From Switches to Firewalls: Practical Huawei Network Command Handbook

VRP System Overview

Huawei devices run the Versatile Routing Platform (VRP), which uses a strict view hierarchy. After boot the device is in <Huawei> user view (basic info only). Enter system-view to reach the system view ( [Huawei]) where device‑level parameters such as hostname, AAA, VLAN, and routing protocols can be configured. Further drill‑down to interface view ( interface GigabitEthernet0/0/1) or protocol view (e.g., ospf 1) follows the same nested structure.

View Switching Commands

quit

– step back one level (e.g., from interface view to system view). return – return directly to user view from any level (Ctrl+Z works the same).

Essential Shortcut Keys

Tab

– auto‑complete commands. ? – list all commands available in the current view. command ? – show next‑level parameters (e.g., int ?). Ctrl+C – abort the current command (useful during ping). Ctrl+Z – return to user view. display hotkey – list all shortcut keys.

Using Tab and ? can improve efficiency by at least 30%.

Switch Commands

Common commands for S5700/S6700/S7700 series include VLAN, STP, trunk, and port aggregation.

<Huawei> system-view
[Huawei] sysname SW-Core-01
[Huawei] undo info-center enable
[Huawei] clock timezone Beijing add 08:00:00
[Huawei] header login information "Warning: Unauthorized access prohibited!"
[Huawei] header shell information "=== Welcome to SW-Core-01 ==="
[Huawei] user-interface console 0
[Huawei-ui-console0] idle-timeout 10 0
[Huawei] quit
<Huawei> save

VLAN example:

[Huawei] system-view
[Huawei] vlan batch 10 20
[Huawei-vlan10] description Sales
[Huawei] interface GigabitEthernet0/0/1
[Huawei-GigabitEthernet0/0/1] port link-type access
[Huawei-GigabitEthernet0/0/1] port default vlan 10
[Huawei] display vlan
[Huawei] display vlan 10

Trunk configuration:

[Huawei] interface GigabitEthernet0/0/24
[Huawei-GigabitEthernet0/0/24] port link-type trunk
[Huawei-GigabitEthernet0/0/24] port trunk allow-pass vlan 10 20
[Huawei-GigabitEthernet0/0/24] undo port trunk allow-pass vlan 1

STP/MSTP example:

[Huawei] stp mode mstp
[Huawei] stp enable
[Huawei] stp root primary
[Huawei] stp priority 4096
[Huawei] stp edged-port enable
[Huawei] stp region-configuration
[Huawei-mst-region] region-name HUAWEI
[Huawei-mst-region] instance 1 vlan 10 20
[Huawei-mst-region] active region-configuration

Port‑aggregation (Eth‑Trunk) example:

[Huawei] interface Eth-Trunk 1
[Huawei-Eth-Trunk1] trunkport GigabitEthernet0/0/1 to 0/0/2
[Huawei-Eth-Trunk1] port link-type trunk
[Huawei-Eth-Trunk1] port trunk allow-pass vlan 10 20
[Huawei] display eth-trunk 1

Port security and common display commands are listed with their purpose (e.g., display cpu-usage, display interface brief, display logbuffer).

Router Commands

For AR series routers, interface IP configuration, static routes, OSPF, BGP, VRRP, ACL, and DHCP are covered.

[Huawei] interface GigabitEthernet0/0/0
[Huawei-GigabitEthernet0/0/0] ip address 192.168.1.1 255.255.255.0
[Huawei-GigabitEthernet0/0/0] undo shutdown
[Huawei] ip route-static 10.1.0.0 255.255.0.0 192.168.1.2
[Huawei] ip route-static 0.0.0.0 0.0.0.0 200.1.1.1
[Huawei] ospf 1 router-id 1.1.1.1
[Huawei-ospf-1] area 0
[Huawei-ospf-1-area-0.0.0.0] network 192.168.1.0 0.0.0.255
[Huawei] bgp 65010
[Huawei-bgp] router-id 2.2.2.2
[Huawei-bgp] peer 10.1.1.2 as-number 65010
[Huawei-bgp-af-ipv4] network 192.168.0.0 255.255.0.0
[Huawei] vrrp vrid 1 virtual-ip 192.168.10.254
[Huawei] acl 2000
[Huawei-acl-basic-2000] rule 5 deny source 192.168.1.0 0.0.0.255
[Huawei] dhcp enable
[Huawei] ip pool LAN-Pool
[Huawei-ip-pool-LAN-Pool] network 192.168.10.0 mask 255.255.255.0
[Huawei-ip-pool-LAN-Pool] gateway-list 192.168.10.1

Firewall (USG) Commands

Key differences: default deny‑all policy, security zones, policies, NAT, HRP, and debugging.

[USG6300] system-view
[USG6300] sysname FW-Edge
[USG6300] interface GigabitEthernet0/0/0
[USG6300-GigabitEthernet0/0/0] ip address 200.1.1.1 255.255.255.252
[USG6300] firewall zone untrust
[USG6300-zone-untrust] add interface GigabitEthernet0/0/0
[USG6300] firewall zone trust
[USG6300-zone-trust] add interface GigabitEthernet0/0/1
[USG6300] security-policy
[USG6300-policy-security] rule name Trust-to-Untrust
[USG6300-policy-security-rule-Trust-to-Untrust] source-zone trust
[USG6300-policy-security-rule-Trust-to-Untrust] destination-zone untrust
[USG6300-policy-security-rule-Trust-to-Untrust] source-address 192.168.1.0 24
[USG6300-policy-security-rule-Trust-to-Untrust] action permit
[USG6300] nat-policy
[USG6300-policy-nat] rule name NAT-EasyIP
[USG6300-policy-nat-rule-NAT-EasyIP] source-zone trust
[USG6300-policy-nat-rule-NAT-EasyIP] destination-zone untrust
[USG6300-policy-nat-rule-NAT-EasyIP] source-address 192.168.1.0 24
[USG6300-policy-nat-rule-NAT-EasyIP] action source-nat easy-ip
[USG6300] hrp enable
[USG6300] hrp interface GigabitEthernet0/0/2 remote 1.1.1.2
[USG6300] display hrp state

Debugging commands such as display firewall session table, display security-policy rule all, and diagnose are listed.

Remote Login

Telnet (experimental) and Stelnet (SSH) configurations are provided, including RSA key generation, AAA user creation, and VTY settings.

[Huawei] rsa local-key-pair create
[Huawei] user-interface vty 0 4
[Huawei-ui-vty0-4] authentication-mode aaa
[Huawei-ui-vty0-4] protocol inbound ssh
[Huawei] aaa
[Huawei-aaa] local-user admin password cipher Admin@2024
[Huawei-aaa] local-user admin privilege level 15
[Huawei-aaa] local-user admin service-type ssh
[Huawei] stelnet server enable

Troubleshooting Command Set

A consolidated list of display commands for device status, interface/traffic, routing protocols, configuration, and logs helps locate 80% of common issues.

Practical Cases

Three end‑to‑end scenarios are presented:

Two switches inter‑connected via a trunk to achieve VLAN 10 cross‑device communication.

Firewall Easy‑IP NAT to let an internal 192.168.1.0/24 network share a public IP.

Complete SSH login configuration on a router, ready for client connection.

Each case includes the exact command sequence needed to implement the solution.

Summary

The core workflow for Huawei devices is: view hierarchy → interface configuration → protocol configuration → security policy → troubleshooting verification . Memorising the ten highlighted commands (system‑view/quit/return, display current‑configuration, display interface brief, save, vlan batch/port default vlan, ip route‑static/ospf/bgp, security‑policy/nat‑policy, display logbuffer/debugging, stelnet server enable/local‑user, undo) covers the majority of daily tasks.