20
Step Command
Remarks
3.
(Optional.) Configure a
password for the local
user.
•
For a network access user:
password
{
cipher
|
simple
}
password
•
For a device management user:
{
In non-FIPS mode:
password
[ {
hash
|
simple
}
password
]
{
In FIPS mode:
password
Network access user passwords are
encrypted with the encryption
algorithm and saved in ciphertext.
Device management user passwords
are encrypted with the hash
algorithm and saved in ciphertext.
In non-FIPS mode, a
non-password-protected user passes
authentication if the user provides the
correct username and passes
attribute checks. To enhance security,
configure a password for each local
user.
In FIPS mode, only
password-protected users can pass
authentication.
4.
Assign services to the local
user.
•
For a network access user:
service-type
{
lan-access
|
portal
}
•
For a device management user:
{
In non-FIPS mode:
service-type
{
ftp
| {
http
|
https
|
ssh
|
telnet
|
terminal
} * }
{
In FIPS mode:
service-type
{
https
|
ssh
|
terminal
} *
By default, no service is authorized to
a local user.
5.
(Optional.) Place the local
user to the active or
blocked state.
state
{
active
|
block
}
By default, a created local user is in
active state and can request network
services.
6.
(Optional.) Set the upper
limit of concurrent logins
using the local user name.
access-limit
max-user-number
By default, the number of concurrent
logins is not limited for the local user.
This command takes effect only when
local accounting is configured for the
local user. It does not apply to FTP,
SFTP, or SCP users, who do not
support accounting.
7.
(Optional.) Configure
binding attributes for the
local user.
bind-attribute
{
ip
ip-address
|
location
interface
interface-type
interface-number
|
mac
mac-address
|
vlan
vlan-id
} *
By default, no binding attribute is
configured for a local user.
Binding attribute
ip
applies only to
LAN users using 802.1X.
Binding attributes
location
,
mac
, and
vlan
apply only to LAN and portal
users.
