Essential H3C Command Cheat Sheet for Switches, Routers, and Firewalls

Command View Basics

H3C devices use a four‑layer view hierarchy. Most configuration errors (about 80%) stem from operating in the wrong view.

User View ( <H3C> )

system-view

– enter system view (most used command). save – save current configuration. display version – show device version, uptime, serial number. display cpu-usage – CPU usage, essential for troubleshooting. display memory-usage – memory usage. reboot – restart device (use with caution in production). ping / tracert – connectivity test.

System View ( [H3C] )

sysname <name>

– set device hostname. undo info-center enable – stop info‑center alarm flooding. display current-configuration – view full running config. display saved-configuration – view saved config. display this – view config of the current view. quit / return – exit current view (quit one level, return to user view).

Interface View ( [H3C-GigabitEthernet1/0/1] )

ip address <ip> <mask>

– assign IP to an interface. undo shutdown – enable the interface (default is up). shutdown – disable the interface. description <text> – add a description for later maintenance. display this – view all configuration of the interface.

Protocol View (e.g., [H3C-ospf-1] , [H3C-bgp-100] )

Used for configuring protocols such as OSPF, BGP, STP. After issuing a command, if it does not take effect, first display this then display ip interface brief to verify interface status.

Switch Common Commands: From VLAN to Aggregation

VLAN Configuration

Three steps: create VLAN, assign ports, configure trunk.

<H3C]vlan 10
<H3C-vlan10]description Sales
<H3C-vlan10]quit
# Batch create multiple VLANs
<H3C]vlan batch 10 20 30 100

vlan <id>

– create a single VLAN and enter VLAN view. vlan batch <id1> <id2> ... – batch create VLANs (recommended). description <text> – label VLAN purpose. undo vlan <id> – delete VLAN (ensure ports are moved first).

Access Port (PC/Server)

<H3C]interface GigabitEthernet 1/0/1
<H3C-GigabitEthernet1/0/1]port link-type access
<H3C-GigabitEthernet1/0/1]port access vlan 10
<H3C-GigabitEthernet1/0/1]quit
# Batch assign ports 1‑24 to VLAN 10
<H3C]port-group manual pg1
<H3C-port-group-manual-pg1]group-member GigabitEthernet 1/0/1 to GigabitEthernet 1/0/24
<H3C-port-group-manual-pg1]port link-type access
<H3C-port-group-manual-pg1]port access vlan 10
<H3C-port-group-manual-pg1]quit

port link-type access

– set port to Access mode. port access vlan <id> – assign port to a VLAN. port-group manual <name> – create a port group for bulk configuration.

Trunk Port (Switch‑to‑Switch)

<H3C]interface GigabitEthernet 1/0/24
<H3C-GigabitEthernet1/0/24]port link-type trunk
<H3C-GigabitEthernet1/0/24]port trunk permit vlan 10 20 30 100
<H3C-GigabitEthernet1/0/24]port trunk pvid vlan 1
<H3C-GigabitEthernet1/0/24]quit

port link-type trunk

– set port to Trunk mode. port trunk permit vlan <list> – explicitly allow VLANs on the trunk. port trunk pvid vlan <id> – set default VLAN (usually 1). undo port trunk permit vlan 1 – remove VLAN 1 from allowed list for security.

VLAN Modes

Access – belongs to a single VLAN, used for PCs, printers.

Trunk – carries multiple VLANs, used for inter‑switch links.

Hybrid – H3C‑specific, flexible tagging for special scenarios.

VLAN Interface (Vlanif)

<H3C]interface Vlanif 10
<H3C-Vlanif10]ip address 192.168.10.1 255.255.255.0
<H3C-Vlanif10]quit
# DHCP relay configuration
<H3C]dhcp relay server-group 1 ip 192.168.100.1
<H3C]interface Vlanif 10
<H3C-Vlanif10]dhcp select relay
<H3C-Vlanif10]dhcp relay server-select 1
<H3C-Vlanif10]quit

interface Vlanif <id>

– enter VLAN virtual interface. ip address <ip> <mask> – set gateway IP for the VLAN. dhcp select relay – enable DHCP relay. dhcp relay server-select <group> – specify DHCP server group.

Spanning Tree (STP/MSTP)

# Enable MSTP globally
<H3C]stp mode mstp
<H3C]stp enable
# Configure MST region
<H3C]stp region-configuration
<H3C-mst-region]region-name H3C
<H3C-mst-region]instance 1 vlan 10 20
<H3C-mst-region]instance 2 vlan 30 40
<H3C-mst-region]active region-configuration
<H3C-mst-region]quit
# Set root bridge
<H3C]stp instance 1 root primary
<H3C]stp instance 2 root secondary

stp mode mstp

– switch to MSTP mode. stp enable – enable STP (default is on). stp region-configuration – enter MST region view. instance <id> vlan <list> – map VLANs to MST instances. active region-configuration – activate the region (must be executed). stp instance <id> root primary – set primary root bridge. stp instance <id> root secondary – set backup root.

Port Aggregation (Link Aggregation)

# Create aggregation interface
<H3C]interface Bridge-Aggregation 1
<H3C-Bridge-Aggregation1]port link-type trunk
<H3C-Bridge-Aggregation1]port trunk permit vlan 10 20 30
<H3C-Bridge-Aggregation1]quit
# Add physical ports to the group
<H3C]interface GigabitEthernet 1/0/23
<H3C-GigabitEthernet1/0/23]port link-aggregation group 1
<H3C-GigabitEthernet1/0/23]quit
<H3C]interface GigabitEthernet 1/0/24
<H3C-GigabitEthernet1/0/24]port link-aggregation group 1
<H3C-GigabitEthernet1/0/24]quit
# Switch to dynamic LACP mode
<H3C]interface Bridge-Aggregation 1
<H3C-Bridge-Aggregation1]link-aggregation mode dynamic

interface Bridge-Aggregation <id>

– create a Layer‑2 aggregation interface. port link-aggregation group <id> – add a physical port to the group. link-aggregation mode dynamic – enable LACP (recommended). display link-aggregation summary – view aggregation status; Selected indicates a healthy member.

Router Common Commands: Interfaces, Routing, NAT

Static Routing

# Standard static route
<H3C]ip route-static 10.0.0.0 255.0.0.0 192.168.1.2
# Point‑to‑point route (specify outgoing interface)
<H3C]ip route-static 192.168.2.0 255.255.255.0 GigabitEthernet 0/0 10.0.0.2
# Floating static route (backup, higher preference wins)
<H3C]ip route-static 0.0.0.0 0.0.0.0 192.168.1.1 preference 60
<H3C]ip route-static 0.0.0.0 0.0.0.0 10.0.0.1 preference 100
# Default route for Internet access
<H3C]ip route-static 0.0.0.0 0.0.0.0 203.0.113.1

ip route-static <dest> <mask> <next‑hop>

– basic static route.

ip route-static ... <out‑interface> <next‑hop>

– bind route to an interface. preference <value> – lower value = higher priority (default 60).

Floating routes use a higher preference (e.g., 100) to act as backup.

OSPF Dynamic Routing

# Enable OSPF process
<H3C]ospf 1 router-id 1.1.1.1
<H3C-ospf-1]area 0.0.0.0
<H3C-ospf-1-area-0.0.0.0]network 10.0.0.0 0.0.0.255
<H3C-ospf-1-area-0.0.0.0]network 192.168.1.0 0.0.0.255
<H3C-ospf-1-area-0.0.0.0]quit
<H3C-ospf-1]quit

ospf <process‑id> router-id <id>

– start OSPF and set Router ID (usually a loopback address). area <id> – enter area view; 0.0.0.0 is the backbone. network <network> <wildcard‑mask> – advertise a network (wildcard mask is inverse of subnet mask).

Wildcard mask examples: /24 → 0.0.0.255, /30 → 0.0.0.3.

OSPF Troubleshooting Commands

<H3C]display ospf peer
<H3C]display ospf peer brief
<H3C]display ospf interface GigabitEthernet 0/0
<H3C]display ospf routing
<H3C]display ospf lsdb

display ospf peer

– view neighbors; must be in FULL state. display ospf peer brief – quick neighbor summary. display ospf routing – OSPF learned routes. display ospf lsdb – link‑state database (useful when routes are missing).

Common OSPF neighbor failures: INIT (no Hello received), 2‑WAY (non‑DR in multi‑access LAN), EXSTART (MTU mismatch). Typical causes are mismatched Area ID or missing authentication.

DHCP Service

# Enable DHCP service
<H3C]dhcp enable
# Create address pool
<H3C]dhcp server ip-pool vlan10
<H3C-dhcp-pool-vlan10]network 192.168.10.0 mask 255.255.255.0
<H3C-dhcp-pool-vlan10]gateway-list 192.168.10.1
<H3C-dhcp-pool-vlan10]dns-list 223.5.5.5 8.8.8.8
<H3C-dhcp-pool-vlan10]expired day 7
<H3C-dhcp-pool-vlan10]quit
# Exclude static addresses (gateway, servers, etc.)
<H3C]dhcp server forbidden-ip 192.168.10.1 192.168.10.10

dhcp enable

– globally enable DHCP (must be set). dhcp server ip-pool <name> – create a pool. network <subnet> mask <mask> – define address range. gateway-list <gw> – set default gateway (must match VLAN interface IP). dns-list <dns1> <dns2> – DNS servers. expired day <n> – lease time (default 1 day). dhcp server forbidden-ip <range> – reserve addresses.

DHCP Relay (when DHCP server is in another subnet)

<H3C]dhcp relay server-group 1 ip 192.168.100.1
<H3C]interface Vlanif 10
<H3C-Vlanif10]dhcp select relay
<H3C-Vlanif10]dhcp relay server-select 1
<H3C-Vlanif10]quit

NAT (Network Address Translation)

# Simple NAT (Easy IP) – use outbound interface IP
<H3C]interface GigabitEthernet 0/1
<H3C-GigabitEthernet0/1]nat outbound
<H3C-GigabitEthernet0/1]quit
# NAT address pool (recommended for enterprise edge)
<H3C]nat address-group 1 203.0.113.10 203.0.113.20
<H3C]acl number 3000
<H3C-acl-adv-3000]rule 5 permit ip source 192.168.0.0 0.0.255.255
<H3C-acl-adv-3000]quit
<H3C]interface GigabitEthernet 0/1
<H3C-GigabitEthernet0/1]nat outbound 3000 address-group 1
<H3C-GigabitEthernet0/1]quit
# Port mapping (NAT Server) – expose internal server
<H3C]interface GigabitEthernet 0/1
<H3C-GigabitEthernet0/1]nat server protocol tcp global 203.0.113.10 80 inside 192.168.1.100 80

nat outbound

– simple NAT using interface IP.

nat address-group <id> <start‑ip> <end‑ip>

– define public address pool. nat outbound <acl> address-group <id> – dynamic NAT for traffic matching ACL.

nat server protocol tcp global <public‑ip> <public‑port> inside <private‑ip> <private‑port>

– static port mapping. display nat session – view NAT sessions (first step when internal hosts cannot reach Internet).

Firewall Common Commands: Zones, Policies, NAT

Security Zones

# Create zones
<H3C]firewall zone name trust
<H3C-zone-trust]priority 85
<H3C-zone-trust]quit
<H3C]firewall zone name untrust
<H3C-zone-untrust]priority 5
<H3C-zone-untrust]quit
<H3C]firewall zone name dmz
<H3C-zone-dmz]priority 50
<H3C-zone-dmz]quit
# Assign interface to a zone
<H3C]interface GigabitEthernet 1/0/1
<H3C-GigabitEthernet1/0/1]zone-member security trust
<H3C-GigabitEthernet1/0/1]ip address 192.168.1.1 24
<H3C-GigabitEthernet1/0/1]quit

firewall zone name <name>

– create a zone (common names: trust, untrust, dmz). priority <1‑100> – higher number = more trusted. zone-member security <zone> – bind an interface to a zone (required for traffic).

Key difference from switches: Different zones are isolated by default; traffic only passes when a security policy permits it.

Security Policies

# Create IPv4 security policy
<H3C]security-policy ip
<H3C-security-policy-ip]rule name trust-to-untrust
<H3C-security-policy-ip-1]source-zone trust
<H3C-security-policy-ip-1]destination-zone untrust
<H3C-security-policy-ip-1]source-ip-subnet 192.168.1.0 24
<H3C-security-policy-ip-1]destination-ip-subnet 203.0.113.0 24
<H3C-security-policy-ip-1]service ping http
<H3C-security-policy-ip-1]action pass
<H3C-security-policy-ip-1]quit
<H3C-security-policy-ip-1]rule name deny-all
<H3C-security-policy-ip-1]action drop
<H3C-security-policy-ip-1]quit
<H3C-security-policy-ip]quit

security-policy ip

– enter IPv4 policy view. rule name <name> – create a rule (name should reflect business). source-zone / destination-zone – specify zones. source-ip-subnet / destination-ip-subnet – IP ranges. service <name> – protocol (ping, http, https, telnet, etc.). action pass / drop / reject – allow, discard, or reject with error.

Rules are evaluated top‑down; earlier rules have higher precedence.

Firewall NAT

# Dynamic NAT (PAT)
<H3C]nat address-group 1 203.0.113.10 203.0.113.20
<H3C]object-group ip address LAN
<H3C-obj-grp-ip-LAN]network subnet 192.168.1.0 24
<H3C-obj-grp-ip-LAN]quit
<H3C]interface GigabitEthernet 1/0/2
<H3C-GigabitEthernet1/0/2]nat outbound address-group 1
# Static NAT (1:1 mapping for a server)
<H3C]interface GigabitEthernet 1/0/2
<H3C-GigabitEthernet1/0/2]nat static global 203.0.113.30 inside 192.168.1.100

nat outbound address-group <id>

– dynamic NAT for internal users.

nat static global <public‑ip> inside <private‑ip>

– one‑to‑one mapping for servers.

Device Management & Maintenance

User & Authentication

# Local user configuration
<H3C]local-user admin class manage
<H3C-luser-manage-admin]password simple YourStrong@Pass123
<H3C-luser-manage-admin]authorization-attribute user-role network-admin
<H3C-luser-manage-admin]service-type ssh telnet terminal http https
<H3C-luser-manage-admin]quit
# Enable VTY (remote) interfaces
<H3C]user-interface vty 0 4
<H3C-line-vty0-4]authentication-mode scheme
<H3C-line-vty0-4]protocol inbound ssh
<H3C-line-vty0-4]quit

local-user <name> class manage

– create a management user. password simple / hashing <pwd> – set password (hashing recommended). authorization-attribute user-role <role> – assign role (network‑admin is highest). service-type – allowed services (ssh, telnet, http, https). authentication-mode scheme – local username/password for VTY. protocol inbound ssh – enforce SSH, disable telnet for security compliance.

SSH Service

<H3C]ssh server enable
<H3C]ssh user admin service-type stelnet authentication-type password
<H3C]public-key local create rsa

ssh server enable

– enable SSH (mandatory in production). public-key local create rsa – generate RSA key pair.

File & Configuration Management

# List files in flash
<H3C]dir
# Backup configuration to TFTP server
<H3C]tftp 192.168.1.100 put startup.cfg backup-20260101.cfg
# Restore configuration from TFTP
<H3C]tftp 192.168.1.100 get backup-20260101.cfg startup.cfg
# Upload to FTP server
<H3C]ftp 192.168.1.100
<H3C-ftp]put startup.cfg backup-20260101.cfg
# Upgrade system software
<H3C]bootrom update file s6900-cmw710-boot.bin
<H3C]boot-loader file flash:/s6900-cmw710-system.bin main

dir

– view files on flash. tftp <ip> put <src> <dst> – upload file (backup config). tftp <ip> get <src> <dst> – download file (restore or upgrade). boot-loader file ... main – set next boot image (critical for upgrade). save – must be executed after any configuration change.

Logs & Monitoring

# View local log buffer
<H3C]display logbuffer
# Configure remote log server
<H3C]info-center loghost 192.168.1.200 facility local7
# Configure NTP time sync
<H3C]clock protocol ntp
<H3C]ntp-service unicast-server 192.168.1.250

display logbuffer

– view device logs (first step in troubleshooting). info-center loghost <ip> – send logs to a syslog server (essential in production). ntp-service unicast-server <ip> – synchronize time; accurate timestamps are vital for analysis.

Common Diagnostic Commands (10 Essential Checks)

display version
display cpu-usage
display memory-usage
display device
display ip interface brief
display interface brief
display current-configuration
display logbuffer
display alarm
display power

Running these ten commands provides a quick health overview of any H3C device and resolves the majority of issues.

Final Advice

Mastering these commands requires hands‑on practice, systematic troubleshooting, and regular configuration backups. Bookmark this cheat sheet and use Ctrl+F to locate needed commands quickly.