. Command Function idbprule delete id <number> Command Format Confidential and Proprietary Information of ZTE CORPORATION...
Page 134: Idsserver
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description Parameter Description <number> This is one IDBP rule id. To delete one IDBP rule whose ID is 2, execute the following com- Example mand: # idbprule delete id 2 idsserver This set of commands is used to set IDS interaction rule-related parameters.
Page 135: Idsserver Clean
# idsserver delete id 8584 idsserver show This command is used to show all IDS interaction rules. Command Function idsserver show Command Format Example #idsserver show ID 8584 pf idsserver add ip 192.168.1.21 key topsec Confidential and Proprietary Information of ZTE CORPORATION...
Page 136: Rule
ZXR10 8900 Series Command Manual (FW Volume) rule This is about management of packet filtering rules. rule set default action This command is used to set default packet filtering rule. Command Function rule set default action <accept|reject> log<yes|no> Command Format...
Page 137: Rule Add Action L2Protocol Arp
Command Format rp|8035|ipx|8137>[log<yes|no>][area <string>][smac < string 2>][dmac < string 3>] Parameter Description Parameter Description This adds one packet filtering rule. action This is the action to packet meeting rules: permit or deny. accept|reject permit|deny Confidential and Proprietary Information of ZTE CORPORATION...
Page 138: Rule Add Action L3Protocol
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description l2protocol This is the L2 protocol type used by packet. arp|0806|rarp|8035 ARP| ARP|RARP| RARP|IPX|IPX protocols |ipx|8137 This specifies whether to record it into log. yes|no Yes|No area This specifies area resource.
Page 139: Rule Clean
Parameter Description modify This modifies one packet filtering rule. This is rule id. < numbe1> This is one number. action This is the action to packet meeting rules: permit or deny. accept|reject permit|deny Confidential and Proprietary Information of ZTE CORPORATION...
Page 140 ZXR10 8900 Series Command Manual (FW Volume) Parameter Description l2protocol This is the L2 protocol type used by packet. ip|0800 IP Protocol area This specifies area resource. <string1> This is one string, which must be one predefined area resource. This specifies whether to record it into log.
Page 141: Rule Show
FW by users in an IP address segment or management level. service add This command is used to add one open service rule. Command Function Confidential and Proprietary Information of ZTE CORPORATION...
Page 142 ZXR10 8900 Series Command Manual (FW Volume) service name < gui|snmp|ssh|monitor|ping|tel Command Format net|tosids|auth|ntp|update|dhcp|rip|l2tp|pptp|webui |ipsecvpn|sdmi > area <string1><addressid <number1>| addressname <string2>>[vsid<number2>] Parameter Description Parameter Description This command is used to add one open service rule. name This selects the name of service opened by This is to enable GUI service.
Page 143: Service Modify
This is to manage FW through WEBUI. ipsecvpn It is to enable services needed for establishing IPSEC tunnel. sdmi It is to enable security management service. It allows to manage intrusion prevention device through military security management platform. Confidential and Proprietary Information of ZTE CORPORATION...
Page 144: Service Delete
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description area It selects the area from which service request is sent. The area must be selected from existing ones. <string1>< This is one string. addressid It sets ID for permitted address object.
Page 145: Service Clean
To show all WEBUI service open rules, execute the following com- Example mand: # service show name webui service clean This command is used to clear all service rules. Command Function service clean Command Format Confidential and Proprietary Information of ZTE CORPORATION...
Page 146 ZXR10 8900 Series Command Manual (FW Volume) This page is intentionally blank. Confidential and Proprietary Information of ZTE CORPORATION...
Page 147: Snmp
This command is used to add one SNMP manage host. Command Function managehost add name <string1> hostip <ipaddress> comm Command Format unity <string2> Parameter Description Parameter Description This adds one SNMP manage host. name This specifies the name of SNMP manage host. Confidential and Proprietary Information of ZTE CORPORATION...
Page 148: Managehost Delete
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description <string1> This is one string, which is the name of SNMP manage host to be added. hostip This specifies IP address of SNMP manage host. <ipaddress> This is one standard IP address string, which is IP address of manage host to be added.
Page 149: Managehost Show
<string2> This is one string, which is the community name. To add one SNMP manage subnet with subnet name to be man- Example age_subnet1, subnet address to be 192.168.83.0, subnet mask to Confidential and Proprietary Information of ZTE CORPORATION...
Page 150: Managesubnet Delete
ZXR10 8900 Series Command Manual (FW Volume) be 255.255.255.0 and community name for accessing FW to be community2, execute the following command: # managehost add name manage_subnet1 subnet 192.168.83.0/24 community community2 managesubnet delete This command is used to delete one SNMP manage subnet.
Page 151: Snmpv3User Delete
To delete one SNMPV3 user named v3_user1, execute the follow- Example ing command: # snmpv3user delete name v3_user1 snmpv3user show This command is used to show all SNMPV3 users. Command Function snmpv3user show Command Format Confidential and Proprietary Information of ZTE CORPORATION...
Page 152: Start
ZXR10 8900 Series Command Manual (FW Volume) start This command is used to enable SNMP Agent. Command Function start Command Format stop This command is used to disable SNMP Agent. Command Function stop Command Format traphost This set of commands is used to configure trap host to receive SNMP Trap messages sent from FW.
Page 153: Traphost Delete
To delete one SNMP trap host named trap_host1, execute the fol- Example lowing command: # traphost delete name trap_host1 traphost show This command is used to show all trap hosts. Command Function traphost show Command Format Confidential and Proprietary Information of ZTE CORPORATION...
Page 154 ZXR10 8900 Series Command Manual (FW Volume) This page is intentionally blank. Confidential and Proprietary Information of ZTE CORPORATION...
Page 155: System
Manager information configuration: FW system supports opera- tion and management by multiple managers. Different managers have different operation rights: super manager, security audit and security management. Manager right and login password can be set here. Confidential and Proprietary Information of ZTE CORPORATION...
Page 156: Admininfo Add
ZXR10 8900 Series Command Manual (FW Volume) admininfo add This command is used to add device manager information: name, Command Function password and privilege information. admininfo add Command Format input manager’s name:<string1> new password:<string2> re_enter password: <string2> choose manager’s privilege[audit| config|vs]:<audit|config |vs>...
Page 157: Admininfo Modify
#admininfo modify input manager’s name:test modify the name(only super admin can change name)[y/n]:y input new name:vstest new password:22222222 re_enter password: 22222222 modify the privilege[y/n]:y choose manager’s privilege[audit | config ]:audit input vsid[1-254]:1 modify the comment[y/n]:y input the comment:vs_user Confidential and Proprietary Information of ZTE CORPORATION...
Page 158: Admininfo Delete_Db_Manager
ZXR10 8900 Series Command Manual (FW Volume) admininfo delete_db_manager This command is used to delete information of a manager in data- Command Function base. admininfo delete_db_manager name <string> Command Format Parameter Description Parameter Description <string> This is manager name string.
Page 159: Authfail
# authfail show The max auth fail number is:5 faillock This set of commands is used to set authentication faillock time- related parameter. faillock set This command is used to set authentication faillock time. Command Function faillock set time<number> Command Format Confidential and Proprietary Information of ZTE CORPORATION...
Page 160: Faillock Show
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description Parameter Description <number> This is one number, which is faillock time, in range of 60-3600, in seconds. To set authentication faillock time, execute the following com- Example mand: # faillock set time 60 faillock show This command is used to show authentication faillock time.
Page 161: Maxonlineadm
This command is used to set all authentication parameters to de- Command Function fault values. setdefault Command Format usermaxlogin This set of commands is used to set the max login number for the same one user. Confidential and Proprietary Information of ZTE CORPORATION...
Page 162: Usermaxlogin Set Maxnum
ZXR10 8900 Series Command Manual (FW Volume) usermaxlogin set maxnum This command is used to set the max login number for the same Command Function one user. usermaxlogin set maxnum <number> Command Format Parameter Description Parameter Description <number> This is the max login number for the same one user, in range of 1-2000.
Page 163: Config Reset
This shows configuration information currently running in system Command Illustration and it can also configuration information not saved yet. Command show cannot show such information. To show current system configuration, execute the following com- Example mand: # config show_running Confidential and Proprietary Information of ZTE CORPORATION...
Page 164: Config Sync_To
ZXR10 8900 Series Command Manual (FW Volume) config sync_to This command is used to synchronize configuration of one FW ser- Command Function vice card to another FW service card not configured with manage address. config sync_to Command Format config statistic This command is used to show system configuration statistics.
Page 165: Devname Show
This set of commands is used to manage HTTP service. httpd start This command is used to enable HTTP service. Command Function httpd start Command Format httpd stop This command is used to disable HTTP service. Command Function httpd stop Command Format Confidential and Proprietary Information of ZTE CORPORATION...
Page 166: Information
ZXR10 8900 Series Command Manual (FW Volume) information This command is used to show current running status of device. Command Function information Command Format Example # information Physical Memory Information: Total 458324 KB Free 253944 KB Free’s ratio 55.4% Buffer...
Page 167: Ping
FW to server in virtual server. probe-package set This command is used to set the number of probe packets sent to Command Function server in virtual server. probe-package set <number> Command Format Confidential and Proprietary Information of ZTE CORPORATION...
Page 168: Probe-Package Show
ZXR10 8900 Series Command Manual (FW Volume) Parameter Description Parameter Description <number> This is one number, in range of 1-8, 1 by default. To set the number of probe packets sent to server in virtual server Example to 5, execute the following command:...
Page 169: Probe-Time
To show the interval of probing statuses of all servers in virtual Example server, execute the following command: # probe-time show time set is 20 second reboot This command is used to reboot FW engine. Command Function reboot Command Format Confidential and Proprietary Information of ZTE CORPORATION...
Page 170: Save
ZXR10 8900 Series Command Manual (FW Volume) save This command is used to save system configuration. Command Function save Command Format service This set of commands is used to configure system services. service default This command is used to restore default system service factory...
Page 171: Show_Cardinfo
11326 root 3647 tos_configd 3648 root 3647 tos_configd 3667 root 3647 tos_configd 3672 root 3647 tos_configd 11214 root 3647 tos_configd …… sshd This set of commands is used to manage SSH service. Confidential and Proprietary Information of ZTE CORPORATION...
Page 172: Sshd Start
ZXR10 8900 Series Command Manual (FW Volume) sshd start This command is used to enable SSH service. Command Function sshd start Command Format sshd stop This command is used to disable SSH service. Command Function sshd stop Command Format tcpdump...
Page 173: Telnetd
Description Parameter Description <number> This is one number, in range of 30-3600s. 0 indicates never time out. To set terminal idle-timeout to 60 seconds, execute the following Example command: # terminal idle-timeout 60 Confidential and Proprietary Information of ZTE CORPORATION...
Page 174: Terminal Show
ZXR10 8900 Series Command Manual (FW Volume) terminal show This command is used to show terminal idle-timeout. Command Function terminal show Command Format Example # terminal show terminal idle timeout: 60 seconds time show This command is used to show device time.
Page 175: Uptime
This command is used to show running uptime after system boots Command Function uptime Command Format Example #uptime UP 01:28 version This command is used to show system version information. Command Function version Command Format Example # version Topsec Operating System tos_3.3.001.001.1 Confidential and Proprietary Information of ZTE CORPORATION...
Page 176: Webui
ZXR10 8900 Series Command Manual (FW Volume) webui This set of commands is used to set WEBUI-related parameter. webui cert This command is used to restore WEBUI system root certificate. Command Function webui cert <restore> Command Format Parameter Description Parameter Description <restore>...
Page 177: Webui Ssl-Verify-Client
WEBUI system of FW system successfully. To set WEBUI authentication mode to client authentication, exe- Example cute the following command: # webui ssl-verify-client yes Confidential and Proprietary Information of ZTE CORPORATION...

Zte ZXR10 8900 Series Command Manual

Chapter 1 Overview Tableofcontents:

Chapter 4 Define Tableofcontents:

Chapter 9 Policy(Nat) Tableofcontents:

Chapter 10 Network Tableofcontents:

Chapter 11 Pf Tableofcontents:

Chapter 12 Snmp Tableofcontents:

Chapter 13 System Tableofcontents:

Quick Links

Related Manuals for Zte ZXR10 8900 Series

Summary of Contents for Zte ZXR10 8900 Series