How to Configure Inband Management for

Huawei MA5616?
This topic describes how to use Telnet or secure shell (SSH) mode to log in to
the MA5616 through an upstream port (inband management port) of the MA5616 for
inband management. The SSH provides authentication, encryption, and authorization
to ensure the network communication security. When a user logs in to the Huawei
SmartAx mini DSLAM MA5616 remotely over an insecure network, SSH provides
security guarantee and powerful authentication to protect the MA5616 against attacks
such as IP address spoofing and interception of plain text password. The SSH mode is
recommended.

Prerequisites
You must be logged in to the system through a local serial port.
The IP address of the maintenance terminal must be properly configured.
NOTE:
In the following operations, the configurations of the MA5616 must be performed
through a local serial port.
In inband management mode, use either of the following isolation mechanism to
separate the management channel from the data channel:
1. ACL: Configure firewall through ACL so that only specific IP addresses can
be used to log in to the MA5616, such as the IP address of the NMS.
2. VLAN: Ensure that the management VLAN is different from the service
VLAN. In addition, do not add a service port to the management VLAN.

Networking - LAN
The figure1 shows an example network for configuring inband management over a
LAN.
Figure1Example network for configuring inband management over a LAN

Data Plan - LAN

Table 1 and Table 2 provide the data plan for configuring inband management over a
LAN.
Table 1 Data plan for configuring inband management over a LAN in the telnet mode

Item
Upstream port
the MA5616

Data
of VLAN ID: 30
Port ID: 0/0/1
IP address: 10.10.20.2/24

Ethernet port of the IP address: 10.10.20.3/24

maintenance terminal
Table 2 Data plan for configuring inband management over a LAN in the SSH mode

Item
Upstream port
the MA5616

New user

Data
of VLAN ID: 30
Port ID: 0/0/1
IP address: 10.10.20.2/24
User authentication mode: RSA public key authentication
RSA key name: key
User name/Password: huawei/test01
Authority: Operator
Permitted reenter number: 4

Ethernet port of the IP address: 10.10.20.3/24

maintenance terminal

Networking - WAN
2

The figure2 shows an example network for configuring inband management over a
WAN.
Figure2 Example network for configuring inband management over a WAN

Data Plan - WAN

Table 3 and Table 4 provide the data plan for configuring inband management over a
WAN.
Table 3 Data plan for configuring inband management over a WAN in the telnet mode

Item

Data

Upstream port of the MA5616

VLAN ID: 30
Port ID: 0/0/1
IP address: 10.10.20.2/24

Ethernet port of the maintenance terminal

IP address: 10.10.21.3/24

Port of the LAN switch connected to the router

IP address: 10.10.20.3/24

Table 4 Data plan for configuring inband management over a WAN in the SSH mode

Item

Data

Upstream port of the MA5616

VLAN ID: 30
Port ID: 0/0/1
IP address: 10.10.20.2/24
User authentication mode:
RSA
public
key
authentication
RSA key name: key

New user

User
name/Password:
huawei/test01

Table 3 Data plan for configuring inband management over a WAN in the telnet mode

Item

Data

Upstream port of the MA5616

VLAN ID: 30
Port ID: 0/0/1
IP address: 10.10.20.2/24

Ethernet port of the maintenance terminal

IP address: 10.10.21.3/24
Authority: Operator
Permitted reenter number: 4

Ethernet port of the maintenance terminal

IP address: 10.10.21.3/24

Router port connecting to the LAN Switch

IP address: 10.10.20.3/24

Configuration Flowchart
Figure 3 and Figure 4 show the flowchart for configuring inband management.
Figure 3 Flowchart for configuring inband management in the telnet mode

Figure 4 Flowchart for configuring inband management in the SSH mode

NOTE:
The blue-shaded configuration procedures are the difference in the SSH mode and the
telent mode.

Procedure
Set up the configuration environment.
Figure 1 or Figure 2 shows how to set up the configuration environment according to
the actual requirements and conditions.
5

Configure the IP address of the VLAN L3 interface.

Run the vlan command to create a VLAN.
huawei(config)#vlan 30 smart
Run the port vlan command to add an upstream port to the VLAN.
huawei(config)#port vlan 30 0/0 1
In the VLANIF mode, run the ip address command to configure the IP address
and subnet mask of the VLAN L3 interface.
huawei(config)#interface vlanif 30
huawei(config-if-vlanif30)#ip address 10.10.20.2 255.255.255.0
huawei(config-if-vlanif30)#quit
Add a route.
If the configuration environment is set up as shown in Figure 1, you need not add
a route.
If the remote WAN management environment is set up as shown in Figure 2, run
the ip route-static command to add a route to the next hop.
huawei(config)#ip route-static 10.10.21.0 24 10.10.20.3
Save the data.
Run the save command to save the data.
huawei(config)#save
Perform the following operations based on the login mode.
If you login in the telnet mode, perform the following operations:
Start Telnet.
Choose Start > Run on the maintenance terminal. In the Open address bar, enter telnet
10.10.20.2 (10.10.20.2 is the IP address of the VLAN L3 interface of the MA5616), as
shown in Figure 5 (considering the Windows OS as an example). Click OK, and the
telnet interface is displayed.
Figure 5 Starting Telnet

Log in to the MA5616.

On the telnet interface, enter the user name and the password. By default, the super
user name is root and the password is mduadmin. When the login is successful, the
system displays the following information:
>>User name:root
6

>>User password:

Huawei Integrated Access Software (MA5616).

Copyright(C) Huawei Technologies Co., Ltd. 2002-2013. All rights reserved.
If you login in the SSH mode, perform the following operations:
Create a user.
Run the terminal user name command to create a user.
huawei(config)#terminal user name
User Name(length<6,15>):huawei
User Password(length<6,15>):test01 //The password is not displayed on the
maintenance terminal.
Confirm Password(length<6,15>):test01 //The password is not displayed on the
maintenance terminal.
User profile name(<=15 chars)[root]:
User's Level:
1. Common User 2. Operator:2
Permitted Reenter Number(0--4):4
User's Appended Info(<=30 chars):
Adding user succeeds
Repeat this operation? (y/n)[n]:n
Create the local RSA key pair.
Run the rsa local-key-pair create command to create the local RSA key pair.
NOTICE:
The prerequisite for the login through SSH is that the local RSA key pair must be
configured and generated. Therefore, before performing other SSH configurations,
make sure that the local RSA key pair is generated.
huawei(config)#rsa local-key-pair create
The key name will be: Host
The range of public key size is (512 ~ 2048).
NOTES: If the key modulus is greater than 512,
It will take a few minutes.
Input the bits in the modulus[default = 512]:
Generating keys...
..++++++++++++
....................++++++++++++
...............................++++++++
...........++++++++
Set the SSH user authentication mode.
7

Run the ssh user huawei authentication-type rsa command to choose the
authentication mode of the SSH user.
There are four authentication modes for SSH users, as shown in the following. In this
topic, authentication mode rsa is considered as an example.
password: authentication based on a password.
rsa: authentication based on an RSA public key.
all: authentication based on a password or an RSA public key. The user can log in
to the device either by the password or the RSA public key.
password-publickey: authentication based on a password and a public key. The
user can log in to the device only after both the password and the RSA public key
authentication.
huawei(config)#ssh user huawei authentication-type
{ all<K>|password-publickey<K>|password<K>|rsa<K> }:rsa
Command:
ssh user huawei authentication-type rsa
%Authentication type setted, and will be in effect next time.
Generate the RSA public key.
Run the key generator.
Run the client software key generator Puttygen.exe. Figure 6 shows the interface of
the key generator.
Figure 6 Interface of the key generator

Generate the client key.

Select SSH-2 RSA as the key type under Parameters, click Generate, and move the
cursor according to the prompt on the interface to generate the client key, as shown
in Figure 7.
Figure 7 Interface of the key generator

Click Save public key and Save private key to save the public key and the private key
respectively after they are generated, as shown in Figure 8.
Figure 8 Save the public key and the private key

10

Generate the RSA public key.

Open sshkey.exe, click Browse, and choose the public key file saved in the preceding
step. Then, click Convert to change the client public key to the RSA public key, as
shown in Figure 9.
Figure 9 Interface of converting the client public key to the RSA public key

11

Generate the public key for the SSH user.

Create RSA public key. Copy the RSA public key to the server in the config-rsa-keycode command line mode.
huawei(config)#rsa peer-public-key key
Enter "RSA public key" view, return system view with "peer-public-key end".
NOTE: The number of the bits of public key must be between 769 and 2048.
huawei(config-rsa-public-key)#public-key-code begin
Enter "RSA key code" view, return last view with "public-key-code end".
huawei(config-rsa-key-code)#30818702 81810098 933744B6 7C864EC7 A86A84CC
198BAC15
huawei(config-rsa-key-code)#D32834F7
710D13ED 22BD4D59
12

365CFD17

E7FE4041

3266E416

huawei(config-rsa-key-code)#DF0C3E46
3F8A3085 51EDB5C7

A995CC61

DC4CB179

F6888B8C

huawei(config-rsa-key-code)#5DEBDBE1
35C0E562 AE0BBFAB

3AB4A256

0D0B9AA8

9A419D85

huawei(config-rsa-key-code)#515299F9 D2803E84 3AE36C20 949367EA 0697EB20

2594A774
huawei(config-rsa-key-code)#9A0EFF04 26928874 FF9124C4 D28F0702 0125
huawei(config-rsa-key-code)#public-key-code end
huawei(config-rsa-public-key)#peer-public-key end
Assign the public key to the SSH user.
Run the ssh user assign rsa-key command to assign the RSA public key to the SSH
user.
huawei(config)#ssh user huawei assign rsa-key key
Log in to the system.
Run the client software.
Run the SSH client software putty.exe, choose SSH > Auth from the navigation tree,
and assign a file for the RSA private key, as shown in Figure 10. Click Browse to
display the window for selecting the file. In the window, select the file for the private
key, and click OK.
Figure 10 Interface of the SSH client software

13

Log in to the system.

Choose Session from the navigation tree, and then input the IP address of
the MA5616 in the Host Name (or IP address) field, as shown in Figure 11. Then,
click Open to log in to the system.
NOTE:
The port in the Figure 11 generally uses the default number 22, you can also use
the display sysman service state command to query and then to configure.
Figure 11 Interface for logging in to the system using the SSH client software

14

The user authentication mode is set to the RSA authentication mode, and the system
therefore displays the prompt, as shown in Figure 12. Input the user name to log in to
the system (here, the user name is huawei).
Figure 12 Interface for logging in to the system using the SSH client software

Result
15

After logging in to the MA5616, you can manage the MA5616.

The more information about technical support you can consult with our engineer the
e-mail address is as below:
support@huanetwork.com
More related topics
Basic Layout of OLT
Huawei SmartAX MA5616 Overview
Example for Configuring Local Attack Defense
How to Add and Delete ONT on the OLT Device
How to Configure the Auto-save Function for Huawei OLT
More Huawei products and Reviews you can visit: http://www.huanetwork.com/blog

Huanetwork.com is a world leading Huawei networking products supplier, we supply original new
Huawei networking equipments, including Huawei switches, Huawei routers, Huaweisymantec
security products, Huawei IAD, Huawei SFP and other Huawei networking products. Our
customers include telecom operators, Huawei resellers, ISP and system integrators. Right now
most of our sales are contributed by regular customers.
In Huanetwork Lab, also we have Huawei OLT, MDU, DSLAM and switch for customer do
remote testing, any potential customer are welcome to login to our lab. If you need a total Huawei
FTTx solution or Huawei ADSL solution for your network, also you may feel free to contact us.

Our website: http://www.huanetwork.com

Telephone: +852-30501940
Email: sales@huanetwork.com
Address: 23/F Lucky Plaza, 315-321 Lockhart Road, Wanchai, Hongkong

16