1. Account Management & Terminal Access
Configure local privilege escalation, authentication credentials, and idle timeout policies for console or remote sessions.
<Switch> system-view
[Switch] super password simple PrivPass#24
[Switch] undo super password
[Switch] local-user admin_mgmt class manage
[Switch-luser-admin_mgmt] password simple Secure@Root!
[Switch-luser-admin_mgmt] authorization-attribute user-role network-admin
[Switch-luser-admin_mgmt] service-type telnet ssh terminal
[Switch] undo local-user admin_mgmt
[Switch] interface aux 0
[Switch-Aux-0] idle-timeout 2 50
[Switch-Aux-0] undo idle-timeout
[Switch] interface vty 0 4
[Switch-Line-vty0-4] idle-timeout 3 60
[Switch-Line-vty0-4] undo idle-timeout
[Switch-Line-vty0-4] authentication-mode password
[Switch-Line-vty0-4] set authentication password cipher RemoteVty!Pass
[Switch-Line-vty0-4] undo authentication-mode password
[Switch] display users all
[Switch] display user-interface
2. Layer 3 Management Interface
Establish a dedicated management VLAN, assign an SVI address, and configure default routing for out-of-band control.
[Switch] vlan 20
[Switch] management-vlan 20
[Switch] interface Vlan-interface 20
[Switch-Vlan-interface20] ip address 172.16.50.10 24
[Switch-Vlan-interface20] undo ip address
[Switch-Vlan-interface20] ip route-static 0.0.0.0 0 172.16.50.1
[Switch-Vlan-interface20] shutdown
[Switch-Vlan-interface20] undo shutdown
[Switch] display ip interface brief Vlan-interface 20
[Switch] debugging ip packet
[Switch] undo debugging ip
3. Dynamic Address Assignment (DHCP Client)
Enable the switch to obtain management IP parameters dynamically from a central DHCP server.
[Switch] interface Vlan-interface 20
[Switch-Vlan-interface20] ip address dhcp-alloc
[Switch-Vlan-interface20] undo ip address dhcp-alloc
[Switch] display ip address dynamic
[Switch] debugging dhcp alloc
[Switch] undo debugging dhcp
4. Physical Ports & Link Aggregation
Adjust link parameters, enforce traffic shaping, configure logical trunking, and establish port channels with load-balancing policies.
[Switch] interface GigabitEthernet 1/0/1
[Switch-GigabitEthernet1/0/1] shutdown
[Switch-GigabitEthernet1/0/1] speed 1000
[Switch-GigabitEthernet1/0/1] duplex full
[Switch-GigabitEthernet1/0/1] flow-control
[Switch-GigabitEthernet1/0/1] broadcast-suppression 20
[Switch-GigabitEthernet1/0/1] loopback internal
[Switch-GigabitEthernet1/0/1] loopback external
[Switch-GigabitEthernet1/0/1] port link-type trunk
[Switch-GigabitEthernet1/0/1] port trunk pvid vlan 30
[Switch-GigabitEthernet1/0/1] port trunk permit vlan 30 40 50
[Switch-GigabitEthernet1/0/1] mdi auto
[Switch] link-aggregation group 1 mode static
[Switch-lacp-intg-1] link-group GigabitEthernet 1/0/1 to GigabitEthernet 1/0/4
[Switch] undo link-aggregation group 1
[Switch-lacp-intg-1] load-balance hash-key src-ip dst-ip
[Switch] monitor-port GigabitEthernet 1/0/2
[Switch] mirroring-port GigabitEthernet 1/0/3 both
[Switch] reset counter GigabitEthernet 1/0/1
[Switch] display interface GigabitEthernet 1/0/1
[Switch] display link-aggregation group 1
[Switch-GigabitEthernet1/0/1] virtual-cable-test
5. Broadcast Domain Segmentation
Create isolated broadcast domains, apply port-based isolation, and map legacy user-groups for backward compatibility.
[Switch] vlan 10
[Switch-vlan10] port GigabitEthernet 1/0/4 to GigabitEthernet 1/0/7
[Switch-vlan10] port-isolate enable
[Switch-GigabitEthernet1/0/4] port-isolate uplink-port vlan 10
[Switch] display vlan id 10
[Switch] user-group 50
[Switch-UserGroup50] port GigabitEthernet 1/0/4 to GigabitEthernet 1/0/7
[Switch] display user-group id 50
6. High Availability Clustering
Enroll switches into a unified management cluster, designate active controllers, and enforce VLAN constraints for control-plane traffic.
[Switch] cluster enable
[Switch] cluster name HA_Cluster_A
[Switch-cluster] administrator-address aa:bb:cc:dd:ee:ff name mgmt_node
[mgmt_node-HA_Cluster_A-cluster] undo administrator-address
[Switch] management-vlan 20
[Switch] debugging cluster packet
7. Quality of Service (QoS) Policies
Map traffic priorities, configure queue scheduling algorithms, and enforce ingress rate limits based on Comware calculation models.
[Switch-GigabitEthernet1/0/1] priority 7
[Switch] priority-trust cos
[Switch] queue-scheduler wrr weight 2 4 6 8
[Switch-GigabitEthernet1/0/1] car inbound 2048 cir 2048 cbs 2048 pbs 2048 green pass yellow discard red discard
[Switch] display qos queue-scheduler configuration
[Switch] display qos trust-mode interface GigabitEthernet 1/0/1
8. System Maintainance & Observability
Manage MAC learning tables, preserve configuration state, handle log aggregation, and control console output buffers.
[Switch] mac-address blackhole aa:bb:cc:dd:ee:ff vlan 10
[Switch] mac-address static aa:bb:cc:dd:ee:ff interface GigabitEthernet 1/0/1 vlan 10
[Switch] mac-address timer aging 500
[Switch] display mac-address count
[Switch] display arp statistics
[Switch] mac-address port-binding aa:bb:cc:dd:ee:ff interface GigabitEthernet 1/0/1 vlan 10
[Switch] display saved-configuration
[Switch] display current-configuration
[Switch] save force
[Switch] restore default
[Switch] version
[Switch] reboot
[Switch] sysname Core_Switch_01
[Switch] info-center source default channel 2 loglevel debugging
[Switch] info-center loghost 192.168.10.50
[Switch] info-center loghost level 7
[Switch] terminal monitor
[Switch] terminal debugging
[Switch] display logbuffer size 50
[Switch] display trapbuffer size 50
[Switch] reset logbuffer
[Switch] reset trapbuffer
9. Neighbor Discovery & Topology Protocols
Tune IPv6 neighbor resolution, bypass authentication storms during migration, and negotiate physical link topology automatically.
[Switch] ndp enable
[Switch-GigabitEthernet1/0/1] ndp enable
[Switch] display ndp peer ipv6
[Switch] debugging ndp interface GigabitEthernet 1/0/1
[Switch] habp enable
[Switch] debugging habp
[Switch] ntdp enable
[Switch-GigabitEthernet1/0/1] ntdp enable
[Switch] debugging ntdp discovery
10. SNMP Monitoring Configuration
Define read-only communities, register system metadata, adjust payload limits, and troubleshoot agent communication.
[Switch] snmp-agent community read public_ro_2024
[Switch] snmp-agent max-pdu-size 1800
[Switch] snmp-agent sys-info contact net-ops@company.com location DataCenter_Rack_12 version v2c
[Switch] undo snmp-agent
[Switch] display snmp-agent community-config
[Switch] display snmp-agent system-info
[Switch] display snmp-agent community public_ro_2024
[Switch] debugging snmp-agent packet
11. Multicast Optimization (IGMP Snooping)
Control multicast flooding at Layer 2, tune expiration timers, enforce rapid leave behaviors, and audit group membership.
[Switch] igmp-snooping enable
[Switch] igmp-snooping router-aging-time 300
[Switch] igmp-snooping max-response-time 10
[Switch] igmp-snooping host-aging-time 600
[Switch-GigabitEthernet1/0/3] igmp-snooping fast-leave
[Switch] display igmp-snooping configuration
[Switch] display igmp-snooping statistics
[Switch] display igmp-snooping group vlan 20
[Switch] reset igmp-snooping statistics
[Switch] debugging igmp-snooping event
12. Diagnostic Framework
Activate global protocol tracing, direct output to the active terminal session, capture driver-level payloads, and verify filter states.
[Switch] debugging all
[Switch] terminal debugging
[Switch] debugging drv packet
[Switch] display debugging | include status
13. IEEE 802.1X Port-Based Authentication
Deploy network access control, define enforcement modes, limit concurrent sessions, synchronize with RADIUS servers, and fine-tune handshake timeouts.
[Switch] dot1x enable
[Switch-GigabitEthernet1/0/1] dot1x enable
[Switch-GigabitEthernet1/0/1] dot1x port-control auto
[Switch-GigabitEthernet1/0/1] dot1x method macbased
[Switch-GigabitEthernet1/0/1] dot1x max-hosts 8
[Switch] dot1x authentication-method eap
[Switch-GigabitEthernet1/0/1] dot1x re-authenticate
[Switch] dot1x timer handshake-period 15 reauth-period 3600 quiet-period 60 tx-period 30 supp- time 30 server-time 100
[Switch] reset dot1x statistics
[Switch] display dot1x running
[Switch] debugging dot1x process
14. AAA Backend Integration (RADIUS)
Target primary authentication servers, configure shared ancryption keys, adjust retry thresholds, and trace accounting exchanges.
[Switch] radius scheme default
[Switch-radius-default] primary authentication 10.100.5.20 1812
[Switch-radius-default] key authentication EncryptKey$7
[Switch-radius-default] timer response-timeout 5
[Switch-radius-default] retry 3
[Switch] display radius scheme-name default
[Switch] debugging radius packet