Context commands -- allocate context

| NOTE: Support for this command depends on the device model.

Use allocate context to assign a range of contexts to an MDC.

Use undo allocate context to restore the default.

Syntax

allocate context start-context-id to end-context-id

undo allocate context start-context-id to end-context-id

Default

All contexts belong to the default MDC.

Views

MDC view

Predefined user roles

network-admin

mdc-admin

Parameters

start-context-id: Specifies the start context ID.

end-context-id: Specifies the end context ID. The end context ID must be equal to or greater than the start context ID.

Usage guidelines

Make sure the contexts to be assigned already exist and are not started.

This command assigns a range of contexts to an MDC. To assign a single context to an MDC, use the join mdc command in context view.

After you use the allocate context command to assign a range of contexts, the system assigns the contexts one by one. If an error occurs before the operation is completed, the system displays an error message and stops the operation. The context with the error and all the subsequent contexts are not assigned to the MDC.

Examples

# Assign contexts 2 through 80 to MDC cnt2.

<Sysname> system-view

[Sysname] mdc cnt2

[Sysname-mdc-2-cnt2] allocate context 2 to 80

Related commands

join mdc

Context commands -- allocate interface

Use allocate interface to assign interfaces to a context.

Use undo allocate interface to reclaim interfaces assigned to a context.

Syntax

allocate interface { interface-type interface-number }&<1-24> [ share ]

undo allocate interface { interface-type interface-number }&<1-24>

allocate interface interface-type interface-number1 to interface-type interface-number2 [ share ]

undo allocate interface interface-type interface-number1 to interface-type interface-number2

Default

All interfaces on the firewall belong to the default context. A non-default context cannot use any interfaces.

Views

Context view

Predefined user roles

network-admin

mdc-admin

Parameters

{ interface-type interface-number }&<1-24>: Assigns 1 to 24 individual interfaces to the context.

interface-type interface-number1 to interface-type interface-number2: Assigns a range of interfaces to the context. The specified interfaces must be the same interface type and must belong to the same interface card.

share: Assigns the interfaces in shared mode. If you do not specify this keyword, the command assigns the interfaces exclusively to the context.

Usage guidelines

Both physical and virtual interfaces can be assigned in exclusive or shared mode.

· Exclusive mode—You assign an interface exclusively to a context, and only the context can use the interface. The administrator of the context can see the interface and use all commands supported on the interface.

· Shared mode—You assign an interface to multiple contexts in shared mode, and the system creates a virtual interface for each context. The virtual interfaces use the same name as the physical interface but have different MAC addresses and IP addresses. They forward and receive packets through the physical interface. The shared mode improves interface usage.

You can see the physical interface and perform all commands supported on the interface from the default context. The administrator of a context can only see the context's virtual interface and use the shutdown, description, and network- and security-related commands.

Examples

# Assign GigabitEthernet 1/0/1 through GigabitEthernet 1/0/3 to context sub1 in shared mode.

<Sysname> system-view

[Sysname] context sub1

[Sysname-context-2-sub1] allocate interface gigabitethernet 1/0/1 gigabitethernet 1/0/3 share

The interfaces will be shared by contexts. Continue? [Y/N]:y

Context commands -- allocate vlan

| NOTE: Support for this command depends on the device model.

Use allocate vlan to assign VLANs to a context.

Use undo allocate vlan to reclaim VLANs assigned to a context.

Syntax

allocate vlan vlan-id&<1-24>

undo allocate vlan vlan-id&<1-24>

allocate vlan vlan-id1 to vlan-id2

undo allocate vlan vlan-id1 to vlan-id2

Default

No VLAN is assigned to a context.

Views

Context view

Predefined user roles

network-admin

context-admin

Parameters

vlan-id&<1-24>: Assigns 1 to 24 individual VLANs to the context.

vlan-id1 to vlan-id2: Assigns a range of VLANs to the context.

Usage guidelines

You assign static VLANs except for VLAN 1 to contexts without the VLAN-unshared attribute. Before doing so, you must create the VLANs on the default context. A VLAN can be assigned only to one context. After the assignment to a context, you can use only the display commands on the context, but you can use all VLAN commands on the default context.

A context with the VLAN-unshared attribute has its own VLAN resources (VLAN 2 through VLAN 4094). It does not share VLAN resources with any other context. To create VLANs for the context, log in to the context and use the vlan command. VLAN 1 is system defined. You cannot create or delete VLAN 1.

Examples

# Assign VLAN 100 to context sub1.

<Sysname> system-view

[Sysname] context sub1

[Sysname-context-2-sub1] allocate vlan 100

The VLAN will be allocated to context sub1. Continue? [Y/N]:y

Related commands

display context vlan

Context commands -- blade-controller-team

| NOTE: Support for this command depends on the device model.

Use blade-controller-team to create a security engine group and enter its view, or enter the view of an existing security engine group.

Use undo blade-controller-team to delete a security engine group.

Syntax

blade-controller-team blade-controller-team-name [ id blade-controller-team-id ]

undo blade-controller-team { blade-controller-team-name | id blade-controller-team-id }

Default

A default security engine group exists. The group name is Default and group ID is 1.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

blade-controller-team-name: Specifies the security engine group name, a case-sensitive string of 1 to 31 characters.

id blade-controller-team-id: Specifies the security engine group ID in the range of 2 to 256. If you do not specify this option, the system assigns the lowest ID among the available IDs to the security engine group.

Usage guidelines

The default security engine group cannot be modified or deleted, and you cannot enter its view.

To delete a security engine group, first use the undo location blade-controller command to remove all security engines in the security engine group.

Examples

# Create a security engine named abc and enter its view.

<sysname> system-view

[sysname] blade-controller-team abc

[sysname-blade-controller-team-3-abc]

Context commands -- capability object-policy-rule maximum

| NOTE: Support for this command depends on the device model.

Use capability object-policy-rule maximum to set the maximum number of object policy rules for a context.

Use undo capability object-policy-rule maximum to restore the default.

Syntax

capability object-policy-rule maximum max-number

undo capability object-policy-rule maximum

Default

The default for this command varies by device model.

Views

Context view

Predefined user roles

network-admin

mdc-admin

Parameters

max-number: Specifies the maximum number of object policy rules for the context.

Usage guidelines

This command allows the same maximum number of object policy rules for every security engine to which the context is assigned. When the maximum number is reached, you cannot add additional rules.

The setting fails if the configured maximum number is smaller than the number of existing rules. For the command to take effect, you can delete some existing rules or set the maximum number equal to or larger than the number of existing rules.

Examples

# Set the maximum number of object policy rules to 1000 for context cnt2.

<Sysname> system-view

[Sysname] context cnt2

[Sysname-context-2-cnt2] capability object-policy-rule maximum 1000

Related commands

display object-policy ip (Security Command Reference)

Context commands -- capability session maximum

| NOTE: Support for this command depends on the device model.

Use capability session maximum to set the maximum number of concurrent unicast sessions for a context.

Use undo capability session maximum to restore the default.

Syntax

capability session maximum max-number

undo capability session maximum

Default

The number of concurrent unicast sessions is not limited for a context. The number is determined by the available memory capacity of each security engine on the context.

Views

Context view

Predefined user roles

network-admin

mdc-admin

Parameters

max-number: Specifies the maximum number of concurrent unicast sessions for the context. The value range is 1 to 4294967295.

Usage guidelines

This command allows the same maximum number of concurrent unicast sessions for every security engine to which the context is assigned. When the maximum number is reached, no additional unicast sessions can be established.

This command takes effect even if the configured maximum number is smaller than the number of existing unicast sessions. The existing unicast sessions are not affected. The system does not allow new unicast sessions until the number of existing unicast sessions drops below the configured number because of the aging mechanism.

Examples

# Set the maximum number of concurrent unicast sessions to 1000000 for context cnt2.

<Sysname> system-view

[Sysname] context cnt2

[Sysname-context-2-cnt2] capability session maximum 1000000

Related commands

context

display session statistics (Security Command Reference)

Context commands -- capability session rate

| NOTE: Support for this command depends on the device model.

Use capability session rate to set the upper limit of the session establishment rate for a context.

Use undo capability session rate to restore the default.

Syntax

capability session rate max-value

undo capability session rate

Default

The session establishment rate is not limited for a context. The rate is determined by the available memory capacity of each security engine on the context.

Views

Context view

Predefined user roles

network-admin

mdc-admin

Parameters

max-value: Specifies the maximum number of sessions that can be established per second.

Usage guidelines

This command allows the same upper limit of the session establishment rate for every security engine to which the context is assigned. When the upper limit is reached, no additional sessions can be established.

Examples

# Configure context cnt2 to establish a maximum of 20000 sessions per second.

<Sysname> system-view

[Sysname] context cnt2

[Sysname-context-2-cnt2] capability session rate 20000

Related commands

context

display session statistics (Security Command Reference)

Context commands -- capability throughput

| NOTE: Support for this command depends on the device model.

Use capability throughput to set the throughput threshold for a context.

Use undo capability throughput to restore the default.

Syntax

capability throughput { kbps | pps } value

undo capability throughput

Default

The throughput of a context is not limited.

Views

Context view

Predefined user roles

network-admin

mdc-admin

Parameters

kbps: Specifies the throughput in kilobits per second.

pps: Specifies the throughput in number of packets per second.

value: Specifies the throughput threshold in the range of 1000 to 100000000.

Usage guidelines

This command imposes the same throughput threshold on every security engine to which the context is assigned.

Examples

# Set the throughput threshold to 100000 kbps for context cnt2.

<Sysname> system-view

[Sysname] context cnt2

[Sysname-context-2-cnt2] capability throughput kbps 100000

# Set the throughput threshold to 10000 pps for context cnt2.

<Sysname> system-view

[Sysname] context cnt2

[Sysname-context-2-cnt2] capability throughput pps 10000

Context commands -- context

Use context to create a context and enter its view, or enter the view of an existing context.

Use undo context to delete a context.

Syntax

context context-name [ id context-id ] [ vlan-unshared ]

undo context context-name

Default

A default context exists. The context name is Admin and the context ID is 1.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

context-name: Specifies the context name, a case-sensitive string of 1 to 15 characters.

id context-id: Specifies the context ID in the range of 1 to 65279. If you do not specify this option, the system assigns the lowest ID among the available IDs to the context.

vlan-unshared: Configures the context to not share VLAN resources with any contexts. If you do not specify this keyword, the context shares the same VLAN resources with other contexts. Support for this keyword depends on the device model.

Usage guidelines

A context with the VLAN-unshared attribute has its own VLAN resources (VLAN 1 through VLAN 4094). It does not share VLAN resources with any other contexts. You log in to the context and use the vlan command to create VLANs for the context.

All contexts without the VLAN-unshared attribute share the same VLAN resources (VLAN 1 through VLAN 4094). You create VLANs on the default context and use the allocate vlan command to assign VLANs to the contexts. A VLAN can be assigned only to one context.

Examples

# Create a context named test.

<Sysname> system-view

[Sysname] context test

[Sysname-context-2-test]

# Create a context named test. Set its ID to 2.

<Sysname> system-view

[Sysname] context test id 2

[Sysname-context-2-test]

Context commands -- context start

Use context start to start a context.

Use undo context start to stop a context.

Syntax

context start

undo context start

Default

A context is not started.

Views

Context view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

| CAUTION: Stop a context with caution. Stopping a context stops all services on the context and logs out all users on the context. To avoid configuration data loss, save the running configuration of a context before you stop the context.

You must use this command to initiate a newly created context. You can configure a context only after it is started.

Examples

# Start context cnt2.

<Sysname> system-view

[Sysname] context cnt2

[Sysname-context-2-cnt2] context start

It will take some time to start the context...

Context started successfully.

Context commands -- description

Use description to configure the description of the default context, or configure a description for a non-default context.

Use undo description to restore the default.

Syntax

description text

undo description

Default

The default context uses the description DefaultContext. A non-default context does not have a description.

Views

Context view

Predefined user roles

network-admin

mdc-admin

Parameters

text: Specifies a description, a case-sensitive string of 1 to 255 characters.

Usage guidelines

You can configure a description for each context, which is useful when there are a number of contexts.

Examples

# Configure a description for context cnt2.

<Sysname> system-view

[Sysname] context cnt2

[Sysname-context-2-cnt2] description test

Context commands -- display blade-controller-team

| NOTE: Support for this command depends on the device model.

Use display blade-controller-team to display security engine groups.

Syntax

display blade-controller-team [ blade-controller-team-name | id blade-controller-team-id ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

blade-controller-team-name: Specifies the name of the security engine group, a case-sensitive string of 1 to 31 characters.

id blade-controller-team-id: Specifies the ID of the security engine group, in the range of 1 to 256.

Usage guidelines

If you do not specify any parameters, the command displays all security engine groups.

Examples

# Display all the security engine groups.

<Sysname> display blade-controller-team

ID Name Location Status

1 abc 3.1 Normal

2 fff 4.1 Normal

# Display security engine group abc.

<Sysname> display blade-controller-team abc

ID: 2 Name: abc

Slot CPU Status

1 1 Absent

* 1 1 Normal

* : Primary blade controller of the team.

Table 1 Command output

Field | Description
Location | Location of the security engines in the security engine group.
Status | Status of the security engine: · Absent—No security engine is installed in the slot. · Fault—The security engine is not operating correctly. · Normal—The security engine is operating correctly.
* : Primary blade controller of the team. | Main security engine of the security engine group.

Context commands -- display context

Use display context to display contexts.

Syntax

display context [ name context-name ] [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

name context-name: Specifies a context name, a case-sensitive string of 1 to 15 characters.

verbose: Displays detailed context information. If you do not specify this keyword, the command displays brief context information.

Usage guidelines

On the default context, this command displays the context specified by the name context-name option. Without the option, this command displays all contexts on the device.

Examples

# Display all contexts.

<Sysname> display context

ID Name Status BelongTo Description

1 cnt1 active Admin context1

2 cnt2 inactive MDC3 context2

3 cnt3 inactive MDC2 context3

Total contexts:3

# Display detailed information about all contexts.

<Sysname> display context verbose

Name : Admin

ID : 1

Status : Active

Description : DefaultContext

Belongto : Admin

Blade controller team : NA

Context Master : All CPUs

Name : cont2

ID : 2

Status : Active

Description : this context name is cont3, has created for three days.

Belongto : Admin

Blade controller team : 2

Context Master : slot 2 cpu 1

Name : cont3

ID : 3

Status : Active

Description : this context name is cont3, has created for five days.

Belongto : Admin

Blade controller team : 3

Context Master :

Total contexts:3

# Display detailed information about the specified context.

<Sysname> display context name cont2 verbose

Name : cont2

ID : 2

Status : Active

Description : this context name is cont3, has created for three days.

Belongto : Admin

Blade controller team : 2

Context Master : slot 1 cpu 1

Table 2 Command output

Field | Description
Status | Status of the context: · active—The context is operating correctly. · inactive—The context is not started. · starting—The context is starting up. · updating—The context is being assigned to a security engine group. · stopping—The context is being stopped.`
Belongto | Name of the MDC to which the context belongs. This field is available for firewall cards.
Blade controller team | Security engine group to which the context is assigned. This field is not available if the device does not support security engine groups.
Context Master | CPU to which the context is assigned.

Context commands -- display context interface

Use display context interface to display interfaces assigned to contexts.

Syntax

display context [ name context-name ] interface

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

name context-name: Specifies a context name, a case-sensitive string of 1 to 15 characters.

Usage guidelines

On the default context, this command displays the interfaces for the context specified by the name context-name option. Without the option, this command displays the interfaces for all contexts on the device.

Examples

# Display the interfaces for all contexts.

<Sysname> display context interface

Context stub1's interfaces:

GigabitEthernet0/1/4

Context stub2's interfaces:

FortyGigE0/1/8

Related commands

allocate interface

Context commands -- display context resource

Use display context resource to display CPU, disk space, and memory usage for contexts.

Syntax

Distributed devices in standalone mode:Centralized IRF devices:

display context [ name context-name ] resource [ cpu | disk | memory ] [ slot slot-number cpu cpu-number ]

Distributed devices in IRF mode:

display context [ name context-name ] resource [ cpu | disk | memory ] [ chassis chassis-number slot slot-number cpu cpu-number ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

name context-name: Specifies a context name, a case-sensitive string of 1 to 15 characters. If you do not specify this option, the command displays the CPU, disk space, and memory usage for all contexts on the current MDC.

cpu: Displays the CPU usage.

disk: Displays the disk space usage.

memory: Displays the memory usage.

slot slot-number cpu cpu-number: Specifies a security engine by its CPU number and the slot number. If you do not specify this option, the command displays the usage for the contexts on all security engines. (Distributed devices in standalone mode.)

slot slot-number cpu cpu-number: Specifies a security engine by its CPU number and the member ID. If you do not specify this option, the command displays the usage for the contexts on all security engines in the IRF fabric. (Centralized IRF devices.)

chassis chassis-number slot slot-number cpu cpu-number: Specifies a security engine by its CPU number, the slot number, and the member ID. If you do not specify this option, the command displays the usage for the contexts on all security engines in the IRF fabric. (Distributed devices in IRF mode.)

Usage guidelines

If a context is not started, its CPU, disk space, and memory space usages are all 0.

Examples

# Display the CPU usage for the contexts on all security engines.

<Sysname> display context resource cpu

CPU usage:

Slot 1 CPU 1:

ID Name Weight Usage(%)

1 cnt1 10 24

2 cnt2 10 0

Context commands -- display context vlan

| NOTE: Support for this command depends on the device model.

Use display context vlan to display VLAN lists for contexts.

Syntax

display context [ name context-name ] vlan

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

name context-name: Specifies a context by its name, a case-sensitive string of 1 to 15 characters.

Usage guidelines

On the default context, if you specify the name context-name option, this command displays the VLAN list for the specified context. If you do not specify the name context-name option, this command displays VLAN lists for all contexts.

Examples

# Display VLAN lists for all contexts.

<Sysname> display context vlan

Context stub1's VLAN(s):

Context stub2's VLAN(s):

2,4094

Context stub3's VLAN(s):

5,6,800-3000,3400

# Display the VLAN list for context sub1.

<Sysname> display context name sub1 vlan

Context stub1's VLAN(s):

5,6,11-23,3400

Related commands

allocate vlan

Context commands -- join mdc

| NOTE: Support for this command depends on the device model.

Use join mdc to assign a context to an MDC.

Use undo join to restore the default.

Syntax

join mdc mdc-name

undo join

Default

A context belongs to the default MDC.

Views

Context view

Predefined user roles

network-admin

mdc-admin

Parameters

mdc-name: Specifies an MDC by its name.

Usage guidelines

Make sure the context to be assigned to the MDC already exists and is not started.

This command assigns a single context to an MDC. To assign a range of contexts to an MDC, use the allocate context command in MDC view.

A context can run and provide services only after you assign it to an MDC.

A context can belong only to one MDC. An MDC can have multiple contexts.

Examples

# Assign context cnt2 to MDC test2.

<Sysname> system-view

[Sysname] context cnt2

[Sysname-context-2-cnt2] join mdc test2

Related commands

allocate context

Context commands -- limit-resource cpu

Use limit-resource cpu to set a CPU weight for a context.

Use undo limit-resource cpu to restore the default.

Syntax

limit-resource cpu weight weight-value

undo limit-resource cpu

Default

Each context has a CPU weight of 10.

Views

Context view

Predefined user roles

network-admin

mdc-admin

Parameters

weight weight-value: Specifies a CPU weight value in the range of 1 to 10.

Usage guidelines

This command imposes the same CPU weight on every security engine to which the context is assigned.

Examples

# Set the CPU weight to 2 for context cnt2.

<Sysname> system-view

[Sysname] context cnt2

[Sysname-context-2-cnt2] limit-resource cpu weight 2

Context commands -- limit-resource disk

Use limit-resource disk to set a disk space percentage for a context. A disk space percentage defines the maximum disk space that the context can use.

Use undo limit-resource disk to restore the default.

Syntax

Distributed devices in standalone mode:Centralized IRF devices:

limit-resource disk slot slot-number cpu cpu-number ratio limit-ratio

undo limit-resource disk slot slot-number cpu cpu-number

Distributed devices in IRF mode:

limit-resource disk chassis chassis-number slot slot-number cpu cpu-number ratio limit-ratio

undo limit-resource disk chassis chassis-number slot slot-number cpu cpu-number

Default

All contexts on a security engine share the disk space on the engine. A context can use all free disk space on the engine.

Views

Context view

Predefined user roles

network-admin

mdc-admin

Parameters

slot slot-number cpu cpu-number: Specifies a security engine by its CPU number and the slot number. (Distributed devices in standalone mode.)

slot slot-number cpu cpu-number: Specifies a security engine by its CPU number and the member ID. (Centralized IRF devices.)

chassis chassis-number slot slot-number cpu cpu-number: Specifies a security engine by its CPU number, the slot number, and the member ID. (Distributed devices in IRF mode.)

ratio limit-ratio: Specifies the ratio of the disk space the context can use on the specified security engine to the total disk space of the engine. The value range is 1 to 100.

Usage guidelines

When you assign a context to a security engine group, the system automatically assigns disk space resources on the security engines to the context. All contexts residing on the same security engine share and compete for the engine's free disk resources. To prevent one context from occupying too many disk space resources, assign disk space resources to the contexts.

When you assign disk space to a context, follow these guidelines:

· Use the display context resource command to view the amount of disk space that has been used by the context before assigning disk space to the context.

· Assign disk space larger than the disk space used by the context to avoid the following problems:

?span style='font:7.0pt "Times New Roman"'> The context cannot apply for more disk space.

?span style='font:7.0pt "Times New Roman"'> The context cannot create, copy, or save additional folders or files.

The disk space percentage setting takes effect on all the storage media.

Examples

# Configure the context cnt2 to use up to 20% of the disk space on the security engine for CPU 1 in the specified slot.

<Sysname> system-view

[Sysname] context cnt2

[Sysname-context-2-cnt2] limit-resource disk slot 3 cpu 1 ratio 20

Context commands -- limit-resource memory

Use limit-resource memory to set a memory space percentage for a context. A memory space percentage defines the maximum memory space that the context can use.

Use undo limit-resource memory to restore the default.

Syntax

Distributed devices in standalone mode:Centralized IRF devices:

limit-resource memory slot slot-number cpu cpu-number ratio limit-ratio

undo limit-resource memory slot slot-number cpu cpu-number

Distributed devices in IRF mode:

limit-resource memory chassis chassis-number slot slot-number cpu cpu-number ratio limit-ratio

undo limit-resource memory chassis chassis-number slot slot-number cpu cpu-number

Default

All contexts on a security engine share the memory space on the engine. A context can use all free memory space on the engine.

Views

Context view

Predefined user roles

network-admin

mdc-admin

Parameters

slot slot-number cpu cpu-number: Specifies a security engine by its CPU number and the slot number. (Distributed devices in standalone mode.)

slot slot-number cpu cpu-number: Specifies a security engine by its CPU number and the member ID. (Centralized IRF devices.)

chassis chassis-number slot slot-number cpu cpu-number: Specifies a security engine by its CPU number, the slot number, and the member ID. (Distributed devices in IRF mode.)

ratio limit-ratio: Specifies the ratio of the memory space the context can use on the specified security engine to the total memory space of the engine. The value range is 1 to 100.

Usage guidelines

When you assign a context to a security engine group, the system automatically assigns memory space resources on the security engines to the context. All contexts residing on the same security engine share and compete for the engine's free memory resources. To prevent one context from occupying too many memory space resources, assign memory space resources to the contexts.

When you assign memory space to a context, follow these guidelines:

· Use the display context resource command to view the amount of memory space that has been used by the context before assigning memory space to the context.

· Assign memory space larger than the memory space used by the context to avoid the following problems:

?span style='font:7.0pt "Times New Roman"'> The context cannot apply for more memory space.

?span style='font:7.0pt "Times New Roman"'> The context cannot create, copy, or save additional folders or files.

Examples

# Configure context cnt2 to use up to 30% of the memory space on the security engine for CPU 1 in the specified slot.

<Sysname> system-view

[Sysname] context cnt2

[Sysname-context-2-cnt2] limit-resource memory slot 1 cpu 1 ratio 30

Context commands -- location blade-controller

| NOTE: Support for this command depends on the device model.

Use location blade-controller to add a security engine to a security engine group.

Use undo location blade-controller to restore the default.

Syntax

Distributed devices in standalone mode:Centralized IRF devices:

location blade-controller slot slot-number cpu cpu-number

undo location blade-controller slot slot-number cpu cpu-number

Distributed devices in IRF mode:

location blade-controller chassis chassis-number slot slot-number cpu cpu-number

undo location blade-controller chassis chassis-number slot slot-number cpu cpu-number

Default

A security engine joins the default security engine group when it is installed.

Views

Security engine group view

Predefined user roles

network-admin

mdc-admin

Parameters

slot slot-number cpu cpu-number: Specifies a security engine by its CPU number and the slot number. (Distributed devices in standalone mode.)

slot slot-number cpu cpu-number: Specifies a security engine by its CPU number and the member ID. (Centralized IRF devices.)

chassis chassis-number slot slot-number cpu cpu-number: Specifies a security engine by its CPU number, the slot number, and the member ID. (Distributed devices in IRF mode.)

Usage guidelines

If the security engine is in position, the location blade-controller command takes effect immediately.

If the security engine is not in position, the location blade-controller command takes effect after the security engine is installed.

You can add security engines to security engine groups before installing the security engines. Make a security engine deployment plan before doing so, and install security engines as planned. If you install a non-security engine card in a slot for a security engine, the system automatically deletes the location blade-controller command from the running configuration.

You can add as many security engines to a security engine group as you like. However, one security engine can be added only to one security engine group.

Examples

# Add the security engine on CPU 1 in the specified slot to security engine group abc.

<sysname> system-view

[sysname] blade-controller-team abc

[Sysname-blade-controller-team-2-abc] location blade-controller slot 1 cpu 1

This operation will also reboot the blade controller. Continue? [Y/N]:y

Context commands -- location blade-controller-team (context view)

Use location blade-controller-team to assign a context to a security engine group.

Use undo location blade-controller-team to reclaim a context from a security engine group.

Syntax

location blade-controller-team team-id

undo location blade-controller-team team-id

Default

The default context resides on all security engine groups. A non-default context does not reside on any security engine groups.

Views

Context view

Predefined user roles

network-admin

mdc-admin

Parameters

team-id: Specifies a security engine group by its ID. The security engine group must already exist.

Usage guidelines

To run and provide services, a context must be assigned to a security engine group. After you assign a context to a security engine group, the context can use the CPU, disk space, and memory space resources on the security engines in the group.

You can assign a maximum of 256 contexts to a security engine group. However, a context can be assigned only to one security engine group. To change an assignment, you must reclaim the context before assigning it to the new security engine group.

You can add a security engine to a security engine group before or after assigning a context to the security engine group.

Examples

# Assign context cnt2 to security engine group 2.

<Sysname> system-view

[Sysname] context cnt2

[Sysname-context-2-cnt2] location blade-controller-team 2

Related commands

blade-controller-team

location blade-controller-team (MDC view)

Context commands -- location blade-controller-team (MDC view)

| NOTE: Support for this command depends on the device model.

Use location blade-controller-team to assign an MDC to a security engine group.

Use undo location blade-controller-team to reclaim an MDC from a security engine group.

Syntax

location blade-controller-team team-id

undo location blade-controller-team team-id

Default

The default MDC resides on all security engine groups. A non-default MDC does not reside on any security engine groups.

Views

MDC view

Predefined user roles

network-admin

mdc-admin

Parameters

team-id: Specifies a security engine group by its ID. The security engine group must already exist.

Usage guidelines

To enable a context to run and provide services, you must assign it to a security engine group. Before assigning a context to a security engine group, you must assign the MDC to which the context belongs to the security engine group.

A security engine group supports multiple MDCs. An MDC can be assigned to multiple security engine groups. An MDC assigned to a security engine group resides on all security engines in the group.

To reclaim an MDC from a security engine group, you must first reclaim all contexts assigned to the MDC.

To assign a context to a security engine group, use the location blade-controller-team command in context view.

Examples

# Assign MDC sub1 to security engine group 2.

<Sysname> system-view

[Sysname] mdc sub1

[Sysname-mdc-2-sub1] location blade-controller-team 2

Related commands

blade-controller-team

location blade-controller-team (context view)

Context commands -- reset blade-controller-team

| NOTE: Support for this command depends on the device model.

Use reset blade-controller-team to clear information for an absent security engine in a security engine group.

Syntax

Distributed devices in standalone mode:Centralized IRF devices:

reset blade-controller-team team-id member slot slot-number cpu cpu-number

Distributed devices in IRF mode:

reset blade-controller-team team-id member chassis chassis-number slot slot-number cpu cpu-number

Views

User view

Predefined user roles

network-admin

mdc-admin

Parameters

team-id: Specifies a security engine group by its ID. The value range is 1 to 256. To view the engine ID, use the display blade-controller-team command.

slot slot-number cpu cpu-number: Specifies a security engine by its CPU number and the slot number. (Distributed devices in standalone mode.)

slot slot-number cpu cpu-number: Specifies a security engine by its CPU number and the member ID. (Centralized IRF devices.)

chassis chassis-number slot slot-number cpu cpu-number: Specifies a security engine by its CPU number, the slot number, and the member ID. (Distributed devices in IRF mode.)

Examples

# Clear information for the absent security engine with ID 1 (CPU 1 in the specified slot) in security engine group abc.

<sysname> reset blade-controller-team 1 member slot 2 cpu 1

This operation will cause a short interruption of NAT session. Are you sure? [Y/N]:y

Erasing the controller data successed.

Context commands -- switchto context

Use switchto context to log in to a context.

Syntax

switchto context context-name

Views

System view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

context-name: Specifies a context that has been started.

Usage guidelines

(MDC-incapable devices.) Use this command to log in to a non-default context from the system view of the default context. The connection uses the internal interfaces between the physical device and the context.

(MDC-capable devices.) Use this command to log in to a non-default context from the system view of the MDC to which the context is assigned. The connection uses the internal interfaces between the physical device and the context.

Examples

# Log in to context test2.

<Sysname> system-view

[Sysname] switchto context test2

******************************************************************************

* Copyright (c) 2004-2013 Hangzhou H3C Tech. Co., Ltd. All rights reserved. *

* Without the owner's prior written consent, *

* no decompiling or reverse-engineering shall be allowed. *

******************************************************************************

<Context2>