CLI: Example for Logging in to the CLI Using the Telnet (HWTACACS Server Authentication)

By default, Telnet is disabled on the device. You need to establish a Telnet login environment. This section provides an example for configuring how to log in to the CLI using Telnet.

Context

Telnet login is not secure. You are advised to log in to the CLI using STelnet.

Networking Requirements

Figure 1 shows that the FW has a local administrator. The local administrator has some administrator permissions and can use Telnet to log in to the CLI only from a local PC for FW management and maintenance. HWTACACS server authentication takes precedence over local authentication. The FW implements local authentication on administrators only when the HWTACACS server does not respond.

Figure 1 Networking diagram of logging in to the CLI using Telnet

Data Planning

Item	Data	Description
VTY interface timeout period	5 minutes	The default period is 10 minutes.
Maximum number of authentication attempts allowed	2	The default value is 3.
Lockout period	10 minutes	The default period is 30 minutes.
Administrator account/password	vtyadmin/Mydevice@abc	Note down the user name and password in case you forget them.
Authentication scheme	Name: hwtacacs Authentication methods: hwtacacs and local	-
HWTACACS server template	Name: hwtacacs_server HWTACACS server address: 172.16.0.2	-
IP address of the administrator's PC	10.3.0.100/255.255.255.0	-

Configuration Roadmap

Configurations on the FW are as follows:
1. Enable the Telnet service on the FW.
2. Configure the administrator login interface.
3. Configure the VTY administrator interface.
4. Configure the administrator, authentication scheme, and HWTACACS server template.
Configure the IP address of the administrator PC and use the Telnet software to log in to the VTY interface.

Procedure

If you log in to the CLI for the first time, reference Logging In to the CLI Through the Console Port and establish the Telnet login environment.
Enable the Telnet service for IPv4 or IPv6. IPv4 is used as an example.
```
<FW> system-view
[FW] telnet server enable
```
Optional: Configure the login interface.

If you use the default settings of management interface to log in to the device, do not perform this step.

Because the default IP address of the management interface has been set to 192.168.0.1, the interface has been added to the Trust zone, and the administrator is allowed to log in to the device using Telnet.
1. Configure the interface IP address and interface-based access control and enable the administrator to log in to the device through Telnet.
```
[FW] interface GigabitEthernet 0/0/3
[FW-GigabitEthernet0/0/3] ip address 10.3.0.1 255.255.255.0
[FW-GigabitEthernet0/0/3] service-manage enable
[FW-GigabitEthernet0/0/3] service-manage telnet permit
[FW-GigabitEthernet0/0/3] quit
```
2. Add an interface to the security zone.
```
[FW] firewall zone trust
[FW-zone-trust] add interface GigabitEthernet0/0/3
[FW-zone-trust] quit
```
Configure the VTY administrator interface.
Set the authentication mode of the VTY administrator interface to AAA and idle disconnection duration to 5 minutes (the default value is 10 minutes).

The number of default VTY administrator interfaces is five. To add more interfaces, run the user-interface maximum-vty number command.
```
[FW] user-interface vty 0 4
[FW-ui-vty0-4] authentication-mode aaa
[FW-ui-vty0-4] protocol inbound telnet
[FW-ui-vty0-4] user privilege level 3
[FW-ui-vty0-4] idle-timeout 5
[FW-ui-vty0-4] quit
```

Set the interface IP address, assign the interface to a security zone, and configure a security policy.

Set the interface IP address.

[FW] interface GigabitEthernet 0/0/2
[FW-GigabitEthernet0/0/2] ip address 172.16.0.1 255.255.255.0
[FW-GigabitEthernet0/0/2] quit

Add the interface to a security zone.

[FW] firewall zone dmz
[FW-zone-dmz] add interface GigabitEthernet0/0/2
[FW-zone-dmz] quit

Configure a security policy.

[FW] security-policy
[FW-policy-security] rule name rule1
[FW-policy-security-rule-rule1] source-zone local
[FW-policy-security-rule-rule1] destination-zone dmz
[FW-policy-security-rule-rule1] destination-address 172.16.0.2 32
[FW-policy-security-rule-rule1] action permit
[FW-policy-security-rule-rule1] quit
[FW-policy-security] quit

Configure a server template. In this example, an HWTACACS server is used.

[FW] hwtacacs-server template hwtacacs_server
[FW-hwtacacs-hwtacacs_server] hwtacacs-server authentication 172.16.0.2 49
[FW-hwtacacs-hwtacacs_server] hwtacacs-server authorization 172.16.0.2 49
[FW-hwtacacs-hwtacacs_server] hwtacacs-server shared-key cipher Admin@123
[FW-hwtacacs-hwtacacs_server] test-aaa testname testpassword hwtacacs-template hwtacacs_server
[FW-hwtacacs-hwtacacs_server] quit

Configure an authentication scheme.
```
[FW] aaa
[FW-aaa] authentication-scheme hwtacacs
[FW-aaa-authen-hwtacacs] authentication-mode hwtacacs local
[FW-aaa-authen-hwtacacs] quit
```
In this example, only the HWTACACS server is used for authentication, and the local role is used to authorize the administrator. To use the HWTACACS authorization mode, see CLI: Example for Logging In to the CLI Using STelnet (HWTACACS Authentication and Authorization).

Configure the Telnet administrator.

Optional: Create an administrator role.

Ignore this step if the default administrator role is used.

[FW] aaa
[FW-aaa] role service-admin
[FW-aaa-role-service-admin] description policy_object_network_readwrite_and_other_modules_none
[FW-aaa-role-service-admin] dashboard none
[FW-aaa-role-service-admin] monitor none
[FW-aaa-role-service-admin] system none
[FW-aaa-role-service-admin] network read-write
[FW-aaa-role-service-admin] object read-write
[FW-aaa-role-service-admin] policy read-write
[FW-aaa-role-service-admin] quit

Create an administrator and bind a role to the administrator.

[FW] aaa
[FW-aaa] manager-user vtyadmin
[FW-aaa-manager-user-vtyadmin] password 
Enter Password: 
Confirm Password:   
[FW-aaa-manager-user-vtyadmin] service-type telnet
[FW-aaa-manager-user-vtyadmin] authentication-scheme hwtacacs
[FW-aaa-manager-user-vtyadmin] hwtacacs-server hwtacacs_server
[FW-aaa-manager-user-vtyadmin] quit
[FW-aaa] bind manager-user vtyadmin role service-admin

Optional: Configure the automatic lockout function upon a failed login.
By default, an account is locked for 30 minutes after three failed login attempts. In the following example, the account is locked for 10 minutes after two failed login attempts.
```
[FW-aaa] lock-authentication enable
[FW-aaa] lock-authentication failed-count 2
[FW-aaa] lock-authentication timeout 10
```

Configure the HWTACACS server. The configuration procedure includes adding a device, adding a user.
Configure the local administrator PC as follows:
1. Set the IP address and subnet mask of the administrator PC to 10.3.0.100 and 255.255.255.0.
2. Run the Telnet software on the PC. Windows OS is used as an example. Choose Start > Run. The Run window is displayed. Enter telnet 10.3.0.1 in Open.
3. Click OK and start to connect to the FW.
4. On the login page, enter vtyadmin for Username: and press Enter.
5. Enter Mydevice@abc for Password: and press Enter to log in to the VTY interface.

Configuration Scripts

#                                                                               
 telnet server enable
#
interface GigabitEthernet0/0/2                                                  
 ip address 172.16.0.1 255.255.255.0                                           
#
interface GigabitEthernet0/0/3                                                  
 ip address 10.3.0.1 255.255.255.0                                           
 service-manage enable
 service-manage telnet permit                                                    
#
user-interface vty 0 4 
 authentication-mode aaa
 protocol inbound telnet
 user privilege level 3
 idle-timeout 5
#
aaa
 authentication-scheme hwtacacs                                                   
  authentication-mode hwtacacs local
 #
 manager-user vtyadmin                                                          
  password cipher %@%@*y:3*ZN}.%%qcL1cCyDwlB.|@XBVMDWq'6JF(iOz2D8>A\SN%@%@           
  service-type telnet                                                             
  level 15                                                                      
  authentication-scheme hwtacacs 
  hwtacacs-server hwtacacs_server
 #
 lock-authentication enable
 lock-authentication failed-count 2
 lock-authentication timeout 10
 #
 bind manager-user vtyadmin role service-admin
role service-admin            
  description policy_object_network_readwrite_and_other_modules_none
 dashboard none
 monitor none
 system none
 network read-write 
 object read-write
 policy read-write
# 
hwtacacs-server template hwtacacs_server
 hwtacacs-server authentication 172.16.0.2 49
 hwtacacs-server authorization 172.16.0.2 49
 hwtacacs-server shared-key cipher %@%@'`Fo,5PRT<%+yu"zhf[18:7W%@%@
#
firewall zone trust 
 set priority 85 
 add interface GigabitEthernet0/0/3
#
firewall zone dmz 
 set priority 50 
 add interface GigabitEthernet0/0/2
#                                                                              
security-policy                                                                 
 rule name rule1                                                                
  source-zone local                                                             
  destination-zone dmz                                                          
  destination-address 172.16.0.2 32                                             
  action permit                                                                 
#
return