OTROS - Aerohive CLI Guide

27/4/2016 Aerohive CLI Guide
The following is a complete list of commands available in the HiveOS 6.6r1 release for the AP230 along with explanations of every keyword.
Click a command to see its keyword explanations. Then click the Back Arrow in your browser to return to the list of commands. For an
introduction to the Aerohive CLI, explaining different ways to access it, some keyboard shortcuts, and usage tips, click here.
802.1xmactable expiretime <number>

802.1xmactable suppressinterval <number>
aaa attribute NASIdentifier <string>
aaa attribute OperatorName namespaceid <number>
aaa attribute OperatorName namespaceid {TADIG|REALM|E212|ICC}
aaa attribute OperatorName value <string>
aaa attribute userprofileattribute vendorid <number> attributeid <number>
aaa macformat casesensitivity {lowercase|uppercase}
aaa macformat delimiter {dash|dot|colon}
aaa macformat style {twodelimiter|fivedelimiter|nodelimiter}
aaa ppskserver autosaveinterval <number>
aaa ppskserver radiusserver {primary|backup1|backup2|backup3} <ip_addr|string> [ sharedsecret <string> ] [
authport <number> ] [ viavpntunnel ]
aaa radiusserver accountinteriminterval <number>
aaa radiusserver accounting {primary|backup1|backup2|backup3} <ip_addr|string> [ sharedsecret <string> ] [ acct
port <number> ] [ viavpntunnel ]
aaa radiusserver dynamicauthextension
aaa radiusserver inject OperatorName
aaa radiusserver keepalive enable
aaa radiusserver keepalive interval <number>
aaa radiusserver keepalive retry <number>
aaa radiusserver keepalive retryinterval <number>
aaa radiusserver keepalive username <string> password <string>
aaa radiusserver local acctenable
aaa radiusserver local attrmap groupattrname <string>
aaa radiusserver local attrmap reauthattrname <string>
aaa radiusserver local attrmap userprofileattrname <string>
aaa radiusserver local attrmap vlanattrname <string>
aaa radiusserver local cache lifetime <number>
aaa radiusserver local concurrentsession agetimeout <number>
aaa radiusserver local concurrentsession limit <number>
aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} computerou <string>
aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} domain <string> binddn <string>
password <string>
aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} domain <string> fullname
<string> [ default ]
aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} domain <string> server <string>
aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} login adminuser <string>
password <string>
aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} {server} <string> [ {viavpn
tunnel} ]
aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} {tlsenable|globalcatalog}
aaa radiusserver local dbtype ldapserver subtype edirectory
aaa radiusserver local dbtype ldapserver subtype edirectory acctpolicycheck
aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} basedn <string>
aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} binddn <string> password <string>
aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} filterattr <string>
aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} nostripfilter
aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} port <number>
aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} protocol {ldap|ldaps}
aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} {server} <string> [ {viavpntunnel}
]
aaa radiusserver local dbtype librarysipserver {primary} institutionid <string>
aaa radiusserver local dbtype librarysipserver {primary} loginenable
aaa radiusserver local dbtype librarysipserver {primary} loginuser <string> password <string>
aaa radiusserver local dbtype librarysipserver {primary} port <port>
aaa radiusserver local dbtype librarysipserver {primary} separator <string>
aaa radiusserver local dbtype librarysipserver {primary} {server} <string>
aaa radiusserver local dbtype local
aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} adminuser <string> password
<string>
aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} domain <string> binddn <string>
password <string>
aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} domain <string> fullname <string>
aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} filterattr <string>
aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} nostripfilter
aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} tlsenable
aaa radiusserver local ldapauth {primary|backup1|backup2|backup3} type tls cacert <string> [ clientcert
<string> privatekey <string> [ privatekeypassword <string> ] ] [ verifyserver {never|try|demand} ]
aaa radiusserver local librarysippolicy <string>
aaa radiusserver local localcheckperiod <number>
http://docs.aerohive.com/330000/docs/help/english/documentation/cli_guide_ap230_66r1.htm#cmd7 1/315
aaa radiusserver local nas <string> sharedkey <string>
aaa radiusserver local nas <string> tls
aaa radiusserver local port <number>
aaa radiusserver local remotecheckperiod <number>
aaa radiusserver local requiremessageauthenticator
aaa radiusserver local retryinterval <number>
aaa radiusserver local sharedsecretautogen
aaa radiusserver local staauth cacert <string> servercert <string> privatekey <string> [ privatekeypassword
<string> ]
aaa radiusserver local staauth defaulttype {leap|peap|tls|ttls|md5}
aaa radiusserver local staauth type tls {checkcertcn|checkindb}
aaa radiusserver local staauth type {leap|peap|tls|ttls|md5}
aaa radiusserver local staauth type {peap|ttls} checkindb
aaa radiusserver local usergroup <string>
aaa radiusserver local {enable|cache}
aaa radiusserver name <string> acctport <port>
aaa radiusserver name <string> authport <port>
aaa radiusserver name <string> server <string> sharedsecret <string>
aaa radiusserver name <string> server <string> tls
aaa radiusserver name <string> tlsport <port>
aaa radiusserver proxy deadtime <number>
aaa radiusserver proxy inject operatorname
aaa radiusserver proxy radsec acctport <port>
aaa radiusserver proxy radsec authport <port>
aaa radiusserver proxy radsec dynamicauthextension
aaa radiusserver proxy radsec enable
aaa radiusserver proxy radsec realm <string> {primary|backup} <string>
aaa radiusserver proxy radsec tlsport <port>
aaa radiusserver proxy realm <string> nostrip
aaa radiusserver proxy realm <string> {primary|backup} <string>
aaa radiusserver proxy realm format {nai|ntdomain}
aaa radiusserver proxy retrydelay <number> retrycount <number>
aaa radiusserver retryinterval <number>
aaa radiusserver {primary|backup1|backup2|backup3} <ip_addr|string> [ sharedsecret <string> ] [ authport
<number> ] [ acctport <number> ] [ viavpntunnel ]
accessconsole customssid <string>
accessconsole hidessid
accessconsole maxclient <number>
accessconsole mode {auto|disable|enable}
accessconsole security macfilter <string>
accessconsole security protocolsuite open
accessconsole security protocolsuite {wpa2aespsk|wpa2tkippsk|wpaautopsk} asciikey <string>
accessconsole telnet
admin auth radiusmethod [ {pap|chap|mschapv2} ]
admin auth {local|radius|both}
admin managerip <ip_addr/netmask>
admin minpasswordlength <number>
admin rootadmin <string> password <string>
admin {readwrite|readonly} <string> password <string>
alg {ftp|tftp|sip|dns|http} enable
alg {ftp|tftp|sip|dns} qos <number>
alg {ftp|tftp|sip} inactivedatatimeout <number>
alg {ftp|tftp|sip} maxduration <number>
amrp interface <ethx|redx|aggx> priority <number>
amrp l2neighborkeepalivecount <number>
amrp metric pollinterval <number>
amrp metric type {aggressive|conservative|normal}
amrp neighbor <mac_addr> metric min <number> max <number>
amrp vpntunnel heartbeat interval <number> retry <number>
application identification cdpindex <number> cdpname <string>
application identification cdpindex <number> cdprule <string> cdpmodule {TCP|UDP|HTTP|TLS}
application identification name <string> value <string>
application identification shutdown
application reporting appid <string>
application reporting appid <string> enable
application reporting collectionperiod <number> reportperiod <number>
application reporting upload <url> timewindow <number> [ admin <string> password <string> {basic|digest} ]
application reporting watchlist <string>
application reporting watchlist <string> enable
application reporting {enable|disable|auto}
bonjourgateway enable
bonjourgateway filter rule <number> [ from <string> ] <string> [ to <string> ] [ metric <number> ]
bonjourgateway filter rule <number> {before|after} rule <number>
bonjourgateway neighbor <ip_addr|string>
bonjourgateway priority <number>
bonjourgateway realm <string>
bonjourgateway vlan <number> [ <number> ]
bootparam bootfile <string>
bootparam bootpassword <string>
bootparam countrycode <number>
bootparam device <ip_addr/netmask>
bootparam device <ip_addr> <netmask>
bootparam gateway <ip_addr>
bootparam nativevlan <number>
bootparam netboot enable
bootparam netdump dumpfile [ <string> ]
bootparam netdump enable
bootparam server <ip_addr>
bootparam vlan <number>
cac airtimepersecond <number>
cac enable
cac roaming airtimepercentage <number>
capture interface <wifix> [ count <number> ] [ filter <number> ] [ promiscuous ]
capture save interface <wifix> <string>
capwap client HTTP proxy name <string> port <number>
capwap client HTTP proxy user <string> password <string>
capwap client defaultservername <string>
capwap client discovery interval <number>
capwap client discovery maximum interval <number>
capwap client discovery method {broadcast}
capwap client dtls acceptbootstrappassphrase
capwap client dtls bootstrappassphrase <string>
capwap client dtls enable
capwap client dtls handshakewaittime <number>
capwap client dtls hmdefinedpassphrase <string> keyid <number>
capwap client dtls maxretries <number>
capwap client dtls negotiation enable
capwap client dtls psk <string>
capwap client dtls sessiondeletewaittime <number>
capwap client enable
capwap client join timeout <number>
capwap client neighbor dead interval <number>
capwap client neighbor heartbeat interval <number>
capwap client pcialert enable
capwap client server [ {backup} ] name <string> [ connectdelay <number> ] [ viavpntunnel ]
capwap client server port <number>
capwap client silent interval <number>
capwap client transport HTTP
capwap client vhmname <string>
capwap maxdiscoveries counter <number>
capwap ping <string> [ port <number> ] [ count <number> ] [ size <number> ] [ timeout <number> ]
capwap ping <string> [ port <number> ] flood <number> [ size <number> ] [ timeout <number> ]
clear aaa radiusserver cache [ username <string> ]
clear aaa radiusserverkey [ {radiusserver|ldapclient} ] [ <string> ]
clear aaa radiusserverkey radsec ca
clear application reporting appstats
clear application reporting statistics
clear arpcache
clear auth roamingcache mac <mac_addr> {hiveneighbors|hiveall}
clear auth roamingcache {hiveneighbors}
clear auth username <string>
clear auth {localcache|roamingcache|station} [ mac <mac_addr> ]
clear auth {localcache|roamingcache|station} ssid <string>
clear cac stationairtime [ mac <mac_addr> ]
clear capture local [ <string> ]
clear capwap client counter
clear config rollback
clear forwardingengine counters [ interface <wifix|wifix.y|ethx|mgtx|aggx|redx> ] [ station <mac_addr> ] [ drop ]
[ tunnel ] [ policy ]
clear forwardingengine ipsessions [ srcip <ip_addr> ] [ dstip <ip_addr> ] [ srcport <number> ] [ dstport
<number> ] [ protocol <number> ]
clear forwardingengine ipsessions id <number>
clear forwardingengine macsessions [ srcmac <mac_addr> ] [ dstmac <mac_addr> ]
clear forwardingengine macsessions id <number>
clear gretunnel counters tunnel
clear hive <string> counter neighbor [ <mac_addr> ]
clear interface <ethx|aggx|redx> maclearning dynamic <mac_addr>
clear interface <ethx|aggx|redx> maclearning dynamic all
clear interface <ethx|wifix|wifix.y|aggx|redx> counter
clear interface <mgtx|mgtx.y> dhcpserver lease all
clear interface <mgtx|mgtx.y> dhcpserver lease ip <ip_addr>
clear interface <mgtx|mgtx.y> dhcpserver lease mac <mac_addr>
clear interface <wifix> wlanidp mitigate rogueap [ <mac_addr> ]
clear lldp [ {cdp} ] table
clear location {aeroscout|tzsp} counter
clear log [ {buffered|debug|flash|all} ]
clear mdnsd counter [ vlan <number> ]
clear networkfirewall session all
clear qos counter
clear service [ <string> ] counter
clear ssh known_host <string>
clear ssid <string> counter station [ <mac_addr> ]
clear supplicant certfile [ <string> ]
clear userandgroup all
clear vpn certificatekey
clear vpn {ike|ipsec} sa
clear webdirectory [ {ppskselfreg} ]
clear wlanidp mitigate [ <mac_addr> ]
clientmonitor enable
clientmonitor policy <string> problemtype {association|authentication|networking} [ triggertimes <number> ] [
reportinterval <number> ] [ quiettime <number> ]
clienttracing <mac_addr>
clock datetime <date> <time>
clock timezone <number> [ {30|45} ]
clock timezone daylightsavingtime <date> <time> <date> <time>
config rollback enable
config rollback manual [ waittime <number> ]
config rollback now
config rollback {capwapdisconnect|nextreboot} [ waittime <number> ]
config version <number>
console echo obscurepasswords
console page <number>
console serialport enable
console timeout <number>
datacollection collect interval <number>
datacollection enable
datacollection report interval <number>
datacollection {maxcollect} <number>
debug console [ {all} ]
debug console level {emergency|alert|critical|error|warning|notification|info|debug}
debug console timestamp
designatedserver idmproxy announce
designatedserver idmproxy dynamic
devicegroup <string> [ macobject <string> ] [ domainobject <string> ] [ osobject <string> ]
devicegroup <string> ownership {cid|byod}
devicelocation <string>
dns domainname <string>
dns dynamicdns domainname <string>
dns dynamicdns enable
dns dynamicdns serveraccount {dyndns|noip} username <string> password <string>
dns serverip <ip_addr|ipv6_addr> [ {second|third} ]
domainobject <string> domain <string>
exec aaa idmtest auth username <string> password <string> [ {pap|mschapv2} ] [ proxy <string> ] [ bindssid
<string> ]
exec aaa idmtest {radsecproxy|authproxy}
exec aaa ldapsearch servertype {activedirectory|ldapserver|opendirectory} server <string> basedn <string>
binddn <string> password <string> [ {attributes} [ <string> ] ]
exec aaa ldapsearch username <string> [ basedn <string> ] [ domain <string> ]
exec aaa librarysiptest primary username <string> password <string>
exec aaa netadsinfo <string>
exec aaa netjoin [ {primary|backup1|backup2|backup3} username <string> password <string> ]
exec aaa netjoin domain <string> fullname <string> server <string> username <string> password <string> [
computerou <string> ]
exec aaa ntlmauth username <string> password <string> [ domain <string> ]
exec aaa radiustest <string> accounting
exec aaa radiustest <string> callcheck <mac_addr>
exec aaa radiustest <string> username <string> password <string> [ {pap|chap|mschapv2} ]
exec activealarmsresending
exec antennaalignment interface <wifix> peer <mac_addr> [ count <number> ] [ interval <number> ] [ textsize
<number> ]
exec auth <string> ppskmacunbinding mac <mac_addr>
exec auth <string> ppskmacunbinding macppsk <mac_addr> <string>
exec auth <string> ppskmacunbinding ppsk <string>
exec bypasswanhardening
exec capture remotesniffer [ user <string> <string> ] [ hostallowed <string> ] [ localport <number> ] [
promiscuous ]
exec clientmonitor <mac_addr>
exec datacollection {push|clear}
exec delayexecute [ <number> ]
exec interface <wifix> spectralscan channel <number>
exec interface <wifix> spectralscan reportinterval <number>
exec interface <wifix> spectralscan {start|stop}
exec mobiledevicemanager aerohive statuschange <string>
exec sshclient server <string> user <string>
exec usergroup <string> psktopmk
exec wlanidp apclassify {rogue|friendly} <mac_addr> [ <mac_addr> ]
exec wlanidp mitigate {rogueap} <mac_addr>
exec wlanidp mitigate {rogueap} <mac_addr> interface <wifix>
exec {jsscheck|airwatchcheck|aerohivecheck} mobiledevice <mac_addr> enrollstatus
exit
filter <number> l2 [ {data|ctl|mgmt} ] [ subtype <hex> ] [ srcmac <mac_addr> ] [ dstmac <mac_addr> ] [ bssid
<mac_addr> ] [ txmac <mac_addr> ] [ rxmac <mac_addr> ] [ error {crc|decrypt|mic|all|no} ] [ etype <hex> ]
filter <number> l3 [ srcip <ip_addr> ] [ dstip <ip_addr> ] [ protocol <number> ] [ srcport <number> ] [ dst
port <number> ]
filter [ <number> ] [ direction bidirectional ]
forwardingengine drop {ipfragmentedpackets|toselfnonmanagementtraffic}
forwardingengine interssidflood enable
forwardingengine l2defaultroute interface <ethx> vlan <number> [ <number> ]
forwardingengine log {firewalldroppedpackets|toselfsessions}
forwardingengine macsessions syncvlan
forwardingengine maxipsessionsperstation <number>
forwardingengine maxmacsessionsperstation <number>
forwardingengine proxyarp enable
forwardingengine staticrule <string> action drop inif <ethx|aggx|redx> dstmac <mac_addr>
forwardingengine staticrule <string> action drop inif <ethx|aggx|redx> srcmac <mac_addr> dstmac <mac_addr>
forwardingengine staticrule <string> action drop inif <ethx|aggx|redx> srcoui <oui> dstmac <mac_addr>
forwardingengine staticrule <string> action drop inif <wifix.y> dstmac <mac_addr> txmac <mac_addr>
forwardingengine staticrule <string> action drop inif <wifix.y> srcmac <mac_addr> dstmac <mac_addr> txmac
<mac_addr>
forwardingengine staticrule <string> action drop inif <wifix.y> srcoui <oui> dstmac <mac_addr> txmac
<mac_addr>
forwardingengine staticrule <string> action pass inif <ethx|aggx|redx> dstmac <mac_addr> outif
<ethx|aggx|redx>
forwardingengine staticrule <string> action pass inif <ethx|aggx|redx> dstmac <mac_addr> outif <wifix.y> rx
mac <mac_addr>
forwardingengine staticrule <string> action pass inif <ethx|aggx|redx> srcmac <mac_addr> dstmac <mac_addr>
outif <ethx|aggx|redx>
forwardingengine staticrule <string> action pass inif <ethx|aggx|redx> srcmac <mac_addr> dstmac <mac_addr>
outif <wifix.y> rxmac <mac_addr>
forwardingengine staticrule <string> action pass inif <ethx|aggx|redx> srcoui <oui> dstmac <mac_addr> outif
<ethx|aggx|redx>
forwardingengine staticrule <string> action pass inif <ethx|aggx|redx> srcoui <oui> dstmac <mac_addr> outif
<wifix.y> rxmac <mac_addr>
forwardingengine staticrule <string> action pass inif <wifix.y> dstmac <mac_addr> txmac <mac_addr> outif
<ethx|aggx|redx>
forwardingengine staticrule <string> action pass inif <wifix.y> dstmac <mac_addr> txmac <mac_addr> outif
forwardingengine staticrule <string> action pass inif <wifix.y> srcmac <mac_addr> dstmac <mac_addr> txmac
<mac_addr> outif <ethx|aggx|redx>
forwardingengine staticrule <string> action pass inif <wifix.y> srcmac <mac_addr> dstmac <mac_addr> txmac
<mac_addr> outif <wifix.y> rxmac <mac_addr>
forwardingengine staticrule <string> action pass inif <wifix.y> srcoui <oui> dstmac <mac_addr> txmac
forwardingengine staticrule <string> action pass inif <wifix.y> srcoui <oui> dstmac <mac_addr> txmac
forwardingengine tunnel selectivemulticastforward allowall except <ip_addr|ip_addr/mask>
forwardingengine tunnel selectivemulticastforward blockall
forwardingengine tunnel selectivemulticastforward blockall except <ip_addr|ip_addr/mask>
forwardingengine tunnel tcpmssthreshold enable
forwardingengine tunnel tcpmssthreshold thresholdsize <number>
history <number>
hive <string>
hive <string> fragthreshold <number>
hive <string> manage all
hive <string> manage {Telnet|SSH|SNMP|ping}
hive <string> neighbor connectingthreshold <number> pollinginterval <number>
hive <string> neighbor connectingthreshold {low|medium|high} pollinginterval <number>
hive <string> password <string>
hive <string> rtsthreshold <number>
hive <string> security macfilter <string>
hive <string> security wlan dos stationlevel frametype {assocreq|auth|eapol} ban <number>
hive <string> security wlan dos stationlevel frametype {assocreq|auth|eapol} ban forever
hive <string> security wlan dos {hivelevel|stationlevel} frametype {probereq|proberesp|assocreq|assoc
resp|disassoc|auth|deauth|eapol|all}
resp|disassoc|auth|deauth|eapol|all} alarm <number>
resp|disassoc|auth|deauth|eapol|all} threshold <number>
hive <string> wlanidp innetap
hive <string> wlanidp maxmitigatornum <number>
hive <string> wlanidp mitigationmode {automatic|semiautomatic|manual}
hive <string> wlanidp mitigationmode {automatic|semiautomatic} action {mitigate|report}
hive <string> wlanidp mitigatorreevalperiod <number>
hive <string> wlanidp queryinterval <number>
hive <string> wlanidp waitinterval <number>
hiveui cas client server name <string>
hiveui cas client server port <number>
hiveui enable
hostname <string>
interface <blex> ibeacon [ uuid <string> ] [ major <number> ] [ minor <number> ] [ measuredpower <number> ]
interface <blex> ibeacon enable
interface <blex> ibeaconmonitor enable
interface <ethx> bind <aggx>
interface <ethx> bind <redx> [ primary ]
interface <ethx> clientmonitorpolicy <string>
interface <ethx> duplex {full|half|auto}
interface <ethx> ip <ip_addr/netmask>
interface <ethx> mode wan
interface <ethx> nativevlan <number>
interface <ethx> pppoe authmethod {pap|chap|any}
interface <ethx> pppoe enable
interface <ethx> pppoe username <string> password <string>
interface <ethx> securityobject <string>
interface <ethx> speed {10|100|1000|auto}
interface <ethx> supplicant <string>
interface <ethx|aggx|redx> allowedvlan <number> [ <number> ]
interface <ethx|aggx|redx> allowedvlan {all|auto}
interface <ethx|aggx|redx> interstationtraffic
interface <ethx|aggx|redx> linkdiscovery {lldp|cdp}
interface <ethx|aggx|redx> maclearning enable
interface <ethx|aggx|redx> maclearning idletimeout <number>
interface <ethx|aggx|redx> maclearning static <mac_addr>
interface <ethx|aggx|redx> manage {Telnet|SSH|SNMP|ping|all}
interface <ethx|aggx|redx> mode bridge802.1q userprofileattribute <number>
interface <ethx|aggx|redx> mode {bridge802.1q|backhaul}
interface <ethx|aggx|redx> qosclassifier <string>
interface <ethx|aggx|redx> qosmarker <string>
interface <ethx|aggx|redx> ratelimit broadcast <number>
interface <ethx|aggx|redx> ratelimit multicast <number>
interface <ethx|aggx|redx> ratelimit unicast <number>
interface <ethx|aggx|redx> ratelimit {multicast|broadcast|unicast} enable
interface <ethx|aggx|redx> shutdown
interface <ethx|redx|aggx> mode bridgeaccess [ userprofileattribute <number> ]
interface <ethx|usbnetx> mode wan nat
interface <ethx|usbnetx> mode wan natpolicy <string>
interface <ethx|usbnetx> mode wan priority <number>
interface <mgtx.y> ip <ip_addr/netmask>
interface <mgtx.y> manage ping
interface <mgtx.y> vlan <number>
interface <mgtx> defaultipprefix <ip_addr/netmask>
interface <mgtx> defaultipprefix <ip_addr>
interface <mgtx> dhcp client fallbacktostaticip
interface <mgtx> dhcp keepalive enable
interface <mgtx> dhcp keepalive interval <number>
interface <mgtx> dhcp keepalive retry <number>
interface <mgtx> dhcp keepalive timeout <number>
interface <mgtx> dhcp keepalive vlan <number> [ <number> ]
interface <mgtx> dhcpprobe vlanrange <number> <number> [ timeout <number> ] [ retries <number> ]
interface <mgtx> hive <string>
interface <mgtx> ip <ip_addr/netmask>
interface <mgtx> ip <ip_addr> <netmask>
interface <mgtx> ipv6 <ipv6_addr/mask> [ eui64 ]
interface <mgtx> ipv6 <ipv6_addr> linklocal
interface <mgtx> ipv6 autoconfig
interface <mgtx> ipv6 dhcp client
interface <mgtx> mtu <number>
interface <mgtx> nativevlan <number>
interface <mgtx> vlan <number>
interface <mgtx|ethx> dhcp client
interface <mgtx|ethx> dhcp client addressonly
interface <mgtx|ethx> dhcp client option custom ppskserverip <number>
interface <mgtx|ethx> dhcp client option custom radiusserverip <number>
interface <mgtx|ethx> dhcp client option custom radiusserverip accounting <number>
interface <mgtx|ethx> dhcp client option custom {syslogserverip|hivemanagerip|backuphivemanagerip} <number>
interface <mgtx|ethx> dhcp client option custom {syslogserver|hivemanager|backuphivemanager} <number>
interface <mgtx|ethx> dhcp client prefersubnet <ip_addr/netmask>
interface <mgtx|ethx> dhcp client timeout <number>
interface <mgtx|mgtx.y> dhcpserver enable
interface <mgtx|mgtx.y> dhcpserver ipbinding <ip_addr> <mac_addr>
interface <mgtx|mgtx.y> dhcpserver ippool <ip_addr> <ip_addr>
interface <mgtx|mgtx.y> dhcpserver options custom <number> hex <string>
interface <mgtx|mgtx.y> dhcpserver options custom <number> integer <number>
interface <mgtx|mgtx.y> dhcpserver options custom <number> ip <ip_addr>
interface <mgtx|mgtx.y> dhcpserver options custom <number> string <string>
interface <mgtx|mgtx.y> dhcpserver options defaultgateway <ip_addr> [ {natsupport} ]
interface <mgtx|mgtx.y> dhcpserver options domainname <string>
interface <mgtx|mgtx.y> dhcpserver options hivemanager <ip_addr>
interface <mgtx|mgtx.y> dhcpserver options hivemanager <string>
interface <mgtx|mgtx.y> dhcpserver options leasetime <number>
interface <mgtx|mgtx.y> dhcpserver options mtu <number>
interface <mgtx|mgtx.y> dhcpserver options netmask <netmask>
interface <mgtx|mgtx.y> dhcpserver options vendorspecific VCI <string>
interface <mgtx|mgtx.y> dhcpserver options vendorspecific VCI <string> <number> ip <ip_addr>
interface <mgtx|mgtx.y> dhcpserver options vendorspecific VCI <string> <number> string <string>
interface <mgtx|mgtx.y> dhcpserver options {dns1|dns2|dns3} <ip_addr>
interface <mgtx|mgtx.y> dhcpserver options {logsrv|pop3|smtp} <ip_addr>
interface <mgtx|mgtx.y> dhcpserver options {ntp1|ntp2} <ip_addr>
interface <mgtx|mgtx.y> dhcpserver options {wins1|wins2} <ip_addr>
interface <mgtx|mgtx.y> dhcpserver reservedaddress <ip_addr> <ip_addr>
interface <mgtx|mgtx.y> dhcpserver {arpcheck|authoritativeflag}
interface <mgtx|mgtx.y> dnsserver enable
interface <mgtx|mgtx.y> dnsserver extresolve {dns1|dns2|dns3} <ip_addr>
interface <mgtx|mgtx.y> dnsserver intdomainname <string> [ <ip_addr> ]
interface <mgtx|mgtx.y> dnsserver intresolve {dns1|dns2|dns3} <ip_addr>
interface <mgtx|mgtx.y> dnsserver mode {split|nonsplit}
interface <mgtx|mgtx.y> dnsserver opendnsdeviceid <string>
interface <mgtx|mgtx.y> iphelper address <ip_addr>
interface <mgtx|mgtx.y> iphelper maxhops <number>
interface <mgtx|vlanx> dhcpserver options vendorspecific VCI <string> <number> hex <string>
interface <mgtx|vlanx> dhcpserver options vendorspecific VCI <string> <number> integer <number>
interface <wifix> hive <string> shutdown
interface <wifix> linkdiscovery {lldp|cdp}
interface <wifix> mode {access|backhaul|dual|sensor}
interface <wifix> radio antenna diversity
interface <wifix> radio channel <string>
interface <wifix> radio channel exclude <string>
interface <wifix> radio power <number>
interface <wifix> radio power auto
interface <wifix> radio power auto floor <number>
interface <wifix> radio power auto maxdrop <number>
interface <wifix> radio profile <string>
interface <wifix> radio range <number>
interface <wifix> radio txpowercontrol <number>
interface <wifix> radio txpowercontrol auto
interface <wifix> ssid <string>
interface <wifix> ssid <string> ip <ip_addr/netmask>
interface <wifix> ssid <string> shutdown
interface <wifix> wlanidp profile <string>
ip natpolicy <string>
ip natpolicy <string> type matchnet inside <ip_addr/netmask> outside <ip_addr/netmask>
ip natpolicy <string> type virtualhost insidehost <ip_addr> insideport <port> outsideport <port> protocol
{tcp|udp}
ip pathmtudiscovery enable
ip route default gateway <ip_addr> [ metric <number> ]
ip route host <ip_addr> [ gateway <ip_addr> ] [ metric <number> ]
ip route net <ip_addr> <netmask> [ gateway <ip_addr> ] [ metric <number> ]
ip tcpmssthreshold enable
ip tcpmssthreshold l3vpnthresholdsize <number>
ip tcpmssthreshold thresholdsize <number>
ip versionpreference {ipv4|ipv6}
ippolicy <string> [ id <number> ] [ {before|after} id <number> ] [ from <ip_addr|string_64> [ <mask> ] ] [ to
<ip_addr|string_64> [ <mask> ] ] [ service <string> ] [ action {permit|deny|nat|interstationtraffic
drop|redirect} ]
<ip_addr|string_64> [ <mask> ] ] [ service <string> ] action deny log packetdrop
<ip_addr|string_64> [ <mask> ] ] [ service <string> ] action interstationtrafficdrop log [ {initiate
session|terminatesession|packetdrop} ]
<ip_addr|string_64> [ <mask> ] ] [ service <string> ] action permit log [ {initiatesession|terminatesession} ]
ippolicy <string> [ id <number> ] [ {before|after} id <number> ] [ from <ip_addr|string_64> [ <mask> ] ] to
localsubnet [ service <string> ] [ action {permit|deny|nat|interstationtrafficdrop|redirect} ]
iperf client <ip_addr> [ {port} <number> ] [ {udp} ] [ {interval} <number> ] [ {nodelay} ] [ {dualtest} ] [
{tradeoff} ] [ {listenport} <number> ] [ {window} <number> ] [ {mss} <number> ] [ {bandwidth} <number> ] [ {time}
<number> ] [ {parallel} <number> ]
iperf server [ {port} <number> ] [ {udp} ] [ {singleudp} ] [ {interval} <number> ] [ {nodelay} ] [ {window}
<number> ] [ {mss} <number> ] [ {bind} <ip_addr> ]
ipv6 dhcpv6shield enable
ipv6 raguard stateless enable
ipv6 route <ipv6_addr/mask> <mgtx> gateway <ipv6_addr> [ metric <number> ]
ipv6 route <ipv6_addr/mask> gateway <ipv6_addr> [ metric <number> ]
ipv6 route default <mgtx> gateway <ipv6_addr> [ metric <number> ]
ipv6 route default gateway <ipv6_addr> [ metric <number> ]
kddr enable
librarysippolicy <string> default usergroup <string> [ action {permit|restricted|deny} ] [ additionaldisplay
message <string> ]
librarysippolicy <string> id <number> field <string> {equal|greaterthan|lessthan} <number> usergroup <string>
[ action {permit|restricted|deny} ] [ additionaldisplaymessage <string> ]
librarysippolicy <string> id <number> field <string> {matches|differsfrom|startswith|occursafter|occurs
before|contains} <string> usergroup <string> [ action {permit|restricted|deny} ] [ additionaldisplaymessage
<string> ]
librarysippolicy <string> id <number> {after|before} id <number>
license <string> <string>
lldp [ {cdp|receiveonly} ]
lldp [ {cdp} ] maxentries <number>
lldp holdtime <number>
lldp maxpower <number>
lldp timer <number>
load config {current|backup|bootstrap|default}
location aerohive enable
location aerohive listmatch enable
location aerohive mac <mac_addr>
location aerohive oui <oui>
location aerohive reportinterval <number>
location aerohive rssiholdtime <number>
location aerohive rssiupdatethreshold <number>
location aerohive rssivalidperiod <number>
location aerohive suppressreport <number>
location ratethreshold {tag|station|rogueap} <number>
location {aeroscout|tzsp} enable
location {aeroscout} server <string>
location {aeroscout} {tag|station|rogueap}
location {tzsp} mcastmac <mac_addr>
location {tzsp} serverconfig server <string> port <number>
logging buffered level {emergency|alert|critical|error|warning|notification|info|debug}
logging debug
logging facility {local0|local1|local2|local3|local4|local5|local6|local7|auth|authpriv|security|user}
logging flash level {emergency|alert|critical|error|warning|notification|info|debug}
logging server <string> [ level {emergency|alert|critical|error|warning|notification|info|debug} ] [ {viavpn
tunnel} ]
logging trap level [ {emerg|alert|crit|err|warning|notice|info} ]
login banner <string>
macobject <string> macrange <mac_addr> <mac_addr>
macpolicy <string> [ id <number> ] [ {before|after} id <number> ] [ from <mac_addr> [ <number> ] ] [ to
<mac_addr> [ <number> ] ] [ action {permit|deny} ]
<mac_addr> [ <number> ] ] action deny log packetdrop
<mac_addr> [ <number> ] ] action permit log [ {initiatesession|terminatesession} ]
mdmobject <string> [ enrollstatus {enrolled|nonenrolled|unknown} ] [ compliancestatus {compliant|non
compliant|unknown} ] [ clienttag <string> ]
mobiledevicepolicy <string> [ rule <number> ] [ originaluserprofile <string> ] devicegroup <string>
reassigneduserprofileattr <number>
mobiledevicepolicy <string> apply {once|multipletimes}
mobiledevicepolicy <string> clientclassification [ {mac} ] [ {domain} ] [ {os} ]
mobiledevicepolicy <string> rule <number> {before|after} rule <number>
mobilitypolicy <string> dnxp
mobilitypolicy <string> dnxp nomadicroaming
mobilitypolicy <string> dnxp unroamthreshold <number> <number>
mobilitypolicy <string> inxp gretunnel from <ip_addr/netmask> password <string>
mobilitypolicy <string> inxp gretunnel to <ip_addr> <ip_addr> password <string>
mobilitypolicy <string> inxp gretunnel to <ip_addr> password <string>
mobilitythreshold gretunnel permittedload {low|medium|high}
networkfirewall name <string> [ from {any|vpn} ] [ to {any|vpn} ] [ service <string> ] [ action {permit|deny} ]
logging {on|off}
networkfirewall name <string> [ from {any|vpn} ] to hostname <string> [ service <string> ] [ action {permit|deny}
] logging {on|off}
networkfirewall name <string> [ from {any|vpn} ] to iprange <ip_addr> <ip_addr> [ service <string> ] [ action
{permit|deny} ] logging {on|off}
networkfirewall name <string> [ from {any|vpn} ] to network <ip_addr> <mask> [ service <string> ] [ action
networkfirewall name <string> [ from {any|vpn} ] to wildcard <ip_addr> <mask> [ service <string> ] [ action
networkfirewall name <string> from iprange <ip_addr> <ip_addr> [ to {any|vpn} ] [ service <string> ] [ action
networkfirewall name <string> from iprange <ip_addr> <ip_addr> to hostname <string> [ service <string> ] [
action {permit|deny} ] logging {on|off}
networkfirewall name <string> from iprange <ip_addr> <ip_addr> to iprange <ip_addr> <ip_addr> [ service
<string> ] [ action {permit|deny} ] logging {on|off}
networkfirewall name <string> from iprange <ip_addr> <ip_addr> to network <ip_addr> <mask> [ service <string> ]
[ action {permit|deny} ] logging {on|off}
networkfirewall name <string> from iprange <ip_addr> <ip_addr> to wildcard <ip_addr> <mask> [ service <string> ]
networkfirewall name <string> from network <ip_addr> <mask> [ to {any|vpn} ] [ service <string> ] [ action
networkfirewall name <string> from network <ip_addr> <mask> to hostname <string> [ service <string> ] [ action
networkfirewall name <string> from network <ip_addr> <mask> to iprange <ip_addr> <ip_addr> [ service <string> ]
networkfirewall name <string> from network <ip_addr> <mask> to network <ip_addr> <mask> [ service <string> ] [
networkfirewall name <string> from network <ip_addr> <mask> to wildcard <ip_addr> <mask> [ service <string> ] [
networkfirewall name <string> from userprofile <string> [ to {any|vpn} ] [ service <string> ] [ action
networkfirewall name <string> from userprofile <string> to hostname <string> [ service <string> ] [ action
networkfirewall name <string> from userprofile <string> to iprange <ip_addr> <ip_addr> [ service <string> ] [
networkfirewall name <string> from userprofile <string> to network <ip_addr> <mask> [ service <string> ] [
networkfirewall name <string> from userprofile <string> to wildcard <ip_addr> <mask> [ service <string> ] [
networkfirewall name <string> from wildcard <ip_addr> <mask> [ to {any|vpn} ] [ service <string> ] [ action
networkfirewall name <string> from wildcard <ip_addr> <mask> to hostname <string> [ service <string> ] [ action
networkfirewall name <string> from wildcard <ip_addr> <mask> to iprange <ip_addr> <ip_addr> [ service <string> ]
networkfirewall name <string> from wildcard <ip_addr> <mask> to network <ip_addr> <mask> [ service <string> ] [
networkfirewall name <string> from wildcard <ip_addr> <mask> to wildcard <ip_addr> <mask> [ service <string> ] [
ntp enable
ntp interval <number>
ntp server <string> [ {second|third|fourth} ] [ {viavpntunnel} ]
osdetection enable
osdetection method dhcpoption55
osdetection method useragent
osobject <string> osversion <string>
osversion <string> option55 <string>
performancesentinel notificationinterval <number>
ping <ip_addr> [ count <number> ] [ size <number> ] [ ttl <number> ] [ timeout <number> ]
ping <string> [ count <number> ] [ size <number> ] [ ttl <number> ] [ timeout <number> ]
ping6 <ipv6_addr> [ interface <string> ] [ count <number> ] [ size <number> ] [ ttl <number> ] [ timeout <number>
]
ping6 <string> [ interface <string> ] [ count <number> ] [ size <number> ] [ ttl <number> ] [ timeout <number> ]
probe <ip_addr|mac_addr> [ size <number> ] [ srcmac <mac_addr> ] [ waittime <number> ] [ ttl <number> ] [ count
<number> ]
probe portal [ size <number> ] [ srcmac <mac_addr> ] [ waittime <number> ] [ ttl <number> ] [ count <number> ]
qos airtime enable
qos airtime ratepreferenceweight {none|moderate|high}
qos classifiermap 80211e <number> <number>
qos classifiermap 8021p <number> <number>
qos classifiermap diffserv <number> <number>
qos classifiermap interface <ethx|aggx|redx> <number>
qos classifiermap oui <oui> [ qos <number> ] [ action {permit|deny|log} ] [ comment <string> ]
qos classifiermap service <string> [ qos <number> ] [ action {permit|deny|log} ]
qos classifiermap ssid <string> <number>
qos classifierprofile <string> [ {interface/ssidonly|8021p|80211e|diffserv|interface/ssid|mac|service} ]
qos enable
qos l3police interface <string> enable
qos l3police interface <string> maxdownloadbw <number>
qos l3police interface <string> maxuploadbw <number>
qos l3police voipdetecttimeout <number>
qos markermap 80211e <number> <number>
qos markermap 8021p <number> <number>
qos markermap 8021p <string> [ <number> <number> ]
qos markermap diffserv <number> <number>
qos markermap diffserv <string> [ <number> <number> ]
qos markerprofile <string> [ {8021p|80211e|diffserv} ]
qos policy <string> [ userprofile <number> <number> ] [ user <number> ] [ qos <number> {strict|wrr} <number>
<number> ]
quit
radio profile <string>
radio profile <string> acsp access channelautoselect timerange <time> <time> [ station <number> ]
radio profile <string> acsp allchannelsmodel enable
radio profile <string> acsp channelmodel 4channels [ <channel_g4> ]
radio profile <string> acsp channelmodel {3channels} [ <channel_g3> ]
radio profile <string> acsp interferenceswitch crcerrthreshold <number>
radio profile <string> acsp interferenceswitch iuthreshold <number>
radio profile <string> acsp interferenceswitch {enable|nostationenable|disable}
radio profile <string> acsp maxtxpower <number>
radio profile <string> ampdu
radio profile <string> amsdu
radio profile <string> backhaul failover [ triggertime <number> ] [ holdtime <number> ]
radio profile <string> bandsteering balanceband threshold <number>
radio profile <string> bandsteering enable
radio profile <string> bandsteering mode {balanceband|prefer5g|force5g}
radio profile <string> bandsteering prefer5g suppressionlimit <number>
radio profile <string> beaconperiod <number>
radio profile <string> benchmark phymode 11a rate {6|9|12|18|24|36|48|54} success <number> usage <number>
radio profile <string> benchmark phymode 11ac rate
{6|9|12|18|24|36|48|54|mcs0/1|mcs1/1|mcs2/1|mcs3/1|mcs4/1|mcs5/1|mcs6/1|mcs7/1|mcs8/1|mcs9/1|mcs0/2|mcs1/2|mcs2/2|mcs3/2|mc
success <number> usage <number>
radio profile <string> benchmark phymode 11b rate {1|2|5.5|11} success <number> usage <number>
radio profile <string> benchmark phymode 11g rate {1|2|5.5|11|6|9|12|18|24|36|48|54} success <number> usage
<number>
radio profile <string> benchmark phymode 11n rate
{6|9|12|18|24|36|48|54|mcs0|mcs1|mcs2|mcs3|mcs4|mcs5|mcs6|mcs7|mcs8|mcs9|mcs10|mcs11|mcs12|mcs13|mcs14|mcs15|mcs16|mcs17|mc
radio profile <string> channelwidth {20|40|40above|40below|80}
radio profile <string> clientloadbalance crcerrorlimit <number>
radio profile <string> clientloadbalance enable
radio profile <string> clientloadbalance holdtime <number>
radio profile <string> clientloadbalance interferencelimit <number>
radio profile <string> clientloadbalance mode {airtime|stanum}
radio profile <string> clientloadbalance neighborloadqueryinterval <number>
radio profile <string> clientloadbalance staminiairtime <number>
radio profile <string> denyclient {11b|11abg}
radio profile <string> detectbssidspoofing
radio profile <string> dfs
radio profile <string> dfs radardetectonly
radio profile <string> frameburst
radio profile <string> highdensity broadcastprobesuppress oui <oui>
radio profile <string> highdensity continuousprobesuppress enable
radio profile <string> highdensity enable
radio profile <string> highdensity mgmtframetxrate {low|high}
radio profile <string> interferencemap crcerrthreshold <number>
radio profile <string> interferencemap cuthreshold <number>
radio profile <string> interferencemap enable
radio profile <string> interferencemap shortterminterval <number>
radio profile <string> maxclient <number>
radio profile <string> phymode {11a|11b/g|11na|11ng|11ac}
radio profile <string> presence aggrinterval <number>
radio profile <string> presence agingtime <number>
radio profile <string> presence enable
radio profile <string> presence trapinterval <number>
radio profile <string> primarychanneloffset {auto|0|1|2|3}
radio profile <string> receivechain <number>
radio profile <string> safetynet enable
radio profile <string> safetynet timeout <number>
radio profile <string> scan access
radio profile <string> scan access client
radio profile <string> scan access client powersave
radio profile <string> scan access interval <number>
radio profile <string> scan access voice
radio profile <string> sensor channellist <string>
radio profile <string> sensor dwelltime <number>
radio profile <string> shortguardinterval
radio profile <string> shortpreamble
radio profile <string> transmitchain <number>
radio profile <string> txbeamforming [ {explicitonly|auto} ]
radio profile <string> txrate vhtmcs
{MCS0/1|MCS1/1|MCS2/1|MCS3/1|MCS4/1|MCS5/1|MCS6/1|MCS7/1|MCS8/1|MCS9/1|MCS0/2|MCS1/2|MCS2/2|MCS3/2|MCS4/2|MCS5/2|MCS6/2|MCS
radio profile <string> txrate
{auto|1Mbps|2Mbps|5.5Mbps|6Mbps|9Mbps|11Mbps|12Mbps|18Mbps|24Mbps|36Mbps|48Mbps|54Mbps|MCS0|MCS1|MCS2|MCS3|MCS4|MCS5|MCS6|M
radio profile <string> vht2g
radio profile <string> weaksnrsuppress enable
radio profile <string> weaksnrsuppress threshold <number>
radio profile <string> wmm ac {background|besteffort|video|voice} aifs <number>
radio profile <string> wmm ac {background|besteffort|video|voice} cwmax <number>
radio profile <string> wmm ac {background|besteffort|video|voice} cwmin <number>
radio profile <string> wmm ac {background|besteffort|video|voice} noack
radio profile <string> wmm ac {background|besteffort|video|voice} txoplimit <number>
reboot
reboot date <date> time <time>
reboot offset <time>
reboot {backup|current}
reboot {backup|current} date <date> time <time>
reboot {backup|current} offset <time>
report statistic alarmthreshold client {txdroprate|rxdroprate|txretryrate|airtimeconsumption} <number>
report statistic alarmthreshold interface {crcerrorrate|txdroprate|rxdroprate|txretryrate|airtime
consumption} <number>
report statistic enable
report statistic period <number>
reset config [ {bootstrap} ]
reset webdirectory [ <string> [ {savetoflash} ] ]
reset webdirectory allrunningssid
resetbutton resetconfigenable
roaming cache updateinterval <number> ageout <number>
roaming cachebroadcast neighbortype access enable
roaming cachebroadcast neighbortype backhaul enable
roaming hop <number>
roaming neighbor exclude ip <ip_addr>
roaming neighbor include ip <ip_addr> <netmask>
roaming neighbor queryinterval <number> querytimes <number>
roaming port <number>
route <mac_addr> outgoinginterface <string> nexthop <mac_addr>
routing internalsubnetwork <ip_addr/netmask> [ {tunneldistonly} ]
routing matchmap <string> from {any} to {any|private}
routing matchmap <string> from {any} to {hostname} <string>
routing matchmap <string> from {any} to {iprange} <ip_addr> <ip_addr>
routing matchmap <string> from {any} to {network} <ip_addr/netmask>
routing matchmap <string> from {iprange} <ip_addr> <ip_addr> to {any|private}
routing matchmap <string> from {iprange} <ip_addr> <ip_addr> to {hostname} <string>
routing matchmap <string> from {iprange} <ip_addr> <ip_addr> to {iprange} <ip_addr> <ip_addr>
routing matchmap <string> from {iprange} <ip_addr> <ip_addr> to {network} <ip_addr/netmask>
routing matchmap <string> from {network} <ip_addr/netmask> to {any|private}
routing matchmap <string> from {network} <ip_addr/netmask> to {hostname} <string>
routing matchmap <string> from {network} <ip_addr/netmask> to {iprange} <ip_addr> <ip_addr>
routing matchmap <string> from {network} <ip_addr/netmask> to {network} <ip_addr/netmask>
routing matchmap <string> {iif} <ethx> to {any|private}
routing matchmap <string> {iif} <ethx> to {hostname} <string>
routing matchmap <string> {iif} <ethx> to {iprange} <ip_addr> <ip_addr>
routing matchmap <string> {iif} <ethx> to {network} <ip_addr/netmask>
routing matchmap <string> {userprofile} <string> to {any|private}
routing matchmap <string> {userprofile} <string> to {hostname} <string>
routing matchmap <string> {userprofile} <string> to {iprange} <ip_addr> <ip_addr>
routing matchmap <string> {userprofile} <string> to {network} <ip_addr/netmask>
routing policy <string> id <number> matchmap <string> routemap <string>
routing routemap <string> via <ethx|usbnetx|wifix>
routing routemap <string> via {encrypted|blackhole}
routing routerequest enable
routing routerequest interval <number>
save ble ibeacon firmware
save config <location> bootstrap
save config <location> current
save config <location> current <time> [ <date> ]
save config <location> current now
save config <location> current offset <time>
save config <url> bootstrap [ admin <string> password <string> {basic|digest} ] [ proxy <string> [ proxyadmin
<string> password <string> ] ]
save config <url> current <time> [ <date> ] [ admin <string> password <string> {basic|digest} ] [ proxy <string> [
proxyadmin <string> password <string> ] ]
save config <url> current [ {now} ] [ admin <string> password <string> {basic|digest} ] [ proxy <string> [ proxy
admin <string> password <string> ] ]
save config <url> current offset <time> [ admin <string> password <string> {basic|digest} ] [ proxy <string> [
save config [ running current ]
save config bootstrap <location>
save config current <location>
save config current bootstrap
save config running bootstrap
save config users [ bootstrap ]
save config {current|bootstrap} <url> [ admin <string> password <string> {basic|digest} ] [ proxy <string> [
save dhcpfingerprint {option55} <location>
save dhcpfingerprint {option55} <url> [ admin <string> password <string> {basic|digest} ] [ proxy <string> [
save image <location> <time> [ <date> ] [ limit <number> ]
save image <location> [ {now} ] [ limit <number> ]
save image <location> offset <time> [ limit <number> ]
save image <url> <time> [ <date> ] [ admin <string> password <string> {basic|digest} ] [ proxy <string> [ proxy
save image <url> [ {now} ] [ admin <string> password <string> {basic|digest} ] [ proxy <string> [ proxyadmin
save image <url> offset <time> [ admin <string> password <string> {basic|digest} ] [ proxy <string> [ proxyadmin
save radiusserverkey radsec {cert|ca} <location>
save radiusserverkey radsec {cert|ca} <url> [ admin <string> password <string> {basic|digest} ] [ proxy <string>
[ proxyadmin <string> password <string> ] ]
save radiusserverkey {radiusserver|ldapclient} <location>
save radiusserverkey {radiusserver|ldapclient} <url> [ admin <string> password <string> {basic|digest} ] [
proxy <string> [ proxyadmin <string> password <string> ] ]
save serverfiles
save signaturefile <location> [ limit <number> ]
save signaturefile <url> [ admin <string> password <string> {basic|digest} ] [ proxy <string> [ proxyadmin
save ssid <string> macbind <location>
save supplicant certfile <location>
save supplicant certfile <url> [ admin <string> password <string> {basic|digest} ] [ proxy <string> [ proxyadmin
save users <location>
save users <url> [ admin <string> password <string> {basic|digest} ] [ proxy <string> [ proxyadmin <string>
password <string> ] ]
save vpn {cacert|eecert|privatekey} <url> [ admin <string> password <string> {basic|digest} ] [ proxy <string>
[ proxyadmin <string> password <string> ] ]
save vpn {eecert|privatekey|cacert} <location>
save webpage [ ppskselfreg ] webdirectory <string> <location>
save webpage [ ppskselfreg ] webdirectory <string> <url> [ admin <string> password <string> {basic|digest} ] [
save webserverkey <number> <location> [ comment <string> ]
save webserverkey <number> <url> [ comment <string> ] [ admin <string> password <string> {basic|digest} ] [
save {capture} local <string> <location>
save {capture} local <string> <url> [ admin <string> password <string> {basic|digest} ] [ proxy <string> [ proxy
schedule <string> once <date> <time> to <date> <time> [ timezone <number> ] [ comment <string> ]
schedule <string> ppsk once <date> <time> to <date> <time> [ timezone <number> ] [ comment <string> ]
schedule <string> ppsk recurrent [ daterange <date> [ to <date> ] ] [ weekday <string> ] timerange <time> to
<time> [ timerange <time> to <time> ] [ timezone <number> ] [ comment <string> ]
schedule <string> recurrent [ daterange <date> [ to <date> ] ] [ weekdayrange
{Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday} [ to
{Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday} ] ] timerange <time> to <time> [ timerange <time> to
<time> ] [ timezone <number> ] [ comment <string> ]
security macfilter <string> address <mac_addr> {permit|deny} [ comment <string> ]
security macfilter <string> default {permit|deny}
security macfilter <string> oui <oui> {permit|deny} [ comment <string> ]
security wlanidp profile <string>
security wlanidp profile <string> adhoc
security wlanidp profile <string> apdetection clientmacinnet
security wlanidp profile <string> apdetection connected
security wlanidp profile <string> appolicy
security wlanidp profile <string> appolicy apoui
security wlanidp profile <string> appolicy apoui entry <oui>
security wlanidp profile <string> appolicy shortbeacon
security wlanidp profile <string> appolicy shortpreamble
security wlanidp profile <string> appolicy ssid
security wlanidp profile <string> appolicy ssid entry <string>
security wlanidp profile <string> appolicy ssid entry <string> encryption
security wlanidp profile <string> appolicy ssid entry <string> encryption {open|wep|wpa}
security wlanidp profile <string> appolicy wmm
security wlanidp profile <string> mitigate deauthtime <number>
security wlanidp profile <string> mitigate duration <number> quiettime <number>
security wlanidp profile <string> mitigate period <number>
security wlanidp profile <string> stareport
security wlanidp profile <string> stareport agetime <number>
securityobject <string>
securityobject <string> defaultuserprofileattr <number>
securityobject <string> dhcpserver leasetime <number>
securityobject <string> dhcpserver renewalresponse {renewnakunicast|keepsilent}
securityobject <string> mobiledevicepolicy <string>
securityobject <string> ppskwebserver authuser
securityobject <string> ppskwebserver bindtoppskssid <string>
securityobject <string> ppskwebserver https
securityobject <string> ppskwebserver loginpage <string>
securityobject <string> ppskwebserver loginscript <string>
securityobject <string> ppskwebserver webdirectory <string>
securityobject <string> security aaa radiusserver [ firstretryinterval <number> ] [ maxretries <number> ]
securityobject <string> security aaa radiusserver accountinteriminterval <number>
securityobject <string> security aaa radiusserver accounting {primary|backup1|backup2|backup3} <ip_addr|string>
[ sharedsecret <string> ] [ acctport <number> ] [ viavpntunnel ]
securityobject <string> security aaa radiusserver dynamicauthextension
securityobject <string> security aaa radiusserver idm [ pri ]
securityobject <string> security aaa radiusserver inject OperatorName
securityobject <string> security aaa radiusserver msgauthallmessages
securityobject <string> security aaa radiusserver retryinterval <number>
securityobject <string> security aaa radiusserver {primary|backup1|backup2|backup3} <ip_addr|string> [ shared
secret <string> ] [ authport <number> ] [ acctport <number> ] [ viavpntunnel ]
securityobject <string> security aaa userprofilemapping attributeid <number>
securityobject <string> security aaa userprofilemapping enable
securityobject <string> security aaa userprofilemapping vendorid <number> attributeid <number>
securityobject <string> security additionalauthmethod captivewebportal [ reguserprofileattr <number> ] [
authuserprofileattr <number> ] [ timeout <number> ] [ timerdisplay ]
securityobject <string> security additionalauthmethod captivewebportal anonymousaccess
securityobject <string> security additionalauthmethod captivewebportal authmethod [ {pap|chap|mschapv2} ]
securityobject <string> security additionalauthmethod captivewebportal checkusepolicy
securityobject <string> security additionalauthmethod captivewebportal cloudcwp apikey <string> apinonce
<string>
securityobject <string> security additionalauthmethod captivewebportal cloudcwp customerid <string>
securityobject <string> security additionalauthmethod captivewebportal cloudcwp enable
securityobject <string> security additionalauthmethod captivewebportal cloudcwp serviceid <number>
securityobject <string> security additionalauthmethod captivewebportal cloudcwp urlrootpath <string>
securityobject <string> security additionalauthmethod captivewebportal defaultlanguage {chinese
simple|chinesetraditional|dutch|english|french|german|italian|korean|spanish}
securityobject <string> security additionalauthmethod captivewebportal externalserver {primary} loginpage
<string>
securityobject <string> security additionalauthmethod captivewebportal externalserver {primary} password
encryption uambasic
securityobject <string> security additionalauthmethod captivewebportal externalserver {primary} password
encryption uamshared <string>
securityobject <string> security additionalauthmethod captivewebportal externalserver {primary} {success
register|noroamingatlogin|noradiusauth}
securityobject <string> security additionalauthmethod captivewebportal failureredirect externalpage
<string> [ delay <number> ]
securityobject <string> security additionalauthmethod captivewebportal failureredirect loginpage [ delay
<number> ]
securityobject <string> security additionalauthmethod captivewebportal internalpages {nosuccesspage|no
failurepage}
securityobject <string> security additionalauthmethod captivewebportal internalservers
securityobject <string> security additionalauthmethod captivewebportal loginpagemethod http302
securityobject <string> security additionalauthmethod captivewebportal passthrough vlan <number>
securityobject <string> security additionalauthmethod captivewebportal processsipinfo
securityobject <string> security additionalauthmethod captivewebportal processsipinfo blockredirect
<string>
securityobject <string> security additionalauthmethod captivewebportal reportguestinfo
securityobject <string> security additionalauthmethod captivewebportal selfregviaidm
securityobject <string> security additionalauthmethod captivewebportal selfregviaidm api <string>
securityobject <string> security additionalauthmethod captivewebportal selfregviaidm crlfile <string>
securityobject <string> security additionalauthmethod captivewebportal servername <string>
securityobject <string> security additionalauthmethod captivewebportal servername certdn
securityobject <string> security additionalauthmethod captivewebportal successredirect externalpage
<string> [ delay <number> ]
securityobject <string> security additionalauthmethod captivewebportal successredirect originalpage [ delay
<number> ]
securityobject <string> security additionalauthmethod captivewebportal timerdisplay alert <number>
securityobject <string> security additionalauthmethod macbasedauth [ {authmethod} {pap|chap|mschapv2} ]
securityobject <string> security additionalauthmethod macbasedauth callcheck
securityobject <string> security additionalauthmethod macbasedauth fallbacktoecwp
securityobject <string> security additionalauthmethod mobiledevicemanager aerohive apikey <string> api
instanceid <string>
securityobject <string> security additionalauthmethod mobiledevicemanager aerohive onboard accessssid
<string>
securityobject <string> security additionalauthmethod mobiledevicemanager airwatch apikey <string>
securityobject <string> security additionalauthmethod mobiledevicemanager airwatch noncompliant disconnect
forvlanchange
securityobject <string> security additionalauthmethod mobiledevicemanager airwatch noncompliant guestupid
<number>
securityobject <string> security additionalauthmethod mobiledevicemanager airwatch noncompliant sendmessage
content <string>
title <string>
type {email|sms|push|all}
securityobject <string> security additionalauthmethod mobiledevicemanager airwatch urlenrollment <url>
securityobject <string> security additionalauthmethod mobiledevicemanager airwatch urlrestapi <url>
securityobject <string> security additionalauthmethod mobiledevicemanager {jss|aerohive} urlrootpath <url>
securityobject <string> security additionalauthmethod mobiledevicemanager {jss|airwatch|aerohive} enable
securityobject <string> security additionalauthmethod mobiledevicemanager {jss|airwatch|aerohive} osobject
<string> [ {ios|macos} ]
securityobject <string> security additionalauthmethod mobiledevicemanager {jss|airwatch} httpauth user
<string> password <string>
securityobject <string> security additionalauthmethod mobiledevicemanager {jss|airwatch} pollstatus [
interval <number> ]
securityobject <string> security authmode hostbased
securityobject <string> security authmode {portbased} [ failureuserprofileattr <number> ]
securityobject <string> security eap retries <number>
securityobject <string> security eap timeout <number>
securityobject <string> security ft
securityobject <string> security ft mobilitydomainid <number>
securityobject <string> security initialauthmethod macbasedauth
securityobject <string> security localcache timeout <number>
securityobject <string> security macwhitelist bypasscwp
securityobject <string> security macwhitelist macobject <string>
securityobject <string> security preauth [ interface <ethx|wifix.y|redx|aggx> ]
securityobject <string> security privatepsk
securityobject <string> security privatepsk defaultpskdisabled
securityobject <string> security privatepsk externalserver [ {webportal} ]
securityobject <string> security privatepsk macbindingenable
securityobject <string> security privatepsk macbindingkeyspermac <number>
securityobject <string> security privatepsk macbindingmacsperkey <number>
securityobject <string> security privatepsk ppskserver <ip_addr>
securityobject <string> security privatepsk radiusauth [ {pap|chap|mschapv2} ]
securityobject <string> security privatepsk sameuserlimit <number>
securityobject <string> security privatepsk selfregenable
securityobject <string> security protocolsuite 802.1x
securityobject <string> security protocolsuite open
securityobject <string> security protocolsuite wepopen <number> {hexkey|asciikey} <string> [ default ]
securityobject <string> security protocolsuite wepshared <number> {hexkey|asciikey} <string> [ default ]
securityobject <string> security protocolsuite wep1048021x [ rekeyperiod <number> ]
securityobject <string> security protocolsuite wpaauto8021x [ rekeyperiod <number> ] [ {nonstrict|strict} ]
[ gmkrekeyperiod <number> ] [ ptktimeout <number> ] [ ptkretry <number> ] [ gtktimeout <number> ] [ gtkretry
<number> ] [ roaming proactivepmkidresponse ] [ ptkrekeyperiod <number> ]
securityobject <string> security protocolsuite wpaautopsk {hexkey|asciikey} <string> [ rekeyperiod <number>
] [ {nonstrict|strict} ] [ gmkrekeyperiod <number> ] [ ptktimeout <number> ] [ ptkretry <number> ] [ gtk
timeout <number> ] [ gtkretry <number> ] [ ptkrekeyperiod <number> ]
securityobject <string> security protocolsuite wpa2aes8021x [ rekeyperiod <number> ] [ {nonstrict|strict} ]
securityobject <string> security protocolsuite wpa2aespsk {hexkey|asciikey} <string> [ rekeyperiod <number>
] [ {nonstrict|strict} ] [ gmkrekeyperiod <number> ] [ ptktimeout <number> ] [ ptkretry <number> ] [ gtk
timeout <number> ] [ gtkretry <number> ] [ ptkrekeyperiod <number> ]
securityobject <string> security protocolsuite wpa2tkip8021x [ rekeyperiod <number> ] [ {nonstrict|strict} ]
securityobject <string> security protocolsuite wpa2tkippsk {hexkey|asciikey} <string> [ rekeyperiod
<number> ] [ {nonstrict|strict} ] [ gmkrekeyperiod <number> ] [ ptktimeout <number> ] [ ptkretry <number> ] [
gtktimeout <number> ] [ gtkretry <number> ] [ ptkrekeyperiod <number> ]
securityobject <string> security protocolsuite {wpaauto8021x[wpa2tkip8021x[wpa2aes8021x} reauthinterval
<number>
securityobject <string> security protocolsuite {wpaauto8021x[wpa2tkip8021x|wpaautopsk[wpa2tkippsk[wpa2
aespsk[wpa2aes8021x} replaywindow <number>
securityobject <string> security protocolsuite {wpaauto8021x[wpa2tkip8021x|wpaautopsk[wpa2tkippsk}
localtkipcountermeasure
securityobject <string> security protocolsuite {wpaauto8021x[wpa2tkip8021x|wpaautopsk[wpa2tkippsk}
remotetkipcountermeasure
securityobject <string> security protocolsuite {wpa2aespsk|wpa2aes8021x} mfp {mandatory|optional} [ bip ]
securityobject <string> security roaming cache updateinterval <number> ageout <number>
securityobject <string> userprofileallowed <string>
securityobject <string> userprofileallowed {all}
securityobject <string> userprofiledeny action ban [ <number> ] [ strict ]
securityobject <string> userprofiledeny action {banforever|disconnect} [ strict ]
securityobject <string> userprofilepolicy <string>
securityobject <string> userprofilesequence {cwpssidmac|cwpmacssid|ssidcwpmac|ssidmaccwp|macssid
cwp|maccwpssid}
securityobject <string> walledgarden hostname <string> [ service {all|web} ]
securityobject <string> walledgarden hostname <string> service protocol <number> port <number>
securityobject <string> walledgarden ipaddress <ip_addr|ip_addr/mask> [ service {all|web} ]
securityobject <string> walledgarden ipaddress <ip_addr|ip_addr/mask> service protocol <number> port <number>
securityobject <string> webdirectory <string>
securityobject <string> webserver [ port <number> ] [ indexfile <string> ] [ successfile <string> ] [ failure
file <string> ] [ ssl serverkey <number> ]
securityobject <string> webserver webpage {mandatoryfield} <number> [ optionalfield <number> ]
service <string> alg {ftp|tftp|sip|dns|http}
service <string> appid <number> [ timeout <number> ]
service <string> protocol <number> [ port <number> ] [ timeout <number> ]
service <string> protocol {tcp|udp|svp} [ port <number> ] [ timeout <number> ]
sflow enable
sflow instance <string> interface <ethx|wifix> collectoraddr <ip_addr> [ collectorport <number> ] [ sampling
rate <number> ] [ pollinginterval <number> ] [ direction {ingress|egress|both} ]
show 802.1xmactable [ interface <ethx> ] [ mac <mac_addr> ]
show aaa
show aaa radiusserver
show aaa radiusserver NAS [ <string> ]
show aaa radiusserver activesession [ username <string> ]
show aaa radiusserver cache
show aaa radiusserver domain
show aaa radiusserver proxy [ server ]
show aaa radiusserverkey {radiusserver|ldapclient}
show accessconsole
show acsp
show acsp channelinfo [ {detail|arbiter} ]
show acsp neighbor
show admin [ active ]
show admin auth
show admin managerip
show alg [ {ftp|tftp|sip|dns|http} ]
show alg sip calls [ <string> ]
show amrp
show amrp Ethlink
show amrp Ethlink <mac_addr>
show amrp bonjour [ <ip_addr> ]
show amrp client [ <mac_addr> ]
show amrp dnxp cache [ <mac_addr> ]
show amrp dnxp neighbor [ <mac_addr> ]
show amrp interface
show amrp interface <ethx|redx|aggx> bmttable
show amrp interface <ethx|redx|aggx> maclearning
show amrp interface <ethx|redx|aggx|mgtx|wifix.y>
show amrp neighbor [ {Ethernet|WiFi} ]
show amrp node <ip_addr|mac_addr>
show amrp node [ all ]
show amrp staticneighbor
show amrp tunnel [ <ip_addr> ]
show amrp tunnel route [ <ip_addr> ]
show application identification [ cdpindex <number> ] [ cdpname <string> ]
show application reporting appstats
show application reporting applications
show application reporting configuration
show application reporting statistics
show arpcache
show auth [ interface <wifix.y|ethx> ]
show auth macbinding <string> [ <mac_addr> ] [ <string> ]
show auth privatepsk
show bandsteering status
show bonjourgateway filter
show bonjourgateway service local [ vlan <number> ] [ detail ]
show bonjourgateway service remote [ vlan <number> ] [ detail ]
show bonjourgateway status
show bonjourgateway vlan
show bootparam
show bootparam countrycode
show cac summary
show capture interface <wifix>
show capture local
show capture remotesniffer
show capwap client
show clientinfocollection [ ip <ip_addr> ]
show clientloadbalance status
show clientmonitor info
show clientmonitor policy [ <string> ]
show clock
show cmds
show config rollback
show config running
show config running password
show config version
show config {current|backup|bootstrap|default|failed}
show console
show cpu [ {detail} ]
show datacollection
show devicegroup [ <string> ]
show dns
show dns dynamicdns
show domainobject [ <string> ]
show filter [ <number> ]
show forwardingengine counters [ interface <wifix|wifix.y|ethx|mgtx|aggx|redx> ] [ station <mac_addr> ] [ drop ]
show forwardingengine interssidflood
show forwardingengine ipgates
show forwardingengine ipsessions [ srcip <ip_addr> ] [ dstip <ip_addr> ] [ srcport <number> ] [ dstport
<number> ] [ protocol <number> ] [ qos <number> ]
show forwardingengine ipsessions id <number>
show forwardingengine macsessions [ srcmac <mac_addr> ] [ dstmac <mac_addr> ] [ vlan <number> ]
show forwardingengine macsessions id <number>
show forwardingengine maxipsessperstation
show forwardingengine maxmacsessperstation
show forwardingengine openportstoself
show forwardingengine policy
show forwardingengine staticrule
show forwardingengine tunnel selectivemulticastforward
show forwardingengine tunnel tcpmssthreshold
show gretunnel
show highdensity status
show history
show hive <string> connectingthreshold
show hive <string> counter neighbor [ <mac_addr> ]
show hive <string> manage
show hive <string> neighbor [ mac <mac_addr> ]
show hive <string> security wlan dos
show hive [ <string> ]
show hivemanager
show hiveui cas client
show hwinfo
show icsa
show idm
show interface <blex> ibeacon
show interface <blex> ibeaconmonitor list
show interface <ethx> defaultroutevlan
show interface <ethx> pppoe
show interface <ethx|aggx|redx> allowedvlan
show interface <ethx|aggx|redx> maclearning {static|dynamic|all}
show interface <ethx|aggx|redx> manage
show interface <ethx|aggx|redx> qosclassifier
show interface <ethx|aggx|redx> qosmarker
show interface <ethx|aggx|redx> ratelimit
show interface <mgtx.y> manage
show interface <mgtx> dhcp keepalive
show interface <mgtx> dhcpprobe resultssummary
show interface <mgtx> ipv6 dhcp client
show interface <mgtx|ethx|bgdx.y|usbnetx|wifix.y> dhcp client
show interface <mgtx|mgtx.y> dhcpserver [ detail ]
show interface <mgtx|mgtx.y> dhcpserver ipbinding
show interface <mgtx|mgtx.y> dhcpserver reservedaddress
show interface <mgtx|mgtx.y> iphelper
show interface <mgtx|mgtx.y> iphelper maxhops
show interface <wifix.y> multicast
show interface <wifix> channel
show interface <wifix> dfs
show interface <wifix> multicast
show interface <wifix> wlanidp apinfo
show interface <wifix> wlanidp apinfo compliance {compliant|noncompliant}
show interface <wifix> wlanidp apinfo type {rogue|valid|external}
show interface <wifix> wlanidp clientinfo
show interface <wifix> wlanidp mitigate rogueap [ <mac_addr> ]
show interface <wifix|wifix.y> counter
show interface [ <ethx|mgtx|mgtx.y|wifix|wifix.y|redx|aggx|tunnelx|bgdx.y> ]
show ip natpolicy
show ip natpolicy <string>
show ip natpolicy serviceportlist
show ip pathmtudiscovery
show ip policyroute [ {l3tunnelall|l3tunnelexception|l3tunnelsplit|l3tunneldrop} ]
show ip route
show ip session natpolicy
show ip session natpolicy <string>
show ip tcpmssthreshold
show ippolicy
show ippolicy <string>
show ippolicy userprofile <number|string> [ {fromaccess|toaccess} ] [ from <ip_addr|string> <mask> ] [ to
<ip_addr|string> <mask> ] [ service <string> ] [ action {permit|deny|interstationtrafficdrop} ] [ lines
<number> ]
show ipv6 route
show l3 interface [ ipv6 ]
show librarysippolicy [ <string> ]
show license
show lldp [ {cdp} ] [ {neighbor} ]
show location [ {aeroscout|tzsp} ]
show location aerohive
show location aerohive list
show location aerohive rssi
show location aerohive rssi mac <mac_addr>
show location aerohive rssi oui <oui>
show location {aeroscout|tzsp} counter
show logging
show logging {buffered|flash|debug} [ level {emergency|alert|critical|error|warning|notification|info|debug} ] [
tail <number> ] [ date <date> ] [ time <time> ]
show macobject [ <string> ]
show macpolicy
show macpolicy <string> [ from <mac_addr> [ <number> ] ] [ to <mac_addr> [ <number> ] ] [ action {permit|deny} ]
[ lines <number> ]
show macpolicy userprofile <number|string> [ {fromaccess|toaccess} ] [ from <mac_addr> [ <number> ] ] [ to
<mac_addr> [ <number> ] ] [ action {permit|deny} ] [ lines <number> ]
show mdnsd [ {cache|authrecord|duplicaterecord|authrecordproxied|duplicaterecordproxied|activeclient
requests|interface|questions|memory|others} ]
show mdnsd counter [ vlan <number> ]
show memory [ {detail} ]
show minpasswordlength
show mobiledevicepolicy [ <string> ]
show mobilitypolicy [ <string> ]
show mobilitythreshold gretunnel permittedload
show networkfirewall
show ntp
show osdetection [ {option55toosdatabase|dhcpfingerprintversion} ]
show osobject [ <string> ]
show performancesentinel
show ppsk schedule [ <string> ]
show proxy
show qos
show qos classifiermap 80211e [ <number> ]
show qos classifiermap 8021p [ <number> ]
show qos classifiermap diffserv [ <number> ]
show qos classifiermap interface <ethx|aggx|redx>
show qos classifiermap oui [ <oui> ]
show qos classifiermap service [ <string> ]
show qos classifiermap ssid <string>
show qos classifierprofile [ <string> ]
show qos counter user [ <mac_addr> ]
show qos counter userprofile [ <string> ]
show qos l3police [ detail ]
show qos l3police interface <string> [ detail ]
show qos l3police statistics [ detail ]
show qos l3police statistics interface <string> [ detail ]
show qos markermap 80211e [ <number> ]
show qos markermap 8021p [ <number> ]
show qos markermap diffserv [ <number> ]
show qos markermap {diffserv|8021p} <string>
show qos markerprofile [ <string> ]
show qos policy [ <string> ]
show radio profile [ <string> ]
show reboot schedule
show report statistic
show resetbutton
show roaming cache
show roaming cache mac <mac_addr>
show roaming neighbor [ mac <mac_addr> ] [ ip <ip_addr> ]
show route
show routing internalsubnetwork
show routing policy
show routing policy <string>
show routing policy <string> route
show routing routerequest
show routing {matchmap|routemap} [ <string> ]
show runningconfig
show runningconfig password
show runningconfig users [ password ] [ all ]
show runningconfig xauthclients [ password ]
show schedule [ <string> ]
show scheduleindetail
show security macfilter [ <string> ]
show security protocolsuite
show securityobject <string> dhcpserver
show securityobject <string> dnsserver
show securityobject <string> mobiledevicemanager {jss|airwatch|aerohive}
show securityobject <string> mobiledevicepolicy
show securityobject <string> security aaa
show securityobject <string> security macwhitelist
show securityobject <string> security protocolsuite
show securityobject <string> walledgarden
show securityobject <string> webserver
show securityobject [ <string> ]
show service [ <string> ]
show service [ <string> ] counter
show sflow
show sflow instance [ <string> ]
show snmp [ {v3admin} ]
show snmp community [ {readonly} ]
show snmp contact
show snmp location
show snmp traphost
show sshtunnel
show ssid <string> admctl tsinfo [ sta <mac_addr> ]
show ssid <string> counter station [ <mac_addr> ]
show ssid <string> manage
show ssid <string> multicast
show ssid <string> qosclassifier
show ssid <string> qosmarker
show ssid <string> schedule [ detail ]
show ssid <string> security screening [ detail ]
show ssid <string> security wlan dos
show ssid <string> station [ mac <mac_addr> ]
show ssid <string> station ipv6
show ssid <string> usergroup
show ssid [ <string> ]
show ssidschedule
show station [ <mac_addr> ]
show station [ <mac_addr> ] counter
show station ipv6
show supplicant certfile [ <string> ]
show supplicant name [ <string> ]
show system
show system connectiontrap delay
show system diskinfo
show system led
show system power mode
show system power status
show system processes [ state ]
show system temperature
show teacherview resourcemap
show tech
show tech <url> [ admin <string> password <string> {basic|digest} ] [ proxy <string> [ proxyadmin <string>
password <string> ] ]
show timezone
show track [ <string> ]
show trackwan
show usbdevice
show usbmodem [ modemid <string> ]
show usbmodem descriptor
show usbmodem info
show usbmodem modeswitch
show usbmodem networkmode
show usbmodem networkservice
show usbmodem rssi
show usbmodem siminfo
show usbmodem status
show user
show usergroup <string> pskdigest [ <string> ]
show usergroup [ <string> ]
show userprofile <string> cac airtimepercentage
show userprofile <string> schedule [ detail ]
show userprofile [ <string> ]
show userprofilepolicy [ <string> ]
show userprofileschedule
show version [ {detail} ]
show video ip <ip_addr> <number>
show video ip <ip_addr> dstportrange <number> <number>
show vlangroup
show vpn gretunnel
show vpn ike configuration
show vpn ike {sa|event}
show vpn ike {sp}
show vpn ipsec sa
show vpn ipsectunnel
show vpn l3tunnelexception
show vpn layer3tunnel
show vpn tunnelid [ <number> ]
show vpn tunnelpolicy
show vpn {socket|timer|memory|queue|ph2|sp|rekey}
show wan db
show wan failover
show wan interface
show wan interface <ethx|usbnetx|wifix|tunnelx>
show webdirectory [ ppskselfreg ] [ <string> ]
show websecurityproxy {websensev1|barracudav1}
show webserverkey
show wlanidp mitigate [ <mac_addr> ]
show wlanidp profile [ <string> ]
snmp contact <string>
snmp location <string>
snmp reader version v3 admin <string> [ auth {md5|sha} password <string> ] [ encryption {aes|des} password
<string> ]
snmp reader version {v1|v2c|any} community <string> [ <string> ]
snmp traphost {v1|v2c} <ip_addr|string> [ port <number> ] [ {viavpntunnel} ] [ community <string> ]
snmp traphost {v3} <ip_addr|string> [ port <number> ] [ {viavpntunnel} ] admin <string>
snmp traphost {v3} admin <string> auth {md5|sha} password <string> [ encryption {aes|des} password <string> ]
snmp trapinfo {oversnmp|overcapwap}
sshtunnel server <string> tunnelport <number> user <string> password <string> [ timeout <number> ]
ssid <string>
ssid <string> 11arateset [ {6|6basic} ] [ {9|9basic} ] [ {12|12basic} ] [ {18|18basic} ] [ {24|24basic} ] [
{36|36basic} ] [ {48|48basic} ] [ {54|54basic} ]
ssid <string> 11acmcsrateset <string>
ssid <string> 11grateset [ {1|1basic} ] [ {2|2basic} ] [ {5.5|5.5basic} ] [ {11|11basic} ] [ {6|6basic} ] [
{9|9basic} ] [ {12|12basic} ] [ {18|18basic} ] [ {24|24basic} ] [ {36|36basic} ] [ {48|48basic} ] [ {54|54
basic} ]
ssid <string> 11nmcsexpandrateset <string>
ssid <string> admctl ac <number> enable
ssid <string> admctl delts sta <mac_addr> tid <number>
ssid <string> blocktowifimcast
ssid <string> clientageout <number>
ssid <string> clientmonitorpolicy <string>
ssid <string> dtimperiod <number>
ssid <string> fragthreshold <number>
ssid <string> hidessid
ssid <string> ignorebroadcastprobe
ssid <string> interstationtraffic
ssid <string> manage all
ssid <string> manage {Telnet|SSH|SNMP|ping}
ssid <string> maxclient <number>
ssid <string> mode compliance
ssid <string> mode legacy
ssid <string> multicast conversiontounicast {auto|always|disable}
ssid <string> multicast cuthreshold <number>
ssid <string> multicast memberthreshold <number>
ssid <string> qosclassifier <string>
ssid <string> qosmarker <string>
ssid <string> rrm enable
ssid <string> rtsthreshold <number>
ssid <string> schedule <string>
ssid <string> security macfilter <string>
ssid <string> security screening radiusattack
ssid <string> security screening radiusattack action banforever
ssid <string> security screening radiusattack action {alarm|ban} [ [ <number> ] ]
ssid <string> security screening radiusattack threshold <number> [ action {alarm|ban} [ <number> ] ]
ssid <string> security screening radiusattack threshold <number> action banforever
ssid <string> security screening tcpsyncheck
ssid <string> security screening {icmpflood|udpflood|synflood|arpflood|addresssweep|portscan|ipspoof} [
threshold <number> ]
ssid <string> security screening {icmpflood|udpflood|synflood|arpflood|addresssweep|portscan|ipspoof}
action banforever
action disconnect
action {alarm|drop|ban} <number>
threshold <number> action banforever
threshold <number> action disconnect
threshold <number> action {alarm|drop|ban} <number>
ssid <string> security wlan dos stationlevel frametype {assocreq|auth|eapol} ban <number>
ssid <string> security wlan dos stationlevel frametype {assocreq|auth|eapol} ban forever
ssid <string> security wlan dos {ssidlevel|stationlevel} frametype {probereq|proberesp|assocreq|assoc
resp|disassoc|auth|deauth|eapol|all}
resp|disassoc|auth|deauth|eapol|all} alarm <number>
resp|disassoc|auth|deauth|eapol|all} threshold <number>
ssid <string> securityobject <string>
ssid <string> uapsd
ssid <string> usergroup <string>
ssid <string> wmm
ssid <string> wnm enable
ssid <string> wnm sta <mac_addr> send bstmreq
supplicant <string>
supplicant <string> cacert <string>
supplicant <string> clientcert <string> privatekey <string> [ privatekeypassword <string> ]
supplicant <string> eaptype {md5|peap|tls|ttls}
supplicant <string> password <string>
supplicant <string> username <string> [ password <string> ]
system connectiontrap delay <number>
system disablemulticastping
system environment {indoor|outdoor}
system icmpredirect enable
system led brightness {bright|soft|dim|off}
system powermode {802.3at|802.3af|auto}
system webserver enable
teacherview promptfordenyurl
teacherview resourcemap name <string> ip <ip_addr> port <port>
timeobject <string> once <date> <time> to <date> <time> [ timezone <number> ]
timeobject <string> recurrent [ daterange <date> [ to <date> ] ] [ weekdayrange
{Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday} ] ] timerange <time> to <time> [ timerange <time> to
<time> ] [ timezone <number> ]
tracert <ip_addr> [ maxhops <number> ] [ timeout <number> ] [ noresolve ]
tracert <string> [ maxhops <number> ] [ timeout <number> ] [ noresolve ]
track <string> [ ip <ip_addr> ]
track <string> action startmeshfailover
track <string> action {enableaccessconsole|disableaccessradio}
track <string> defaultgateway
track <string> enable
track <string> interval <number>
track <string> multidstlogic {and|or}
track <string> retry <number>
trackwan <string>
trackwan <string> defaultgateway
trackwan <string> enable
trackwan <string> interface <ethx|usbnetx|wifix>
trackwan <string> interval <number>
trackwan <string> ip <ip_addr>
trackwan <string> multidstlogic {and|or}
trackwan <string> retry <number>
usbmodem enable
usbmodem mode {ondemand|alwaysconnected|primarywan}
usbmodem modemid <string>
usbmodem modemid <string> apn [ <string> ]
usbmodem modemid <string> atcmdget {cardinfo|signalstrength} <string>
usbmodem modemid <string> atcmdset {networkmodeauto|networkmodelte|networkmode3g|networkmode2g|modem
reset} <string>
usbmodem modemid <string> connectcmd <string>
usbmodem modemid <string> connectstatuscmd <string> connectedpattern <string> disconnectpattern <string>
usbmodem modemid <string> connecttype {pppdialup|atcmddirectip|qmidirectip}
usbmodem modemid <string> dialupnumber [ <string> ]
usbmodem modemid <string> dialuppassword [ <string> ]
usbmodem modemid <string> dialupusername [ <string> ]
usbmodem modemid <string> disconnectcmd <string>
usbmodem modemid <string> usbnet {cdcether|sierranet}
usbmodem modemid <string> usbserial {option|sierra|cdcacm}
usbmodem modemid <string> vendorid <string> productid <string>
usbmodem modeswitch vendorid <string> productid <string> message <string>
usbmodem networkmode {auto|lte|3g|2g}
usbmodem power cycle
usbmodem power enable
usbmodem resetdevice
usbmodem rssithreshold <number>
usbport power {auto|enable|disable}
user <string>
user <string> group <string>
user <string> password <string>
usergroup <string>
usergroup <string> autogeneration bulknumber <number> bulkinterval <number> <time>
usergroup <string> autogeneration indexrange <number> [ <number> ]
usergroup <string> autogeneration location <string>
usergroup <string> autogeneration passwordlength <number>
usergroup <string> autogeneration prefix <string>
usergroup <string> autogeneration revokeuser <number> [ <number> ]
usergroup <string> autogeneration schedule <string>
usergroup <string> autogeneration sharedsecret <string>
usergroup <string> cachemode {temporary|mandatory}
usergroup <string> expiredtime <date/time>
usergroup <string> passwordgenerationmethod {manual|auto}
usergroup <string> pmkautosave
usergroup <string> pskformat characterpattern {letters|digits|specialcharacters}
usergroup <string> pskformat combopattern {or|and|no}
usergroup <string> pskformat version {0|1}
usergroup <string> pskgenerationmethod usernameandpassword concatenatedcharacters <string>
usergroup <string> pskgenerationmethod {passwordonly|usernameandpassword}
usergroup <string> reauthinterval <number>
usergroup <string> starttime <date/time>
usergroup <string> userattribute <number>
usergroup <string> vlanid <number>
usergroup <string> voicedevice
userprofile <string> [ qospolicy <string> ] [ vlanid <number> ] [ mobilitypolicy <string> ] [ attribute
<number> [ <number> ] ]
userprofile <string> cac airtimepercentage <number> [ sharetime ]
userprofile <string> denyactionforschedule {ban|quarantine}
userprofile <string> ippolicydefaultaction {permit|deny|interstationtrafficdrop}
userprofile <string> ippolicyredirecturl <string>
userprofile <string> l3tunnelaction {all|withexception|split|droptunneltraffic}
userprofile <string> macpolicydefaultaction {permit|deny}
userprofile <string> qosmarkermap {diffserv|8021p} <string>
userprofile <string> schedule <string>
userprofile <string> security deny {ipv4|ipv6}
userprofile <string> security ippolicy [ fromaccess <string> ] [ toaccess <string> ]
userprofile <string> security macpolicy [ fromaccess <string> ] [ toaccess <string> ]
userprofile <string> tunnelpolicy <string>
userprofile <string> vlangroup <string>
userprofile <string> {after|before} <string>
userprofile <string> {performancesentinel} action {log|boost}
userprofile <string> {performancesentinel} enable
userprofile <string> {performancesentinel} guaranteedbandwidth <number>
userprofilepolicy <string>
userprofilepolicy <string> actionforupidchange {switch|sustain|ignore}
userprofilepolicy <string> mdmtimeout <number>
userprofilepolicy <string> rule <number> authattrs <string>
userprofilepolicy <string> rule <number> devicelocation <string>
userprofilepolicy <string> rule <number> groupname <string>
userprofilepolicy <string> rule <number> macobject <string>
userprofilepolicy <string> rule <number> mdmobject <string>
userprofilepolicy <string> rule <number> osobject <string>
userprofilepolicy <string> rule <number> timeobject <string>
userprofilepolicy <string> rule <number> userprofileattrid <number>
vlangroup <string> <number> [ <number> ]
vpn clientippool <string> local <ip_addr> <ip_addr> netmask <ip_addr>
vpn ipsectunnel <string> clientlist <string> [ clientippool <string> dnsserver <ip_addr> ]
vpn ipsectunnel <string> dpd idleinterval <number> retry <number> retryinterval <number>
vpn ipsectunnel <string> gateway <ip_addr> clientname <string> password <string>
vpn ipsectunnel <string> ike phase1 authmethod {hybrid|rsasig|psk}
vpn ipsectunnel <string> ike phase1 dhgroup {group1|group2|group5}
vpn ipsectunnel <string> ike phase1 mode {main|aggressive}
vpn ipsectunnel <string> ike phase1 psk <string>
vpn ipsectunnel <string> ike phase2 pfsgroup {nopfs|group1|group2|group5}
vpn ipsectunnel <string> ike {phase1|phase2} encryptionalgorithm {3des|aes128|aes192|aes256}
vpn ipsectunnel <string> ike {phase1|phase2} hash {md5|sha1}
vpn ipsectunnel <string> ike {phase1|phase2} lifetime <number>
vpn ipsectunnel <string> localikeid {asn1dn|address|fqdn|ufqdn|keyid} <string>
vpn ipsectunnel <string> natpolicy <string>
vpn ipsectunnel <string> nattraversal enable
vpn ipsectunnel <string> peerikeid {asn1dn|address|fqdn|ufqdn} <string>
vpn l3tunnelexception <ip_addr|ip_addr/mask|string>
vpn tunnelpolicy <string> client ipsectunnel <string> [ primary ]
vpn tunnelpolicy <string> password <string>
vpn tunnelpolicy <string> server ipsectunnel <string>
vpn xauthclientlist <string> clientname <string> password <string>
vpn xauthclientlist <string> local
vpn {clientipsectunnel|serveripsectunnel} <string> [ vpnmode {layer2|layer3} ]
webdirectory <string> linktoresources <string> <string>
webdirectory [ {ppskselfreg} ] <string>
websecurityproxy clientinfocollection enable
websecurityproxy websensev1 accountkey <string>
websecurityproxy {websensev1|barracudav1} accountid <string>
websecurityproxy {websensev1|barracudav1} defaultdomain <string>
websecurityproxy {websensev1|barracudav1} defaultusername <string>
websecurityproxy {websensev1|barracudav1} enable
websecurityproxy {websensev1|barracudav1} httpproxyhost <string>
websecurityproxy {websensev1|barracudav1} httpproxyport <port>
websecurityproxy {websensev1|barracudav1} httpsproxyhost <string>
websecurityproxy {websensev1|barracudav1} httpsproxyport <port>
websecurityproxy {websensev1|barracudav1} subnet <ip_addr/netmask> [ actionifunreachable {allow|block} ]
websecurityproxy {websensev1|barracudav1} whitelist <string>
802.1xmactable expiretime <number>

Set parameters for the client MAC address table that is used to track the status of
802.1xmactable
authenticated clients and those attempting authentication through 802.1X/EAP
expiretime Set the interval of idle time after which the status of an authenticated client elapses
<number> Enter an expiration time interval in seconds (Range: 6086400; Default: 300)
802.1xmactable suppressinterval <number>

Set parameters for the client MAC address table that is used to track the status of
802.1xmactable
authenticated clients and those attempting authentication through 802.1X/EAP
Set a length of time to ignore further authentication requests after a client fails an
suppressinterval
authentication check
Enter a suppress interval in seconds (Range: 03600; Default: 0; Note: 0 means that no
<number>
suppression is applied after an authentication failure.)
aaa attribute NASIdentifier <string>

aaa Set parameters for AAA (authentication, authorization, accounting)
attribute Set attribute parameters for RADIUS AccessRequest and AccountingRequest packets
Set the RADIUS AccessRequest and AccountingRequest packets NASIdentifier parameter
NASIdentifier (Note: The NAS identifier contains a string that identifies the NAS that is originating
the access or accounting request.)
<string> Enter the custom NASIdentifier (Default: HiveAP host name; 164 chars)
aaa attribute OperatorName namespaceid <number>

Set the operator name of the RADIUS AccessRequest and AccountingRequest packets (Note:
The operator name contains the operator namespace ID and the operator name. The operator
OperatorName name is combined with the namespace ID to uniquely identify the owner of the access
network.)
namespaceid Set the namespace ID parameter of the OperatorName (Default: realm)

Enter a number used for namespace ID (Range: 4206; Note: These namespace ID values
<number> anticipate future additions to the list of namespaces as defined by IANA and reference
in RFC 5580.)
aaa attribute OperatorName namespaceid {TADIG|REALM|E212|ICC}

OperatorName
name is combined with the namespace ID to uniquely identify the owner of the access
network.)
namespaceid Set the namespace ID parameter of the OperatorName (Default: realm)
Set the NamespaceID parameter to TADIG (Transferred Account Data Interchange Group;
TADIG Note: TADIG namespaces include a country code and a company code, and are used in
cellular telephone networks.)
Set the NamespaceID parameter to REALM (Note: Realm namespaces must be globally unique,
REALM
so administrators commonly use device fully qualified domain name.)
Set the NamespaceID parameter to E212 (Note: The E.212 standard is defined in the ITU
E212 (International Telecommunication Union) standard. E.212 namespaces include a mobile
country code and a mobile network code, and are used in cellular telephone networks.)
Set the NamespaceID parameter to ICC (ITU carrier code; Note: ICC namespaces consist of
ICC
a country code and the carrier code, and are used in cellular telephone networks.)
aaa attribute OperatorName value <string>

OperatorName
network.)
value Set the value for the operator name attribute
<string> Enter a string for OperatorName(164 chars)
aaa attribute userprofileattribute vendorid <number> attributeid <number>

userprofileattribute Map a RADIUS attribute to the user profile
vendorid Set a vendor ID RADIUS attribute
Enter the vendor ID number (Range: 165535; Note: Aerohive recommends a vendor ID of
<number>
26928, which identifies Aerohive as the vendor.)
attributeid Set an ID for a private RADIUS attribute
Enter the private RADIUS attribute ID number to be combined with the vendor ID
<number> number(Range: 1255; Note: Aerohive recommends an attribute ID of 6, which corresponds
to the user profile attribute.)
aaa macformat casesensitivity {lowercase|uppercase}

Set the MAC address format to use when sending client MAC addresses to an external
macformat
authentication server
casesensitivity Set the letter case to use when formatting MAC addresses
lowercase Use lowercase formatting (Example: 01ab23cd45ef; Default: lowercase)
uppercase Use uppercase formatting (Example: 01AB23CD45EF; Default: lowercase)
aaa macformat delimiter {dash|dot|colon}
macformat
delimiter Set the type of delimiter to use when formatting MAC addresses
dash Set a dash ( ) as the MAC address delimiter (Default: colon)
dot Set a dot ( . ) as the MAC address delimiter (Default: colon)
colon Set a colon ( : ) as the MAC address delimiter (Default: colon)
aaa macformat style {twodelimiter|fivedelimiter|nodelimiter}

macformat
Set the number of delimiters to use when grouping the hexadecimal digits in a MAC
style
address
Set the number of delimiters in a MAC address as two (Example: 0123.4567.89ab; Default:
twodelimiter
nodelimiter)
Set the number of delimiters in a MAC address as five (Example: 0123456789ab;
fivedelimiter
Default: nodelimiter)
Set the number of delimiters in a MAC address as none (Example: 0123456789ab; Default:
nodelimiter
nodelimiter)
aaa ppskserver autosaveinterval <number>

ppskserver Set parameters for the local HiveAP when it is acting as a private PSK server
Set the length of time to save the list of private PSKtoclient MAC address bindings to
autosaveinterval
flash memory
<number> Enter the interval in seconds(Default: 600 sec; Range: 603600)
aaa ppskserver radiusserver {primary|backup1|backup2|backup3} <ip_addr|string> [ sharedsecret

<string> ] [ authport <number> ] [ viavpntunnel ]
ppskserver Set parameters for the local HiveAP when it is acting as a private PSK server
radiusserver Set parameters for a RADIUS (Remote Authentication Dial In User Service) server
primary Set the RADIUS server that is first queried when authenticating users
backup1 Set the RADIUS server that is queried if the primary server stops responding
backup2 Set the RADIUS server that is queried if the backup1 server stops responding
<ip_addr> Enter an IP address or a domain name for the RADIUS server (max 32 chars)
<string> Enter an IP address or a domain name for the RADIUS server (max 32 chars)
sharedsecret Set the shared secret for authenticating communications with a RADIUS server
Enter the shared secret for authenticating communications with a RADIUS server (164
<string>
chars)
authport Set the RADIUS authentication port number
<number> Enter the RADIUS authentication port number (Default: 1812; Range: 165535)
Send all RADIUS traffic through a VPN tunnel (Note: Set this option on VPN clients when
viavpntunnel the RADIUS server is in a different subnet from the tunnel interface. When they are in
the same subnet, tunneling is automatic.)
aaa radiusserver accountinteriminterval <number>

accountinterim
Set the interval in seconds for sending RADIUS accounting updates
interval
Enter the interval in seconds for sending RADIUS accounting updates (Default: 600;
<number>
Range: 10100000000)
aaa radiusserver accounting {primary|backup1|backup2|backup3} <ip_addr|string> [ sharedsecret

<string> ] [ acctport <number> ] [ viavpntunnel ]
accounting Set parameters for a RADIUS accounting server
Set the RADIUS accounting server to which the HiveAP sends AccountingRequest packets
primary
first
Set the RADIUS accounting server to which the HiveAP sends AccountingRequest packets if
backup1
the primary server does not respond
backup2
the backup1 server does not respond
backup3
<ip_addr> Enter the IP address or domain name for the RADIUS accounting server (max 32 chars)
<string> Enter the IP address or domain name for the RADIUS accounting server (max 32 chars)
sharedsecret Set the shared secret for securing communications with RADIUS accounting servers
Enter the shared secret (164 chars; Note: The RADIUS shared secret is case sensitive
<string>
and can contain spaces.)
acctport Set the RADIUS accounting port number
<number> Enter the RADIUS accounting port number (Default: 1813; Range: 165535)
aaa radiusserver dynamicauthextension

Enable the HiveAP acting as a NAS to accept unsolicited messages from the RADIUS
dynamicauthextension
authentication server (Default: Disabled)
aaa radiusserver inject OperatorName

inject Set injection parameters for RADIUS AccessRequest and AccountingRequest packets
OperatorName
network.)
aaa radiusserver keepalive enable

keepalive Set parameters for periodically checking network connectivity to RADIUS servers
enable Set parameters for periodically checking network connectivity to RADIUS servers
aaa radiusserver keepalive interval <number>

interval Set the interval between periodic connectivity status checks
<number> Enter the interval in seconds (Default: 60; Range: 6086400)
aaa radiusserver keepalive retry <number>


Set the number of times to retry sending an AccessRequest or AccountingRequest that
retry
does not elicit a response from a RADIUS authentication or accounting server
<number> Enter the retry value (Default: 3; Range: 110)
aaa radiusserver keepalive retryinterval <number>

retryinterval Set the interval between retries if no response is received from the RADIUS server
<number> Enter the retry interval value in seconds (Default: 10; Range: 160)
aaa radiusserver keepalive username <string> password <string>

Set the user name to submit in AccessRequest messages when checking the connectivity to
username
RADIUS authentication servers
<string> Enter the user name (132 chars)
password Set the password to submit in AccessRequest messages
<string> Enter the password (164 chars)
aaa radiusserver local acctenable

local Set the local Aerohive device as a RADIUS server
acctenable Enable the local RADIUS server accounting functionality
aaa radiusserver local attrmap groupattrname <string>

Map an attribute defined on a remote LDAP server to an attribute on the local RADIUS
attrmap
server
groupattrname Set the user group attribute name that is defined on the LDAP server
Enter the attribute name (132 chars; Note: The attribute type must be "string". Default
<string>
attribute in AD: memberOf; in OD: applegrouprealname; in LDAP server: radiusGroupName)
aaa radiusserver local attrmap reauthattrname <string>

attrmap
server
reauthattrname Set the user reauthentication time attribute name that is defined on the LDAP server
Enter the attribute name (132 chars; Note: The attribute type must be "integer".
<string>
Default attribute in AD: msRADIUSServiceType; in LDAP server: radiusServiceType)
aaa radiusserver local attrmap userprofileattrname <string>

attrmap
server
userprofileattrname Set the user group ID attribute name that is defined on the LDAP server
<string>
attribute in AD: msRADIUSCallbackNumber; in LDAP server: radiusCallbackNumber)
aaa radiusserver local attrmap vlanattrname <string>

attrmap
server
vlanattrname Set the VLAN ID attribute that is defined on the LDAP server
<string>
attribute in AD: msRASSavedCallbackNumber; in LDAP server: radiusCallbackId)
aaa radiusserver local cache lifetime <number>

cache Set parameters for caching userauthentication responses from external LDAP servers
lifetime Set the lifetime for entries in the RADIUS server cache
Enter the lifetime for keeping entries in the RADIUS server cache (Default: 86400
<number>
seconds; Range: 36002592000)
aaa radiusserver local concurrentsession agetimeout <number>

concurrentsession Set parameters for concurrent sessions on a RADIUS server
agetimeout Set the age timeout value for a session
Enter the age timeout value, suggest to be 3 times of the accountinteriminterval time
<number>
on NAS(Range: 30300000000; Default: 1800)
aaa radiusserver local concurrentsession limit <number>

concurrentsession Set parameters for concurrent sessions on a RADIUS server
limit Limit the concurrent sessions of the same user
Enter the limit number (Range: 015; Default: 0, which means concurrent limit is
<number>
disabled)
aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} computerou

<string>
dbtype Set the type and location of the user database
activedirectory Set the user database on an AD (Active Directory) server
primary Set the AD server that is first queried when authenticating users
backup1 Set the AD server that is queried if the primary server stops responding
backup2 Set the AD server that is queried if the backup1 server stops responding
Set the OU (organizational unit) used on the Active Directory server where the AP RADIUS
computerou
server admin has privileges to add the AP as a computer in the domain
Enter the OU (Max: 256 chars; Format: ou/subou/subou; Note: If there are any spaces,
<string>
enclose the entire string in quotation marks.)
aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} domain <string>

binddn <string> password <string>
domain Set the domain name of the AD domain controller
Enter the NetBOIS name of the domain (164 chars; Note: The domain name cannot contain
<string>
multiplelevel domains delimited by dots.)
Set the bindDN (distinguished name) under which LDAP searches are done (Note: bindDN
binddn must be set if want to get attributes from AD server or want to check TLS username
against LDAP server.)
<string> Enter the bindDN name (1256 chars)
password Set the password which authenticate the bindDN

fullname <string> [ default ]
<string>
Set the full DNS name of the domain to which the RADIUS server (local AP) and AD server
fullname
both belong
<string> Enter the full DNS name of the domain (164 chars)
Set the domain as the default domain, which will be added to the RADIUS request if no
default
domain name appears in the request

server <string>
<string>
Set the IP address or resolvable domain name for the AD server (Note: The AD server is
server
the same as the domain controller.)
<string> Enter the IP address or domain name (164 chars)
aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} login adminuser

<string> password <string>
login Set admin user name and password that the local AP will use to access the AD server
adminuser Set the admin user name
password Set the password which authenticate the login user
aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} {server} <string> [

{viavpntunnel} ]
server Set the IP address or resolvable domain name for the AD server
Send all traffic from the AP RADIUS authentication server to the AD server through a VPN
viavpntunnel tunnel (Note: Set this option on VPN clients when the AD server is in a different subnet
from the tunnel interface. When they are in the same subnet, tunneling is automatic.)
aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} {tlsenable|global

catalog}
Enable TLS authentication that the local AP, as an LDAP client, uses with the AD server
tlsenable
(Default: Disabled)
Set the AP to use TCP port 3268 when doing an LDAP search on an AD global catalog server
globalcatalog
(Default: Disabled)
aaa radiusserver local dbtype ldapserver subtype edirectory

ldapserver Set the user database on an LDAP server
subtype Set the type of LDAP server
edirectory Set the user database on an eDirectory LDAP server
aaa radiusserver local dbtype ldapserver subtype edirectory acctpolicycheck

subtype Set the type of LDAP server
edirectory Set the user database on an eDirectory LDAP server
Enable the Novell eDirectory account policy check and intruder detection for RADIUS
acctpolicycheck
users (Default: Disabled)
aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} basedn <string>

primary Set the LDAP server that is first queried when authenticating users
backup1 Set the LDAP server that is queried if the primary server stops responding
backup2 Set the LDAP server that is queried if the backup1 server stops responding
Set the base DN (distinguished name) where the user profiles are located in the LDAP
basedn
tree structure
Enter the base DN (1256 chars; Note: If there are any spaces, enclose the whole string
<string>
in quotation marks.)
aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} binddn <string> password

<string>
binddn Set the bind DN (distinguished name) under which LDAP searches are done
Enter the bind DN (1256 chars; Note: If there are any spaces, enclose the whole string
<string>
aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} filterattr <string>

Set the LDAP search filter to locate user objects using the name the client supplies
filterattr
during RADIUS authentication
<string> Enter the filter attribute used to search for the user (Default: "cn"; 132 chars)
aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} nostripfilter

nostripfilter Do not strip the realm name
aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} port <number>

port Set the destination port number for communicating with the LDAP server
<number> Enter the destination port number (Default: 389, 636 for LDAPS; Range: 165535)
aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} protocol {ldap|ldaps}
protocol Set the protocol for communicating with the LDAP server
ldap Set LDAP as the protocol for communicating with the LDAP server (Default: LDAP)
Set LDAPS (Secure LDAP) as the protocol for communicating with the LDAP server (Default:
ldaps
LDAP)
aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} {server} <string> [

{viavpntunnel} ]
server Set the IP address or resolvable domain name for the LDAP server
Send all traffic from the AP RADIUS authentication server to the LDAP server through a
VPN tunnel(Note: Set this option on VPN clients when the LDAP server is in a different
viavpntunnel
subnet from the tunnel interface. When they are in the same subnet, tunneling is
automatic.)
aaa radiusserver local dbtype librarysipserver {primary} institutionid <string>

Set parameters for the local RADIUS server to communicate with a library SIP (Standard
librarysipserver
Interchange Protocol) server
primary Set the library SIP server that is first queried when authenticating users
Set institution ID that the local RADIUS server provides when exchanging messages with
institutionid
the library SIP server
<string> Enter the institution ID (164 chars)
aaa radiusserver local dbtype librarysipserver {primary} loginenable

librarysipserver Interchange Protocol) server
Enable the AP, acting as a library SIP client, to log in when connecting to the library
loginenable
SIP server (Default: Disabled)
aaa radiusserver local dbtype librarysipserver {primary} loginuser <string> password <string>
librarysipserver
Set the user name that the local RADIUS server submits when logging in to the library
loginuser
SIP server
Set the password that the local AP RADIUS server submits when logging in to the library
password
SIP server
aaa radiusserver local dbtype librarysipserver {primary} port <port>

librarysipserver
port Set the library SIP server port number
<port> [1~65535]Enter the port number (Default: 6001; Range: 165535)
aaa radiusserver local dbtype librarysipserver {primary} separator <string>

librarysipserver
Set the character that the library SIP server uses to separate multiple field name +
separator
value entries
<string> Enter the separator (1 char; Default: '|')
aaa radiusserver local dbtype librarysipserver {primary} {server} <string>

librarysipserver
server Set IP address or domain name of the library SIP server
<string> Enter the IP address or domain name (Domain name: 132 chars)
aaa radiusserver local dbtype local
local Set the user database on the local AP
aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} adminuser <string>

password <string>
opendirectory Set the user database on an OD (Open Directory) server
primary Set the OD server that is first queried when authenticating users
backup1 Set the OD server that is queried if the primary server stops responding
backup2 Set the OD server that is queried if the backup1 server stops responding
adminuser Set the admin user name that the local AP uses when logging in to the OD server
password Set the password that the local AP uses when logging in to the OD server
aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} domain <string>

binddn <string> password <string>
domain Set the domain name of the OD domain controller
<string> Enter the name of the domain (164 chars)
binddn Set the bindDN (distinguished name) under which LDAP searches are done
<string> Enter the bindDN name (1256 chars)
aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} domain <string>

fullname <string>
domain Set the domain name of the OD domain controller
<string> Enter the name of the domain (164 chars)
fullname Set the full DNS name of the OD domain server
<string> Enter the full DNS name of the domain (164 chars)
aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} filterattr <string>

Set the LDAP search filter to locate user objects using the name the client supplies
filterattr
during RADIUS authentication
<string> Enter the filter attribute used to search for the user (Default: "uid"; 132 chars)
aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} nostripfilter

nostripfilter Do not strip the realm name
aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} tlsenable

Enable TLS authentication that the local AP, as an LDAP client, uses with the OD server
tlsenable
(Default: Disabled)
aaa radiusserver local ldapauth {primary|backup1|backup2|backup3} type tls cacert <string> [

clientcert <string> privatekey <string> [ privatekeypassword <string> ] ] [ verifyserver
{never|try|demand} ]
Set the authentication method that the local AP, as an LDAP client, uses with the LDAP
ldapauth
server
primary Set the authentication method for the first LDAP server
backup1 Set the authentication method for the second LDAP server
backup2 Set the authentication method for the third LDAP server
backup3 Set the authentication method for the fourth LDAP server
type Set the authentication type to use for LDAP communications
tls Set the authentication type as TLS (Transport Layer Security)
Set the CA certificate that the local AP uses when authenticating itself as an LDAP
cacert
client to an LDAP server
<string> Enter the file name of the CA certificate (132 chars)
Set the client certificate that the local AP uses when authenticating itself to an LDAP
clientcert
server
<string> Enter the file name of the client certificate (132 chars)
privatekey Set the private key that the local AP uses to authenticate itself to an LDAP server
<string> Enter the name of the private key file (132 chars)
privatekeypassword Set the password for the private key that is used when forming a TLS tunnel
verifyserver Set options for verifying the LDAP server (Default: LDAP server verification is try.)
never never verify the identity of the LDAP server (Default: try)
try try verify the identity of the LDAP server (Default: try)
demand demand verify the identity of the LDAP server (Default: try)
aaa radiusserver local librarysippolicy <string>

Set a library SIP policy to enforce when the local RADIUS server acts as a library SIP
librarysippolicy
client
<string> Enter the library SIP policy name (132 chars)
aaa radiusserver local localcheckperiod <number>

Set the length of time that the local AP RADIUS server checks just its cache of user
localcheckperiod authentication responses and its own database before retrying previously unresponsive
LDAP servers
Enter the interval for checking the local RADIUS cache and database (Default: 300 secs;
<number>
Min: 30; Max: 3600)
aaa radiusserver local nas <string> sharedkey <string>

Set parameters for communicating with other hive members acting as the RADIUS NAS
nas
(Network Access Server) devices
Enter the IP address or resolvable domain name (132 chars) for a single NAS device or
<string>
the subnet for multiple devices
sharedkey Set the shared secret for authenticating communications with the RADIUS NAS
<string> Enter the shared secret (131 chars)
aaa radiusserver local nas <string> tls
Set parameters for communicating with other hive members acting as the RADIUS NAS
nas
(Network Access Server) devices
Enter the IP address or resolvable domain name (132 chars) for a single NAS device or
<string>
the subnet for multiple devices
Set TLS (Transport Layer Security) encryption for securing communications with the
tls
RADIUS NAS devices
aaa radiusserver local port <number>

port Set the local RADIUS port number
<number> Enter the RADIUS port number (Default: 1812; Range: 165535)
aaa radiusserver local remotecheckperiod <number>

Set the length of time that the local AP RADIUS server will repeatedly try contacting an
remotecheckperiod
unresponsive LDAP server before giving up
<number> Enter the LDAP server retry interval (Default: 30 secs; Min: 10; Max: 3600)
aaa radiusserver local requiremessageauthenticator

requiremessage Enable the local RADIUS server to require MessageAuthenticator, if client doesn't, then
authenticator the packet will be silently discarded(Default: Disabled)
aaa radiusserver local retryinterval <number>

Set the interval after which the AP RADIUS server tries to contact a previously
retryinterval
unresponsive primary LDAP server (even if a backup server is currently responding)
Enter the interval for retrying the primary LDAP server (Default: 600 secs; Min: 60;
<number>
Max: 200000000)
aaa radiusserver local sharedsecretautogen

Enable the automatic generation of shared secrets when static entries are not found
sharedsecretautogen
(Default: Enabled)
aaa radiusserver local staauth cacert <string> servercert <string> privatekey <string> [ private
keypassword <string> ]
radiusserver
Set parameters for a RADIUS (Remote Authentication Dial In User Service) server
staauth Set the authentication type and certificate parameters for authenticating users
cacert Set the CA certificate for a TLS (Transport Layer Security) tunnel
<string> Enter the file name of the CA certificate (132 chars)
servercert Set the server certificate used when forming a TLS tunnel
<string> Enter the file name of the server certificate (132 chars)
privatekey Set the private key used when forming a TLS tunnel
privatekeypassword Set the password for encrypting the private key used when forming a TLS tunnel
<string> Enter a password (164 chars)
aaa radiusserver local staauth defaulttype {leap|peap|tls|ttls|md5}

defaulttype Set the default RADIUS authentication type
Set LEAP (Lightweight Extensible Authentication Protocol) as the default RADIUS
leap
authentication type (Default: peap)
Set PEAP (Protected Extensible Authentication Protocol) as the default RADIUS
peap
authentication type (Default: peap)
Set TLS (Transport Layer Security) as the default RADIUS authentication type (Default:
tls
peap)
ttls Set TTLS (Tunneled TLS) as the default RADIUS authentication type (Default: peap)
md5 Set MD5 as the default RADIUS authentication type (Default: peap)
aaa radiusserver local staauth type tls {checkcertcn|checkindb}

type Set the RADIUS authentication type (Default: tls+peap+ttls+leap+md5)
Set TLS (Transport Layer Security) as the RADIUS authentication type (Default:
tls
tls+peap+ttls+leap+md5)
checkcertcn Check the CN (common name) in the certificate against the user name (Default: Disabled)
checkindb Query databases to check if the user exists (Default: Disabled)
aaa radiusserver local staauth type {leap|peap|tls|ttls|md5}

Set LEAP (Lightweight Extensible Authentication Protocol) as the RADIUS authentication
leap
type (Default: tls+peap+ttls+leap+md5)
Set PEAP (Protected Extensible Authentication Protocol) as the RADIUS authentication
peap
Set TLS (Transport Layer Security) as the RADIUS authentication type (Default:
tls tls+peap+ttls+leap+md5)
Set TTLS (Tunneled TLS) as the RADIUS authentication type (Default:

ttls
md5 Set MD5 as the RADIUS authentication type (Default: tls+peap+ttls+leap+md5)
aaa radiusserver local staauth type {peap|ttls} checkindb
Set PEAP (Protected Extensible Authentication Protocol) as the RADIUS authentication
peap
Set TTLS (Tunneled TLS) as the RADIUS authentication type (Default:
ttls
Enable the local RADIUS server to query the Active Directory database to check that user
checkindb accounts are stored under the proper baseDN before authenticating them (Default:
Disabled)
aaa radiusserver local usergroup <string>

usergroup Add a user group on the local RADIUS server
<string> Enter the user group name (132 chars)
aaa radiusserver local {enable|cache}

enable Enable RADIUS server functionality on the local AP
cache Set parameters for caching userauthentication responses from external LDAP servers
aaa radiusserver name <string> acctport <port>

name Set the name for the RADIUS server
Enter the name of the RADIUS server (132 chars; Note: Use this name when assigning the
<string>
server to a realm.)
<port> [1~65535]Enter the RADIUS accounting port number (Default: 1813; Range: 165535)
aaa radiusserver name <string> authport <port>

<string>
server to a realm.)
<port> [1~65535]Enter the RADIUS authentication port number (Default: 1812; Range: 165535)
aaa radiusserver name <string> server <string> sharedsecret <string>

<string> server to a realm.)
server Set the IP address or resolvable domain name for the RADIUS server
<string> Enter the IP address or domain name (max 32 chars)
Enter the shared secret (164 chars; Note: The RADIUS shared secret is case sensitive
<string>
and can contain spaces.)
aaa radiusserver name <string> server <string> tls

<string>
server to a realm.)
server Set the IP address or resolvable domain name for the RADIUS server
<string> Enter the IP address or domain name (max 32 chars)
Set TLS (Transport Layer Security) encryption for authenticating communications with the
tls
RADIUS server
aaa radiusserver name <string> tlsport <port>

<string>
server to a realm.)
tlsport Set the TLS (Transport Layer Security) port number
<port> [1~65535]Enter the TLS port number (Range: 165535; Default: 2083)
aaa radiusserver proxy deadtime <number>

proxy Set parameters for proxying RADIUS requests
Set the interval after which the AP tries to contact a previously unresponsive RADIUS
deadtime
server
aaa radiusserver proxy inject operatorname

operatorname
network.)
aaa radiusserver proxy radsec acctport <port>

Set parameters to proxy RADIUS requests over a secure TLS tunnel between the local
radsec
device and a RADIUS server
acctport Set the RadSec proxy accounting port number
<port> [1~65535]Enter the RadSec proxy accounting port number (Range: 165535; Default: 1813)
aaa radiusserver proxy radsec authport <port>
radsec
authport Set the RadSec proxy authentication port number
[1~65535]Enter the RadSec proxy authentication port number (Range: 165535; Default:
<port>
1812)
aaa radiusserver proxy radsec dynamicauthextension

radsec
Enable the RadSec proxy to accept unsolicited messages from the RADIUS authentication
server (Default: Disabled)
aaa radiusserver proxy radsec enable

radsec
enable Enable RadSec proxy functionality on the Aerohive device
aaa radiusserver proxy radsec realm <string> {primary|backup} <string>

radsec
Set parameters for proxying requests to RADIUS servers based on the realm specified in
realm
submitted user names
Enter the realm name (132 chars; Note: Assign a server to the "NULL" realm to proxy
<string> requests that do not include a realm name to that server. Assign a server to "DEFAULT"
to send it requests containing an unconfigured realm.)
primary Assign a primary RADIUS server to the realm
backup Assign a backup RADIUS server to the realm
<string> Enter the RADIUS server name (132 chars)
aaa radiusserver proxy radsec tlsport <port>

radsec
tlsport Set the auth proxy TLS port number (Max: 8 ports per Aerohive device)
<port> [1~65535]Enter the auth proxy TLS port number (Range: 165535; Default: 80,443)
aaa radiusserver proxy realm <string> nostrip


realm
Do not strip the realm name from a submitted user name when proxying requests to the
nostrip
RADIUS server (Default: The realm name is stripped from proxied requests.)
aaa radiusserver proxy realm <string> {primary|backup} <string>

realm
primary Assign a primary RADIUS server to the realm
backup Assign a backup RADIUS server to the realm
<string> Enter the RADIUS server name (132 chars)
aaa radiusserver proxy realm format {nai|ntdomain}

realm
format Set the format in which a realm name is appended to a user's name in request packets
nai Set NAI (network access identifier) as the realm name format: user@realm (Default: NAI)
ntdomain Set Windows NT domain as the realm name format: realm\user (Default: NAI)
aaa radiusserver proxy retrydelay <number> retrycount <number>

Set the interval to wait for a response from the RADIUS server before resending a
retrydelay
proxied request
<number> Enter the interval between retries in seconds (Default: 5; Range: 310)
retrycount Set the number of times to retry proxying a request to the RADIUS server
<number> Enter the number of retries (Default: 3; Range: 110)
aaa radiusserver retryinterval <number>

retryinterval Set RADIUS server retry interval
<number> Enter RADIUS server retry interval (Default: 600 secs; Range: 60100000000)
aaa radiusserver {primary|backup1|backup2|backup3} <ip_addr|string> [ sharedsecret <string> ] [

authport <number> ] [ acctport <number> ] [ viavpntunnel ]
<string>
chars)
accessconsole customssid <string>

accessconsole Set access console parameters
customssid Set custom SSID profile name for the access console
<string> Enter an SSID profile name (132 chars)
accessconsole hidessid
hidessid Hide the SSID in beacons and ignore broadcast probe requests(Default: disabled)
accessconsole maxclient <number>

maxclient Set the maximum number of clients that can associate with the access console SSID
<number> Enter the maximum number of clients that can associate (Default: 2; Range: 164)
accessconsole mode {auto|disable|enable}

Set the mode for the access console (Note: 'auto' enables the access console only when
mode there is no Ethernet or wireless backhaul connection. 'enable' and 'disable' set the
mode manually.)
auto Set the mode as auto (Default: auto)
disable Set the mode as disable (Default: auto)
enable Set the mode as enable (Default: auto)
accessconsole security macfilter <string>

security Set the security parameters for the access console
Assign a MAC filter to the access console to restrict access only to those MAC addresses
macfilter
and OUIs (organizational unique identifiers) specified in the filter
<string> Enter the filter name (132 chars)
accessconsole security protocolsuite open

protocolsuite Set the security protocol suite for the access console
open Set the security protocol suite as open
accessconsole security protocolsuite {wpa2aespsk|wpa2tkippsk|wpaautopsk} asciikey <string>
protocolsuite Set the security protocol suite for the access console
wpa2aespsk Set the security protocol suite as wpa2aespsk
wpa2tkippsk Set the security protocol suite as wpa2tkippsk
wpaautopsk Set the security protocol suite as wpaautopsk
asciikey Set key type as an ASCII string
<string> Enter the ASCII key value (863 chars)
accessconsole telnet
telnet Enable Telnet manageability of the access console (Default: enabled)
admin auth radiusmethod [ {pap|chap|mschapv2} ]

admin Set the administrator parameters
auth Set the administrators authentication method
radiusmethod Authenticate admins by checking accounts stored on an external RADIUS server
Set PAP (Password Authentication Protocol) as the method for sending authentication
pap
requests between the AP and RADIUS server (Default: PAP)
Set CHAP (ChallengeHandshake Authentication Protocol) as the method for sending
chap
authentication requests between the AP and RADIUS server (Default: PAP)
Set MSCHAPv2 (Microsoft CHAP Version 2) as the method for sending authentication
mschapv2
requests between the AP and RADIUS server (Default: PAP)
admin auth {local|radius|both}

auth Set the administrators authentication method
local Authenticate admins by checking accounts stored on the local database (Default: local)
radius Authenticate admins by checking accounts stored on an external RADIUS server
Authenticate admins by checking accounts on an external RADIUS server first and the
both
local database second
admin managerip <ip_addr/netmask>

Allow administrative access from a host or subnet (By default, access from all addresses
managerip
are allowed.)
<ip_addr/netmask> Enter an IP address and netmask
admin minpasswordlength <number>

minpasswordlength Set the minimum password length
<number> Enter the minimum password length (Default: 8; Range: 832)
admin rootadmin <string> password <string>

The rootadmin has complete privileges, including the ability to add, modify, and delete
rootadmin
other admins
<string> Enter rootadmin name (320 chars)
password Set password for the rootadmin
Set password for the rootadmin ([minpasswordlength]32 chars, use CLI "show min
<string>
passwordlength" to get value of minpasswordlength, default: 8)
admin {readwrite|readonly} <string> password <string>
The readwrite admin has the ability to view, set commands and modify his or her own
readwrite password, but not the ability to reset the configuration or add, modify, and delete
other admins
readonly The readonly admin has the ability to view settings
<string> Enter an admin user's name (320 chars)
password Set password for the user
Set password for the user ([minpasswordlength]32 chars, use CLI "show minpassword
<string>
length" to get value of minpasswordlength, default: 8)
alg {ftp|tftp|sip|dns|http} enable

alg Set ALG (Application Level Gateway) parameters
ftp Set an FTP (File Transfer Protocol) ALG
tftp Set a TFTP (Trivial File Transfer Protocol) ALG
sip Set a SIP (Session Initiation Protocol) ALG
dns Set a DNS (Domain Name System) ALG
http Set an HTTP ALG
enable Enable ALG functionality
alg {ftp|tftp|sip|dns} qos <number>

dns Set a DNS (Domain Name System) ALG
qos Set an Aerohive QoS class for ALG data traffic
Enter an Aerohive QoS class (Default: 0 for FTP, 0 for TFTP, 6 for SIP, 0 for DNS;
<number>
Range: 07)
alg {ftp|tftp|sip} inactivedatatimeout <number>

inactivedatatimeout Set a timeout to close an inactive gate
Enter an inactive gateway timeout value in seconds (Default: 30 for FTP, 30 for TFTP, 60
<number>
for SIP; Range: 11800s)
alg {ftp|tftp|sip} maxduration <number>

maxduration Set the maximum duration for the ALG
Enter the maximum duration in minutes (Default: 60 for FTP, 60 for TFTP, 720 for SIP;
<number>
Range: 17200(min))
amrp interface <ethx|redx|aggx> priority <number>

amrp Set AMRP (Advanced Mobility Routing Protocol) parameters
interface Set AMRP parameters per interface
<ethx> Enter the name of an Ethernet interface, where x = 0 or 1
<redx> Enter the name of the redundant interface, where x = 0

<aggx> Enter the name of the aggregate interface, where x = 0
Set a priority for the AP to be elected as a DA (designated AP) on the Ethernet link to
priority
which the interface connects
Enter the priority value (Range: 0255; Default: 0; Note: The greater the number is, the
<number> higher its priority, and the more preferred the AP will be during the DA election
process. For example, 100 has a higher priority than 50.)
amrp l2neighborkeepalivecount <number>

l2neighborkeepalive
Number of keepalive packet loss allowed before mesh failover
count
[1~255] Packet number N. Failover delay time is about 2sec * N (Default: 16; Min: 1;
<number>
Max: 255)
amrp metric pollinterval <number>

metric Set route metric parameters for the backhaul link (Ethernet and wireless)
pollinterval Set the interval for polling neighbors to determine current route metrics
<number> Enter the pollinterval value (Default: 60 secs; Range: 10300)
amrp metric type {aggressive|conservative|normal}

metric Set route metric parameters for the backhaul link (Ethernet and wireless)
type Set the type of behavior governing dynamic changes to route metrics
aggressive Change route metrics to aggressive (Default: normal)
conservative Change route metrics to conservative (Default: normal)
normal Change route metrics to normal (Default: normal)
amrp neighbor <mac_addr> metric min <number> max <number>

neighbor Specify the neighbor to which you want to set AMRP parameters
Enter a MAC address (Note: You can use colons, dashes, or periods to format the address.
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
Set route metric parameters for the backhaul link (Ethernet and wireless) to the
metric
neighbor
min Set the minimum metric value
<number> Enter the minimum metric value (Default: 67; Range: 81200)
max Set the maximum metric value equal to or greater than the minimum value
<number> Enter the maximum metric value (Default: 67; Range: 81200)
amrp vpntunnel heartbeat interval <number> retry <number>

vpntunnel Set parameters for VPN tunneling
heartbeat Set AMRP (Advanced Mobility Routing Protocol) heartbeat parameters for VPN tunnel
interval Set the interval for sending AMRP heartbeats through the tunnel
Enter the heartbeat interval in seconds (Range: 065535; Default: 10; Note: 0 disables
<number>
AMRP heartbeats.)
retry Set the number of times to retry sending a heartbeat when it does not elicit a response
<number> Enter the number of heartbeats to retry sending (Range: 1255; Default: 10)
application identification cdpindex <number> cdpname <string>

application Set L7 related parameters
identification Set L7 identification related parameters

cdpindex Set index for custom defined application
<number> Enter the index for custom defined application (Range: 1900019099)
cdpname Specify name for custom defined application
<string> Enter the name of the custom defined application (1 to 8 characters)
application identification cdpindex <number> cdprule <string> cdpmodule {TCP|UDP|HTTP|TLS}

cdprule Specify the rule for custom defined application
<string> Enter the rule for custom defined application (1 to 255 characaters)
cdpmodule Specify the module for custom defined application rule
TCP Enter the module for custom defined application rule TCP
UDP Enter the module for custom defined application rule UDP
HTTP Enter the module for custom defined application rule HTTP
TLS Enter the module for custom defined application rule TLS
application identification name <string> value <string>

name Enter the name of L7 identification parameter
<string> Enter the name of L7 identification parameter
value Enter the value of L7 identification parameter
<string> Enter the value of L7 identification parameter
application identification shutdown

shutdown Shutdown L7 service
application reporting appid <string>

reporting Set L7 application reporting related parameters
appid Set L7 appid related parameters
<string> Enter an appids' list seperated by comma
application reporting appid <string> enable

appid Set L7 appid related parameters
<string> Enter an appids' list seperated by comma
enable Enable L7 application reporting for the specified appid
application reporting collectionperiod <number> reportperiod <number>

collectionperiod Set L7 collectionperiod related parameters
<number> Enter a number in increments of 60 between 60~3600 (Default: 3600)
reportperiod Set L7 reportperiod related parameters
<number> Enter a number in increments of 60 between 60~3600 (Default: 3600)
application reporting upload <url> timewindow <number> [ admin <string> password <string>
{basic|digest} ]
upload Set L7 application reporting upload parameters
Enter the HTTP protocol, remote server domain name, port, directory path, and file name
<url> (Default port: 80; 1256 chars; Format: http://domain/path/, http://domain:port/path/;
Note: You can substitute 'https' for 'http'.)
timewindow Reporting timewindow
<number> minutes(Range: 130)
admin Set the name of the server administrator
<string> Enter the administrator name (132 chars)
password Set the password for the server administrator
<string> Enter the server password (164 chars)
Set the access authentication scheme as basic, which appends a user name and password
basic
encoded with the Base64 algorithm to the authorization header in HTTP requests
Set the access authentication scheme as digest, which appends an MD5 checksum of the
digest
username, password, and other values to the authorization header in HTTP requests
application reporting watchlist <string>

watchlist Set L7 a watch list related parameters
<string> Enter watch list composed of appids and separated by comma
application reporting watchlist <string> enable

watchlist Set L7 a watch list related parameters
<string> Enter watch list composed of appids and separated by comma
enable Enable L7 application reporting for the specified appid forcibly
application reporting {enable|disable|auto}

enable Enable L7 application reporting
disable Disable L7 application reporting
auto Automate L7 application reporting
bonjourgateway enable
Set parameters for the device to act as a Bonjour Gateway, collecting, filtering, and
bonjourgateway
sharing Bonjour services across subnets/VLANs
enable Enable Bonjour gateway functionality (Default: Enabled)
bonjourgateway filter rule <number> [ from <string> ] <string> [ to <string> ] [ metric <number> ]
bonjourgateway
Set a filter to control which Bonjour services the local gateway transmits to remote
filter gateways
Set a Bonjour gateway filter rule to determine which services get advertised to Bonjour
rule
gateways in other subnets
<number> Enter the ID for the rule (Range 1128)
from Set the source from which services are advertised
<string> Enter the source VLAN group name (132 chars)
Enter the text string to filter which services are advertised (164 chars; Note: A
<string> service is advertised if its name matches the string in a rule. You can use asterisks as
wildcards)
to Set the VLAN group to which services are advertised
<string> Enter the destination VLAN group name (132 chars)
Set the maximum number of hops away from the local BDD to accept service advertisements
metric (Note: An immediately neighboring BDD is one hop away, a neighbor of that neighbor is
two hops away, and so on.)
Enter the maximum distance from which service advertisements are acceptable (Range: 0
<number>
100; Default: 0; Note: A value of 0 means that there is no maximum distance.)
bonjourgateway filter rule <number> {before|after} rule <number>

bonjourgateway
Set a filter to control which Bonjour services the local gateway transmits to remote
filter
gateways
rule
before Move the rule before another rule in the Bonjour Gateway filter
after Move the rule after another rule in the Bonjour Gateway filter
rule
bonjourgateway neighbor <ip_addr|string>

bonjourgateway
neighbor Set an AP or CVG as a remote BDD (Bonjour Dedicated Device)
<ip_addr> Enter the IP address or resolvable domain name (132 chars) of the remote BDD
<string> Enter the IP address or resolvable domain name (132 chars) of the remote BDD
bonjourgateway priority <number>

bonjourgateway
Set the priority of the local device to be elected as the BDD (Bonjour Designated
priority
Device)
Enter the BDD election priority (Range: 0255; Defaults: SR series=50, BR200 series=40,
VGVA/VG1U=25, AP370/AP390=23, AP230=21, AP330/AP350=20, AP320/AP340=15,
<number>
AP120/AP121/AP130/AP141/AP170/AP1130=10, AP110=5; Note: Values closer to 255 have higher
priority.)
bonjourgateway realm <string>

bonjourgateway
realm Set the name of the Bonjour realm to which the local device belongs
<string> Enter the Bonjour realm name (1128 chars)
bonjourgateway vlan <number> [ <number> ]

bonjourgateway
vlan Set the VLAN or range of VLANs in which to probe for DHCP servers
<number> Enter the VLAN ID to be probed (Range: 14094; Note: If you are defining a range of
VLANs, this is the starting point of that range.)
<number> Enter the last VLAN ID in the range (Range: 14094)
bootparam bootfile <string>

bootparam Set parameters for the boot loader
Set the file name of the HiveOS image that you want to load on the local HiveAP through
bootfile
a network connection to a TFTP server
<string> Enter the file name (1127 chars)
bootparam bootpassword <string>

bootpassword Set the password that a root admin must enter to interrupt the autoboot sequence
bootparam countrycode <number>

countrycode Set the country code used to control radio channel and power selections
<number> Enter a country code value (Default: 840; Range: 110000)
bootparam device <ip_addr/netmask>

device Set the IP address and netmask of the local HiveAP device
<ip_addr/netmask> Enter the IP address and netmask
bootparam device <ip_addr> <netmask>

device Set the IP address and netmask of the local HiveAP device
<ip_addr> Enter the IP address
<netmask> Enter the IP netmask
bootparam gateway <ip_addr>

Set the IP address of the gateway so that the local HiveAP can reach the TFTP server
gateway
with the HiveOS image that you want to load
bootparam nativevlan <number>

nativevlan Set the native VLAN ID of the local HiveAP
<number> Enter the VLAN ID (Default: 0; Range: 04094)
bootparam netboot enable

Set the HiveAP to boot up automatically from an external TFTP server after an
netboot
application crash occurs
Enable the ability to boot up automatically from an external TFTP server after an
enable
application crash occurs
bootparam netdump dumpfile [ <string> ]

Set parameters for saving a core dump to the TFTP server specified in the "bootparam
netdump server" command (Note: If the HiveAP crashes, it saves a core dump file to the TFTP
server in its next rebooting phase)
dumpfile Set the name of the core dump file to be saved to the TFTP server
<string> Enter the name of the core dump file (Default name: .netdump; 132 chars)
bootparam netdump enable

Set parameters for saving a core dump to the TFTP server specified in the "bootparam
netdump server" command (Note: If the HiveAP crashes, it saves a core dump file to the TFTP
server in its next rebooting phase)
enable Enable the netdump feature (Default: Disabled)
bootparam server <ip_addr>

Set the IP address of the TFTP server that has the HiveOS image file that you want to
server
load
bootparam vlan <number>

vlan Set the VLAN that the local HiveAP must use to reach the TFTP server
cac airtimepersecond <number>

Set CAC (Call Admission Control) parameters for regulating the admission of new VoIP
cac
calls
airtimepersecond Set airtime reserved for VoIP calls
<number> Enter the airtime for VoIP calls (Default: 500ms; Range: 100ms1000ms)
cac enable
cac
calls
enable Enable CAC protection of VoIP traffic
cac roaming airtimepercentage <number>

cac
calls
roaming Set parameters for VoIP calls when a client roams
airtimepercentage Set the percentage of airtime reserved for VoIP calls during roaming
<number> Enter the percentage of reserved airtime (Default: 20; Range: 0100)
capture interface <wifix> [ count <number> ] [ filter <number> ] [ promiscuous ]

capture Set packet capture parameters
interface Enable packet capturing on a radio interface
<wifix> Enter the name of a WiFi radio interface, where x = 0 or 1
count Set the number of frames to capture
<number> Enter the number of frames to capture (Default: 2000; Range: 1100000)
filter Set the packet capture filter
<number> Enter a filter ID (Range: 164)
Enable the wifi interfaces to operate in promiscuous mode during packet capturing
promiscuous
(Default: Disabled)
capture save interface <wifix> <string>
capture Set packet capture parameters
save Set the packet capture tool to save captured packets to a file
interface Set the packet capture tool to save captured packets to a file on a radio interface
Enter a local file name or the remote location, path, and file name (Format: filename or
<string>
tftp://server:/path/filename; Default: wifix.dmp)
capwap client HTTP proxy name <string> port <number>

capwap Set parameters for CAPWAP (Control and Provisioning of Wireless Access Points)
client Set CAPWAP client parameters
HTTP Set HTTP as the applicationlevel protocol using TCP as the transport mode
proxy Set parameters for the HTTP proxy server
name Set the HTTP proxy server name
<string> Enter the IP address or domain name of the HTTP proxy server (132 chars)
port Set the HTTP proxy server port number
<number> Enter the port number (Range: 165535)
capwap client HTTP proxy user <string> password <string>

user Set the user name for authenticating the HiveAP with the HTTP proxy server
<string> Enter the authentication user name (132 chars)
password Set the user password for authenticating the HiveAP with the HTTP proxy server
capwap client defaultservername <string>

defaultservername Set the default IP address or domain name for the CAPWAP server
<string> Enter IP address or name for CAPWAP server (132 chars)
capwap client discovery interval <number>

discovery Set CAPWAP client discovery parameters
interval Set CAPWAP discovery interval
<number> Enter the CAPWAP discovery interval (Default: 5 secs; Range:1999)
capwap client discovery maximum interval <number>

maximum Set the max time in seconds to wait for a response to a Discovery Request message
interval Set the max time in seconds to wait for a response to a Discovery Request message
Enter the max time to wait for a response to a Discovery Request message (Default: 10
<number>
secs; Range: 2180)
capwap client discovery method {broadcast}
method Set the CAPWAP discovery method
Enable the broadcast of CAPWAP Discovery Request messages in the local Layer 2 domain as
broadcast
part of the CAPWAP server discovery process (Default: Enabled)
capwap client dtls acceptbootstrappassphrase

Set DTLS (Datagram Transport Layer Security) parameters for securing the CAPWAP
dtls
connection
acceptbootstrap
Always accept the bootstrap passphrase proposed by HiveManager
passphrase
capwap client dtls bootstrappassphrase <string>

dtls
connection
bootstrappassphrase Set a passphrase for initial and recovery CAPWAP connections
<string> Enter the bootstrap passphrase (1632 chars)
capwap client dtls enable

dtls
connection
enable Enable CAPWAP client dtls feature
capwap client dtls handshakewaittime <number>

dtls
connection
handshakewaittime Set the maximum time to wait for a DTLS handshake message from the CAPWAP server
<number> Enter the maximum wait time in seconds (Default: 60; Range: 30120)
capwap client dtls hmdefinedpassphrase <string> keyid <number>

dtls
connection
hmdefinedpassphrase Use the HiveManagerdefined passphrase to secure CAPWAP communications
Enter a passphrase for the HiveAP to use when making a secure CAPWAP connection (1632
<string>
chars)
keyid Set the key ID for the passphrase
<number> Enter the key ID (Range: 1255)
capwap client dtls maxretries <number>

dtls Set DTLS (Datagram Transport Layer Security) parameters for securing the CAPWAP
connection
maxretries Set the maximum number of times to retry making a DTLS connection
<number> Enter the maximum number of retries (Default: 3; Range: 165535)
capwap client dtls negotiation enable

dtls
connection
negotiation Set the HiveAP to autonegotiate the use of DTLS with HiveManager
enable Enable DTLS autonegotiation
capwap client dtls psk <string>

dtls
connection
psk Set the DTLS preshared key manually (instead of deriving it from a passphrase)
<string> Enter the DTLS preshared key in ASCII hex format (164 chars)
capwap client dtls sessiondeletewaittime <number>

dtls
connection
sessiondeletewait
Set the minimum time to wait for DTLS session deletion
time
<number> Enter the wait time in seconds (Default: 5; Range: 165535)
capwap client enable

enable Enable CAPWAP client
capwap client join timeout <number>

join Set the interval that the HiveAP waits for a CAPWAP Join Response message
timeout Set the interval that the HiveAP waits for a CAPWAP Join Response message
Enter join interval in seconds to wait for Join Response message (Default: 60 secs;
<number>
Range: 30999)
capwap client neighbor dead interval <number>

neighbor Set CAPWAP client neighbor parameters
dead Set the dead interval for CAPWAP neighbors
Set the interval in seconds to wait for ping responses before considering a CAPWAP
interval
neighbor dead
Enter interval to wait for responses before considering a neighbor dead (Default: 105
<number>
secs; Range: 60240)
capwap client neighbor heartbeat interval <number>

neighbor Set CAPWAP client neighbor parameters
heartbeat Set the heartbeat parameters for a CAPWAP neighbor
interval Set the heartbeat interval for a CAPWAP neighbor
<number> Enter the heartbeat interval for a CAPWAP neighbor (Default: 30; Range: 30120)
capwap client pcialert enable

pcialert Report PCI (Payment Card Infrastructure) compliance information to HiveManager
enable Enable the reporting of PCI compliance information
capwap client server [ {backup} ] name <string> [ connectdelay <number> ] [ viavpntunnel ]

server Set parameters for communicating with the CAPWAP server
backup Set the backup CAPWAP server
name Set the IP address or domain name of the CAPWAP server
<string> Enter IP address or name for CAPWAP server (132 chars)
Schedule a connection to the specified CAPWAP server at a time relative to the moment
connectdelay
the HiveAP receives the command
<number> Enter the interval in seconds after which the CAPWAP client connects (Range: 065535)
Send all CAPWAP traffic through a VPN tunnel (Note: Set this option on VPN clients when
viavpntunnel the CAPWAP server is in a different subnet from the tunnel interface. When they are in
capwap client server port <number>

server Set parameters for communicating with the CAPWAP server
port Set the destination port number for communicating with the CAPWAP server
<number> Enter the port number (Default: 12222; Range: 165535)
capwap client silent interval <number>

Set an interval to wait after failing to receive Discovery Request responses before
silent
sending more requests
Set an interval to wait after failing to receive Discovery Request responses before
interval
sending more requests
Enter an interval to wait after failing to receive Discovery Request responses (Default:
<number>
15 secs; Range: 1999)
capwap client transport HTTP

transport Set the packet transport mode for CAPWAP communications
capwap client vhmname <string>

vhmname Set the name of the virtual HiveManager system
<string> Enter the name of the virtual HiveManager system (164 chars)
capwap maxdiscoveries counter <number>

maxdiscoveries Set the max number of CAPWAP Discovery Request messages
counter Set the max number of CAPWAP Discovery Request messages
<number> Enter the max number of CAPWAP Discovery Request messages (Default: 3; Range: 1999)
capwap ping <string> [ port <number> ] [ count <number> ] [ size <number> ] [ timeout <number> ]
Perform a CAPWAP ping (Note: A CAPWAP ping does not use ICMP echo requests, but UDP
ping
packets similar to those used for CAPWAP heartbeats.)
<string> Enter the IP address or domain name of the CAPWAP server (132 chars)
port Set the destination UDP port number for communicating with the CAPWAP server
Enter the destination UDP port number for communicating with the CAPWAP server (Default:
<number>
12222; Range: 165535)
count Set the number of CAPWAP UDP packets to send
<number> Enter the number of packets to send (Default: 5; Range: 165535)
size Set the size of the UDP packets
<number> Enter the packet size in bytes (Default: 56; Range:11300)
timeout Set the length of time to wait for a response
<number> Enter the timeout in seconds (Default: 5; Range: 160)
capwap ping <string> [ port <number> ] flood <number> [ size <number> ] [ timeout <number> ]
Perform a CAPWAP ping (Note: A CAPWAP ping does not use ICMP echo requests, but UDP
ping
packets similar to those used for CAPWAP heartbeats.)
<string> Enter the IP address or domain name of the CAPWAP server (132 chars)
port Set the destination UDP port number for communicating with the CAPWAP server
Enter the destination UDP port number for communicating with the CAPWAP server (Default:
<number>
12222; Range: 165535)
Set the number of batches, each consisting of 100 CAPWAP UDP packets, to send at one
flood
time
<number> Enter the number of batches of packets(Range: 165535)
size Set the size of the UDP packets
<number> Enter the packet size in bytes (Default: 56; Range:11300)
clear aaa radiusserver cache [ username <string> ]

clear Clear dynamic system information or remove all web directories
aaa Clear parameters for AAA (authentication, authorization, accounting)
radiusserver Clear RADIUS server parameters
cache Clear all RADIUS server caches or one cache
username Clear the RADIUS server cache by username
<string> Enter the username (132 chars)
clear aaa radiusserverkey [ {radiusserver|ldapclient} ] [ <string> ]

Clear all certificates that the local Aerohive device uses as a RADIUS server and LDAP
radiusserverkey
client
radiusserver Clear certificates that the local AP uses as a RADIUS server
ldapclient Clear certificates that the local AP uses as a LDAP client
<string> Enter the name of the certificate
clear aaa radiusserverkey radsec ca

Clear all certificates that the local Aerohive device uses as a RADIUS server and LDAP
radiusserverkey
client
Clear certificates that the local Aerohive device uses as a RadSec proxy server (Note: A
radsec RadSec proxy server can forward RADIUS requests over a secure TLS tunnel between RadSec
peers.)
Clear the CA (certificate authority) certificate that the local Aerohive device uses as
ca
a RadSec proxy server
clear application reporting appstats

application Clear L7 related parameters
reporting Clear L7 application reporting related parameters
appstats Clear L7 application reporting applicaton statistics
clear application reporting statistics

application Clear L7 related parameters
reporting Clear L7 application reporting related parameters
statistics Clear L7 application reporting statistics
clear arpcache
arpcache Clear the ARP cache
clear auth roamingcache mac <mac_addr> {hiveneighbors|hiveall}

auth Clear dynamic authentication information
Clear all entries from the roaming cache, which contains authentication information for
roamingcache
stations currently connected to neighboring hive members
Set the MAC address of the station whose cached authentication information you want to
mac
clear
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
Clear all entries from the local roaming cache and from the roaming caches of all
hiveneighbors
neighboring hive members
Clear the MAC address from the local roaming cache and from the roaming caches of all
hiveall
hive members
clear auth roamingcache {hiveneighbors}

roamingcache
Clear all entries from the local roaming cache and from the roaming caches of all
hiveneighbors neighboring hive members
clear auth username <string>
username Clear dynamic authentication information by user name
<string> Enter a user name (132 chars)
clear auth {localcache|roamingcache|station} [ mac <mac_addr> ]

Clear all entries from the local cache, which contains authentication information for
localcache
stations currently connected to the local HiveAP
roamingcache
station Clear authentication information for a specific station
Set the MAC address of the station whose cached authentication information you want to
mac
clear
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
clear auth {localcache|roamingcache|station} ssid <string>

Clear all entries from the local cache, which contains authentication information for
localcache
stations currently connected to the local HiveAP
roamingcache
station Clear authentication information for a specific station
ssid Clear cached authentication information based on the SSID with which stations associated
clear cac stationairtime [ mac <mac_addr> ]

cac Clear CAC (Call Admission Control) statistics
stationairtime Clear airtime statistics for a specific station
mac Set the specific destination MAC
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
clear capture local [ <string> ]

capture Clear packet capture parameters
local Clear one or all locally stored packet capture files
<string> Enter the file name to clear
clear capwap client counter

capwap Clear CAPWAP (Control and Provisioning of Wireless Access Points) statistics
client Clear CAPWAP client statistics
counter Clear CAPWAP client keepalive packet counters
clear config rollback

config Clear the configuration rollback settings
rollback Clear the current configuration rollback point and related settings
clear forwardingengine counters [ interface <wifix|wifix.y|ethx|mgtx|aggx|redx> ] [ station

<mac_addr> ] [ drop ] [ tunnel ] [ policy ]
forwardingengine Clear dynamically generated data from the forwarding engine
counters Clear forwarding engine counter statistics
interface Clear forwarding engine counter by interface
<wifix.y> Enter the name of a WiFi radio subinterface (Ranges: x: 01; y: 116)
<mgtx> Enter the name of the management interface, where x = 0
station Clear forwarding engine counter by station MAC
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
drop Clear the drop packet counter
tunnel Clear the counter on tunnels
policy Clear the counter on policies
clear forwardingengine ipsessions [ srcip <ip_addr> ] [ dstip <ip_addr> ] [ srcport <number> ] [

dstport <number> ] [ protocol <number> ]
ipsessions Clear IP sessions
srcip Clear IP sessions by source IP address
<ip_addr> Source IP address
dstip Clear IP sessions by destination IP address
<ip_addr> Destination IP address
srcport Clear IP essions by source port number
<number> source IP port (Range: 165535)
dstport Clear IP sessions by destination port number
<number> destination IP port (Range: 165535)
protocol Clear IP sessions by protocol type
clear forwardingengine ipsessions id <number>

ipsessions Clear IP sessions
id Clear IP sessions by session ID number
<number> Enter the IP session ID (Range: 19999)
clear forwardingengine macsessions [ srcmac <mac_addr> ] [ dstmac <mac_addr> ]

macsessions Clear MAC sessions
srcmac Clear MAC sessions by source MAC address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
dstmac Clear MAC sessions by destination MAC address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
clear forwardingengine macsessions id <number>

macsessions Clear MAC sessions
id Clear MAC sessions by session ID number
<number> Enter the MAC session ID (Range: 19999)
clear gretunnel counters tunnel

gretunnel Clear GRE (Generic Routing Encapsulation) tunnel information
counters Clear GRE tunnel counter statistics
tunnel Clear the counter on tunnels
clear hive <string> counter neighbor [ <mac_addr> ]

hive Clear hive info
<string> Enter a hive profile name (132 chars)
counter Clear counters for neighboring hive members
neighbor Clear counters for all neighbors or a specific neighbor in this hive
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
clear interface <ethx|aggx|redx> maclearning dynamic <mac_addr>

interface Clear interface info
maclearning Clear entries in the MAC address learning table
dynamic Clear dynamically learned MAC address entries
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
clear interface <ethx|aggx|redx> maclearning dynamic all

maclearning Clear entries in the MAC address learning table
dynamic Clear dynamically learned MAC address entries
all Clear all dynamically learned MAC address entries
clear interface <ethx|wifix|wifix.y|aggx|redx> counter


counter Clear all counters for the interface
clear interface <mgtx|mgtx.y> dhcpserver lease all

<mgtx.y> Enter the name of the virtual management interface (Ranges: x: 0; y: 116)
dhcpserver Clear the DHCP server lease
lease Clear a specific DHCP lease or all leases
all Clear all DHCP leases
clear interface <mgtx|mgtx.y> dhcpserver lease ip <ip_addr>

ip Clear the DHCP lease that uses a specific IP address
clear interface <mgtx|mgtx.y> dhcpserver lease mac <mac_addr>

mac Clear the DHCP lease assigned to a client with a specific MAC address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
clear interface <wifix> wlanidp mitigate rogueap [ <mac_addr> ]

wlanidp Clear rogue AP entries from the WLAN IDP (intrusion detection and prevention) table
mitigate Clear mitigated rogue APs
rogueap Clear all mitigated rogue APs or a specific rogue AP
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
clear lldp [ {cdp} ] table

lldp Set LLDP (Link Layer Discovery Protocol) parameters
cdp Set CDP (Cisco Discovery Protocol) parameters

table Clear LLDP or CDP neighbor table
clear location {aeroscout|tzsp} counter

location Clear parameters for location tracking
aeroscout Clear parameters for the aeroscout location processing engine
tzsp Clear parameters for the tzsp location processing engine
counter Clear statistics for location reports sent to the location processing engine
clear log [ {buffered|debug|flash|all} ]

log Clear logging messages
buffered Clear buffered log messages
debug Clear debug log messages
flash Clear flash log messages
all Clear all log messages
clear mdnsd counter [ vlan <number> ]

mdnsd Clear MDNS information
counter Clear MDNS packet counter
vlan Clear MDNS packet counters on a specific VLAN
<number> Enter the VLAN ID number (Range: 14094)
clear networkfirewall session all

networkfirewall Clear Layer 3 firewall information
session Clear Layer 3 firewall sessions
Clear all sessions (Note: You must clear all existing sessions for new or changed
all firewall policy rules to take effect. Once the new rules are in effect, the HiveAP
applies them to new sessions.)
clear qos counter

qos Clear dynamic QoS information
counter Clear dynamic QoS statistics counters
clear service [ <string> ] counter

service Clear dynamically generated information for all services or for a specific service
<string> Enter the name of the service whose counters you want to clear
counter Clear the counter statistics for all services or for a specific service
clear ssh known_host <string>

ssh Secure Shell
known_host List of known saved hosts
<string> Enter the domain name (164 chars) or IP address
clear ssid <string> counter station [ <mac_addr> ]
ssid Clear SSID info
counter Clear counters for stations (wireless clients) associated with the SSID
station Clear counters for all stations or a specific station associated with the SSID
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
clear supplicant certfile [ <string> ]

clear Show settings, parameters, or dynamically generated information
supplicant Clear objects for supplicant
certfile Clear cert files for supplicant
clear userandgroup all

userandgroup Clear all users and usergroups
all Clear all users and usergroups
clear vpn certificatekey

vpn Clear VPN information
Clear all certificates that the local HiveAP uses when authenticating its identity to a
certificatekey
VPN peer and when verifying the identity of a VPN peer
clear vpn {ike|ipsec} sa

vpn Clear VPN information
ike Clear IKE SA information established during IKE phase 1 negotiations
ipsec Clear IPsec SA information established during IKE phase 2 negotiations
sa Clear SA (security association) information
clear webdirectory [ {ppskselfreg} ]

webdirectory Remove all web directories
ppskselfreg Remove all selfregistration web directories from the private PSK server
clear wlanidp mitigate [ <mac_addr> ]

wlanidp Clear rogue AP entries from the WLAN IDP (intrusion detection and prevention) table
Clear one or a list of the rogue APs against which mitigation was performed and the
mitigate
HiveAPs that reported them
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
clientmonitor enable
clientmonitor Set parameters for Client Monitor
Enable client monitor to detect client issues and report client connection activities
enable
and problems to HiveManager (Default: Enabled)
clientmonitor policy <string> problemtype {association|authentication|networking} [ triggertimes
<number> ] [ reportinterval <number> ] [ quiettime <number> ]
clientmonitor Set parameters for Client Monitor
policy Set parameters for a Client Monitor policy
<string> Enter the Client Monitor policy name (132 chars)
problemtype Set the problem type which specifies a category of clientcentric problems
association Detect, analyze and report the client association problem
authentication Detect, analyze and report the client authentication problem
networking Detect, analyze and report the client networking problem
Set how many times the problem type is detected to trigger reporting the problem and
triggertimes
related logs
<number> Enter trigger times for the problem type (Range: 110; Default: 1)
reportinterval Set the interval to report the problem and related logs
Enter a report interval in seconds for the problem type (Range: 0 or 303600; Default:
<number>
0; Note: The default value of 0 reports every instance of the problem)
quiettime Set the time period after which the problem elapses
<number> Enter quiet time in seconds for the problem type (Range: 6086400; Default: 300)
clienttracing <mac_addr>
clienttracing Test client tracing
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
clock datetime <date> <time>

clock Set the internal clock
datetime Set the date and time for the internal clock
Enter the date for the internal clock, (Format: YYYYMMDD, Range: 19700101 to 2035
<date>
1231)
Enter the time for the internal clock, (Format: hh:mm:ss, Range: hh(0023), mm(0059),
<time>
ss(0059)
clock timezone <number> [ {30|45} ]

timezone Set the time zone for the internal clock
<number> Enter the time zone for the internal clock (Default: 0; Range: from 12 to 12)
30 Add 30 minutes to the specified time zone
45 Add 45 minutes to the specified time zone
clock timezone daylightsavingtime <date> <time> <date> <time>

timezone Set the time zone for the internal clock
daylightsavingtime Set the daylight saving time parameters
<date> Enter the start date for the daylight saving time (Format: MMDD, Range: 0101 to 1231)
Enter the start time for the daylight saving time (Format: hh:mm:ss, Range: hh(0023),
<time>
mm(0059), ss(0059)
<date> Enter the end date for the daylight saving time (Format: MMDD, Range: 0101 to 1231)
Enter the end time for the daylight saving time (Format: hh:mm:ss, Range: hh(0023),
<time>
mm(0059), ss(0059)
config rollback enable

Set parameters for the current configuration file, which is a flash file containing
config
default and admindefined settings
Set the current config as a rollback point to which the AP can return after a length of
rollback time elapses or if it becomes disconnected from the CAPWAP server, or return the config
to a previously set rollback point immediately
enable Enable the configuration rollback feature
config rollback manual [ waittime <number> ]

config
Perform the configuration rollback after the defined length of time elapses regardless
of its CAPWAP connectivity (Note: This option is useful when accessing the CLI remotely
manual
and you are concerned that some commands might cause the AP to lose its network
connection.)
Set the length of time that the AP must be disconnected from the CAPWAP server before
waittime
rolling back the configuration
Enter the length of time in minutes to wait before rolling back the configuration
<number> (Default: 10 minutes; Range: 060000: Note: 0 means that the rollback point persists
indefinitely until the 'config rollback now' command is entered.)
config rollback now

config
now Return the configuration to a previously set rollback point immediately
config rollback {capwapdisconnect|nextreboot} [ waittime <number> ]

config
Perform the configuration rollback if a CAPWAP disconnection occurs for the defined
length of time (Note: This is useful when uploading a delta configuration, which does
capwapdisconnect
not require the AP to reboot, and you are concerned that some changes might disrupt
network connectivity for the AP.)
Perform the configuration rollback if a CAPWAP disconnection occurs for the defined
length of time after the AP reboots (Note: This is useful when uploading a full
nextreboot
configuration, which requires the AP to reboot, and you are concerned that the new
config might disrupt network connectivity for the AP.)
Set the length of time that the AP must be disconnected from the CAPWAP server before
waittime
rolling back the configuration
Enter the length of time in minutes to wait before rolling back the configuration
<number>
(Default: 10 minutes; Range: 260000)
config version <number>

config
version Set the version number for the current configuration file
<number> Enter the version number (Range: 14294967295)
console echo obscurepasswords

console Set console parameters
echo Set parameters for the display of data in the terminal window
Display passwords and sensitive networking keys as asterisks (***) in the CLI (Default:
obscurepasswords
Passwords and keys are replaced by asterisks instead of displaying original text)
console page <number>

Set the maximum number of lines of data displayed as a batch when retrieved from a
device (Note: If the number of retrieved lines exceeds the maximum, press TAB to return
page
the next batch or ENTER to retrieve the next single line. Press the Q key to cancel the
display of all further requested data and return to the command prompt.)
Set the maximum number of lines to display at a time (Default: 22, Range: 10100,
<number>
Disable: 0, which means that there is no maximum limit)
console serialport enable

serialport Set administrative access to the serial port
enable Enable access to the console serial port
console timeout <number>

timeout Set the amount of time required to close a console connection due to inactivity
<number> Set the console timeout value in minutes (Default: 10, Range: 060, Disable: 0)
datacollection collect interval <number>

Set parameters for collecting data about the types and capabilities of devices on the
datacollection
network and the types of applications and IP protocols they use
collect Set parameters for collecting data
interval Set the interval for collecting data about devices and their network usage
Enter the amount of time in hours during which the HiveAP collects data (Default: 1;
<number>
Range: 148)
datacollection enable
datacollection
Enable the local HiveAP to collect data about types and capabilities of devices on the
enable
network and their network usage (Default: Disabled)
datacollection report interval <number>

datacollection
report Set parameters for reporting data to HiveManager
interval Set the interval for reporting data to HiveManager
Enter the amount of time in hours between data reports to HiveManager (Default: 6;
<number>
Range: 048; Note: 0 disables sending reports to HiveManager.)
datacollection {maxcollect} <number>

datacollection
Set the maximum number of collection times that must elapse before clearing data that
maxcollect cannot be reported to HiveManager (Note: The default collection interval is 1 hour and
the default report interval is 6 hours.)
Enter the maximum number of times to collect data before clearing it if it cannot be
<number>
reported to HiveManager (Default: 24; Range: Range:148)
debug console [ {all} ]

debug Enable debug messages
console Show debug messages on the console
all Show all messages on the console
debug console level {emergency|alert|critical|error|warning|notification|info|debug}

level Specify a logging level
emergency Show emergencylevel log entries (Default: debug)
alert Show log entries from alert to emergency levels (Default: debug)
critical Show log entries from critical to emergency levels (Default: debug)
error Show log entries from error to emergency levels (Default: debug)
warning Show log entries from warning to emergency levels (Default: debug)
notification Show log entries from notification to emergency levels (Default: debug)
info Show log entries from info to emergency levels (Default: debug)
debug Show log entries for all severity levels (Default: debug)
debug console timestamp

timestamp Show debug messages timestamp
designatedserver idmproxy announce

designatedserver Set parameters for a dynamic server
Set parameters for a dynamic proxy server to forward RADIUS requests over a secure TLS
idmproxy
tunnel between the local device and ID Manager
Enable the designated proxy server on the Aerohive device and announce the server
announce
information to all devices in a DA domain (Default: Disabled)
designatedserver idmproxy dynamic

designatedserver Set parameters for a dynamic server
Set parameters for a dynamic proxy server to forward RADIUS requests over a secure TLS
idmproxy
tunnel between the local device and ID Manager
Enable the Aerohive device acting as a NAS to send RADIUS requests to the designated
dynamic
proxy server (Default: Disabled)
devicegroup <string> [ macobject <string> ] [ domainobject <string> ] [ osobject <string> ]

Set a device group containing various objects that the HiveAP can use to classify client
devicegroup
devices (Max: 64 groups)
<string> Enter a device group name (132 chars)
macobject Add a MAC object to the device group
<string> Enter the MAC object name (132 chars)
domainobject Add a domain object to the device group
<string> Enter the domain object name (132 chars)
osobject Add an OS object to the device group
<string> Enter the OS object name (132 chars)
devicegroup <string> ownership {cid|byod}

Set a device group containing various objects that the HiveAP can use to classify client
devicegroup
devices (Max: 64 groups)
Set an attribute for the client device group identifying its devices as userowned
ownership
(BYOD=bring your own device) or companyissued (CID=companyissued device)
cid Set the devices in the device group as companyissued
byod Set the devices in the device group as userowned
devicelocation <string>
devicelocation Set the device location
<string> Enter a device location (1128 chars)
dns domainname <string>
dns Set DNS (Domain Name System) parameters
domainname Set the domain name suffix for the local AP
<string> Enter the domain name suffix for the local AP (132 chars)
dns dynamicdns domainname <string>

dynamicdns Set dynamic DNS parameters
domainname Set dynamic DNS hostname
<string> Enter the dynamic DNS domainname (up to 256 chars)
dns dynamicdns enable

enable Enable dynamic DNS
dns dynamicdns serveraccount {dyndns|noip} username <string> password <string>

serveraccount Set dynamic DNS server account
dyndns Use noip server
noip Use noip server
username Set server account username
<string> Enter the server account username (132 chars)
password Set server account password
<string> Enter the service account password (132 chars)
dns serverip <ip_addr|ipv6_addr> [ {second|third} ]

serverip Set the IP address of the primary, secondary, or tertiary DNS server
<ip_addr> Enter the IP address of the primary, secondary, or tertiary DNS server
<ipv6_addr> Enter the IP address of the primary, secondary, or tertiary DNS server
second Assign the IP address to a secondary DNS server
third Assign the IP address to a tertiary DNS server
domainobject <string> domain <string>

Set parameters for a domain object that the HiveAP can use to assign a client that
domainobject belongs to a matching device domain to a user profile (Max: 64 domain objects per
HiveAP)
Enter a domain object name (132 chars; Note: The object name is an admindefined name
<string>
and does not have to be the name of a device domain.)
Add a device domain to the domain object (Note: Specify the domain to which devices in
domain
an LDAPstructured database belong.)
<string> Enter an domain name (164 chars)
exec aaa idmtest auth username <string> password <string> [ {pap|mschapv2} ] [ proxy <string> ] [
bindssid <string> ]
exec Execute a command to initiate a task immediately
Test TLS connectivity from the Aerohive device acting as the RadSec or AUTH proxy to the
idmtest
ID Manager gateway
auth Send a RADIUS AccessRequest message from the Aerohive device to the ID Manager
username Set the user name belonging to an account on the ID Manager
password Set the password that belongs to the same account as the user name on the ID Manager
pap
requests between the Aerohive device and ID Manager (Default: MSCHAPv2)
mschapv2
requests between the Aerohive device and ID Manager (Default: MSCHAPv2)
proxy Set parameters for connecting to an ID Manager proxy server
<string> Enter the IP address or domain name of the ID Manager proxy server (132 chars)
Set the SSID to which the user name binds for ID Manager testing (Note: By default,
bindssid wired links use the user namepassword pair for testing ID Manager accounts, so the user
name does not need to bind to an SSID.)
<string> Enter the name of the SSID to which you want to bind the user name (132 chars)
exec aaa idmtest {radsecproxy|authproxy}

Test TLS connectivity from the Aerohive device acting as the RadSec or AUTH proxy to the
idmtest
ID Manager gateway
radsecproxy Test TLS connectivity from the RadSec proxy to the ID Manager gateway
authproxy Test TLS connectivity from the AUTH proxy to the ID Manager gateway
exec aaa ldapsearch servertype {activedirectory|ldapserver|opendirectory} server <string> basedn

<string> binddn <string> password <string> [ {attributes} [ <string> ] ]
ldapsearch Execute a search of the LDAP database
servertype Set the type of LDAP server whose database you want to search
activedirectory Set the server type as an Active Directory server
ldapserver Set the server type as an OpenLDAP server
opendirectory Set the server type as an Open Directory server
server Set the IP address or resolvable domain name of the LDAP server
<string> Enter the IP address or domain name (up to 32 chars)
Set a node in the LDAP tree structure as the baseDN (distinguished name) from which to
basedn search for nodes one level below it or for information about one or all of its
attributes
Enter the baseDN (up to 256 chars) (Note: If there are any spaces, enclose the whole
<string>
string in quotation marks.)
Set the bindDN name and password for the user that has permission to search the LDAP
binddn
directory
<string> Enter the bindDN name (up to 256 chars)
password Set the bindDN password
attributes Search for attributes of the node specified as the baseDN
Enter the name of a specific attribute for which to search (Note: To see the user group
<string> attribute of the baseDN node when the default group attribute name is being used, do not
enter anything.)
exec aaa ldapsearch username <string> [ basedn <string> ] [ domain <string> ]

ldapsearch Execute a search of the LDAP database
username Set the user name to search for in the LDAP database
Set the baseDN (distinguished name) where the user profiles are located in the LDAP tree
basedn
structure
Enter the baseDN (1256 chars; Note: If there are any spaces, enclose the whole string
<string>
domain Set the domain name of the domain controller
<string> Enter a NT domain name (164 chars)
exec aaa librarysiptest primary username <string> password <string>

Test a simulated authentication process for a library patron on a library SIP (Standard
librarysiptest
primary Test the authentication process on the primary library SIP server
username Set the library patron's user name to submit to the library SIP server
password Set the library patron's password to submit to the library SIP server
exec aaa netadsinfo <string>

Retrieve information from the Active Directory server such as its IP address, Active
netadsinfo
Directory domain name, root BaseDN, and realm name
Enter the name of the realm to which the Active Directory server belongs (Example:
<string>
corp123.com; Note: The realm name is not case sensitive; Range: 164 chars)
exec aaa netjoin [ {primary|backup1|backup2|backup3} username <string> password <string> ]

netjoin Join the local AP RADIUS server to the domain controller
primary Join the local AP RADIUS server to the primary domain controller
backup1 Join the local AP RADIUS server to the backup1 domain controller
Set the admin user name for the local AP RADIUS server (Note: For the AP RADIUS server
username
to join the domain, its user account must have domain admin privileges or higher.)
password Set the password for the user name
exec aaa netjoin domain <string> fullname <string> server <string> username <string> password
<string> [ computerou <string> ]
netjoin Join the local AP RADIUS server to the domain controller
Enter the NetBIOS name of the domain (164 chars; Note: The domain name cannot contain
<string>
Set the full name of the domain to which the RADIUS server (local AP) and AD server both
fullname
belong
<string> Enter the full domain name (164 chars)
Set the IP address or resolvable domain name for the AD server (Note: The AD server is
server
the same as the domain controller.)
<string> Enter the IP address or domain name (up to 32 chars)
Set the admin user name that the local AP RADIUS server submits to the AD server (Note:
username For the AP RADIUS server to join the domain, its user account must have domain admin
privileges or higher.)
password Set the password for the user name
Set the OU (organizational unit) used on the Active Directory server where the AP RADIUS
computerou
server admin has privileges to add the AP as a computer in the domain
Enter the OU (Max: 256 chars; Format: ou/subou/subou; Note: If there are any spaces,
<string>
enclose the entire string in quotation marks.)
exec aaa ntlmauth username <string> password <string> [ domain <string> ]

Initiate NTLM (NT LAN Manager) authentication between the AP RADIUS server and the
ntlmauth
domain controller
Set the user name that the AP RADIUS server uses when authenticating itself to the
username
domain controller
Set the password that the AP RADIUS server uses when authenticating itself to the domain
password
controller
domain Set the domain name of the domain controller
<string> Enter a NT domain name (164 chars)
exec aaa radiustest <string> accounting

Send a RADIUS AccessRequest message from the HiveAP to a RADIUS authentication server
radiustest
or an AccountingRequest message to a RADIUS accounting server
<string> Enter the IP address or domain name of the RADIUS server (132 chars)
Check the network connectivity status of a RADIUS accounting server (Default: Check the
accounting
status of a RADIUS authentication server.)
exec aaa radiustest <string> callcheck <mac_addr>

radiustest
callcheck Do macbaseauth callcheck with Radius server
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
exec aaa radiustest <string> username <string> password <string> [ {pap|chap|mschapv2} ]

radiustest
username Set the user name belonging to an account on the RADIUS server
password Set the password that belongs to the same account as the user name on the RADIUS server
pap
requests between the HiveAP and RADIUS server (Default: MSCHAPv2)
chap
authentication requests between the HiveAP and RADIUS server (Default: MSCHAPv2)
mschapv2
requests between the HiveAP and RADIUS server (Default: MSCHAPv2)
exec activealarmsresending
activealarms
Make device resend all active alarms to HiveManager
resending
exec antennaalignment interface <wifix> peer <mac_addr> [ count <number> ] [ interval <number> ] [
textsize <number> ]
Set parameters for aligning a directional or sectional antenna connected to a radio in
antennaalignment
backhaul or dual (access and backhaul) mode with a specified peer
interface Set the interface bound to the radio whose antenna you want to align with that of a peer
Set the MAC address of the peer to which the HiveAP sends antenna alignment request
peer
frames
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
count Set the total number of request frames to send to the peer
<number> Enter the total number of request frames (Default: 60; Range: 11000)
interval Set the interval between each request frame transmission
textsize Set the amount of filler text in each request frame
<number> Enter the amount of filler text in bytes (Default: 16; Range: 162048)
exec auth <string> ppskmacunbinding mac <mac_addr>

auth Execute an auth module command
ppskmacunbinding Execute a PPSK MAC addressunbinding command
mac Remove the PPSK MAC address binding from a MAC address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
exec auth <string> ppskmacunbinding macppsk <mac_addr> <string>

macppsk Remove the PPSK MAC address binding from MAC address and PPSK
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
<string> Enter the PPSK of the station used (132 chars)
exec auth <string> ppskmacunbinding ppsk <string>

ppsk Remove the PPSK MAC address binding from a PPSK
<string> Enter the PPSK of the station used (132 chars)
exec bypasswanhardening
Disable WAN hardening to allow SSH, Telnet, and the remote sniffer tool to access the
device over the WAN interface (Note: Execute this command to allow remote access for
bypasswanhardening
troubleshooting. To restore WAN hardening, enter "no exec bypasswanhardening" or
reboot the device.)
exec capture remotesniffer [ user <string> <string> ] [ hostallowed <string> ] [ localport <number>
] [ promiscuous ]
capture Initiate packet capturing
remotesniffer Set parameters for a remote packet sniffer
Set user name and password that the remote sniffer uses when authenticating itself to
user
the HiveAP
Set the IP address or domain name of the remote packet sniffer that is allowed to
hostallowed
connect to the HiveAP
Set the port number on which the HiveAP listens for connection requests from the remote
localport
sniffer
<number> Enter the port number (Default: 2002; Range: 102465535)
Enable the wifi interfaces to operate in promiscuous mode during packet capturing
promiscuous
(Default: Disabled)
exec clientmonitor <mac_addr>

clientmonitor Monitor the activities of a client
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
exec datacollection {push|clear}

Perform an action on the data collected about the types and capabilities of devices on
datacollection
the network and the types of applications and IP protocols they use
push Push all collected data to HiveManager
clear Clear all collected data that is currently stored in the local HiveAP
exec delayexecute [ <number> ]

Delay the execution of commands for a period of time (Note: The delay period starts the
delayexecute moment you enter this command and ends when you enter the "no exec delayexecute"
command. This does not affect "show" commands.)
Enter an interval in seconds to wait after the delay period ends before executing the
<number>
submitted commands (Default: 5; Range: 160)
exec interface <wifix> spectralscan channel <number>

interface Execute the command through a specific interface
Execute a spectral scan of all the channels specified in the channel scan list and
spectralscan report signal frequency and amplitude, channel utilization, and types of interference to
HiveManager
channel Set the channel to be scanned

Enter the channel number (Note: To create a list of multiple channels, repeatedly enter
<number> this command with a different channel number for each one that you want to scan.)
(Range: 1165)
exec interface <wifix> spectralscan reportinterval <number>

HiveManager
reportinterval Set the length of time to collect spectral data and then report it to HiveManager
<number> Enter the report interval in seconds (Default: 1; Range: 130)
exec interface <wifix> spectralscan {start|stop}

HiveManager
start Start a spectral scan
stop Stop a spectral scan that is currently in progress
exec mobiledevicemanager aerohive statuschange <string>

mobiledevicemanager Set the mobile device manager parameters
aerohive Aerohive MDM notifies client status change to AP
statuschange Set status notification body as parameter
<string> MDM status notification body(1256 chars)
exec sshclient server <string> user <string>

sshclient Secure Shell client
server Set the domain name or IP address of the SSH server and, optionally, its port number
Enter the domain name (164 chars) or IP address and, optionally, the port number
<string>
(Default port: 22; Range: 102465535; Format: name:port or ip:port)
user Set the user name for logging in to the SSH server
exec usergroup <string> psktopmk

usergroup Execute a usergroup command
psktopmk Regenerate all users' PMKs (pairwise master keys) based on their PSKs (preshared keys)
exec wlanidp apclassify {rogue|friendly} <mac_addr> [ <mac_addr> ]

wlanidp Execute a command relating to WLAN IDP (intrusion detection and prevention)
apclassify
Classify one or more APs as rogue or friendly by MAC address
rogue Classify APs as rogue
friendly Classify APs as friendly
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
Set a range of MAC addresses
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
exec wlanidp mitigate {rogueap} <mac_addr>

mitigate Mitigate a specific rogue AP and its clients by sending a deauth DoS attack against them
rogueap Mitigate a specific rogue AP
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
exec wlanidp mitigate {rogueap} <mac_addr> interface <wifix>

mitigate Mitigate a specific rogue AP and its clients by sending a deauth DoS attack against them
rogueap Mitigate a specific rogue AP
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
exec {jsscheck|airwatchcheck|aerohivecheck} mobiledevice <mac_addr> enrollstatus

jsscheck Check the enrollment status of a mobile device on the JSS (JAMF software server)
airwatchcheck Check the enrollment status of a mobile device on the AirWatch
aerohivecheck Check the enrollment status of a mobile device on the Aerohive MDM server
mobiledevice Set the MAC address or ID of a mobile device
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
enrollstatus Retrieve the enrollment status of the mobile device
exit
exit Exit from the current mode
filter <number> l2 [ {data|ctl|mgmt} ] [ subtype <hex> ] [ srcmac <mac_addr> ] [ dstmac <mac_addr> ]

[ bssid <mac_addr> ] [ txmac <mac_addr> ] [ rxmac <mac_addr> ] [ error {crc|decrypt|mic|all|no} ] [
etype <hex> ]
filter Set packet capture filter parameters
l2 Set packet capture filter for layer 2 parameters
data Filter by data traffic
ctl Filter by ctl traffic
mgmt Filter by mgmt traffic
subtype Filter by frame subtype
<hex> Enter frame subtype value
srcmac Filter by source MAC address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
dstmac Filter by destination MAC address

<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
bssid Filter by BSSID
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
txmac Filter by transmitter MAC address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
rxmac Filter by receiver MAC address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
error Filter by error condition
crc Filter by crc error
decrypt Filter by decrypt error
mic Filter by mic error
all Filter by all error
no Filter by no error
etype Filter by Ethernet value
<hex> Enter the value indicating an ethernet type (ARP:0806; IP:0800; IPX:8137; RARP:8035)
filter <number> l3 [ srcip <ip_addr> ] [ dstip <ip_addr> ] [ protocol <number> ] [ srcport <number>
] [ dstport <number> ]
l3 Set packet capture filter for layer 3 parameters
srcip Filter by source IP address
<ip_addr> Enter a source IP address
dstip Filter by destination IP address
<ip_addr> Enter a destination IP address
protocol Filter by protocol number in IP header
<number> Enter a protocol value (UDP:17; TCP:6 ICMP:1)
srcport Filter by source port filter
<number> Enter a source port number
dstport Filter by destination port
<number> Enter a destination port number (HTTP:80; FTP:21; TELNET:23; DHCP:67; TFTP:79)
filter [ <number> ] [ direction bidirectional ]

direction Set filter traffic flowing direction
bidirectional Filter traffic flowing in both directions
forwardingengine drop {ipfragmentedpackets|toselfnonmanagementtraffic}

forwardingengine Set parameters to shape the behavior of the forwarding engine
drop Set parameters for dropping packets
ipfragmentedpackets Drop fragmented IP packets
toselfnon
Drop all nonmanagement traffic destined to the HiveAP itself
managementtraffic
forwardingengine interssidflood enable

interssidflood Forward multicast and broadcast traffic between access interfaces to protect SSIDs from
flooding (Default: Enabled)
enable Enable the protection of SSIDs from multicast and broadcast flooding
forwardingengine l2defaultroute interface <ethx> vlan <number> [ <number> ]

Set the default Layer 2 route for VLANs that must use an interface other than eth0
l2defaultroute
(Note: Do not set for the eth0 interface.)
Set the Ethernet interface that connects to the VLANs for which you want to create
interface
default routes (Note: Do not set this command for the eth0 interface.)
vlan Set a range of VLAN IDs that use the default Layer 2 route for the specified interface
<number> Enter the VLAN ID (Range: 14094)
Set a range of VLAN IDs
Enter the last VLAN ID in the range (Range: 14094; Note: The end of the VLAN ID range
<number>
must be equal to or greater than the VLAN ID at the start.)
forwardingengine log {firewalldroppedpackets|toselfsessions}

log Set logging parameters for packets
firewalldropped Log dropped packets that are denied by IP or MAC firewall policies (Default: Do not log
packets dropped packets)
Log the first packets of sessions destined for the HiveAP itself (Default: Do not log
toselfsessions
first packets)
forwardingengine macsessions syncvlan

macsessions Set MAC session parameters
Enable the local AP to inform its neighbors of the VLAN ID assigned to a client that
syncvlan initially connected it (Default: Disabled; Note: Enabling this option allows neighbors
to do a Layer 2 default route lookup based on VLAN.)
forwardingengine maxipsessionsperstation <number>

maxipsessionsper
Set the maximum number of IP sessions that can be created to or from a station
station
Enter the maximum IP sessions number per station (Range: 18000; Note: By default, IP
<number>
session limiting is disabled.)
forwardingengine maxmacsessionsperstation <number>

maxmacsessionsper
Set the maximum number of MAC sessions that can be created to or from a station
station
Enter the maximum MAC sessions number per station (Range: 18000; Note: By default, MAC
<number>
session limiting is disabled.)
forwardingengine proxyarp enable

proxyarp Set ARP proxying parameters
enable Enable learning MAC addresses and proxy replies to ARP requests
forwardingengine staticrule <string> action drop inif <ethx|aggx|redx> dstmac <mac_addr>

staticrule Add a static packetforwarding rule that preempts dynamic forwarding decisions
<string> Enter the name of the packetforwarding rule (132 chars)
action Set the action to apply to packets matching the static packetforwarding rule
drop Drop packets that match the rule
inif Set the inbound interface
dstmac Set the destination MAC address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
forwardingengine staticrule <string> action drop inif <ethx|aggx|redx> srcmac <mac_addr> dstmac
<mac_addr>
srcmac Set the source MAC address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
forwardingengine staticrule <string> action drop inif <ethx|aggx|redx> srcoui <oui> dstmac
<mac_addr>
Set the source OUI, apply the rule to any MAC address sharing the same OUI as the MAC
srcoui
address
Enter the OUI (Note: You can use colons, dashes, or periods to format the OUI. Examples:
<oui>
Apple iPhone=00:1b:63; DLink Phone=00179a; Vocera=00.09.ef.)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
forwardingengine staticrule <string> action drop inif <wifix.y> dstmac <mac_addr> txmac
<mac_addr>
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
Set the MAC address of the transmitter; that is the MAC address of the device on the
txmac
network that forwarded the frame to the HiveAP
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
forwardingengine staticrule <string> action drop inif <wifix.y> srcmac <mac_addr> dstmac
<mac_addr> txmac <mac_addr>
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
txmac
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
forwardingengine staticrule <string> action drop inif <wifix.y> srcoui <oui> dstmac <mac_addr>
txmac <mac_addr>
srcoui
address
<oui>
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
txmac
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
<ethx|aggx|redx>
staticrule
Add a static packetforwarding rule that preempts dynamic forwarding decisions
pass Pass packets that match the rule
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
outif Set the outbound interface
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
Set the MAC address of the receiver; that is the MAC address of the device on the
rxmac
network to which the HiveAP forwards the frame
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
forwardingengine staticrule <string> action pass inif <ethx|aggx|redx> srcmac <mac_addr> dstmac
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)

<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
forwardingengine staticrule <string> action pass inif <ethx|aggx|redx> srcmac <mac_addr> dstmac
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
rxmac
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
forwardingengine staticrule <string> action pass inif <ethx|aggx|redx> srcoui <oui> dstmac
srcoui
address
<oui>
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)

forwardingengine staticrule <string> action pass inif <ethx|aggx|redx> srcoui <oui> dstmac
srcoui
address
<oui>
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
rxmac
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
forwardingengine staticrule <string> action pass inif <wifix.y> dstmac <mac_addr> txmac
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
txmac
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
forwardingengine staticrule <string> action pass inif <wifix.y> dstmac <mac_addr> txmac
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
txmac
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
rxmac
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
forwardingengine staticrule <string> action pass inif <wifix.y> srcmac <mac_addr> dstmac
<mac_addr> txmac <mac_addr> outif <ethx|aggx|redx>
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
txmac
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
forwardingengine staticrule <string> action pass inif <wifix.y> srcmac <mac_addr> dstmac
<mac_addr> txmac <mac_addr> outif <wifix.y> rxmac <mac_addr>
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
txmac
<mac_addr> Enter a MAC address (Note: You can use colons, dashes, or periods to format the address.
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
rxmac
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
forwardingengine staticrule <string> action pass inif <wifix.y> srcoui <oui> dstmac <mac_addr>
txmac <mac_addr> outif <ethx|aggx|redx>
srcoui
address
<oui>
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
txmac
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
forwardingengine staticrule <string> action pass inif <wifix.y> srcoui <oui> dstmac <mac_addr>
txmac <mac_addr> outif <wifix.y> rxmac <mac_addr>
srcoui
address
<oui>
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
txmac
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
rxmac Set the MAC address of the receiver; that is the MAC address of the device on the
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
forwardingengine tunnel selectivemulticastforward allowall except <ip_addr|ip_addr/mask>

tunnel Set tunnel (GRE tunnel or GREoverIPsec tunnel) parameters
selectivemulticast
Selective multicast forwarding through GRE tunnels
forward
Allow the forwarding of all IP multicast traffic through tunnels except for specified IP
allowall
multicast groups
except Block specific IP multicast traffic through tunnels
Enter the IP address and netmask of the multicast group to block (Example: 224.1.1.1 or
<ip_addr>
224.1.1.0/24)
Enter the IP address and netmask of the multicast group to block (Example: 224.1.1.1 or
<ip_addr/netmask>
224.1.1.0/24)
forwardingengine tunnel selectivemulticastforward blockall

selectivemulticast
forward
Block the forwarding of all IP multicast traffic through tunnels except for specified IP
blockall
multicast groups
forwardingengine tunnel selectivemulticastforward blockall except <ip_addr|ip_addr/mask>

selectivemulticast
forward
Block the forwarding of all IP multicast traffic through tunnels except for specified IP
blockall
multicast groups
except Allow specific IP multicast traffic through tunnels
Enter the IP address and netmask of the multicast group to allow (Example: 224.1.1.1 or
<ip_addr>
224.1.1.0/24)
Enter the IP address and netmask of the multicast group to allow (Example: 224.1.1.1 or
<ip_addr/netmask>
224.1.1.0/24)
forwardingengine tunnel tcpmssthreshold enable

tcpmssthreshold Set TCP MSS (Maximum Segment Size) parameters
enable Enable the TCP MSS threshold feature
forwardingengine tunnel tcpmssthreshold thresholdsize <number>

tcpmssthreshold Set TCP MSS (Maximum Segment Size) parameters
thresholdsize Set the TCP MSS threshold size
Enter the TCP MSS size in bytes(GRE Tunnel Range: 641414; GREoverIPSec Tunnel Range:
<number>
641336)
history <number>
history Set the capacity for command history
<number>
Enter the max number of commands to store in command history (Default: 20; Range: 150)
hive <string>
hive Create a hive or set hive parameters
hive <string> fragthreshold <number>

fragthreshold Set fragment threshold parameters for the hive
<number> Enter the fragment threshold in bytes for the hive (Default: 2346; Range: 2562346)
hive <string> manage all

manage Set management service parameters
Enable all manageability options (ping, SNMP, SSH, and Telnet) for mgt0 through wireless
all backhaul interfaces in this hive (Defaults: ping enabled, SNMP disabled, SSH enabled,
Telnet disabled)
hive <string> manage {Telnet|SSH|SNMP|ping}

Enable Telnet manageability of mgt0 through wireless backhaul interfaces in this hive
Telnet
(Default: Disabled)
Enable SSH manageability of mgt0 through wireless backhaul interfaces in this hive
SSH
(Default: Enabled)
Enable SNMP manageability of mgt0 through wireless backhaul interfaces in this hive
SNMP
(Default: Disabled)
Enable mgt0 to respond to pings through subinterfaces bound to this SSID (Default:
ping
Enabled)
hive <string> neighbor connectingthreshold <number> pollinginterval <number>

neighbor Set the threshold parameters for connecting wirelessly with neighboring hive members
Set the minimum signal strength threshold required for connecting with a neighboring
connectingthreshold
hive member
<number> Enter a minimum signal strength value in dBm (Default: 80; Range: 90~55)
Set the time interval in minutes for polling the signal strength of neighboring hive
pollinginterval
members
<number> Enter the polling time interval (Default: 1 minute; range: 160)
hive <string> neighbor connectingthreshold {low|medium|high} pollinginterval <number>

neighbor Set the threshold parameters for connecting wirelessly with neighboring hive members
Set the minimum signal strength threshold required for connecting with a neighboring
connectingthreshold
hive member
low Set a relatively low minimum signal strength threshold (85dBm)
medium Set a relatively moderate minimum signal strength threshold (80dBm)
high Set a relatively high minimum signal strength threshold (75dBm)
pollinginterval Set the time interval in minutes for polling the signal strength of neighboring hive
members
<number> Enter the polling time interval (Default: 1 minute; range: 160)
hive <string> password <string>

password Set a key for hive member authentication
Enter a string (863 chars) for hive member authentication (Default: a default password
<string>
is derived from the hive name)
hive <string> rtsthreshold <number>

rtsthreshold Set the RTS (request to send) threshold for the hive
Enter the packet size for the RTS threshold for the hive (Default: 2346 bytes; Range: 1
<number>
2346)
hive <string> security macfilter <string>

security Set hive security parameters
macfilter Assign a filter for MAC addresses or OUIs (organizational unique identifiers)
<string> Enter the filter name for MAC addresses or OUIs (organizational unique identifiers)
hive <string> security wlan dos stationlevel frametype {assocreq|auth|eapol} ban <number>
wlan Set WLAN parameters
dos Set WLAN DoS (Denial of Service) parameters
stationlevel Set DoS parameters at stationlevel
frametype Set WLAN DoS (Denial of Service) frame type
assocreq Specify WLAN DoS frame type assocreq
auth Specify WLAN DoS frame type auth
eapol Specify WLAN DoS frame type eapol
ban Set the period of time to ignore frames after a theshold has been crossed
Enter the period of time in seconds to ignore frames after a theshold has been crossed
<number>
(Default: 60; Min: 0 Max: None)
hive <string> security wlan dos stationlevel frametype {assocreq|auth|eapol} ban forever
forever Set ban forever
hive <string> security wlan dos {hivelevel|stationlevel} frametype {probereq|proberesp|assoc

req|assocresp|disassoc|auth|deauth|eapol|all}
hivelevel Set DoS parameters at hivelevel
probereq Specify WLAN DoS frame type probereq
proberesp Specify WLAN DoS frame type proberesp
assocresp Specify WLAN DoS frame type assocresp
disassoc Specify WLAN DoS frame type disassoc
deauth Specify WLAN DoS frame type deauth
all Specify WLAN DoS frame type all

req|assocresp|disassoc|auth|deauth|eapol|all} alarm <number>
alarm Set the interval in seconds between alarms to indicate continuous DoS conditions
Enter the interval in seconds between alarms to indicate continuous DoS conditions
<number>
(Default: 60 secs; Min: 0 Max: None)

req|assocresp|disassoc|auth|deauth|eapol|all} threshold <number>
Set the frame threshold in ppm (packets per minute) that must be crossed to trigger an
threshold
alarm
Enter threshold in ppm (Default: hivelevel probereq 12000, proberesp 24000, eapol
6000, auth 6000, assocreq 6000, assocresp 2400, all others 1200; stalevel probereq
<number>
1200 ppm, proberesp 2400, eapol 600, auth 600, assocreq 600, assocresp 240, all
others 120; Min: 0 Max: None)
hive <string> wlanidp innetap

wlanidp Set WLAN IDP (intrusion detection and prevention) parameters
Mitigate rogue APs and their clients only if the rogues are in the same backhaul network
innetap
as the HiveAPs that detected them (Default: Mitigate all rogue APs and their clients)
hive <string> wlanidp maxmitigatornum <number>

Set the maximum number of detector APs that can be assigned as mitigator APs to perform
maxmitigatornum
mitigation on a rogue and its clients
Enter the maximum number of mitigator APs (Default: 1; Range: 01024; 0 means all
<number>
detector APs can be assigned to perform rogue mitigation))
hive <string> wlanidp mitigationmode {automatic|semiautomatic|manual}

mitigationmode Set the mode for mitigating rogue APs and their clients
Set the arbitrator AP to appoint a mitigator AP and start the mitigation process
automatic
automatically (Default: semiautomatic)
Set the arbitrator AP to appoint a mitigator AP automatically but start the mitigation
semiautomatic
process manually (Default: semiautomatic)
manual Set the mitigator AP and start the mitigation process manually (Default: semiautomatic)
hive <string> wlanidp mitigationmode {automatic|semiautomatic} action {mitigate|report}

mitigationmode Set the mode for mitigating rogue APs and their clients
automatic Set the arbitrator AP to appoint a mitigator AP and start the mitigation process
automatically (Default: semiautomatic)
Set the arbitrator AP to appoint a mitigator AP automatically but start the mitigation
semiautomatic
process manually (Default: semiautomatic)
Set the action that you want detector APs to take after discovering rogue APs and their
action
clients
mitigate Mitigate rogue APs and their clients (Default: Rogue mitigation)
report Report rogue APs and their clients (Default: Rogue mitigation)
hive <string> wlanidp mitigatorreevalperiod <number>

mitigatorreeval Set the recurring period of time after which the arbitrator AP reevaluates which HiveAPs
period to make mitigator APs
<number> Enter the period of time in minutes (Default: 5 mins; Range: 11440)
hive <string> wlanidp queryinterval <number>

queryinterval Set a period of time in minutes for DA to query apclassify info from HiveManager
Enter the period of time in minutes (Default: 60 mins; Range: 6043200; Note: 43200
<number>
minutes is 30 days)
hive <string> wlanidp waitinterval <number>

Set a time interval for a newly promoted arbitrator AP to wait for AP classification
waitinterval information from HiveManager or the previous arbitrator, or to wait for the previous
arbitrator to come back online, before taking over arbitration responsibilities
<number> Enter the time interval in minutes (Default: 1 minute; Range: 110)
hiveui cas client server name <string>

Enable the NetConfig UI for defining network settings, configuring settings to connect
hiveui
to HiveManager, and uploading a new HiveOS image
Set client and server parameters for CAS (Central Authentication Service) to
cas
authenticate users such as teachers accessing TeacherView
client Set parameters for the local AP to act as a CAS client
server Set parameters for communicating with the CAS server
name Set the IP address or resolvable domain name for the CAS server
<string> Enter the IP address or domain name (max 32 chars) of the CAS server
hiveui cas client server port <number>

hiveui
Set client and server parameters for CAS (Central Authentication Service) to
cas
authenticate users such as teachers accessing TeacherView
client Set parameters for the local AP to act as a CAS client
server Set parameters for communicating with the CAS server
port Set the destination TCP port number for the CAS server
<number> [1~65535]Enter the TCP port number (Default: 443; Range: 165535)
hiveui enable
hiveui
enable Enable the HiveUI
hostname <string>
hostname Set the hostname of the AP
<string> Enter the hostname of the AP (132 chars)
interface <blex> ibeacon [ uuid <string> ] [ major <number> ] [ minor <number> ] [ measuredpower
<number> ]
interface Set interface parameters
<blex> Enter the name of the iBeacon interface, where x = 0
ibeacon Select the Bluetooth iBeacon device
uuid Set the UUID (universally unique identifier) of the iBeacon
<string> Enter the uuid (32 chars) (Default: 4165726F686976654E6574776F726B73 (AerohiveNetworks))
major Set the major value of the iBeacon device
<number> Enter the major (Default: 1; Range: 065535)
minor Set the minor value of the iBeacon device
<number> Enter the minor (Default: 1; Range: 065535)
measuredpower Set measured power of the iBeacon device
<number> Enter the measured power value in dBm (Default: 59; Range: 128~127)
interface <blex> ibeacon enable

ibeacon Select the Bluetooth iBeacon device
enable Enable the iBeacon device
interface <blex> ibeaconmonitor enable

ibeaconmonitor Bluetooth iBeacon device monitor
enable Enable the iBeacon Monitor
interface <ethx> bind <aggx>

bind Bind the Ethernet interface to a redundant or aggregate interface
interface <ethx> bind <redx> [ primary ]

bind Bind the Ethernet interface to a redundant or aggregate interface
Set the Ethernet interface as the primary interface of the redundant or aggregate
primary
interface (Default: eth0 is picked as the primary)
interface <ethx> clientmonitorpolicy <string>

Assign a Client Monitor policy to automatically detect, analyze and report problems
clientmonitorpolicy
about the clients which access network through the specified Ethernet interface
interface <ethx> duplex {full|half|auto}

duplex Set the duplex for the interface
full Set the duplex of ethernet interface to full (Default: auto)
half Set the duplex of ethernet interface to half (Default: auto)
auto Set the duplex of ethernet interface to auto (Default: auto)
interface <ethx> ip <ip_addr/netmask>

ip Set an IP address and netmask for the interface
<ip_addr/netmask> Enter the interface IP address and netmask
interface <ethx> mode wan

Set the operational mode for the interface (Default: backhaul except wan in case of
mode
usbnet)
Set the interface in WAN mode, making it a layer 3 interface through which the default
wan
IP route for traffic to and from the main LAN passes
interface <ethx> nativevlan <number>

Set the native (untagged) VLAN used by the switch infrastructure in the surrounding
nativevlan
Ethernet network
<number> Enter the native (untagged) VLAN (Range: 14094)
interface <ethx> pppoe authmethod {pap|chap|any}

Set PPPoE (PointtoPoint Protocol over Ethernet) parameters for the WAN interface
pppoe
(Note: This command only applies to a device functioning as a router.)
Set the type of authentication protocol that the ISP requires clients to use (Default:
authmethod
any)
Use PAP (Password Authentication Protocol) as the method for sending authentication
pap
requests between the device and ISP
Use CHAP (Challenge Handshake Authentication Protocol) as the method for sending
chap
authentication requests between the device and ISP
any Use either PAP or CHAP
interface <ethx> pppoe enable

pppoe
enable Enable PPPoE
interface <ethx> pppoe username <string> password <string>
pppoe
Set the user name that the device sends to the ISP to authenticate itself when
username
establishing a PPPoE session with the access concentrator
password Set the password that the device uses to authenticate itself to the ISP
interface <ethx> securityobject <string>

securityobject Assign a security object to control network access through this interface
<string> Enter the security object name (132 chars)
interface <ethx> speed {10|100|1000|auto}

speed Set the speed for the interface
10 Set the speed of ethernet interface to 10 Mbps (Default: auto)
auto Set the speed of ethernet interface to auto Mbps (Default: auto)
interface <ethx> supplicant <string>

supplicant Set parameters for 802.1x client on ethernet
<string> Enter the supplicant name (132 chars)
interface <ethx|aggx|redx> allowedvlan <number> [ <number> ]

allowedvlan Set a list of VLAN IDs by which traffic allowed to cross the interface can be filtered
<number> Enter the VLAN ID to be allowed (Range: 14094)
Set a range of allowed VLAN IDs
Enter the last VLAN ID in the range (Range: 14094; Note: The end of the VLAN ID range
<number>
must be equal to or greater than the VLAN ID at the start.)
interface <ethx|aggx|redx> allowedvlan {all|auto}

allowedvlan Set a list of VLAN IDs by which traffic allowed to cross the interface can be filtered
all Allow traffic tagged with any VLAN ID
auto Allow traffic whose VLAN ID matches that of the management interface, virtual management
interface, native VLAN, or the default VLAN configured in user profiles
interface <ethx|aggx|redx> interstationtraffic

Set the HiveAP to permit traffic between stations connected to one or more of its access
interstationtraffic
interfaces (Default: Enabled)
interface <ethx|aggx|redx> linkdiscovery {lldp|cdp}

Enable the communication of networkrelated information with neighboring network devices
linkdiscovery
through the interface (Default: LLDP enabled; CDP enabled)
lldp Set LLDP (Link Layer Discovery Protocol) parameters on the interface
cdp Set CDP (Cisco Discovery Protocol) parameters on the interface
interface <ethx|aggx|redx> maclearning enable

maclearning Set parameters for MAC address learning
enable Enable MAC address learning on the Ethernet interface
interface <ethx|aggx|redx> maclearning idletimeout <number>

Set the timeout for automatically clearing an inactive dynamically learned MAC address
idletimeout
from the MAC learning table
<number> Enter the timeout value in seconds (Default: 180; Range: 103600)
interface <ethx|aggx|redx> maclearning static <mac_addr>

static Set statically defined MAC address entries
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
interface <ethx|aggx|redx> manage {Telnet|SSH|SNMP|ping|all}

<ethx>
Enter the name of an Ethernet interface, where x = 0 or 1

Telnet Enable Telnet manageability of mgt0 through this interface (Default: Disabled)
SSH Enable SSH manageability of mgt0 through this interface (Default: Enabled)
SNMP Enable SNMP manageability of mgt0 through this interface (Default: Disabled)
ping Enable mgt0 to respond to pings through this interface (Default: Enabled)
Enable all manageability options (ping, SNMP, SSH, and Telnet) for mgt0 through this
all
interface
interface <ethx|aggx|redx> mode bridge802.1q userprofileattribute <number>

mode
usbnet)
Set the interface in bridge802.1Q mode, making it a VLANaware layer 2 interface to
enable the bridging of traffic between 802.1Q VLANcapable devices in a wired LAN
bridge802.1q
segment and the wireless LAN (Note: The default MAC route is never on an interface in
this mode.)
<number> Enter a numeric value for a single RADIUS attribute (Default:0; Range: 04095)
interface <ethx|aggx|redx> mode {bridge802.1q|backhaul}

mode
usbnet)
Set the interface in bridge802.1Q mode, making it a VLANaware layer 2 interface to
enable the bridging of traffic between 802.1Q VLANcapable devices in a wired LAN
bridge802.1q
segment and the wireless LAN (Note: The default MAC route is never on an interface in
this mode.)
Set the interface in backhaul mode, making it a VLANaware layer 2 interface through
backhaul
which the default MAC route for traffic to and from the main LAN passes
interface <ethx|aggx|redx> qosclassifier <string>

qosclassifier Assign a QoS classification profile (classifier) to the interface
<string> Enter the QoS classifier profile name (1 to 32 chars)
interface <ethx|aggx|redx> qosmarker <string>

qosmarker Assign a QoS marker profile to the interface
<string> Enter the QoS marker profile name (1 to 32 chars)
interface <ethx|aggx|redx> ratelimit broadcast <number>

ratelimit Set parameter for interfacebased rate limiting
broadcast Set broadcast traffic rate limiting
Enter the maximum rate for incoming broadcast traffic for the interface (Default: 10000
<number>
Kbps; Range: 020000)
interface <ethx|aggx|redx> ratelimit multicast <number>

multicast Set multicast traffic rate limiting
Enter the maximum rate for incoming multicast traffic for the interface (Default: 20000
<number>
interface <ethx|aggx|redx> ratelimit unicast <number>

unicast Set unicast traffic rate limiting
Enter the maximum rate for incoming unicast traffic for the interface (Default: 1000000
<number>
interface <ethx|aggx|redx> ratelimit {multicast|broadcast|unicast} enable

multicast Set multicast traffic rate limiting
broadcast Set broadcast traffic rate limiting
unicast Set unicast traffic rate limiting
Enable rate limiting on the interface for this type of traffic (Default:
enable
multicast/broadcast Enable,unicast Disable)
interface <ethx|aggx|redx> shutdown

shutdown Disable the interface
interface <ethx|redx|aggx> mode bridgeaccess [ userprofileattribute <number> ]
mode
usbnet)
Set the interface in bridgeaccess mode, making it a layer 2 interface to enable the
bridgeaccess bridging of traffic between devices in a single VLAN in a wired LAN segment and the
wireless LAN (Note: The default MAC route is never on an interface in this mode.)
<number> Enter a numeric value for a single RADIUS attribute (Default:0; Range: 04095)
interface <ethx|usbnetx> mode wan nat

<usbnetx> Enter the name of the wireless USB modem interface, where x = 0
mode
usbnet)
wan
Enable NAT (network address translation) on the interface to translate the source IP
nat address and port number in fromaccess packets to the IP address of the Ethernet/USB
network interface and a randomly chosen port number (Default: Enabled)
interface <ethx|usbnetx> mode wan natpolicy <string>

mode
usbnet)
wan
natpolicy Enable NAT (network address translation) policy on the interface
<string> Enter ip nat policy name (132 chars)
interface <ethx|usbnetx> mode wan priority <number>

mode
usbnet)
wan
priority Set wan priority for the interface
Enter the priority, where a smaller number means a higher priority (Default: eth0 1 |
<number>
ethx x * 10 | usbnet0 600 ; Range: 1 9999)
interface <mgtx.y> ip <ip_addr/netmask>

ip Set IP address for the virtual management interface
<ip_addr/netmask> Enter the virtual management interface IP address and netmask
interface <mgtx.y> manage ping
ping Enable the virtual management interface to respond to pings (Default: Enabled)
interface <mgtx.y> vlan <number>

vlan Set the VLAN ID for the interface
interface <mgtx> defaultipprefix <ip_addr/netmask>

Set the network address to combine with the automatically generated host IP address to
defaultipprefix
make a complete IP address (The netmask for the default IP address is 255.255.0.0)
Enter the network address/netmask (Default: 192.168.0.0/16; Note: Only 8, 16, and 24bit
<ip_addr/netmask>
netmasks are supported.)
interface <mgtx> defaultipprefix <ip_addr>

Set the network address to combine with the automatically generated host IP address to
defaultipprefix
make a complete IP address (The netmask for the default IP address is 255.255.0.0)
<ip_addr> Enter the network address (Default: 192.168.0.0)
interface <mgtx> dhcp client fallbacktostaticip

dhcp Set DHCP parameters
client Set DHCP client parameters
Assign the static IP address to mgt0 when it does not receive an address through DHCP by
fallbacktostaticip
the end of the timeout interval
interface <mgtx> dhcp keepalive enable

Set parameters for periodically checking network connectivity to DHCP servers on
keepalive
different VLANs
Enable the checking of network connectivity to DHCP servers in the specified VLAN range
enable and also in VLANs set in user profile definitions or assigned by RADIUS servers, the
native VLAN, and the management interface VLAN (Default: Disabled)
interface <mgtx> dhcp keepalive interval <number>

keepalive
different VLANs
interval Set the interval between periodic connectivity status checks
<number> Enter the interval in seconds (Range: 6086400; Default: 3600)
interface <mgtx> dhcp keepalive retry <number>
keepalive
different VLANs
Set the number of times to retry sending a probe that does not elicit a response from a
retry
DHCP server
<number> Enter the retry value (Range: 110; Default: 2)
interface <mgtx> dhcp keepalive timeout <number>

keepalive
different VLANs
timeout Set the timeout for waiting for a response to a DHCP probe
<number> Enter the timeout value in seconds (Range: 160; Default:10)
interface <mgtx> dhcp keepalive vlan <number> [ <number> ]

keepalive
different VLANs
vlan Set the range of VLANs in which to probe for DHCP servers
<number> Enter the start of the VLAN range (Range: 14094)
<number> Enter the end of the VLAN range (Range: 14094)
interface <mgtx> dhcpprobe vlanrange <number> <number> [ timeout <number> ] [ retries <number> ]
dhcpprobe Probe for DHCP servers in one or more VLANs
vlanrange Set the range of VLANs in which to probe for a DHCP server
<number> Enter the start of the VLAN range (Range: 14094)
<number> Enter the end of the VLAN range (Range: 14094)
timeout Set the timeout for waiting for a response to a probe
<number> Enter the timeout value (Default: 10 secs; Range: 160)
Set the number of times to retry sending a probe that does not elicit a response from a
retries
DHCP server
<number> Enter the retry value (Default: 1; Range: 110)
interface <mgtx> hive <string>

Set the hive profile to the mgt0 interface or enable/disable the wifi interface used for
hive
hive communications
interface <mgtx> ip <ip_addr/netmask>

ip Set mgt0 IP address
<ip_addr/netmask> Enter mgt0 IP address/netmask
interface <mgtx> ip <ip_addr> <netmask>

ip Set mgt0 IP address
<ip_addr> Enter mgt0 IP address
<netmask> Enter mgt0 netmask
interface <mgtx> ipv6 <ipv6_addr/mask> [ eui64 ]

ipv6 Set mgt0 IPv6 address
<ipv6_addr/mask> Enter mgt0 IPv6 address/netmask
eui64 Use eui64 interface identifier
interface <mgtx> ipv6 <ipv6_addr> linklocal

<ipv6_addr> Enter mgt0 IPv6 link local address
linklocal Set mgt0 ipv6 linklocal address
interface <mgtx> ipv6 autoconfig

autoconfig Enable IPv6 autoconfig
interface <mgtx> ipv6 dhcp client

interface <mgtx> mtu <number>

mtu Set the MTU (maximum transmission unit) to determine when to start fragmenting packets
<number> Enter the MTU value in bytes (Default: 1500; Range: 1001500)
interface <mgtx> nativevlan <number>

Set the native (untagged) VLAN that the switch infrastructure in the surrounding wired
nativevlan
and wireless backhaul network uses
<number> Enter the native (untagged) VLAN (Default: 1; Range: 14094)
interface <mgtx> vlan <number>
Set the VLAN for administrative access to the HiveAP, management traffic between HiveAPs
vlan
and HiveManager, and control traffic among hive members
<number> Enter the VLAN ID for the interface (Default: 1; Range: 14094)
interface <mgtx|ethx> dhcp client

interface <mgtx|ethx> dhcp client addressonly

Set the AP to use only the IP address, netmask, and gateway received through DHCP
addressonly
instead of all TCP/IP settings (Default: Use all TCP/IP settings received through DHCP)
interface <mgtx|ethx> dhcp client option custom ppskserverip <number>

option Set DHCP client options
custom Set DHCP client custom options
ppskserverip Set a custom DHCP option ID for a private PSK server
<number> Enter the custom DHCP option ID (Range: 1255; Suggested ID numbers: private PSK = 229)
interface <mgtx|ethx> dhcp client option custom radiusserverip <number>

radiusserverip Set a custom DHCP option ID for a RADIUS authentication or accounting server
Enter the custom DHCP option ID for a RADIUS authentication server (Range: 1255;
<number>
Suggested ID numbers: RADIUS authentication = 230)
interface <mgtx|ethx> dhcp client option custom radiusserverip accounting <number>

radiusserverip Set a custom DHCP option ID for a RADIUS authentication or accounting server
accounting Set a custom DHCP option ID for a RADIUS accounting server
Enter the custom DHCP option ID for a RADIUS accounting server (Range: 1255; Suggested
<number>
ID numbers: RADIUS accounting = 231)
interface <mgtx|ethx> dhcp client option custom {syslogserverip|hivemanagerip|backuphivemanager

ip} <number>
syslogserverip Set a custom DHCP option ID for a syslog server ip
hivemanagerip Set a custom DHCP option ID for HiveManager ip
backuphivemanagerip Set a custom DHCP option ID for Backup HiveManager ip
Enter the custom DHCP option ID (Range: 1255; Suggested ID numbers: HiveManager ip =
<number>
226; Syslog server ip = 228; Backup Hivemanager ip = 233)
interface <mgtx|ethx> dhcp client option custom {syslogserver|hivemanager|backuphivemanager}

<number>
syslogserver Set a custom DHCP option ID for a syslog server name
hivemanager Set a custom DHCP option ID for HiveManager name
backuphivemanager Set a custom DHCP option ID for Backup HiveManager name
Enter the custom DHCP option ID (Range: 1255; Suggested ID numbers : HiveManager name=
<number>
225; Syslog server name= 227; Backup HiveManagername=232)
interface <mgtx|ethx> dhcp client prefersubnet <ip_addr/netmask>

prefersubnet Set prefer subnet for DHCP client
<ip_addr/netmask> Enter prefer subnet for DHCP client
interface <mgtx|ethx> dhcp client timeout <number>

<ethx>

Set the interval to wait for a response from the DHCP server before applying the admin
timeout
defined or default network settings
<number> Enter the timeout value in seconds (Default: 20; Range: 03600)
interface <mgtx|mgtx.y> dhcpserver enable

dhcpserver Set DHCP server parameters
enable Enable the DHCP server on the interface
interface <mgtx|mgtx.y> dhcpserver ipbinding <ip_addr> <mac_addr>

ipbinding Set binding parameters between the IP address and MAC address of a client
<ip_addr> Enter the IP address in the static lease
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
interface <mgtx|mgtx.y> dhcpserver ippool <ip_addr> <ip_addr>

Set the IP address pool from which the DHCP server draws addresses when making
ippool
assignments
<ip_addr> Enter the first address in the range that makes up the IP address pool
<ip_addr> Enter the last address in the range that makes up the IP address pool
interface <mgtx|mgtx.y> dhcpserver options custom <number> hex <string>

options Set the DHCP options to be included in DHCPOFFER and DHCPACK messages
custom Set a custom DHCP option
Enter the custom option number (Ranges: 1224, 227254; Note: Numbers 1179 are standard
<number> DHCP options; use with caution. Number 43 is reserved for Vendor specific; Numbers 225
and 226 are reserved for HiveManager.)
hex Set the custom option data type as a hexadecimal digit
Enter the hexadecimal digit (1254 chars; Note: For option 46, which sets the NetBIOS
<string>
over TCP/IP node type, the string must be 1, 2, 4, or 8.)
interface <mgtx|mgtx.y> dhcpserver options custom <number> integer <number>

integer Set the custom option data type as an integer
<number> Enter the integer (Range: 02147483647)
interface <mgtx|mgtx.y> dhcpserver options custom <number> ip <ip_addr>

ip Set the custom option data type as an IP address
interface <mgtx|mgtx.y> dhcpserver options custom <number> string <string>

string Set the custom option data type as a string
<string> Enter the string (1255 chars)
interface <mgtx|mgtx.y> dhcpserver options defaultgateway <ip_addr> [ {natsupport} ]

defaultgateway Set the default gateway for DHCP clients
Enter the default gateway (Note: The gateway IP address cannot be the same as that of
<ip_addr>
the interface.)
Enable NAT support(Note: AP will automatically generates ARP response for default
natsupport
gateway specified in DHCP server options.)
interface <mgtx|mgtx.y> dhcpserver options domainname <string>

domainname Set the domain name for DHCP clients
<string> Enter the domain name (132 chars)
interface <mgtx|mgtx.y> dhcpserver options hivemanager <ip_addr>

hivemanager Set the IP address or domain name of the HiveManager that you want APs to contact
<ip_addr> Enter the IP address (Note: Use DHCP option 226.)
interface <mgtx|mgtx.y> dhcpserver options hivemanager <string>

hivemanager Set the IP address or domain name of the HiveManager that you want APs to contact
<string> Enter the domain name (Length: 164 chars; Note: Use DHCP option 225.)
interface <mgtx|mgtx.y> dhcpserver options leasetime <number>

leasetime Set the length of the DHCP lease
<number> Enter the lease time in seconds (Default: 86400; Range: 6086400000)
interface <mgtx|mgtx.y> dhcpserver options mtu <number>

mtu Set the path MTU (maximum transmission unit)
<number> Enter the MTU value (Range: 688192)
interface <mgtx|mgtx.y> dhcpserver options netmask <netmask>

netmask Set the netmask for DHCP clients
<netmask>
Enter the netmask (Default: The same as the interface netmask.)
interface <mgtx|mgtx.y> dhcpserver options vendorspecific VCI <string>
vendorspecific Set the vendorspecific parameter
VCI Set vendor class identifier
<string> Enter the VCI name (132 chars)(Note: VCI of aerohive is AEROHIVE)
interface <mgtx|mgtx.y> dhcpserver options vendorspecific VCI <string> <number> ip <ip_addr>

Enter the DHCP vendorspecific suboption ID(Ranges: 1255; Suggested ID numbers and
types: HiveManager: 225 string, 226 IP; syslog: 227 string, 228 IP; private PSK: 229 IP;
<number>
RADIUS authentication: 230 IP; RADIUS accounting: 231 IP; Backup HiveManager: 232
string, 233 IP)
ip Set the custom option data type as an IP address
interface <mgtx|mgtx.y> dhcpserver options vendorspecific VCI <string> <number> string <string>
<number>
string, 233 IP)
string Set the vendorspecific suboption data type as a string
<string> Enter the string (1253 chars)
interface <mgtx|mgtx.y> dhcpserver options {dns1|dns2|dns3} <ip_addr>

Set the IP address of the primary DNS (Domain Name System) server that you want DHCP
dns1
clients to use
dns2 Set the IP address of the secondary DNS server
dns3 Set the IP address of the tertiary DNS server
Enter the IP address (Note: The DNS server IP address cannot be the same as that of the
<ip_addr>
interface.)
interface <mgtx|mgtx.y> dhcpserver options {logsrv|pop3|smtp} <ip_addr>

logsrv Set the IP address of the log server that is available for DHCP clients
Set the IP address of the POP3 (Post Office Protocol v3) server that you want DHCP
pop3
clients to use
Set the IP address of the SMTP (Simple Mail Transfer Protocol) server that you want DHCP
smtp
clients to use
interface <mgtx|mgtx.y> dhcpserver options {ntp1|ntp2} <ip_addr>

Set the IP address of the primary NTP (Network Time Protocol) server with which DHCP
ntp1
clients can synchronize their clocks
Set the IP address of the secondary NTP (Network Time Protocol) server with which DHCP
ntp2
clients can synchronize their clocks
interface <mgtx|mgtx.y> dhcpserver options {wins1|wins2} <ip_addr>

Set the IP address of the primary WINS (Windows Internet Name Service) server for
wins1
NetBIOS nametoaddress resolution
Set the IP address of the secondary WINS (Windows Internet Name Service) server for
wins2
NetBIOS nametoaddress resolution
interface <mgtx|mgtx.y> dhcpserver reservedaddress <ip_addr> <ip_addr>

reservedaddress Reserve a range of IP addresses for static allocations
<ip_addr> Enter the first IP address in the reserved range
<ip_addr> Enter the last IP address in the reserved range
interface <mgtx|mgtx.y> dhcpserver {arpcheck|authoritativeflag}

Use ARP to check that an IP address is not already in use on the network before
arpcheck
assigning it to a DHCP client (Default: Enabled)
Set the DHCP server as authoritative (Default: Authoritative; Note: An authoritative
authoritativeflag DHCP server can send NAKs in response to DHCP requests for addresses in a different
subnet from those in the configured IP pool.)
interface <mgtx|mgtx.y> dnsserver enable

dnsserver Set DNS server parameters
enable Enable the DNS server on the interface
interface <mgtx|mgtx.y> dnsserver extresolve {dns1|dns2|dns3} <ip_addr>

Set the external DNS servers used to resolve all domain names not specified for
extresolve
resolution by internal DNS servers
dns1 Set the IP address of the primary external DNS server
dns2 Set the IP address of the secondary external DNS server
dns3 Set the IP address of the tertiary external DNS server dns3
<ip_addr> Enter the IP address of the external DNS server
interface <mgtx|mgtx.y> dnsserver intdomainname <string> [ <ip_addr> ]

intdomainname Set a domain name for resolution by internal DNS servers
Enter the domain name (Max 32 chars; Note: Domain names are matched with implicit
<string> wildcards at the left end of the string; for example, both "www.aerohive.com" and
"www.myhive.com" match the domain name string "hive.com".)
<ip_addr> Enter the IP address of the internal DNS server to use for this domain name
interface <mgtx|mgtx.y> dnsserver intresolve {dns1|dns2|dns3} <ip_addr>

Set the DNS servers on the internal network used to resolve domain names in the match
intresolve
list
dns1 Set the IP address of the primary internal DNS server
dns2 Set the IP address of the secondary internal DNS server
dns3 Set the IP address of the tertiary internal DNS server dns3
<ip_addr> Enter the IP address of the internal DNS server
interface <mgtx|mgtx.y> dnsserver mode {split|nonsplit}

mode Set the mode for responding to domain name resolution queries (Default: split)
Forward queries only for domain names in a match list to internal DNS servers and
split
forward queries for everything else to external DNS servers
nonsplit Forward all queries to internal DNS servers
interface <mgtx|mgtx.y> dnsserver opendnsdeviceid <string>

opendnsdeviceid Set the device ID to use with OpenDNS
<string> Enter the device ID (16char hex string)
interface <mgtx|mgtx.y> iphelper address <ip_addr>

iphelper Forward DHCP broadcast packets to a DHCP server
address Set the DHCP server IP address
interface <mgtx|mgtx.y> iphelper maxhops <number>

iphelper Forward DHCP broadcast packets to a DHCP server
maxhops Set the DHCP relay max Hops, default hops is 4
interface <mgtx|vlanx> dhcpserver options vendorspecific VCI <string> <number> hex <string>
<vlanx> Dup
<number>
string, 233 IP)
hex Set the custom option data type as a hexadecimal digit
Enter the hexadecimal digit (1256 chars; Note: For option 46, which sets the NetBIOS
<string>
over TCP/IP node type, the string must be 1, 2, 4, or 8.)
interface <mgtx|vlanx> dhcpserver options vendorspecific VCI <string> <number> integer <number>

<vlanx> Dup
<number>
string, 233 IP)
integer Set the custom option data type as an integer
interface <wifix> hive <string> shutdown

Set the hive profile to the mgt0 interface or enable/disable the wifi interface used for
hive
hive communications
shutdown Disable the wifi subinterface used for hive communications
interface <wifix> linkdiscovery {lldp|cdp}

Enable the communication of networkrelated information with neighboring network devices
linkdiscovery
through the interface (Default: LLDP enabled; CDP enabled)
lldp Set LLDP (Link Layer Discovery Protocol) on the interface in backhaul mode
cdp Set CDP (Cisco Discovery Protocol) on the interface in backhaul mode
interface <wifix> mode {access|backhaul|dual|sensor}

mode Set the operational mode for the interface
Set the operational mode of the interface to access (Default: access (wifi0), dual
access
(wifi1))
Set the operational mode of the interface to backhaul (Default: access (wifi0), dual
backhaul
(wifi1))
Set the operational mode of the interface to dual so that it can provide both access and
dual
backhaul services (Default: access (wifi0), dual (wifi1))
Set the operational mode of the interface to sensor (Default: access (wifi0), dual
sensor
(wifi1))
interface <wifix> radio antenna diversity

radio Set parameters for the wifi radio interface
antenna Set the antenna parameters for the interface
diversity Set radio antenna diversity
interface <wifix> radio channel <string>

channel Set the radio channel for the interface
Enter the frequency with an optional suffix (G: GHz; M: MHz; K: KHz;), or the channel
<string> number, or "auto" to allow ACSP (Advanced Channel Selection Protocol) to select a
channel automatically (Default: auto)
interface <wifix> radio channel exclude <string>

channel Set the radio channel for the interface
exclude Exclude a channel from the list of available ACSP channels
Enter the frequency with an optional suffix (G: GHz; M: MHz; K: KHz;), or the channel
<string>
number
interface <wifix> radio power <number>

power Set the radio power for an interface
<number> Enter the radio power (in dBm) for an interface (Default: auto; Range: 120 dBm)
interface <wifix> radio power auto

auto Set the radio power to be adjusted automatically
interface <wifix> radio power auto floor <number>

floor Set the minimum radio power for automatic adjustment
<number> Enter the minimum radio power(Default: 5; Range: 220 dBm)
interface <wifix> radio power auto maxdrop <number>

maxdrop Set the maximum drop in radio transmission power
<number> Enter the minimum radio power(Default: 9; Range: 020 dBm)
interface <wifix> radio profile <string>

profile Set radio profile parameters for an interface

<string> Enter a radio profile name (132 chars)
interface <wifix> radio range <number>

range Set the transmission range for the radio linked to the interface
<number> Enter the range value in meters (Default: 300; Range: 30010000)
interface <wifix> radio txpowercontrol <number>

txpowercontrol Set the desired radio power for clients
<number> Enter the desired client radio power (in dBm) (Default: auto; Range: 120 dBm)
interface <wifix> radio txpowercontrol auto

txpowercontrol Set the desired radio power for clients
auto Set the client radio power to be adjusted automatically based on ACSP (Default: auto)
interface <wifix> ssid <string>

ssid Set the SSID (Service Set Identifier) profile for the interface
interface <wifix> ssid <string> ip <ip_addr/netmask>

ip Set IP address for the SSID
<ip_addr/netmask> Enter the SSID IP address
interface <wifix> ssid <string> shutdown

shutdown Disable the subinterface to which the SSID is bound
interface <wifix> wlanidp profile <string>

profile Bind an IDP profile to the interface
<string> Enter an IDP profile name (132 chars)
ip natpolicy <string>
ip Set IP parameters
natpolicy Set IP nat policy parameters
<string> Enter IP nat policy name (132 chars)
ip natpolicy <string> type matchnet inside <ip_addr/netmask> outside <ip_addr/netmask>

type Set the IP nat policy type
matchnet Set the IP nat policy type matchnet
inside Set the matchnet inside subnet
<ip_addr/netmask> Enter the IP address and netmask for the matchnet inside subnet
outside Set the matchnet outside subnet
<ip_addr/netmask> Enter the IP address and netmask for the matchnet outside subnet
ip natpolicy <string> type virtualhost insidehost <ip_addr> insideport <port> outsideport <port>
protocol {tcp|udp}
type Set the IP nat policy type
virtualhost Set the IP nat policy type virtualhost
insidehost Set the virtualhost inside host
<ip_addr> Enter the IP address for the virtualhost inside host
insideport Set the virtualhost inside port
<port> [1~65535]Enter the port number
outsideport Set the virtualhost outside port
<port> [1~65535]Enter the port number
protocol Set the virtualhost service protocol
tcp Choose tcp protocol for virtual host
udp Choose udp protocol for virtual host
ip pathmtudiscovery enable
Set Path MTU (Maximum Transmission Unit) Discovery parameters on a device functioning as
pathmtudiscovery
a router or VPN gateway
Enable Path MTU Discovery to learn the maximum packet size that can be sent across the
enable
network between two hosts without fragmentation (Default: Enabled)
ip route default gateway <ip_addr> [ metric <number> ]

route Set a routing entry
default Set a default route entry
gateway Set the network gateway
<ip_addr> Enter the gateway IP address
metric Set metric parameter
Enter a metric for an IP route (Default: 0; Range: 032766)
<number>
ip route host <ip_addr> [ gateway <ip_addr> ] [ metric <number> ]

host Set a route to a host
<ip_addr> Enter target IP address
<number> Enter a metric for an IP route (Default: 0; Range: 032766)
ip route net <ip_addr> <netmask> [ gateway <ip_addr> ] [ metric <number> ]

net Set a route to a net
<ip_addr> Enter target IP address
<netmask> Enter target netmask
ip tcpmssthreshold enable
Set TCP Maximum Segment Size parameters (Note: This setting only applies to a device
tcpmssthreshold
functioning as a router or VPN gateway.)
Enable the monitoring of the MSS option in TCP SYN and SYNACK messagesand, if
necessary, reduce the MSS value as determined by the TCP MSS threshold (Default:
enable
Enabled; Note: If no TCP MSS threshold value is specified, TCP MSS clamping uses the
Path MTU 40 bytes for the IP and TCP headers.)
ip tcpmssthreshold l3vpnthresholdsize <number>

tcpmssthreshold
l3vpnthresholdsize Set the TCP MSS threshold for TCP connections that pass through a Layer 3 VPN tunnel
Enter the TCP MSS threshold in bytes for tunneled traffic (Range: 641460; Note: If not
<number>
set, the device uses the TCP MSS threshold.)
ip tcpmssthreshold thresholdsize <number>

tcpmssthreshold
thresholdsize Set the TCP MSS threshold for all TCP connections passing through the device
Enter the TCP MSS threshold in bytes (Range: 641460; Default: Path MTU 40 bytes for
<number>
the IP and TCP headers)
ip versionpreference {ipv4|ipv6}
ip Set IP parameter
versionpreference Set IP version preference parameters
ipv4 Set version preference to ipv4 (Default: ipv4)
ipv6 Set version preference to ipv6 (Default: ipv4)
ippolicy <string> [ id <number> ] [ {before|after} id <number> ] [ from <ip_addr|string_64> [ <mask>
] ] [ to <ip_addr|string_64> [ <mask> ] ] [ service <string> ] [ action {permit|deny|nat|inter
stationtrafficdrop|redirect} ]
ippolicy Set IP policy parameters
<string> Enter an IP policy name (132 chars)
id Assign an IP policy ID
<number> Enter the IP policy ID (Range: 11023)
before Set the before parameters for an IP policy
after Set the after parameters for an IP policy
from Set the source IP (Default: any)
<ip_addr> Enter an IP or domain name (164 chars)
<string> Enter an IP or domain name (164 chars)
Enter a netmask or IP wildcard mask in which 0 masks the octet where it appears (For
<mask> example, the 0s in '255.0.0.255' mask the second and third octets, applying the IP
policy to all addresses matching only the first and fourth octets.)
to Set the destination IP (Default: any)
service Set the service (Default: any)
<string> Enter the service (132 chars)
action Set action for an IP policy (Default: deny)
permit Set the action to permit (Default: deny)
deny Set the action to deny (Default: deny)
Set the action to translate clients' source IP address to that of mgt0 and source port
nat number to a dynamically chosen number (Default: deny; Note: NAT is applied only to TCP
and UDP traffic.)
interstationtraffic Set the action to drop traffic between stations if they are both associated with one or
drop more members of the same hive (Default: deny)
redirect redirect http traffic to specified url(Default: deny)

] ] [ to <ip_addr|string_64> [ <mask> ] ] [ service <string> ] action deny log packetdrop
log Set logging options for packets and sessions that match the IP firewall policy
packetdrop Log dropped packets that the IP firewall policy denies

] ] [ to <ip_addr|string_64> [ <mask> ] ] [ service <string> ] action interstationtrafficdrop log [
{initiatesession|terminatesession|packetdrop} ]
log Set logging options for packets and sessions that match IP FW policy
initiatesession Log the creation of sessions that are permitted by the policy
terminatesession Log the termination of sessions that are permitted by the policy
packetdrop Log dropped packets that are denied by the policy

] ] [ to <ip_addr|string_64> [ <mask> ] ] [ service <string> ] action permit log [ {initiate
session|terminatesession} ]
log Set logging options for packets and sessions that match the IP firewall policy
initiatesession Log session details when a session is created after passing a IP firewall policy lookup
terminatesession Log session details when a session matching a IP firewall policy is terminated

] ] to localsubnet [ service <string> ] [ action {permit|deny|nat|interstationtraffic
drop|redirect} ]
localsubnet Set the subnet of the mgt0 interface as the destination
Set the action to translate clients' source IP address to that of mgt0 and source port
nat number to a dynamically chosen number (Default: deny; Note: NAT is applied only to TCP
and UDP traffic.)
redirect redirect http traffic to specified url(Default: deny)
iperf client <ip_addr> [ {port} <number> ] [ {udp} ] [ {interval} <number> ] [ {nodelay} ] [ {dual
test} ] [ {tradeoff} ] [ {listenport} <number> ] [ {window} <number> ] [ {mss} <number> ] [
{bandwidth} <number> ] [ {time} <number> ] [ {parallel} <number> ]
iperf Set parameters for Iperf, a tool for testing and measuring network performance
client Set Iperf to run in client mode
<ip_addr> Enter the server IP address with which the HiveAP connects as an Iperf client
port Set the port on which the client connects to the server
<number> Enter the port number (Range: 102465535; Default: 5001)
udp Set the transport protocol as UDP (Default: TCP)
interval Set the interval between periodic bandwidth, jitter, and loss reports
Enter the interval in seconds (Range: 160; Default: 0, which means that the report is
<number>
not made periodically)
Transmit small logical packets individually without the delay incurred by putting them
nodelay in batches within a single larger physical packet (Default: Smaller packets are
transmitted without delay)
Set the Iperf tool to do bidirectional upstream and downstream performance testing
dualtest
between the client and server concurrently
Set the Iperf tool to do bidirectional upstream and downstream performance testing at
tradeoff
different times so downstream testing only begins after upstream testing is complete
listenport Set the port on which the server connects to the client
Enter the port number (Range: 102465535; Default: The same port on which the client
<number>
connects to the server)
window Set the TCP window size (socket buffer size)
<number> Enter the TCP window size in kilobytes (Range: 265535; Default: 83.5)
mss Set the maximum TCP segment size (MTU: 40 bytes)
<number> Enter the maximum TCP segment size in bytes (Range: 4065535; Default: 4160)
bandwidth Set the amount of UDP bandwidth to send
<number> Enter the bandwidth in megabits per second (Range: 11000; Default: 1)
time Set the length of transmission time
<number> Enter the time in seconds (Range: 165535; Default: 10)
Set the client to make multiple connections to the server concurrently (Note: This
parallel
option requires multiple thread support on both the client and server.)
<number> Enter the number of parallel client threads to run (Range: 110; Default: 1)
iperf server [ {port} <number> ] [ {udp} ] [ {singleudp} ] [ {interval} <number> ] [ {nodelay} ] [

{window} <number> ] [ {mss} <number> ] [ {bind} <ip_addr> ]
iperf Set parameters for Iperf, a tool for testing and measuring network performance
server Set Iperf to run in server mode
port Set the port on which the server listen on
<number> Enter the port number (Range: 102465535; Default: 5001)
udp Set the transport protocol as UDP (Default: TCP)
singleudp Set the Iperf tool to run in singlethreaded UDP mode
interval Set the interval between periodic bandwidth, jitter, and loss reports
Enter the interval in seconds (Range: 160; Default: 0, which means that the report is
<number>
not made periodically)
Transmit small logical packets individually without the delay incurred by putting them
nodelay in batches within a single larger physical packet (Default: Smaller packets are
transmitted without delay)
window Set the TCP window size (socket buffer size)
<number> Enter the TCP window size in kilobytes (Range: 265535; Default: 83.5)
mss Set the maximum TCP segment size (MTU: 40 bytes)
<number> Enter the maximum TCP segment size in bytes (Range: 4065535; Default: 4160)
bind Bind and join the HiveAP to a multicast group
<ip_addr> Enter the IP address of the multicast group (Range: 224.0.0.0239.255.255.255)
ipv6 dhcpv6shield enable
ipv6 Set IPv6 parameters
Set the DHCPv6 shield to block the forwarding of DHCPv6 server messages received on any
dhcpv6shield
access interface
enable Enable the DHCPv6 shield on access interfaces
ipv6 raguard stateless enable

ipv6 Set IPv6 parameters
Set the IPv6 RA guard (router advertisement guard) to block router advertisements on
raguard
access interfaces
Set the IPv6 RA guard as stateless, meaning that incoming router advertisements are
stateless examined and then either blocked or forwarded based only on the information of the
received frame; specifically, the port on which the frame was received
enable Enable the IPv6 RA guard on access interfaces
ipv6 route <ipv6_addr/mask> <mgtx> gateway <ipv6_addr> [ metric <number> ]

ipv6 Set IPV6 parameters
<ipv6_addr/mask> Enter target IPv6 address/netmask
<ipv6_addr> Enter the gateway IP address
metric Set metric parameters
ipv6 route <ipv6_addr/mask> gateway <ipv6_addr> [ metric <number> ]

<ipv6_addr/mask> Enter target IPv6 address/netmask
ipv6 route default <mgtx> gateway <ipv6_addr> [ metric <number> ]

ipv6 route default gateway <ipv6_addr> [ metric <number> ]

kddr enable
kddr Enable/disable the kddr report to HM
enable Enable the kddr feature
librarysippolicy <string> default usergroup <string> [ action {permit|restricted|deny} ] [

additionaldisplaymessage <string> ]
Set a SIP (Standard Interchange Protocol) policy to apply a user profile, VLAN, and
librarysippolicy session length to library patrons accessing the wireless network (Note: Set policies on
a AP RADIUS server. Max policies: 16; Max rules per policy: 64.)
<string> Enter a library SIP policy name (132 chars)
default Set the default rule to apply to unregistered library patrons
Set the user group to which the AP RADIUS authenticator assigns the user (Note: The user
usergroup
group includes user profile, VLAN, and session timeout assignments.)
action Set the action that the library SIP policy rule applies
permit Notify users assigned to the user group that they are permitted network access
restricted Notify users assigned to the user group that they are given restricted network access
Notify users assigned to the user group that they are denied network access except to
deny
websites defined in a walled garden
additionaldisplay
Set a message to display when a user attempts to access the network
message
<string> Enter a message string (up to 256 chars)
librarysippolicy <string> id <number> field <string> {equal|greaterthan|lessthan} <number> user

group <string> [ action {permit|restricted|deny} ] [ additionaldisplaymessage <string> ]
id Set an ID number for a rule to add it to the library SIP policy
<number> Enter an ID number (Range: 164)
Set the twoletter character code that identifies the field name of a specific library
field
SIP value
<string> Enter the twoletter character code(2 char)
Check if the field value that the SIP server returns equals the number entered in the
equal
local AP RADIUS server
Check if the field value that the SIP server returns is greater than the number entered
greaterthan
in the local AP RADIUS server
Check if the field value that the SIP server returns is less than the number entered in
lessthan
the local AP RADIUS server
Enter the number that the AP RADIUS server uses when checking the field values that the
<number>
SIP server returns (Range: 065535)
usergroup
deny
additionaldisplay
message
librarysippolicy <string> id <number> field <string> {matches|differsfrom|startswith|occurs

after|occursbefore|contains} <string> usergroup <string> [ action {permit|restricted|deny} ] [
additionaldisplaymessage <string> ]
Set the twoletter character code that identifies the field name of a specific library
field
SIP value
<string> Enter the twoletter character code(2 char)
Check if the field value that the SIP server returns matches the string entered in the
matches
Check if the field value that the SIP server returns differsfrom the string entered in
differsfrom
Check if the field value that the SIP server returns startswith the string entered in
startswith
Check if the field value that the SIP server returns occursafter the string entered in
occursafter
Check if the field value that the SIP server returns occursbefore the string entered in
occursbefore
Check if the field value that the SIP server returns contains the string entered in the
contains
Enter the string that the AP RADIUS server uses when checking the field values that the
<string> SIP server returns (132 chars; Note: Date format must be YYYYMMDD; Example: 201001
01.)
usergroup
deny
additionaldisplay
message
librarysippolicy <string> id <number> {after|before} id <number>

after Move the library SIP rule after another rule in the policy
before Move the library SIP rule before another rule in the policy
license <string> <string>

license Set license parameters
<string> Enter registration license
<string> Enter registration key
lldp [ {cdp|receiveonly} ]
Enable the HiveAP to receive and cache LLDP advertisements from neighboring network
receiveonly
devices but not send them
lldp [ {cdp} ] maxentries <number>

maxentries Set the maximum number of entries to cache in the LLDP or CDP neighbor table
<number> Enter the maximum number of entries to cache (Default: 64; Range: 1128)
lldp holdtime <number>

Set the length of time that the neighboring network devices to retain the LLDP
holdtime
advertisements that it sends to them
Enter the length of time in seconds that the neighboring network devices to hold LLDP
<number>
advertisements (Default: 90; Range: 065535)
lldp maxpower <number>

maxpower Set the maximum power that can be requested when transmitting LLDP advertisements
Enter the maximum power in watts to be requested (Default: 154; Range: 1250; Note: 154
<number>
= 15.4 watts)
lldp timer <number>

timer Set the interval between LLDP advertisements to neighboring network device
<number> Enter the interval in seconds between LLDP advertisements (Default: 30; Range: 565534)
load config {current|backup|bootstrap|default}

load Load a configuration file
config Specify which configuration file to load after rebooting
current Load the current configuration file after rebooting
backup Load the backup configuration file after rebooting
bootstrap Load the bootstrap configuration file after rebooting
default Load the default configuration file after rebooting
location aerohive enable

location Set parameters for location tracking
aerohive Set parameters for the Aerohive location processing engine
enable Enable client location tracking (Default: Disabled)
location aerohive listmatch enable

listmatch Track a station if its MAC address is in the track list
enable Enable track list checking before tracking a station (Default: Enabled)
location aerohive mac <mac_addr>

mac Add a MAC entry to the track list
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
location aerohive oui <oui>
oui Add an OUI (organizationally unique identifier) entry to the track list
<oui>
location aerohive reportinterval <number>

reportinterval Set the interval between reports of RSSI readings
<number> Enter the report interval in seconds (Default: 60; Range: 151200)
location aerohive rssiholdtime <number>

Set the number of times that the local HiveAP, as an owner AP, can include the same
client RSSI report from another HiveAP in its aggregate report to HiveManager before
rssiholdtime
determining the data to be stale and omitting it from future reports (Note: The owner AP
is the one to which the client is associated)
Enter the number of times to reuse a client RSSI report that has not been updated
<number>
(Default: 0; Range: 010)
location aerohive rssiupdatethreshold <number>

rssiupdatethreshold Set the change in RSSI required to trigger an update
<number> Enter the update threshold in dB (Default: 3; Range: 15)
location aerohive rssivalidperiod <number>

Set the period of time that an RSSI reading remains valid (Note: After this period
rssivalidperiod elapses, an updated report is generated even if the RSSI value has not crossed the
update threshold)
<number> Enter the validity period in seconds (Default: 60; Range: 151200)
location aerohive suppressreport <number>

Set the number of consecutive reports that can be suppressed when a client's RSSI has
suppressreport
not changed significantly
<number> Enter the number of consecutive RSSI reports to suppress (Default: 0; Range: 080)
location ratethreshold {tag|station|rogueap} <number>

ratethreshold Set the rate limit threshold for location tracking
tag Set the rate limit threshold for tags
station Set the rate limit threshold for stations
rogueap Set the rate limit threshold for rogueaps
Enter the rate limit threshold in packets per second (Default: 1000 for tags, 200 for
<number>
stations, 50 for rogue APs; Range: 1100000)
location {aeroscout|tzsp} enable
aeroscout Set parameters for the aeroscout location processing engine
Set parameters for the location processing engine that supports TZSP (Tazmen Sniffer
tzsp
Protocol) for packet encapsulation
enable Enable location tracking and reporting to the location processing engine
location {aeroscout} server <string>

Set the IP address or domain name of the location processing engine to which the HiveAP
server
sends tracking reports
<string> Enter the IP address or domain name of the location processing engine (164 chars)
location {aeroscout} {tag|station|rogueap}

tag Track and report the location of tags to the location processing engine
station Track and report the location of stations to the location processing engine
rogueap Track and report the location of rogue APs to the location processing engine
location {tzsp} mcastmac <mac_addr>

tzsp
Set the multicast MAC address to which the HiveAP transmits captured multicast frames
mcastmac
encapsulated with TZSP (Default: 01:18:8e:00:00:00)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
location {tzsp} serverconfig server <string> port <number>

tzsp
Set the IP address or domain name and port number of the location server to which the
serverconfig
HiveAP sends TZSPencapsulated multicast frames captured from RFID tags
server Set the IP address or domain name of the location server
port Set the port number on which the location server listens for tracking reports
logging buffered level {emergency|alert|critical|error|warning|notification|info|debug}

logging Set logging parameters
buffered Set logging buffer
level Set logging level
emergency Send emergencylevel log entries (Default: debug)
alert Send log entries from alert to emergency levels (Default: debug)
critical Send log entries from critical to emergency levels (Default: debug)
error Send log entries from error to emergency levels (Default: debug)
warning Send log entries from warning to emergency levels (Default: debug)
notification Send log entries from notification to emergency levels (Default: debug)
info Send log entries from info to emergency levels (Default: debug)
debug Send log entries for all severity levels (Default: debug)
logging debug
logging facility {local0|local1|local2|local3|local4|local5|local6|local7|auth|authpriv|security|user}

facility Set logging facility
local0 Set log facility to local0 (Default: local6)
auth Set log facility to auth (Default: local6)
authpriv Set log facility to authpriv (Default: local6)
security Set log facility to security (Default: local6)
user Set log facility to user (Default: local6)
logging flash level {emergency|alert|critical|error|warning|notification|info|debug}

flash Set logging flash
level Set logging level
emergency Send emergencylevel log entries (Default: error)
alert Send log entries from alert to emergency levels (Default: error)
critical Send log entries from critical to emergency levels (Default: error)
error Send log entries from error to emergency levels (Default: error)
warning Send log entries from warning to emergency levels (Default: error)
notification Send log entries from notification to emergency levels (Default: error)
info Send log entries from info to emergency levels (Default: error)
debug Send log entries for all severity levels (Default: error)
logging server <string> [ level {emergency|alert|critical|error|warning|notification|info|debug} ] [

{viavpntunnel} ]
server Set parameters for a syslog server
<string> Set the IP address or domain name (132 chars) for the syslog server
level Set the severity level for the log messages you want to send
emergency Send emergencylevel log entries
alert Send log entries from alert to emergency levels
critical Send log entries from critical to emergency levels
error Send log entries from error to emergency levels
warning Send log entries from warning to emergency levels
notification Send log entries from notification to emergency levels
info Send log entries from info to emergency levels
debug Send log entries for all severity levels
Send all logging traffic through a VPN tunnel (Note: Set this option on VPN clients when
viavpntunnel the logging server is in a different subnet from the tunnel interface. When they are in
logging trap level [ {emerg|alert|crit|err|warning|notice|info} ]

trap Set logging trap parameters
level Set logging trap level
emerg Set logging trap level to emerg (Default: info)
alert Set logging trap level to alert (Default: info)
crit Set logging trap level to crit (Default: info)
err Set logging trap level to err (Default: info)
warning Set logging trap level to warning (Default: info)
notice Set logging trap level to notice (Default: info)
info Set logging trap level to info (Default: info)
login banner <string>

login Set parameters fot the CLI login
banner Set the banner that appears after logging in to the CLI
Enter the banner text (Default: 'Aerohive Networks Inc.\n Copyright (C) 20062010\n';
<string>
Max: 256 chars; Notes: Use '\n' to indicate a line break.)
macobject <string> macrange <mac_addr> <mac_addr>

Set parameters for an MAC object that the HiveAP can use to assign a client with a
macobject
matching MAC address to a user profile (Max: 128 MAC objects per HiveAP.)
Set a range of MAC addresses for the MAC object (Max: 255 MAC address ranges per MAC
macrange
object)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
Set a range of MAC addresses
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
macpolicy <string> [ id <number> ] [ {before|after} id <number> ] [ from <mac_addr> [ <number> ] ] [

to <mac_addr> [ <number> ] ] [ action {permit|deny} ]
macpolicy Set MAC policy parameters
<string> Enter a MAC policy name (132 chars)
id Assign a MAC policy ID
<number> Enter the MAC policy ID (Range: 11023)
before Set the before parameters for a MAC policy
after Set the after parameters for a MAC policy
from Set the source MAC (Default: any)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
<number> Enter a MAC mask length (value: 0, 24, 48)
to Set the destination MAC (Default: any)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
action Set action for a MAC policy (Default: deny)

to <mac_addr> [ <number> ] ] action deny log packetdrop
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
log Set logging options for packets and sessions that match the MAC firewall policy
packetdrop Log dropped packets that the MAC firewall policy denies

to <mac_addr> [ <number> ] ] action permit log [ {initiatesession|terminatesession} ]
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
log Set logging options for packets and sessions that match the MAC firewall policy
initiatesession Log session details when a session is created after passing a MAC firewall policy lookup
terminatesession Log session details when a session matching a MAC firewall policy is terminated
mdmobject <string> [ enrollstatus {enrolled|nonenrolled|unknown} ] [ compliancestatus

{compliant|noncompliant|unknown} ] [ clienttag <string> ]
mdmobject Set the MDM (mobile device management) object
<string> Enter an MDM object name (132 chars)
enrollstatus Set the enrollment status of the managed mobile device
enrolled Set the MDM enrollment status of the device as enrolled
nonenrolled Set the MDM enrollment status of the device as nonenrolled
unknown Set the MDM enrollment status of the device as unknown
compliancestatus Set a compliance status
compliant Set the compliance status as compliant
noncompliant Set the compliance status as noncompliant
unknown Set the compliance status as unknown
Set an MDM client tag name to indicate the ownership of the managed mobile device (Note:
clienttag BYOD and CID are common ownership tags that describe bringyourowndevice and
corporateissuesdevice situations.)
<string> Enter a tag name (132 chars)
mobiledevicepolicy <string> [ rule <number> ] [ originaluserprofile <string> ] devicegroup

<string> reassigneduserprofileattr <number>
Set a policy that assigns a user profile to traffic from a client based on the
mobiledevicepolicy originally assigned user profile or the MAC address, device domain, and OS of the user's
client
<string> Enter the mobile device policy name (132 chars)
rule Add a rule to the mobile device policy
Enter a number for the rule ID (Range: 165535; Note: If you do not specify a rule ID,
<number>
the HiveAP automatically assigns one.)
Specify the user profile that the HiveAP first assigns to traffic before it completes
originaluserprofile
the device classification process
<string> Enter the original user profile (132 chars)
Set the device group that the policy rule references to classify the type of client
devicegroup
device in use
reassigneduser Reassign the client to a different user profile if it belongs to the specified device
profileattr group or was initially assigned to the specified original user profile
Enter the attribute of the user profile to assign in place of the originally assigned
<number>
one (Range: 04095)
mobiledevicepolicy <string> apply {once|multipletimes}

client
apply Set the method for applying mobile device policy rules
Apply a policy rule once if a client match is found after finishing the complete device
once
type classification process(Default: Once)
Apply a policy rule if a client match is found at any point during the device type
multipletimes detection process (Default: Once)(Note: Different rules might be applied at different
times as the HiveAP collects more information about a client.)
mobiledevicepolicy <string> clientclassification [ {mac} ] [ {domain} ] [ {os} ]

client
clientclassification Set the client device classification methods that you want to use
mac Use the client classification method that is based on the MAC address of the device
Use the client classification method that is based on the computer domain to which a
domain
client belongs in the database
os Use the client classification method that is based on the OS running on the device
mobiledevicepolicy <string> rule <number> {before|after} rule <number>
client
rule Add a rule to the mobile device policy
Enter a number for the rule ID (Range: 165535; Note: If you do not specify a rule ID,
<number>
the HiveAP automatically assigns one.)
before Move the mobile device policy rule before another rule in the policy
after Move the mobile device policy rule after another rule in the policy
rule Set a rule before or after another rule in the mobile device policy
<number> Enter a rule ID number (Range: 165535)
mobilitypolicy <string> dnxp

mobilitypolicy Set parameters for a mobility policy
<string> Enter a mobility policy name (132 chars)
Assign DNXP (Dynamic Network eXtension Protocol) for the mobility policy (Default:
dnxp
predictive roaming support among neighboring hive members)
mobilitypolicy <string> dnxp nomadicroaming

dnxp
Enable fast roaming support on nonneighboring hive members in different subnets
nomadicroaming
(Default: predictiveroaming)
mobilitypolicy <string> dnxp unroamthreshold <number> <number>

dnxp
Set the minimum traffic level required to continue tunneling traffic back to the
unroamthreshold original subnet of a L3 roaming client. (Note: If the volume of client traffic dips
below the threshold, it is disassociated.)
Enter the minimum number of packets/minute to and from the client required to continue
<number> tunneling its traffic back to its original subnet (Default: 0; Range: 02147483647;
Note: The value "0" disables the unroaming feature.)
Enter the interval in seconds for polling traffic statistics (Default: 60 seconds;
<number>
Range: 10600)
mobilitypolicy <string> inxp gretunnel from <ip_addr/netmask> password <string>

inxp Assign INXP (Identity Network eXtension Protocol) for the mobility policy
gretunnel Set the INXP gretunnel parameters
from Set the INXP gretunnel source parameters
<ip_addr/netmask> Enter subnet for INXP gretunnel source
password Set password for INXP gretunnel
<string> Enter password for INXP gretunnel (164 chars)
mobilitypolicy <string> inxp gretunnel to <ip_addr> <ip_addr> password <string>


to Set the INXP gretunnel destination parameters
<ip_addr> Enter start IP address for INXP gretunnel destination
<ip_addr> Enter end IP address for INXP gretunnel destination
mobilitypolicy <string> inxp gretunnel to <ip_addr> password <string>

to Set the INXP gretunnel destination parameters
<ip_addr> Enter start IP address for INXP gretunnel destination
mobilitythreshold gretunnel permittedload {low|medium|high}

mobilitythreshold Set parameters for tunneling mobile user traffic
Set the volume of traffic that the local AP will accept through GRE (Generic Routing
gretunnel
Encapsulation) tunnels (Note: Only set this option on portals.)
Set a level determining the amount of traffic the local AP will accept through GRE
permittedload
tunnels
low Accept a relatively low number of tunnels (Default: high)
medium Accept a relatively moderate number of tunnels (Default: high)
high Accept a relatively high number of tunnels (Default: high)
networkfirewall name <string> [ from {any|vpn} ] [ to {any|vpn} ] [ service <string> ] [ action

networkfirewall Set a Layer 3 firewall policy (Max: 1024 rules per Aerohive device)
name Assign a name to a Layer 3 firewall policy rule
<string> Enter the rule name (132 chars)
from Apply the rule based on the traffic source (Default: any)
any Apply the rule regardless of the traffic source
vpn Apply the rule if the traffic comes from a VPN tunnel
to Apply the rule based on the traffic destination (Default: any)
any Apply the rule regardless of the traffic destination
vpn Apply the rule if the traffic destination is a VPN tunnel
Apply the rule if the traffic uses a specific service (Default: any, which applies the
service
rule regardless of the service type)
<string> Enter the service name (132 chars)
Set the action the HiveAP takes when traffic matches the specified source, destination,
action
and service (Default: deny)
permit Permit traffic to cross the firewall
deny Do not allow traffic to cross the firewall
logging Set logging options for packets and sessions that match the firewall rule
Log all matching packets that are dropped or the first packet in a permitted session
on (Note: A session is defined by the 5part tuple: source and destination IP address,
source and destination port number, and protocol)
off Do not log packets
networkfirewall name <string> [ from {any|vpn} ] to hostname <string> [ service <string> ] [ action
Set the domain name of a specific host as the traffic destination (Note: Wildcard domain
hostname
names are not supported.)
<string> Enter a host or domain name (132 chars)
service
action
networkfirewall name <string> [ from {any|vpn} ] to iprange <ip_addr> <ip_addr> [ service <string> ]
iprange Set a range of IP addresses as the traffic destination
<ip_addr> Enter the first IP address in the range
<ip_addr> Enter the last IP address in the range
service
action
networkfirewall name <string> [ from {any|vpn} ] to network <ip_addr> <mask> [ service <string> ] [
network Set a network as the traffic destination
<ip_addr> Enter an IP address
<mask> Enter a netmask
service
action
networkfirewall name <string> [ from {any|vpn} ] to wildcard <ip_addr> <mask> [ service <string> ] [
wildcard Set the destination address using an IP address and wildcard mask
Enter an IP wildcard mask in which 0 masks the octet where it appears (For example, the
<mask> 0s in 255.0.0.255 mask the second and third octets, applying the firewall policy to all
addresses matching only the first and fourth octets.)
service
action
networkfirewall name <string> from iprange <ip_addr> <ip_addr> [ to {any|vpn} ] [ service <string> ]
iprange Set a range of IP addresses as the traffic source
service
action
networkfirewall name <string> from iprange <ip_addr> <ip_addr> to hostname <string> [ service
hostname
service
action
networkfirewall name <string> from iprange <ip_addr> <ip_addr> to iprange <ip_addr> <ip_addr> [
service <string> ] [ action {permit|deny} ] logging {on|off}
service
action
networkfirewall name <string> from iprange <ip_addr> <ip_addr> to network <ip_addr> <mask> [ service
service
action
networkfirewall name <string> from iprange <ip_addr> <ip_addr> to wildcard <ip_addr> <mask> [
to
Apply the rule based on the traffic destination (Default: any)
service
action
networkfirewall name <string> from network <ip_addr> <mask> [ to {any|vpn} ] [ service <string> ] [
network Set a network as the traffic source
service
action
networkfirewall name <string> from network <ip_addr> <mask> to hostname <string> [ service <string> ]
hostname names are not supported.)
service
action
networkfirewall name <string> from network <ip_addr> <mask> to iprange <ip_addr> <ip_addr> [ service
service
action
networkfirewall name <string> from network <ip_addr> <mask> to network <ip_addr> <mask> [ service
service Apply the rule if the traffic uses a specific service (Default: any, which applies the
action
networkfirewall name <string> from network <ip_addr> <mask> to wildcard <ip_addr> <mask> [ service
service
action
networkfirewall name <string> from userprofile <string> [ to {any|vpn} ] [ service <string> ] [

userprofile Apply the rule if the HiveAP assigns a user profile to the traffic
<string> Enter the user profile name (132 chars)
service
action
networkfirewall name <string> from userprofile <string> to hostname <string> [ service <string> ] [
hostname
service
action
networkfirewall name <string> from userprofile <string> to iprange <ip_addr> <ip_addr> [ service
service
action
networkfirewall name <string> from userprofile <string> to network <ip_addr> <mask> [ service
service
action
networkfirewall name <string> from userprofile <string> to wildcard <ip_addr> <mask> [ service
service
action
networkfirewall name <string> from wildcard <ip_addr> <mask> [ to {any|vpn} ] [ service <string> ] [
wildcard Set the source address using an IP address and wildcard mask
service
action
networkfirewall name <string> from wildcard <ip_addr> <mask> to hostname <string> [ service <string>
] [ action {permit|deny} ] logging {on|off}
hostname
service
action
on
(Note: A session is defined by the 5part tuple: source and destination IP address,
networkfirewall name <string> from wildcard <ip_addr> <mask> to iprange <ip_addr> <ip_addr> [
service
action
networkfirewall name <string> from wildcard <ip_addr> <mask> to network <ip_addr> <mask> [ service
service
action
networkfirewall name <string> from wildcard <ip_addr> <mask> to wildcard <ip_addr> <mask> [ service
service
action
ntp enable
ntp Set NTP (Network Time Protocol) parameters
enable Enable the local AP to act as an NTP client
ntp interval <number>

interval Set the interval for synchronizing the internal clock with an NTP server
<number> Enter the interval in minutes (Default: 1440; Range: 6010080)
ntp server <string> [ {second|third|fourth} ] [ {viavpntunnel} ]

server Set NTP server parameters
<string> Enter the IP address or domain name of an NTP server (132 chars)
second Set the priority of the NTP server as second
third Set its priority as third
fourth Set its priority as fourth
Send all NTP traffic through a VPN tunnel (Note: Set this option on VPN clients when the
NTP server is in a different subnet from the tunnel interface. When they are in the same
viavpntunnel
subnet, tunneling is automatic.)
osdetection enable
osdetection Set the OS (Operating System) detection parameters
enable Enable OS detection to learn client station operating systems (Default: Enabled)
osdetection method dhcpoption55

Set the OS detection method (Note: HiveAPs can detect the OS of client stations using
method option 55 in the DHCP packets or by parsing the HTTP headers to find the UserAgent
field.)
Detect client station operating systems by parsing option 55 in DHCP messages from
dhcpoption55
clients (Default: Enabled)
osdetection method useragent

Set the OS detection method (Note: HiveAPs can detect the OS of client stations using
method option 55 in the DHCP packets or by parsing the HTTP headers to find the UserAgent
field.)
Detect client station operating systems by parsing the UserAgent field in HTTP packets
useragent
(Default: Disabled)
osobject <string> osversion <string>

Set parameters for an OS object that the HiveAP can use to assign a client running a
osobject
matching OS to a user profile (Max: 64 OS objects per HiveAP.)
Enter an OS object name (132 chars; Note: The object name is an admindefined name and
<string>
does not have to be the name of an operating system.)
Set the name and version of an operating system version (Max: 32 OS versions per OS
osversion
object)
Enter the exact text string that identifies an operating system as it appears in the
<string> user agent ID field in HTTP headers (132 chars; Note: Use quotation marks if spaces are
required. Examples: "Windows NT 5.1", "Mac OS X", "Linux i686")
osversion <string> option55 <string>

osversion Set the OS (operating system) version you want to detect in the DHCP packets
Enter the OS version name (132 chars; Note: The OS version name can be in any form you
<string>
choose; for example, "Windows XP" or "WinXP".)
option55 Set the option 55 string for the type of operating system you want to detect
<string> Enter the DHCP option 55 string (1256 chars)
performancesentinel notificationinterval <number>

performancesentinel Set performance sentinel parameters to moderate client throughput
Set the interval for sending SNMP traps to HiveManager to update the performance
notificationinterval
sentinel log
Enter the performance sentinel log update interval in seconds (Default: 600; Range: 30
<number>
1800)
ping <ip_addr> [ count <number> ] [ size <number> ] [ ttl <number> ] [ timeout <number> ]
ping Perform a ping
<ip_addr> Enter the destination IP address
count Stop pinging after sending the specified number of ICMP echo requests
Enter a number after sending the number of ICMP echo requests the pinging stop (Default:
<number>
5, Range: 165535)
size Set the size of the ICMP packets
<number> Enter the packet size in bytes (Default: 56, Range: 11024)
ttl Set the TTL (time to live)
<number> Enter the TTL (Range: 1255)
ping <string> [ count <number> ] [ size <number> ] [ ttl <number> ] [ timeout <number> ]
ping Perform a ping
<string> Enter the destination domain name (132 chars)
count Set the number of ICMP echo requests to send
<number> Enter the number of ICMP echo requests (Default: 5, Range: 165535)
ping6 <ipv6_addr> [ interface <string> ] [ count <number> ] [ size <number> ] [ ttl <number> ] [
timeout <number> ]
ping6 Perform a ping
<ipv6_addr> Enter the destination IPv6 address
The egress interface name, to be converted to IPv6 scope ID if pinging a linklocal
interface
address
<string> Enter the interface name (132 chars)
<number>
5, Range: 165535)
ping6 <string> [ interface <string> ] [ count <number> ] [ size <number> ] [ ttl <number> ] [ timeout
<number> ]
ping6 Perform a ping
<string> Enter the destination domain name (132 chars)
The egress interface name, to be converted to IPv6 scope ID if pinging a linklocal
interface
address
<string> Enter the interface name (132 chars)
<number>
5, Range: 165535)
probe <ip_addr|mac_addr> [ size <number> ] [ srcmac <mac_addr> ] [ waittime <number> ] [ ttl

<number> ] [ count <number> ]
probe Set the probe parameters
<ip_addr> Enter the target IP or MAC address

<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
size Set the probe request packet size (default: 512 bytes)
<number> Enter a packet size (range: 2561400 bytes)
srcmac Set the Source MAC address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
waittime Set the timeout value (default: 1 second)
<number> Enter an timeout value (range: 130 seconds)
ttl Set the TTL value (default 32)
<number> Enter an TTL value (range: 1255)
count Set probe request count (default: 5)
<number> Enter the probe request count (range: 164)
probe portal [ size <number> ] [ srcmac <mac_addr> ] [ waittime <number> ] [ ttl <number> ] [ count
<number> ]
probe Set the probe parameters
portal Set the target of the probe as the MAC address of the HiveAP acting as portal
size Set the probe request packet size (default: 512 bytes)
<number> Enter a packet size (range: 2561400 bytes)
srcmac Set the Source MAC address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
waittime Set the timeout value (default: 1 second)
<number> Enter an timeout value (range: 130 seconds)
ttl Set the TTL value (default 32)
<number> Enter an TTL value (range: 1255)
count Set probe request count (default: 5)
<number> Enter the probe request count (range: 164)
qos airtime enable

qos Set QoS (Quality of Service) parameters
airtime Set QoS parameters based on the amount of airtime that wireless client traffic uses
enable Enable dynamic airtime scheduling
qos airtime ratepreferenceweight {none|moderate|high}

airtime Set QoS parameters based on the amount of airtime that wireless client traffic uses
Set a preference for forwarding traffic to and from wireless clients that are capable of
ratepreferenceweight
fast data transfer rates
none Set no preference for clients with a fast data rate (Default: high)
moderate Set a moderate preference for clients with a fast data rate (Default: high)
high Set a high preference for clients with a fast data rate (Default: high)
qos classifiermap 80211e <number> <number>

classifiermap Map QoS priority markers on incoming packets to Aerohive QoS classes
80211e Map IEEE 802.11e user priority markers on incoming packets to Aerohive QoS classes
<number> Enter IEEE 802.11e user priority (Range: 07)
<number> Enter Aerohive QoS class (Range: 07)
qos classifiermap 8021p <number> <number>
8021p Map IEEE 802.1p priority markers on incoming packets to Aerohive QoS classes
<number> Enter IEEE 802.1p Priority (Range: 07)
qos classifiermap diffserv <number> <number>

Map diffserv DSCP (Differentiated Services Code Point) values on incoming packets to
diffserv
Aerohive QoS classes
<number> Enter the DSCP class (Range: 063)
<number> Enter the Aerohive QoS class (Range: 07)
qos classifiermap interface <ethx|aggx|redx> <number>

interface Map incoming Ethernet traffic to Aerohive QoS classes by its ingress interface
qos classifiermap oui <oui> [ qos <number> ] [ action {permit|deny|log} ] [ comment <string> ]
oui Set a MAC OUI (Organizational Unique Identifier) classification table
<oui>
qos Set an Aerohive QoS class to the MAC
action Set an action to the MAC OUI
permit permit the packet
deny deny the packet
log log the packet
comment Add a comment to the MAC OUI
<string> Enter a comment (Maximum:32 chars) to the MAC
qos classifiermap service <string> [ qos <number> ] [ action {permit|deny|log} ]

service Set servicebased classification table
<string> Enter service name (132 chars)
qos Set an Aerohive QoS class to the service
action Set the action to take when receiving a packet for this service
permit permit the packet
deny deny the packet
log log the packet

qos classifiermap ssid <string> <number>

ssid Map incoming wireless traffic to Aerohive QoS classes by SSID
<string> Enter an SSID name
qos classifierprofile <string> [ {interface/ssid

only|8021p|80211e|diffserv|interface/ssid|mac|service} ]
classifierprofile Set a QoS classification profile
<string> Enter a classifier profile name (132 chars)
Classify all incoming and outgoing packets using the interface or SSID bound to this
classifier profile (Note: The interface/ssidonly method cannot be combined with other
interface/ssidonly
methods in the same classifier profile or applied to more than one profile. This profile
has precedence over all others.)
8021p Classify incoming packets by 802.1p priority markers present in Layer2 frame headers
80211e Classify incoming packets by 802.11e priority markers present in wireless frame headers
diffserv Classify incoming packets by DiffServ DSCP values present in Layer3 packet headers
Classify packets by the interface or SSID that they traverse (Note: If two
interface/ssid interface/SSID classifier profiles apply to the same session, the one providing better
QoS is used.)
Classify packets by the OUI (organizationally unique identifier) of the session
mac participants (Note: If two OUI classifier profiles apply to the same session, the one
providing better QoS is used.)
service Classify incoming packets by network service type
qos enable
enable Enable QoS (Quality of Service)
qos l3police interface <string> enable

l3police Set parameters for simplified Layer 3 (VoIP QoS) policing
interface Set simplified Layer 3 (VoIP QoS) parameters for the specified interface
<string> Interface name
enable Enable Layer 3 policing for the specified interface
qos l3police interface <string> maxdownloadbw <number>

maxdownloadbw Set the maximum download bandwidth in Kbps
<number> The maximum download bandwidth in Kbps (Default: 100 Kbps; Range: 0~20000 Kbps)
qos l3police interface <string> maxuploadbw <number>

maxuploadbw Set the maximum upload bandwidth in Kbps
<number> The maximum upload bandwidth in Kbps (Default: 100 Kbps; Range: 0~20000 Kbps)
qos l3police voipdetecttimeout <number>

voipdetecttimeout Sets timeout used to turn off VoIP QoS policing after VoIP media traffic detection stops
<number> The timeout duration in seconds (Default: 10 seconds; Range: 2~100 seconds)
qos markermap 80211e <number> <number>

markermap Map Aerohive QoS classes to QoS priority markers on outgoing packets
80211e Map Aerohive QoS classes to IEEE 802.11e user priority markers on outgoing packets
<number> Enter the IEEE 802.11e user priority (Range: 07)
qos markermap 8021p <number> <number>

8021p Map Aerohive QoS classes to IEEE 802.1p priority markers on outgoing packets
qos markermap 8021p <string> [ <number> <number> ]

8021p Map Aerohive QoS classes to IEEE 802.1p priority markers on outgoing packets
<string> Enter marker name (132 chars)
qos markermap diffserv <number> <number>

Map Aerohive QoS classes to diffserv DSCP (Differentiated Services Code Point) values on
diffserv
outgoing packets
qos markermap diffserv <string> [ <number> <number> ]

Map Aerohive QoS classes to diffserv DSCP (Differentiated Services Code Point) values on
diffserv
outgoing packets
qos markerprofile <string> [ {8021p|80211e|diffserv} ]

markerprofile Set a QoS marker profile
<string> Enter the marker profile name (132 chars)
8021p Use 802.1p priority markers in Layer 2 frame headers as the marking method
80211e Use 802.11e priority markers in wireless frame headers as the marking method
diffserv Use DiffServ DSCP values in Layer 3 packet headers as the marking method
qos policy <string> [ userprofile <number> <number> ] [ user <number> ] [ qos <number> {strict|wrr}
<number> <number> ]
policy Set a QoS policy to control traffic forwarding
<string> Enter the policy name (132 chars)
userprofile Set QoS policy parameters at the user profile level
<number> Enter the user profile rate limit in kbps (Range: 02000000)
<number> Enter the scheduling weight for the user profile (Range: 01000)
user Set QoS parameters at the user level
<number> Enter the user rate limit in kbps (Range: 02000000)
qos Set QoS parameters at the Aerohive QoS class level
strict Set the scheduling mode as strict to forward traffic without queuing it
Set the scheduling mode as WRR (weighted round robin) to queue traffic and use rate
wrr
limits and weights to prioritize forwarding
<number> Enter the class rate limit in kbps (Range: 02000000)
Enter the scheduling weight (Range: 01000; Note: If the scheduling mode is strict, its
<number>
weight must be zero.)
quit
quit Quit CLI (Command Line Interface)
radio profile <string>

radio Set radio profile parameters
profile Set radio profile parameters
radio profile <string> acsp access channelautoselect timerange <time> <time> [ station <number> ]
acsp Set parameters for ACSP (Advanced Channel Selection Protocol)
access Set access point interface parameters
channelautoselect Set conditions for automatically selecting radio channels
Set the time range when a new radio channel can be selected (Note: During this time, the
timerange radio reevaluates the channel in use. It might switch to a different channel or
continue using the same channel.)
<time> Enter the start time (Format: hh:mm; Hour Range: 0023; Minute Range: 0059)
<time> Enter the end time (Format: hh:mm; Hour Range: 0023; Minute Range: 0059)
Set the maximum number of stations that can be connected to the HiveAP when selecting a
station
channel (If more are connected during the time range, no channel selection occurs.)
<number> Enter the station maximum (Range: 0100; Default: 0)
radio profile <string> acsp allchannelsmodel enable

allchannelsmodel Set all channels from which the radio can select the optimal channel
enable Enable all channels selection
radio profile <string> acsp channelmodel 4channels [ <channel_g4> ]

Set the pool of channels from which the radio can select the optimal channel(Default: 3
channelmodel
channel model)
4channels Set a 4channel model
Enter the pool of channels from which the radio can select one to use (Format: xxxxxx
<channel_g4>
xx; Default for FCC: 01040811; Default for all other regions: 01050913)
radio profile <string> acsp channelmodel {3channels} [ <channel_g3> ]

Set the pool of channels from which the radio can select the optimal channel(Default: 3
channelmodel
channel model)
3channels Set a 3channel model
Enter the pool of channels from which the radio can select one to use (Format: xxxxxx;
<channel_g3>
Default for all regions: 010611)
radio profile <string> acsp interferenceswitch crcerrthreshold <number>

Set parameters for the collection of RF interferencerelated data and switch channels if
interferenceswitch
the threshold is reached
Set an RF interference threshold based on the rate of CRC (cyclic redundancy check)
crcerrthreshold errors (Note: If the rate of CRC errors exceeds this threshold, the HiveAP switches
channels)
<number> Enter the threshold as a percent (Default: 25; Range: 1080)
radio profile <string> acsp interferenceswitch iuthreshold <number>

interferenceswitch
Set an RF interference threshold based on interference utilization (Note: If the percent
iuthreshold
of interference utilization exceeds this value, the HiveAP switches channels)
radio profile <string> acsp interferenceswitch {enable|nostationenable|disable}

interferenceswitch
Enable the radio to switch channels if the RF interference threshold is reached (Default
enable
setting: nostationenable)
Enable the radio to switch channels only if the RF interference threshold is reached and
nostationenable
no stations are connected (Default setting: nostationenable)
Disable the radio from switching channels because of RF interferencerelated data
disable
(Default setting: nostationenable)
radio profile <string> acsp maxtxpower <number>

maxtxpower Set radio max transmit power
<number> Enter the max transmit power (Default: 20 dBm; Range: 1020 dBm)
radio profile <string> ampdu

Enable AMPDU (Aggregate MAC Protocol Data Unit) transmissions to reduce overhead when
ampdu
the transmission channel is busy
radio profile <string> amsdu

Enable AMSDU (Aggregate MAC Service Data Unit) transmissions to reduce overhead when the
amsdu
transmission channel is busy
radio profile <string> backhaul failover [ triggertime <number> ] [ holdtime <number> ]

Set parameters for failing over the backhaul link from Ethernet to wireless (Note: Only
backhaul
set this command on a HiveAP that acts as a portal.)
Enable backhaul communications to fail over to the wireless link if the Ethernet link
failover
goes down (Default: enabled)
triggertime Set how long the Ethernet link must be down to trigger a failover to the wireless link
<number> Enter the failover trigger time in seconds (Default: 2; Range: 15)
Set how long the Ethernet link must be up to revert backhaul communications from
holdtime
wireless to Ethernet
<number> Enter the hold time in seconds (Default: 30; Range: 1300)
radio profile <string> bandsteering balanceband threshold <number>

Distribute wireless clients that support both 2.4 and 5 GHz bands evenly across the two
bandsteering
bands when an SSID is available on both bands
Balance clients according to an approximate ratio between 2.4 GHz and 5 GHz channels
balanceband
(Default: Allow four 5 GHz clients for every one 2.4 GHz client, or 80%.)
Set the minimum ratio of 5 GHz clients to 2.4 GHz clients, expressed as a percentage
threshold
(Example: Four 5GHz stations to five total stations is 80%.)
Enter the threshold to begin balancing band usage as a percentage (Range: 0100;
<number>
Default: 80)
radio profile <string> bandsteering enable

bandsteering
enable Enable band steering (Default: Disabled)
radio profile <string> bandsteering mode {balanceband|prefer5g|force5g}

bandsteering
mode Set the mode for band steering (Default: balanceband)
Balance clients according to an approximate ratio between 2.4 GHz and 5 GHz channels
balanceband
(Default: Allow four 5 GHz clients for every one 2.4 GHz client, or 80%.)
Encourage clients that are 5GHz capable to move to the 5 GHz band by ignoring requests
from them on the 2.4 GHz band (Note: If a client continues to attempt using 2.4 GHz even
prefer5g
when offered a 5 GHz connection, the system allows it to connect at 2.4 GHz after a
specified number of attempts. The default is 5.)
force5g Answer probe requests from 5 GHzcapable clients only on 5 GHz interfaces
radio profile <string> bandsteering prefer5g suppressionlimit <number>

bandsteering
Encourage clients that are 5GHz capable to move to the 5 GHz band by ignoring requests
from them on the 2.4 GHz band (Note: If a client continues to attempt using 2.4 GHz even
prefer5g
when offered a 5 GHz connection, the system allows it to connect at 2.4 GHz after a
specified number of attempts. The default is 5.)
Set a limit number to the number of probe responses the system suppresses before
suppressionlimit
accepting a client on the 2.4 GHz band
Enter the number of probe responses the system suppresses before accepting client in the
<number>
2.4 GHz band (Default: 5; Range: 1100)
radio profile <string> beaconperiod <number>

beaconperiod Set the period of time between beacon broadcasts
Enter the beacon period in TUs (time units, a measurement of time equal to 1024
<number>
microseconds) for the radio profile (Default: 100, Range: 403500)
radio profile <string> benchmark phymode 11a rate {6|9|12|18|24|36|48|54} success <number> usage
<number>
benchmark Set benchmark parameters for gauging the health of client connectivity
phymode Set the physical mode for which you want to measure client connectivity
11a Set benchmark parameters for 11a mode
Set the transmission rate that you expect clients with healthy connectivity to use
rate
(Note: You can set up to 3 rates for the same phymode)
6 Enter the transmission rate
Set the percent of packets that you expect clients with healthy connectivity to transmit
success
successfully
<number> Enter the percent for successfully transmitted packets (Range: 1100)
Set the percent of time that you expect clients with healthy connectivity to transmit at
usage
the defined rate
<number> Enter the percent of time that clients transmit at the defined rate (Range: 1100)
radio profile <string> benchmark phymode 11ac rate

{6|9|12|18|24|36|48|54|mcs0/1|mcs1/1|mcs2/1|mcs3/1|mcs4/1|mcs5/1|mcs6/1|mcs7/1|mcs8/1|mcs9/1|mcs0/2|mcs1/2|mcs
benchmark Set benchmark parameters for gauging the health of client connectivit
phymode Set the physical mode for which you want to measure client connectivi
11ac Set benchmark parameters for 11ac mode
rate Set the transmission rate that you expect clients with healthy connec
mcs0/1 Enter the transmission rate
success Set the percent of packets that you expect clients with healthy conne
usage Set the percent of time that you expect clients with healthy connecti
<number> Enter the percent of time that clients transmit at the defined rate (
radio profile <string> benchmark phymode 11b rate {1|2|5.5|11} success <number> usage <number>
11b Set benchmark parameters for 11b mode
rate
(Note: You can set up to 3 rates for the same phymode)
5.5 Enter the transmission rate
success
successfully
usage
the defined rate
radio profile <string> benchmark phymode 11g rate {1|2|5.5|11|6|9|12|18|24|36|48|54} success <number>
usage <number>
11g Set benchmark parameters for 11g mode
rate (Note: You can set up to 3 rates for the same phymode)

5.5 Enter the transmission rate
success
successfully
usage
the defined rate
radio profile <string> benchmark phymode 11n rate

{6|9|12|18|24|36|48|54|mcs0|mcs1|mcs2|mcs3|mcs4|mcs5|mcs6|mcs7|mcs8|mcs9|mcs10|mcs11|mcs12|mcs13|mcs14|mcs15|m
benchmark Set benchmark parameters for gauging the health o
phymode Set the physical mode for which you want to measu
11n Set benchmark parameters for 11n mode
rate Set the transmission rate that you expect clients
mcs0 Enter the transmission rate
success Set the percent of packets that you expect client
<number> Enter the percent for successfully transmitted pa
usage Set the percent of time that you expect clients w
<number> Enter the percent of time that clients transmit a
radio profile <string> channelwidth {20|40|40above|40below|80}

channelwidth Set the channel width or the extensive channel offset when channel width is 40 MHz
20 Enter the channel width and extensive channel offset (Default: 20 Mhz)
40above Enter the channel width and extensive channel offset (Default: 20 Mhz)
40below Enter the channel width and extensive channel offset (Default: 20 Mhz)
radio profile <string> clientloadbalance crcerrorlimit <number>

Enable the HiveAP to engage in client load balancing with neighboring hive members and
clientloadbalance
set client load balancing parameters
Set the maximum CRC (cyclic redundancy check) error rate that the HiveAP will tolerate
crcerrorlimit
before ignoring probes and association requests
<number> Enter the maximum CRC error rate as a percent (Default: 30; Range: 199)
radio profile <string> clientloadbalance enable

clientloadbalance
enable Enable client load balancing (Default: Disabled)
radio profile <string> clientloadbalance holdtime <number>

clientloadbalance
Set the amount of time that a client must be associated with a HiveAP before it can roam
(Note: Roaming before the hold time elapses is allowed if the client SNR is below the
holdtime
SNR threshold, the owner HiveAP is overloaded, or the client is experiencing a high
level of interference.)
<number> Enter the hold time for clients in seconds (Default: 60; Range: 10600)
radio profile <string> clientloadbalance interferencelimit <number>

clientloadbalance
Set the maximum amount of RF interference that the HiveAP will tolerate before ignoring
interferencelimit
probes and association requests
<number> Enter the maximum interference limit as a percent (Default: 40; Range: 199)
radio profile <string> clientloadbalance mode {airtime|stanum}

clientloadbalance
mode Set the mode for balancing client load with neighboring hive members (Default: airtime)
Enable load balancing based on airtime; that is, on the amount of the wireless medium
airtime
being used
stanum Enable load balancing based on the total number of clients associated with the device
radio profile <string> clientloadbalance neighborloadqueryinterval <number>
clientloadbalance
neighborloadquery
Set the time interval to query neighboring HiveAPs for load information
interval
<number> Enter the load query time interval in seconds (Range: 1600; Default: 60)
radio profile <string> clientloadbalance staminiairtime <number>

clientloadbalance
Set the minimum average percent of airtime consumed by all clients associated with the
staminiairtime
HiveAP before it begins ignoring probes and association requests from new client
<number> Enter the minimum station airtime as a percent (Default: 4; Range: 15)
radio profile <string> denyclient {11b|11abg}

denyclient Deny connections from wireless clients using the specified standards
Deny connections from wireless clients using the 802.11b standard (Default: All
11b
connections are accepted)
Deny connections from wireless clients using the 802.11a/b/g standard (Default: All
11abg connections are accepted; Note: This option is only allowed for radio profiles
supporting 802.11n)
radio profile <string> detectbssidspoofing

detectbssidspoofing Enable the detection of spoofed BSSIDs (Default: Disabled)
radio profile <string> dfs

Enable DFS (Dynamic Frequency Selection) so the radio can switch channels automatically
dfs
when detecting a radar signal (Default: Disabled)
radio profile <string> dfs radardetectonly

Enable DFS (Dynamic Frequency Selection) so the radio can switch channels automatically
dfs
when detecting a radar signal (Default: Disabled)
Enable radar signal detection but do not change channels if it is detected (Default:
radardetectonly
Disabled)
radio profile <string> frameburst
Enable frame bursting, which allows the device to send a series of frames in succession
frameburst
without having to give up contorl of the medium(Default: Disabled)
radio profile <string> highdensity broadcastprobesuppress oui <oui>

Set parameters to reduce management traffic and improve the processing of client traffic
highdensity
in a highdensity RF environment
broadcastprobe
Suppress responses to broadcast probe requests that are broadcast by specified clients
suppress
Set the OUI (Organizationally Unique Identifier) portion of client MAC addresses to
oui
which you want to suppress probe responses
<oui>
radio profile <string> highdensity continuousprobesuppress enable

highdensity
continuousprobe Suppress subsequent transmissions of probe responses to clients that send multiple probe
suppress requests within the same beacon interval
enable Enable the suppression of subsequent probe responses (Default: Disabled)
radio profile <string> highdensity enable

highdensity
enable Enable highdensity settings (Default: Disabled)
radio profile <string> highdensity mgmtframetxrate {low|high}

highdensity
Set the management frame transmit bit rate as low or high (Note: This setting also
mgmtframetxrate applies to broadcast and multicast data frame bit rates and unicast data frame retry bit
rates.)
low Set the basic transmit rate for a high density deployment as low (Default: Low)
high Set the basic transmit rate for a high density deployment as high (Default: Low)
radio profile <string> interferencemap crcerrthreshold <number>

Set parameters for the collection of RF interferencerelated data and the reporting of
interferencemap this data to HiveManager
Set an RF interference threshold based on the rate of CRC (cyclic redundancy check)
crcerrthreshold errors (Note: If the rate of CRC errors exceeds this threshold, the HiveAP alerts
HiveManager to switch from its regular polling interval to a shorter one)
radio profile <string> interferencemap cuthreshold <number>

interferencemap
this data to HiveManager
Set an RF interference threshold based on channel utilization (Note: If the percent of
cuthreshold channel utilization exceeds this value, the HiveAP alerts HiveManager to switch from its
regular polling interval to a shorter one)
radio profile <string> interferencemap enable

interferencemap
enable Enable the collection and reporting of RF interferencerelated data to HiveManager
radio profile <string> interferencemap shortterminterval <number>

interferencemap
Set the interval during which the HiveAP calculates a shortterm average of channel
shortterminterval utilization and CRC errors (Note: The HiveAP calculates three averages: a running
average, a configurable shortterm average, and a 60second snapshot average)
<number> Enter the shortterm interval in minutes (Default: 5; Range: 530)
radio profile <string> maxclient <number>

maxclient Set radio profile's max number of clients/neighbors
<number> Enter the maximum number of clients (Range: 1100)
radio profile <string> phymode {11a|11b/g|11na|11ng|11ac}

phymode Set the physical mode of the radio profile
11a Set the physical mode to 11a (Default: 11b/g)
11b/g Set the physical mode to 11b/g (Default: 11b/g)
11na Set the physical mode to 11na (Default: 11b/g)
11ng Set the physical mode to 11ng (Default: 11b/g)
11ac Set the physical mode to 11ac (Default: 11b/g)
radio profile <string> presence aggrinterval <number>
presence Set precense parameters for the radio profile
aggrinterval Set the precense aggr interval of the radio profile
Enter a interval number to which the aggregation will be done (Default: 120 sec;Range:
<number>
15 600)
radio profile <string> presence agingtime <number>

agingtime Set the precense aging time of the radio profile
<number> Enter an aging time for presence client (Default: 120 sec; Range: 15 600)
radio profile <string> presence enable

enable Enable presence setting (Default: Disabled)
radio profile <string> presence trapinterval <number>

trapinterval Set the precense trap interval of the radio profile
<number> Enter a interval number to which the trap was sent (Default: 120 sec;Range: 15 600)
radio profile <string> primarychanneloffset {auto|0|1|2|3}

primarychanneloffset Set the primary channel offset of the radio profile
auto Set primary channel offset to auto (Default: auto)
0 Set primary channel offset to 0 (Default: auto)
radio profile <string> receivechain <number>

receivechain Set the number of receive chains for frame reception
<number> Enter the number of receive chains (Default: 3; Range: 13)
radio profile <string> safetynet enable
Enable the HiveAP, when it is in an overloaded state or if the client's SNR is low, to
safetynet
respond to a client making association requests after the timeout period elapses
enable Enable safety net checking (Default: Enabled)
radio profile <string> safetynet timeout <number>

Enable the HiveAP, when it is in an overloaded state or if the client's SNR is low, to
safetynet
respond to a client making association requests after the timeout period elapses
Set the maximum length of time to ignore association requests from a client when the
timeout
HiveAP is in an overloaded state or if the client's SNR is low
radio profile <string> scan access

scan Enable scanning to detect neighboring APs
access Enable scanning for interfaces in access mode (Default: Enabled)
radio profile <string> scan access client

client Allow scanning to occur when clients are connected (Default: Allowed)
radio profile <string> scan access client powersave

client Allow scanning to occur when clients are connected (Default: Allowed)
Allow scanning to occur when connected clients are in a power save state (Default:
powersave
Disallowed)
radio profile <string> scan access interval <number>

interval Set the scan interval
<number> Enter the scan interval in minutes (Default: 10 minutes; Range: 11440)
radio profile <string> scan access voice
voice Allow scanning to occur while processing voice traffic (Default: Disallowed)
radio profile <string> sensor channellist <string>

sensor Set sensor parameters for the radio profile
channellist Set the channel list to sensor mode of the radio profile
Enter a string comprised of channel list. channel number and separated by ','(e.g.
<string>
1,6,11).or "all" (Default: all)(164 chars)
radio profile <string> sensor dwelltime <number>

sensor Set sensor parameters for the radio profile
dwelltime Set the dwell time to sensor mode of the radio profile
<number> Enter a numeric value for sensor dwell time (Default:1200 millisecond; Range: 25030000)
radio profile <string> shortguardinterval

Enable the short guard interval option (400ns) to avoid intersymbol interference and
shortguardinterval
improve media throughput (Note: This is only valid in 40MHz channel mode.)
radio profile <string> shortpreamble

shortpreamble Set short preamble mode of radio profile
radio profile <string> transmitchain <number>

Set the number of transmit chains for frame transmission or configure the HiveAP to
transmitchain
determine them automatically
<number> Enter the number of transmit chains (Default: 3; Range: 13)
radio profile <string> txbeamforming [ {explicitonly|auto} ]

txbeamforming Enable beamforming on the transmit antennas (Default: Disabled)
Use explicit transmit beamforming, in which the transmitter uses a steering matrix
explicitonly
calculated by the receiver as a basis for calculating its own steering matrix
Allow the transmitter to choose whether it uses implicit or explicit beamforming rules
auto to calculate its steering matrix based on whether it receives explicit feedback from the
receiver(default)
radio profile <string> txrate vhtmcs

{MCS0/1|MCS1/1|MCS2/1|MCS3/1|MCS4/1|MCS5/1|MCS6/1|MCS7/1|MCS8/1|MCS9/1|MCS0/2|MCS1/2|MCS2/2|MCS3/2|MCS4/2|MCS5
txrate Set the Tx (transmission) rate for the radio profile
vhtmcs Set the 802.11ac Tx(transmission) rate
MCS0/1 Set the transmit rate as MCS0/1
radio profile <string> txrate

{auto|1Mbps|2Mbps|5.5Mbps|6Mbps|9Mbps|11Mbps|12Mbps|18Mbps|24Mbps|36Mbps|48Mbps|54Mbps|MCS0|MCS1|MCS2|MCS3|
MCS4|MCS5|MCS6|MCS7|MCS8|MCS9|MCS10|MCS11|MCS12|MCS13|MCS14|MCS15|MCS16|MCS17|MCS18|MCS19|MCS20|MCS21|MCS22|MC
txrate Set the Tx (transmission) rate for the radio profile
auto Set the radio to determine its transmission rate automatically (Default: auto; Range: 154 Mbps
1Mbps Set the transmit rate as 1Mbps (Only for 802.11bg and 802.11ng)
5.5Mbps Set the transmit rate as 5.5Mbps (Only for 802.11bg and 802.11ng)
6Mbps Set the transmit rate as 6Mbps
MCS0 Set the transmit rate as MCS0
MCS16 Set the transmit rate as MCS16 (Only for the HiveAP 330, 350, 370 and 390)
radio profile <string> vht2g

Set VHT (802.11ac) support mode on 2.4GHz interface or configure the AP to determine it
vht2g
automatically(Default: Disabled)
radio profile <string> weaksnrsuppress enable

Set parameters to determine when the SNR (signaltonoise ratio) for a client is weak,
weaksnrsuppress and enable the HiveAP to ignore probes and association requests from clients with weak
SNRs
Enable the suppression of probe responses when the client SNR is weak (Default:
enable
Disabled)
radio profile <string> weaksnrsuppress threshold <number>

Set parameters to determine when the SNR (signaltonoise ratio) for a client is weak,
weaksnrsuppress and enable the HiveAP to ignore probes and association requests from clients with weak
SNRs
Set the minium amount of SNR(signaltonoise ratio) that the HiveAP will accepting
threshold
probes and association requests
<number> Enter threshold of weak snr suppress in dB (Default: 15, Range: 1100)
radio profile <string> wmm ac {background|besteffort|video|voice} aifs <number>

wmm Set WiFi Multimedia parameters
ac Set Access Category parameters
background Set background access category parameters
besteffort Set besteffort access category parameters
video Set video access category parameters
voice Set voice access category parameters
aifs Set AIFS (arbitration interframe space) parameters
<number> Set the AIFS value (Range: 015)
radio profile <string> wmm ac {background|besteffort|video|voice} cwmax <number>

cwmax Set maximal contention window parameters
<number> contention window maximal value (Range: 115)
radio profile <string> wmm ac {background|besteffort|video|voice} cwmin <number>

cwmin Set minimal contention window parameters
<number> Set contention window minimal value (Range: 115)
radio profile <string> wmm ac {background|besteffort|video|voice} noack

noack Set no acknowledgments
radio profile <string> wmm ac {background|besteffort|video|voice} txoplimit <number>

txoplimit Set transmission opportunity limit parameters
Set transmission opportunity limit value (Range: 08192; Note: Your input must be
<number>
multiples of 32)
reboot
reboot Reboot the system
reboot date <date> time <time>

date Schedule the system to reboot at a specific date and time
Enter the date when you want the system to reboot (Format: yyyymmdd; Default: The
<date>
current date provided by HiveOS)
time Set the time when you want the system to reboot
<time> Enter the time (Format: hh:mm:ss; Default: 00:00:00)
reboot offset <time>

offset Schedule the system to reboot at a time relative to the moment you enter the command
Enter the length of time after which the system will reboot (Maximum: 24 hours from the
<time>
time you enter the command; Format: hh:mm:ss; Default:00:00:00)
reboot {backup|current}
Load the backup HiveOS image when rebooting (Default image to load when rebooting after
saving a new image: backup; Default image to load when rebooting at all other times:
backup
current)
current Load the currently running HiveOS image when rebooting
reboot {backup|current} date <date> time <time>

backup saving a new image: backup; Default image to load when rebooting at all other times:
current)
date Schedule the system to reboot at a specific date and time
Enter the date when you want the system to reboot (Format: yyyymmdd; Default: The
<date>
current date provided by HiveOS)
time Set the time when you want the system to reboot
<time> Enter the time (Format: hh:mm:ss; Default: 00:00:00)
reboot {backup|current} offset <time>

backup saving a new image: backup; Default image to load when rebooting at all other times:
current)
offset Schedule the system to reboot at a time relative to the moment you enter the command
Enter the length of time after which the system will reboot (Maximum: 24 hours from the
<time>
time you enter the command; Format: hh:mm:ss; Default:00:00:00)
report statistic alarmthreshold client {txdroprate|rxdroprate|txretryrate|airtimeconsumption}

<number>
report Set the parameters for gathering traffic statistics and reporting them to HiveManager
statistic Set the periodic reporting of interfacelevel and clientlevel traffic statistics
Set the alarm threshold for the CRC error rate, Tx/Rx drop rate, and Tx retry rate(Note:
alarmthreshold
If the rate exceeds the threshold, the HiveAP sends an alarm to HiveManager.)
Set the Tx/Rx drop rate, Tx retry rate, and airtime consumption alarm threshold of
client
clients
txdroprate Set the Tx drop rate alarm threshold for clients (Default: 40%)
rxdroprate Set the Rx drop rate alarm threshold for clients (Default: 40%)
txretryrate Set the Tx retry rate alarm threshold for clients (Default: 40%)
Set the airtime consumption (Tx airtime percentage + Rx airtime percentage) alarm
airtimeconsumption
threshold for clients (Default: 30%)
<number> Enter the alarm threshold (Range: 1100)
report statistic alarmthreshold interface {crcerrorrate|txdroprate|rxdroprate|txretry

rate|airtimeconsumption} <number>
Set the alarm threshold for the CRC error rate, Tx/Rx drop rate, and Tx retry rate(Note:
alarmthreshold
If the rate exceeds the threshold, the HiveAP sends an alarm to HiveManager.)
Set the CRC error rate, Tx/Rx drop rate, Tx retry rate, and airtime consumption alarm
interface
threshold of wifi interfaces
crcerrorrate Set CRC error rate alarm threshold for the wifi interfaces (Default: 30%)
txdroprate Set the Tx drop rate alarm threshold for the wifi interfaces (Default: 40%)
rxdroprate Set the Rx drop rate alarm threshold for the wifi interfaces (Default: 40%)
txretryrate Set the Tx retry rate alarm threshold for the wifi interfaces (Default: 40%)
Set the airtime consumption (Tx airtime percentage + Rx airtime percentage) alarm
airtimeconsumption
threshold for the wifi interfaces (Default: 50%)
<number> Enter the alarm threshold (Range: 1100)
report statistic enable
enable Enable the creation of traffic statistics reports
report statistic period <number>

period Set the time interval for gathering traffic statistics and calculating percentages
<number> Enter the time interval (Default: 10 minutes; Supported: 1, 5, 10, 30 or 60 minutes)
reset config [ {bootstrap} ]

Return the configuration to its default settings or the files in a web directory to the
reset
default file set
config Reset the configuration to the factory default settings and reboot
bootstrap Clear bootstrap configuration
reset webdirectory [ <string> [ {savetoflash} ] ]

reset
default file set
Reset the files in all web directories, in a specific directory, or in directories
webdirectory
referenced by SSIDs to the default file set
Enter the web directory name to reset files in the directory to the default file set (1
<string>
32 chars)
savetoflash Save the default set of files in the specified directory to flash memory
reset webdirectory allrunningssid

reset
default file set
Reset the files in all web directories, in a specific directory, or in directories
webdirectory
referenced by SSIDs to the default file set
allrunningssid Reset the web directories for all SSIDs to the default file set
resetbutton resetconfigenable
resetbutton Enable the reset button on the AP chassis to reset the AP config
Enable the reset button to reset the AP to its factory default settings or, if set, to a
resetconfigenable
bootstrap config (Default: enabled)
roaming cache updateinterval <number> ageout <number>

roaming Set roaming parameter
Set the interval between updates and the number of times to update station's roaming
cache
cache
updateinterval Set the interval for sending roaming cache updates to neighbors
<number> Enter the roaming cache update interval in seconds (Default: 60; Range: 1036000)
Set how many times an entry must be absent from a neighbors updates before removing it
ageout
from the roaming cache
<number> Enter the number of absences required to remove an entry (Default:60; Range: 11000)
roaming cachebroadcast neighbortype access enable

cachebroadcast Set parameters for broadcasting roaming cache data to hive neighbors
neighbortype Set the type of neighbor to which you want to broadcast roaming cache data
access Broadcast roaming cache data to hive neighbors discovered through wireless access links
Enable the broadcasting of roaming cache data to hive neighbors over wireless access
enable links (Default: Enabled)
roaming cachebroadcast neighbortype backhaul enable

cachebroadcast Set parameters for broadcasting roaming cache data to hive neighbors
neighbortype Set the type of neighbor to which you want to broadcast roaming cache data
Broadcast roaming cache data to hive neighbors discovered through Ethernet and wireless
backhaul
backhaul links
Enable the broadcasting of roaming cache data to hive neighbors over backhaul links
enable
(Default: Enabled)
roaming hop <number>

Set the number of HiveAPs away from the source HiveAP to which it sends station
hop
authentication information
<number> Set roaming hop value (Defaule: 1, Range: 016)
roaming neighbor exclude ip <ip_addr>

Set which HiveAPs to include or exclude as neighbors (Maximum number of neighbors is 32)
neighbor
or roaming neighbor querying parameters
exclude Exclude dynamic roaming neighbor
ip Set IP address parameter for static roaming neighbor
<ip_addr> Enter IP address for static roaming neighbor
roaming neighbor include ip <ip_addr> <netmask>

neighbor
include Include dynamic roaming neighbor
ip Set IP address parameter for static roaming neighbor
<ip_addr> Enter IP address for static roaming neighbor
<netmask> Enter netmask for static roaming neighbor
roaming neighbor queryinterval <number> querytimes <number>

neighbor
queryinterval Set roaming neighbor query interval
<number> Enter roaming neighbor query interval (Default: 10 secs; Min: 5; Max: 360000)
querytimes Set roaming neighbor query times
<number> Enter roaming neighbor query times (Default: 5; Min: 2; Max: 1000)
roaming port <number>

Set the port number that hive members use when sending roaming control data to each
port
other
Enter the port number for L3 roaming control traffic (Default: 3000; Range: 150065000;
<number>
Note: The new setting must be at least 50 more or 50 less than the current setting.)
route <mac_addr> outgoinginterface <string> nexthop <mac_addr>

route Set a MAC address route
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
outgoinginterface Set outgoing interface
<string> Enter interface name
nexthop Set the MAC address of the next hop in the L2 forwarding route
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
routing internalsubnetwork <ip_addr/netmask> [ {tunneldistonly} ]

routing Set routing parameters
internalsubnetwork Set an internal subnetwork to be used in branch offices
<ip_addr/netmask> Enter the IP address and netmask for the internal subnetwork
tunneldistonly Do not advertise the route to the internal subnetwork via dynamic routing protocols
routing matchmap <string> from {any} to {any|private}

matchmap Set matchmap parameters for a routing policy
<string> Enter match map name (132 chars)
from Apply the policy based on the traffic source prefix
any Apply the policy regardless of the traffic source
to Apply the policy based on the traffic destination prefix
any Apply the policy regardless of the traffic destination
private Private internet
routing matchmap <string> from {any} to {hostname} <string>

hostname
<string> Enter an destination hostname
routing matchmap <string> from {any} to {iprange} <ip_addr> <ip_addr>

<ip_addr> Enter a start IP address
<ip_addr> Enter an end IP address
routing matchmap <string> from {any} to {network} <ip_addr/netmask>

from
Apply the policy based on the traffic source prefix
<ip_addr/netmask> Enter an destination IP address
routing matchmap <string> from {iprange} <ip_addr> <ip_addr> to {any|private}

<ip_addr> Entry start source IP address
<ip_addr> Entry end source IP address
routing matchmap <string> from {iprange} <ip_addr> <ip_addr> to {hostname} <string>

hostname
routing matchmap <string> from {iprange} <ip_addr> <ip_addr> to {iprange} <ip_addr> <ip_addr>
routing matchmap <string> from {iprange} <ip_addr> <ip_addr> to {network} <ip_addr/netmask>

routing matchmap <string> from {network} <ip_addr/netmask> to {any|private}

<ip_addr/netmask> Entry source IP address
routing matchmap <string> from {network} <ip_addr/netmask> to {hostname} <string>

hostname
routing matchmap <string> from {network} <ip_addr/netmask> to {iprange} <ip_addr> <ip_addr>

routing matchmap <string> from {network} <ip_addr/netmask> to {network} <ip_addr/netmask>

routing matchmap <string> {iif} <ethx> to {any|private}

iif Apply the policy based on the traffic incoming LAN interface
routing matchmap <string> {iif} <ethx> to {hostname} <string>

hostname
routing matchmap <string> {iif} <ethx> to {iprange} <ip_addr> <ip_addr>

routing matchmap <string> {iif} <ethx> to {network} <ip_addr/netmask>

routing matchmap <string> {userprofile} <string> to {any|private}

userprofile Apply the policy if the HiveAP assigns a user profile to the traffic
<string> Set userprofile name (132 chars)

routing matchmap <string> {userprofile} <string> to {hostname} <string>

hostname
routing matchmap <string> {userprofile} <string> to {iprange} <ip_addr> <ip_addr>

routing matchmap <string> {userprofile} <string> to {network} <ip_addr/netmask>

routing policy <string> id <number> matchmap <string> routemap <string>

policy Set parameters for a routing policy
<string> Enter routing policy name (132 chars)
id Assign a routing policy ID (range: 1 128)
<number> Enter a routing policy ID (range: 1 128)
routemap Set routemap parameters for a routing policy
<string> Enter route map name (132 chars)
routing routemap <string> via <ethx|usbnetx|wifix>
via Specify the nexthop of traffic
routing routemap <string> via {encrypted|blackhole}

via Specify the nexthop of traffic
encrypted encryped
blackhole via blackhole
routing routerequest enable

routerequest Set parameters for requesting routing information from route authorities
enable Enable the device to request routing information (Default: disabled)
routing routerequest interval <number>

routerequest Set parameters for requesting routing information from route authorities
interval Set the time interval for requesting routing information
save ble ibeacon firmware

Save a configuration, HiveOS image, RADIUS database, or files used by the internal web,
save
RADIUS servers, or packet capture tool
ble Select the Bluetooth low energy device
ibeacon Select a Bluetooth iBeacon device
firmware Save a Aerohive firmware, included in the HiveOS image, to the iBeacon Bluetooth device
save config <location> bootstrap

save
Save a configuration from the HiveAP to a remote server, from a remote server to the
config
HiveAP, or from DRAM to flash as the current or bootstrap config
Enter the protocol, SCP user name, location, path, file name, and SCP port number
<location> (Range: 1256 chars; Default SCP port number: 22; Format: tftp://location:path/filename,
scp://username@location:path/filename or scp://username@location:port:path/filename)
bootstrap Save a configuration to the bootstrap configuration
save config <location> current

save
config
current Save a configuration to the current configuration
save config <location> current <time> [ <date> ]
save
config
<time> Enter the time that you want the system to reboot (Format: hh:mm:ss)
<date> Enter the date that you want the system to reboot (Format: yyyymmdd)
save config <location> current now

save
config
now Save the configuration and reboot the system immediately
save config <location> current offset <time>

save
config
offset Set a relative time for the system to reboot
Schedule the system to reboot at a relative time (Maximum: 24 hours from the time you
<time>
enter the command; Format: hh:mm:ss)
save config <url> bootstrap [ admin <string> password <string> {basic|digest} ] [ proxy <string> [
save
config
<url> (Default port: 80; 1256 chars; Format: http://domain/path/file,
http://domain:port/path/file; Note: You can substitute 'https' for 'http'.)
Save the config file for the HiveAP to use as its bootstrap configuration, which is the
bootstrap one it loads if it fails to load the current and backup config files or if you enter the
'reset config' command
basic
digest
Enter the domain name or IP address and, optionally, the port number for the HTTP proxy
<string> server (Max length: 64 chars; Format: domainname, ip_addr, domainname:port, or
ip_addr:port)
proxyadmin Set the name of the proxy administrator
<string> Enter the proxy administrator name (132 chars)
password Set the password for the proxy administrator
<string> Enter the proxy password (164 chars)
save config <url> current <time> [ <date> ] [ admin <string> password <string> {basic|digest} ] [
save
config
Save the config file for the HiveAP to use as its current configuration, which is the
current
one it loads when booting u
basic
digest
ip_addr:port)
save config <url> current [ {now} ] [ admin <string> password <string> {basic|digest} ] [ proxy
<string> [ proxyadmin <string> password <string> ] ]
save
config
current
now Save the configuration and reboot the system immediately
basic
digest
<string>
server (Max length: 64 chars; Format: domainname, ip_addr, domainname:port, or
ip_addr:port)
save config <url> current offset <time> [ admin <string> password <string> {basic|digest} ] [ proxy
save
config
current
<time>
basic
digest
ip_addr:port)
save config [ running current ]

save
config
running Save a configuration from the running configuration
save config bootstrap <location>

save
config
bootstrap Save the bootstrap configuration to a remote server
save config current <location>
save
config
current Save the current configuration to a remote server or to the bootstrap config
save config current bootstrap

save
config
save config running bootstrap

save
config
running Save a configuration from the running configuration
save config users [ bootstrap ]

save
config
users Save private PSK user accounts to the current or bootstrap configuration
bootstrap Save private PSK user accounts to the bootstrap configuration
save config {current|bootstrap} <url> [ admin <string> password <string> {basic|digest} ] [ proxy
save
config
bootstrap Save the bootstrap configuration to a remote server
basic
digest username, password, and other values to the authorization header in HTTP requests

ip_addr:port)
save dhcpfingerprint {option55} <location>

save
dhcpfingerprint Save a fingerprint file of DHCP options for client OS detection
Save a fingerprint file of various parameter request lists mapped to client operating
systems (Note: DHCP clients include unique lists in DHCP option 55 when sending
option55
DHCPDISCOVER messages. By comparing those lists with the fingerprints in the file,
client operating systems can be detected.)
save dhcpfingerprint {option55} <url> [ admin <string> password <string> {basic|digest} ] [ proxy
save
dhcpfingerprint Save a fingerprint file of DHCP options for client OS detection
Save a fingerprint file of various parameter request lists mapped to client operating
systems (Note: DHCP clients include unique lists in DHCP option 55 when sending
option55
DHCPDISCOVER messages. By comparing those lists with the fingerprints in the file,
client operating systems can be detected.)
basic
digest
ip_addr:port)
save image <location> <time> [ <date> ] [ limit <number> ]

save
image Save a HiveOS image to the HiveAP
limit Limit the amount of bandwidth used for uploading the image file
Enter the bandwidth limit in Kbps (Range:101000000; Default: Maximum available
<number>
bandwidth)
save image <location> [ {now} ] [ limit <number> ]
save
now Save the image and reboot the system immediately
<number>
bandwidth)
save image <location> offset <time> [ limit <number> ]

save
<time>
<number>
bandwidth)
save image <url> <time> [ <date> ] [ admin <string> password <string> {basic|digest} ] [ proxy
save
basic
digest
ip_addr:port)

save image <url> [ {now} ] [ admin <string> password <string> {basic|digest} ] [ proxy <string> [
save
now Save the image and reboot the system immediately
basic
digest
ip_addr:port)
save image <url> offset <time> [ admin <string> password <string> {basic|digest} ] [ proxy <string> [
save
<time>
basic
digest
ip_addr:port)
save radiusserverkey radsec {cert|ca} <location>

save
radiusserverkey Save certificate files for the local Aerohive RADIUS server to use
Save certificates that the local Aerohive device uses when functioning as a RadSec proxy
server (Note: A RadSec proxy server can forward RADIUS requests over a secure TLS tunnel
radsec
between RadSec peers.)
cert Save an endentity certificate for the Aerohive device to use when authenticating itself
to a RadSec peer
Save a CA (certificate authority) certificate for the Aerohive device to verify the
ca
certificate of its RadSec peer
save radiusserverkey radsec {cert|ca} <url> [ admin <string> password <string> {basic|digest} ] [
save
Save certificates that the local Aerohive device uses when functioning as a RadSec proxy
radsec server (Note: A RadSec proxy server can forward RADIUS requests over a secure TLS tunnel
between RadSec peers.)
Save an endentity certificate for the Aerohive device to use when authenticating itself
cert
to a RadSec peer
Save a CA (certificate authority) certificate for the Aerohive device to verify the
ca
certificate of its RadSec peer
admin Set the name that the local device uses to log in to the HTTP server
<string> Enter the login name (132 chars)
password Set the password to enter during the login process
basic
digest
proxy Set parameters for connecting to an HTTP proxy server
<string> server (Max length: 64 chars; Format: domain_name, ip_addr, domain_name:port, or
ip_addr:port)
proxyadmin Set the name that the local device uses to log in to the HTTP proxy server
<string> Enter the login name (132 chars)
password Set the password to enter during the login process
save radiusserverkey {radiusserver|ldapclient} <location>

save
radiusserver Save certificates that the local HiveAP uses when functioning as a RADIUS server
ldapclient Save certificates that the local HiveAP uses when functioning as an LDAP client
save radiusserverkey {radiusserver|ldapclient} <url> [ admin <string> password <string>

{basic|digest} ] [ proxy <string> [ proxyadmin <string> password <string> ] ]
save
radiusserver Save certificates that the local HiveAP uses when functioning as a RADIUS server
ldapclient Save certificates that the local HiveAP uses when functioning as an LDAP client
basic
digest
ip_addr:port)
save serverfiles
save
Save certificate and private key files used by the internal web and RADIUS servers and
serverfiles VPN from DRAM to flash memory for persistent storage after reboots (Note: For security
reasons, these files are saved only in DRAM by default.)
save signaturefile <location> [ limit <number> ]

save
signaturefile Remote image used for L7 application
<number>
bandwidth)
save signaturefile <url> [ admin <string> password <string> {basic|digest} ] [ proxy <string> [
save
signaturefile Remote image used for L7 application
basic
digest username, password, and other values to the authorization header in HTTP requests

ip_addr:port)
save ssid <string> macbind <location>

save
ssid Save a locally stored file to a remote server
<string> Enter the file name to upload to a remote server
macbind Save authppsk macbinding file
save supplicant certfile <location>

save
supplicant Save files for wpa supplicant
certfile Save certificate files for the wpa supplicant
save supplicant certfile <url> [ admin <string> password <string> {basic|digest} ] [ proxy <string> [
save
supplicant Save files for wpa supplicant
certfile Save certificate files for the wpa supplicant
basic
digest
ip_addr:port)
save users <location>

save
users Save private PSK (preshared key) configurations
<location>
(Range: 1256 chars; Default SCP port number: 22; Format: tftp://location:path/filename,
save users <url> [ admin <string> password <string> {basic|digest} ] [ proxy <string> [ proxyadmin
save
users Save private PSK (preshared key) configurations
basic
digest
ip_addr:port)
save vpn {cacert|eecert|privatekey} <url> [ admin <string> password <string> {basic|digest} ] [

save
vpn Save a VPN certificate or private key file
Save a CA (certificate authority) certificate for the HiveAP to verify its IKE peer's
cacert
certificate
Save an endentity certificate for the HiveAP to use when authenticating itself to an
eecert
IKE peer
privatekey Save the private key for the HiveAP to use when creating its RSA signature
basic
digest
ip_addr:port)
save vpn {eecert|privatekey|cacert} <location>

save
vpn Save a VPN certificate or private key file
Save an endentity certificate for the HiveAP to use when authenticating itself to an
eecert
IKE peer
privatekey Save the private key for the HiveAP to use when creating its RSA signature
Save a CA (certificate authority) certificate for the HiveAP to verify its IKE peer's
cacert
certificate
save webpage [ ppskselfreg ] webdirectory <string> <location>

save
webpage Save a file for use with the internal web server
Save a file to the private PSK selfregistration web directory (Note: The HiveAP, as a
ppskselfreg
private PSK server, uses these files to respond to selfregistration requests.)
webdirectory Save a file to a specific web directory
<string> Enter the web directory name
save webpage [ ppskselfreg ] webdirectory <string> <url> [ admin <string> password <string>
save
webpage Save a file for use with the internal web server
Save a file to the private PSK selfregistration web directory (Note: The HiveAP, as a
ppskselfreg
private PSK server, uses these files to respond to selfregistration requests.)
webdirectory Save a file to a specific web directory
basic
digest
ip_addr:port)

save webserverkey <number> <location> [ comment <string> ]

save
webserverkey Save certificate files for the internal web server to use
<number> Enter key file index for the internal web server (Range : 015)
<location>
(Range: 1256 chars; Default SCP port number: 22; Format: tftp://location:path/filename,
comment Enter a comment
<string> Enter a comment (max 64 chars)
save webserverkey <number> <url> [ comment <string> ] [ admin <string> password <string>
save
webserverkey Save certificate files for the internal web server to use
<number> Enter key file index for the internal web server (Range : 015)
comment Set a comment about the certificate file
<string> Enter the comment (164 chars)
basic
digest
ip_addr:port)
save {capture} local <string> <location>

save
capture Save a packet capture file stored locally to a remote server
local Save a locally stored packet capture file to a remote server
save {capture} local <string> <url> [ admin <string> password <string> {basic|digest} ] [ proxy
save
capture Save a packet capture file stored locally to a remote server
local Save a locally stored packet capture file to a remote server

basic
digest
ip_addr:port)
schedule <string> once <date> <time> to <date> <time> [ timezone <number> ] [ comment <string> ]
schedule Set a schedule to control the application of user profiles and the availability of SSIDs
<string> Enter a schedule name (132 chars)
once Set a onetime schedule
Enter a start date for the schedule (Format: yyyymmdd; Range: 19700101 to 203512
<date>
31)
Enter a start time for the schedule (Format: hh:mm; Hour Range: 0023; Minute Range: 00
<time>
59)
to Set a date and time range
<date> Enter an end date for the schedule (Format: yyyymmdd; Range: 19700101 to 20351231)
Enter an end time for the schedule (Format: hh:mm; Hour Range: 0023; Minute Range: 00
<time>
59)
Set the time zone for the schedule (Note: If you do not specify a time zone, the time
timezone
zone for the local system will be used.)
<number> Enter the time zone for the schedule (Default: 0; Range: 12 to 12)
comment Write a comment about the schedule for future reference
<string> Enter a comment about the schedule (max 128 chars)
schedule <string> ppsk once <date> <time> to <date> <time> [ timezone <number> ] [ comment <string> ]
Set a schedule to determine the validity period for the private PSK users to which the
ppsk
schedule is applied
once Set a onetime schedule
<date>
31)
<time>
59)
<time>
59)
timezone
schedule <string> ppsk recurrent [ daterange <date> [ to <date> ] ] [ weekday <string> ] timerange
<time> to <time> [ timerange <time> to <time> ] [ timezone <number> ] [ comment <string> ]
Set a schedule to determine the validity period for the private PSK users to which the
ppsk
schedule is applied
recurrent Set a recurrent schedule
Set dates to mark the start and end of the schedule (If you do not want to set start and
daterange
end dates, do not use this option.)
<date>
31)
to Set a date range (If you do not want to set an end date, do not use this option.)
<date> Enter a end date for the schedule (Format: yyyymmdd; Range: 19700101 to 20351231)
weekday Set the weekdays during which private PSK users are valid
Enter one or more numbers to indicate which days the schedule is applied (1=Sunday,
<string> 2=Monday, ... 7=Saturday; Examples: 246=Monday, Wednesday, Friday; 23456=MondayFriday;
1234567=everyday)
timerange Set a time range during which the schedule will be applied on each scheduled day
<time>
59)
to Set a time range
Enter a end time for the schedule,(Format: hh:mm; Hour Range: 0023; Minute Range: 00
<time>
59)
timerange Set a second time range for the schedule
Enter a second start time for the schedule (Format: hh:mm; Hour Range: 0023; Minute
<time>
Range: 0059)
to Set a time range
Enter a second end time for the schedule,(Format: hh:mm; Hour Range: 0023; Minute
<time>
Range: 0059)
timezone
schedule <string> recurrent [ daterange <date> [ to <date> ] ] [ weekdayrange

{Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday} ] ] timerange <time> to <time> [ time
range <time> to <time> ] [ timezone <number> ] [ comment <string> ]
daterange
<date>
31)
Apply the schedule on specific days of the week (To apply the schedule everyday, do not
weekdayrange
use this option.)
Monday Apply the schedule on every Monday within the date range
Tuesday Apply the schedule on every Tuesday within the date range
Wednesday Apply the schedule on every Wednesday within the date range
Thursday Apply the schedule on every Thursday within the date range
Friday Apply the schedule on every Friday within the date range
Saturday Apply the schedule on every Saturday within the date range
Sunday Apply the schedule on every Sunday within the date range
Set a range of weekdays during which the schedule will be applied (Example: monday to
to
friday)
<time>
59)
to Set a time range
<time>
59)
<time>
Range: 0059)
to Set a time range
<time>
Range: 0059)
timezone
security macfilter <string> address <mac_addr> {permit|deny} [ comment <string> ]

security Set the security parameters
macfilter Set a filter for MAC addresses or OUIs (organizationally unique identifiers)
<string> Enter the filter name for MAC addresses or OUIs (132 chars)
address Set MAC address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
permit Set the action of the specified MAC to permit
deny Set the action of the specified MAC to deny
security macfilter <string> default {permit|deny}

default Set MACfilter default action
permit Set MACfilter default action to permit (Default: permit)
deny Set MACfilter default action to deny (Default: permit)
security macfilter <string> oui <oui> {permit|deny} [ comment <string> ]

oui Set the OUI used to identify a vendor
<oui>
permit Set the action of the specified OUI to permit
deny Set the action of the specified OUI to deny
security wlanidp profile <string>

profile Set an IDP profile
security wlanidp profile <string> adhoc

adhoc Detect adhoc networks
security wlanidp profile <string> apdetection clientmacinnet

apdetection Set attributes to note when detecting APs
Determine that a detected rogue AP is in the same backhaul network as the local device
clientmacinnet
if any of its client MAC addresses appear in the MAC learning table
security wlanidp profile <string> apdetection connected

apdetection Set attributes to note when detecting APs
Determine that a rogue AP is in the same backhaul network as the local device if any MAC
connected address within a 64address range of the BSSID used by the detected rogue AP appears in
the MAC learning table
security wlanidp profile <string> appolicy

appolicy Set an AP policy for the IDP profile
security wlanidp profile <string> appolicy apoui

apoui Categorize neighboring APs as compliant by OUI (organizationally unique identifier)
security wlanidp profile <string> appolicy apoui entry <oui>

apoui Categorize neighboring APs as compliant by OUI (organizationally unique identifier)
entry Add an OUI entry
<oui>
security wlanidp profile <string> appolicy shortbeacon

Categorize neighboring APs as noncompliant if their beacon transmissions are at shorter
shortbeacon
intervals than stated in their beacon frames
security wlanidp profile <string> appolicy shortpreamble

shortpreamble Categorize neighboring APs as compliant if they use short preambles
security wlanidp profile <string> appolicy ssid

ssid Categorize neighboring APs as compliant by SSID (service set identifier)
security wlanidp profile <string> appolicy ssid entry <string>

entry Add an SSID entry
security wlanidp profile <string> appolicy ssid entry <string> encryption
encryption Set approved encryption types for the SSID
security wlanidp profile <string> appolicy ssid entry <string> encryption {open|wep|wpa}
encryption Set approved encryption types for the SSID
open Categorize a neighboring AP as compliant if its SSID uses open (Default: open)
wep Categorize a neighboring AP as compliant if its SSID uses wep (Default: open)
wpa Categorize a neighboring AP as compliant if its SSID uses wpa (Default: open)
security wlanidp profile <string> appolicy wmm

Categorize neighboring APs as compliant if they apply WMM (WiFi Multimedia)
wmm
classifications
security wlanidp profile <string> mitigate deauthtime <number>

mitigate Set rogue AP and client mitigation parameters for the IDP profile
Set the number of consecutive periods that the HiveAP sends deauth frames to mitigate
deauthtime
clients of a rogue AP after detecting client activity
Enter the number of consecutive rogue AP and client mitigation periods (Default: 60;
<number>
Range: 065535; 0 means to send deauth frames for the entire mitigation duration)
security wlanidp profile <string> mitigate duration <number> quiettime <number>

duration Set the overall duration for detecting clients of a rogue AP and performing deauth DoS
attacks against the AP and its clients
Enter the duration in seconds (Default: 14400 secs; Range: 0 or 602592000; 0 secs means
<number>
infinite)
Set the period of time after which the mitigation process stops if no clients are
quiettime
connected to the rogue AP
Enter the quiet time in seconds (Default: 3600 secs; Range: 0 or 602592000; 0 means
<number>
that the quiet time is the same length as the mitigation duration)
security wlanidp profile <string> mitigate period <number>

Set the interval to check periodically for clients of a rogue AP andif foundsend
period
deauth DoS attacks against the AP and clients
<number> Enter the period in seconds (Default: 1 secs; Range: 1600)
security wlanidp profile <string> stareport

stareport Set rogue client report parameters for the IDP profile (Default: Disabled)
security wlanidp profile <string> stareport agetime <number>

stareport Set rogue client report parameters for the IDP profile (Default: Disabled)
Set age time a rogue client must be disconnected from a rogue AP before removing it from
agetime
the report
<number> Enter the age time in seconds (Default: 3600 secs; Range: 6086400)
securityobject <string>
Set parameters for a security object controlling network access through the SSIDs and
securityobject
Ethernet interfaces to which it is applied
securityobject <string> defaultuserprofileattr <number>

securityobject
defaultuserprofile
Set the attribute of the user profile to apply to user traffic by default
attr
Enter the default user profile attribute for the security object (Default: 0; Range: 0
<number>
4095)
securityobject <string> dhcpserver leasetime <number>

securityobject
dhcpserver Set DHCPserver parameters
leasetime Set the lease time

<number> Enter the lease time in seconds (Default: 10; Range: 536000)
securityobject <string> dhcpserver renewalresponse {renewnakunicast|keepsilent}

securityobject
dhcpserver Set DHCPserver parameters
renewalresponse Set the response to a DHCP lease renewal request for a nonexistent lease
Respond to a DHCP lease renewal request for a nonexistent lease with a unicast DHCPNAK
renewnakunicast
message (Default: Broadcast a DHCPNAK message)
Do not respond to a DHCP lease renewal request for a nonexistent lease (Default:
keepsilent
Broadcast a DHCPNAK message)
securityobject <string> mobiledevicepolicy <string>

securityobject
mobiledevicepolicy
originally assigned user profile and the MAC OUI, domain, and OS of the user's client
<string> Enter a mobile device policy name (132 chars)
securityobject <string> ppskwebserver authuser

securityobject
Set parameters for redirecting HTTP or HTTPS traffic to the HiveAP hosting a private PSK
ppskwebserver
web server
Send credentials submitted by users during private PSK selfregistration to a RADIUS
authuser
server for authentication before issuing private PSKs to them
securityobject <string> ppskwebserver bindtoppskssid <string>

securityobject
ppskwebserver
web server
Bind the SSID referencing this security object, which must be set with open
bindtoppskssid authentication and an external captive web portal, to an SSID using private PSKs so the
PSKs can be assigned to users automatically
<string> Enter the name of the SSID using private PSK authentication (132 chars)
securityobject <string> ppskwebserver https

securityobject
ppskwebserver
web server
Use HTTPS for redirection from the private PSK authenticator to the private PSK server
https
(Default: HTTP)
securityobject <string> ppskwebserver loginpage <string>

securityobject
ppskwebserver web server
Specify the .cgi file on the private PSK web server through which the user registers
loginpage
(Default: ppskindex.cgi)
Enter the .cgi file name for the registration page (132 chars; Note: The file name
<string>
cannot be index.cgi.)
securityobject <string> ppskwebserver loginscript <string>

securityobject
ppskwebserver
web server
Specify the .cgi file that the private PSK web server uses for processing user
loginscript
registration requests (Default: ppsklogin.cgi)
<string> Enter the script name (132 chars)
securityobject <string> ppskwebserver webdirectory <string>

securityobject
ppskwebserver
web server
Set the name of the web directory containing the login page and script files that the
webdirectory
private PSK web server uses
<string> Enter the web directory name (132 chars)
securityobject <string> security aaa radiusserver [ firstretryinterval <number> ] [ maxretries

<number> ]
securityobject
security Set security parameters for the security object
Set the initial interval to wait for a RADIUS auth or accounting server to reply before
resending a request(Note: A NAS makes repeated requests before failing over to a backup
firstretryinterval
server, and the interval for each successive attempt is double that of the previous one.
Example: If an initial interval is 3 secs, 3 retry intervals are 3612.)
<number> Enter the initial retry interval in seconds (Range: 15; Default: 3)
Set the maximum number of retries to elicit a response from the RADIUS server before
maxretries
failing over to a backup RADIUS server (if a backup server is configured)
<number> Enter the maximum number of retries (Range: 15; Default: 3)
securityobject <string> security aaa radiusserver accountinteriminterval <number>

securityobject
accountinterim
Set the interval in seconds for sending RADIUS accounting updates
interval
Enter the interval in seconds for sending RADIUS accounting updates (Default: 600 secs;
<number>
Range: 10100000000)
securityobject <string> security aaa radiusserver accounting {primary|backup1|backup2|backup3}

<ip_addr|string> [ sharedsecret <string> ] [ acctport <number> ] [ viavpntunnel ]
securityobject Ethernet interfaces to which it is applied

accounting Set parameters for a RADIUS accounting server
Set the RADIUS accounting server to which the HiveAP sends AccountingRequest packets
primary
first
backup1
the primary server does not respond
backup2
backup3
<ip_addr> Enter the IP address or domain name for the RADIUS accounting server (max 32 chars)
<string> Enter the IP address or domain name for the RADIUS accounting server (max 32 chars)
sharedsecret Set the shared secret for securing communications with RADIUS accounting servers
securityobject <string> security aaa radiusserver dynamicauthextension

securityobject
Enable the HiveAP acting as a NAS to accept unsolicited messages from the RADIUS
authentication server (Default: Disabled)
securityobject <string> security aaa radiusserver idm [ pri ]

securityobject
idm Set ID Manager as RADIUS server
pri Set the ID Manager RADIUS server to have the highest priority
securityobject <string> security aaa radiusserver inject OperatorName

securityobject
OperatorName
network.)
securityobject <string> security aaa radiusserver msgauthallmessages

securityobject
Include the MessageAuthenticator attribute in all RADIUS messages to protect against
msgauthallmessages spoofing (Default: The attribute is only included in RADIUS messages for 802.1X/EAP
authentication but not when using captive web portals and MAC authentication.)
securityobject <string> security aaa radiusserver retryinterval <number>

securityobject
retryinterval Set RADIUS server retry interval
<number> Enter RADIUS server retry interval (Default: 600 secs; Range: 60100000000)
securityobject <string> security aaa radiusserver {primary|backup1|backup2|backup3} <ip_addr|string>

[ sharedsecret <string> ] [ authport <number> ] [ acctport <number> ] [ viavpntunnel ]
securityobject
<string>
chars)
securityobject <string> security aaa userprofilemapping attributeid <number>

securityobject
userprofilemapping Map an attribute value returned in RADIUSAccept messages to a user profile attribute
Set an ID for a RADIUS attribute that contains the text that maps to the user profile
attributeid
(Default: 11; Note: Attribute ID 11 corresponds to the FilterID RADIUS attribute.)
<number> Enter the RADIUS attribute ID number (Range: 1255)
securityobject <string> security aaa userprofilemapping enable

securityobject
enable Enable the mapping of attribute values to user profile attributes (Default: Disabled)
securityobject <string> security aaa userprofilemapping vendorid <number> attributeid <number>

securityobject
vendorid Set a vendor ID RADIUS attribute
<number> Enter the vendor ID number (Range: 165535)
attributeid Set an ID for a private RADIUS attribute
Enter the private RADIUS attribute ID number to be combined with the vendor ID number
<number>
(Range: 1255)
securityobject <string> security additionalauthmethod captivewebportal [ reguserprofileattr

<number> ] [ authuserprofileattr <number> ] [ timeout <number> ] [ timerdisplay ]
securityobject
Set an additional authentication method in addition to the one in the security protocol
additionalauthmethod
suite
captivewebportal Set a captive web portal for additional user authentication or registration
reguserprofileattr Set the registered user profile attribute
<number> Enter the registered user profile attribute (Default: 0; Range: 04095)
authuserprofileattr Set the default authenticated user profile
<number> Enter the default authenticated user profile (Default: 0; Range: 04095)
Set the default timeout for a registered user's session (Note: A timeout provided by an
timeout
external authentication server overrides this setting.)
<number> Enter the timeout in minutes (Default: 720 mins; Range: 1120960)
timerdisplay Enable timerdisplay windows to communicate login and session information
securityobject <string> security additionalauthmethod captivewebportal anonymousaccess

securityobject
suite
Enable anonymous access which will indicate users to read and accept the network use
anonymousaccess
policy and apply a time and data usage limit to the client (Default: Disabled)
securityobject <string> security additionalauthmethod captivewebportal authmethod [

{pap|chap|mschapv2} ]
securityobject
suite
authmethod Set the CWP (captive web portal) user authentication method
pap
requests between the HiveAP and RADIUS server (Default: PAP)
chap
authentication requests between the HiveAP and RADIUS server (Default: PAP)
mschapv2
securityobject <string> security additionalauthmethod captivewebportal checkusepolicy

securityobject
suite
Check if users select the check box on the login page to indicate they have read and
checkusepolicy accepted the network use policy (Note: This option only applies to captive web portals
that require user authentication and use policy acceptance.)
securityobject <string> security additionalauthmethod captivewebportal cloudcwp apikey <string>

apinonce <string>
securityobject
suite
cloudcwp Set a cloud captive web portal for additional user authentication or registration
Set the API key used to encrypt traffic between the Aerohive device and the cloud
apikey
services
<string> Enter the API key (16 chars)
apinonce Set the API nonce
<string> Enter the API nonce (164 chars)
securityobject <string> security additionalauthmethod captivewebportal cloudcwp customerid

<string>
securityobject
suite
customerid Set customer ID for cloud captive web portal
<string> Enter the customer ID (116 chars)
securityobject <string> security additionalauthmethod captivewebportal cloudcwp enable

securityobject
suite
enable Enable cloud captive web portal
securityobject <string> security additionalauthmethod captivewebportal cloudcwp serviceid

<number>
securityobject
suite
serviceid Set the service ID for cloud captive web portal
<number> Enter service ID number(Range: 1255)
securityobject <string> security additionalauthmethod captivewebportal cloudcwp urlrootpath

<string>
securityobject
suite
urlrootpath Set the root URL path to register CWP portal service
Enter the HTTP protocol, remote server domain name, port, directory path(Range: 1256
<string>
chars, Format: https://domain/path)
securityobject <string> security additionalauthmethod captivewebportal defaultlanguage {chinese

simple|chinesetraditional|dutch|english|french|german|italian|korean|spanish}
securityobject
suite
defaultlanguage Set the default language for the captive web portal web pages
chinesesimple Set Simple Chinese as the default language
chinesetraditional Set Traditional Chinese as the default language
dutch Set Dutch as the default language
english Set English as the default language
french Set French as default language
german Set German as the default language
italian Set Italian as the default language
korean Set Korean as the default language
spanish Set Spanish as the default language
securityobject <string> security additionalauthmethod captivewebportal externalserver {primary}

loginpage <string>
securityobject
suite
externalserver Set parameters for the primary or backup external captive web portal server
primary Set parameters for the primary external captive web portal server
loginpage Set the login page to which the HiveAP redirects traffic from unregistered users
Enter the login page URL (1256 chars; Format: http:///.php/; Example:
<string>
http://10.1.1.20/weblogin.php/5)

passwordencryption uambasic
securityobject
suite
Set the method for encrypting the user password that the HiveAP forwards to the RADIUS
passwordencryption
server
Set the encryption method as UAM (User Authentication Module)Basic (Note: The HiveAP
uambasic uses XOR to recover the password encrypted by the external CWP and sends it to the
RADIUS server. PAP, CHAP, or MSCHAPv2 can be used. Default: No encryption)

passwordencryption uamshared <string>
securityobject
suite
Set the method for encrypting the user password that the HiveAP forwards to the RADIUS
passwordencryption
server
Set the encryption method as UAMShared (Note: The HiveAP sends the user password
encrypted by the external CWP and the means for the RADIUS server to perform the same
uamshared operation and validate the user's password by comparing results. CHAP must be used.
Default: No encryption)
{successregister|noroamingatlogin|noradiusauth}
securityobject
suite
Permit network access without first disconnecting the client after it registers on the
successregister external captive web portal (Default: Permit network access only after an initial client
disconnection)
noroamingatlogin Disable roaming support for clients while they log in (Default: Enabled)
Disable RADIUS authentication when the external captive web portal returns an attribute
noradiusauth
indicating that the user has already been authenticated
securityobject <string> security additionalauthmethod captivewebportal failureredirect external

page <string> [ delay <number> ]
securityobject
suite
failureredirect Set options for the page shown to a user after an unsuccessful registration attempt
Display a page stored on an external web server that indicates the login attempt was
externalpage
unsuccessful
Enter the URL for the page on the external web server (1256 chars; Format:
<string>
http:///.html or https: ///.html)
Set the length of time to display a message that the registration succeeded before
delay
redirecting the user to an external web page
Enter the length of time in seconds that the HiveAP displays the message (Default: 5;
<number>
Range: 560)
securityobject <string> security additionalauthmethod captivewebportal failureredirect login

page [ delay <number> ]
securityobject
suite
failureredirect Set options for the page shown to a user after an unsuccessful registration attempt
loginpage Display the login page again
delay
Enter the length of time that the HiveAP displays the message (Default: 5 seconds;
<number>
Range: 560 seconds)
securityobject <string> security additionalauthmethod captivewebportal internalpages {no

successpage|nofailurepage}
securityobject
suite
internalpages Set options for showing pages stored internally on the HiveAP
Do not display the success page stored on the HiveAP when a registration attempt is
nosuccesspage
successful (Default: Display)
Do not display the failure page stored on the HiveAP when a registration attempt is
nofailurepage
unsuccessful (Default: Display)
securityobject <string> security additionalauthmethod captivewebportal internalservers

securityobject
suite
internalservers Enable internal servers to process unregistered users' DHCP and DNS traffic
securityobject <string> security additionalauthmethod captivewebportal loginpagemethod http302

securityobject
suite
loginpagemethod Set the method to redirect the user to the login page
http302 Use HTTP 302 redirect code as the redirection method (Default: JavaScript)
securityobject <string> security additionalauthmethod captivewebportal passthrough vlan <number>

securityobject
suite
Set the captive web portal to pass DHCP, DNS, and ICMP traffic from unregistered users
passthrough
to external servers
Set the VLAN ID to assign users before and after registration (Note: This setting
vlan
overrides any VLAN ID set locally or received from a RADIUS server.)
<number> Enter a CWP VLAN ID (Range: 14094)
securityobject <string> security additionalauthmethod captivewebportal processsipinfo

securityobject
suite
processsipinfo Enable the captive web portal to process library SIP information (Default: Enabled)
securityobject <string> security additionalauthmethod captivewebportal processsipinfo block
redirect <string>
securityobject
suite
processsipinfo Enable the captive web portal to process library SIP information (Default: Enabled)
Set the page that appears when a library patron logs in but is denied network access
blockredirect
because of overdue fines
Enter the URL for the page to which the patron is redirected to submit payment (Max 256
<string>
chars; Format: http:///.html or https: ///.html)
securityobject <string> security additionalauthmethod captivewebportal reportguestinfo

securityobject
suite
Enable the reporting to HiveManager of information that guests enter during
reportguestinfo registration, such as their first and last names, email address, the person they are
visiting, and so on (Default: Disabled)
securityobject <string> security additionalauthmethod captivewebportal selfregviaidm

securityobject
suite
selfregviaidm Enable self register via ID Mananger (Default: Disabled)
securityobject <string> security additionalauthmethod captivewebportal selfregviaidm api

<string>
securityobject
suite
api Set the URL of the API for register via ID Mananger
<string> Enter the URL of API (1256 chars)
securityobject <string> security additionalauthmethod captivewebportal selfregviaidm crlfile

<string>
securityobject
additionalauthmethod suite
crlfile Set the URL of the CRL file for validate the ID Manager server certificate
<string> Enter the URL of CRL file (1256 chars)
securityobject <string> security additionalauthmethod captivewebportal servername <string>

securityobject
suite
Set a domain name for the local web server (Default server name: IP address of the
servername interface on which the captive web portal will operate; Note: The authoritative DNS
server must be configured to resolve this domain name to the interface IP address.)
<string> Enter the domain name for the web server (132 chars)
securityobject <string> security additionalauthmethod captivewebportal servername certdn

securityobject
suite
Set a domain name for the local web server (Default server name: IP address of the
servername interface on which the captive web portal will operate; Note: The authoritative DNS
server must be configured to resolve this domain name to the interface IP address.)
Set the same domain name as the CN value in the certificate that the captive web portal
certdn uses for HTTPS (Note: The CN must be a valid domain name that can be resolved to the IP
address of the interface hosting the portal. The CN max length is 32 chars.)
securityobject <string> security additionalauthmethod captivewebportal successredirect external

page <string> [ delay <number> ]
securityobject
suite
successredirect Set options for displaying the page shown to a user after a successful registration
externalpage Display a page stored on an external web server
Enter the URL for the page on the external web server (1256 chars; Format:
<string>
http:///.html or https: ///.html)
delay
Enter the length of time in seconds that the HiveAP displays the message (Default: 5;
<number>
Range: 560)
securityobject <string> security additionalauthmethod captivewebportal successredirect original

page [ delay <number> ]
securityobject
additionalauthmethod Set an additional authentication method in addition to the one in the security protocol
suite
successredirect Set options for displaying the page shown to a user after a successful registration
originalpage Display the original page that the user requested
delay
Enter the length of time that the HiveAP displays the message (Default: 5 seconds;
<number>
Range: 560 seconds)
securityobject <string> security additionalauthmethod captivewebportal timerdisplay alert

<number>
securityobject
suite
timerdisplay Enable timerdisplay windows to communicate login and session information
alert Notify users when their session is about to expire
<number> Enter the interval before the session expires in minutes (Default: 5 mins; Range: 130)
securityobject <string> security additionalauthmethod macbasedauth [ {authmethod} {pap|chap|ms

chapv2} ]
securityobject
suite
Use client MAC addresses as user names and passwords for RADIUS authentication (Default:
macbasedauth
Disabled)
authmethod Set user authentication method
pap
chap
mschapv2
securityobject <string> security additionalauthmethod macbasedauth callcheck

securityobject
suite
macbasedauth
Disabled)
callcheck Enable mac auth callcheck(Default: Disabled)
securityobject <string> security additionalauthmethod macbasedauth fallbacktoecwp

securityobject
suite
macbasedauth
Disabled)
Redirect HTTP/HTTPS traffic to an external captive web portal if MACbased
fallbacktoecwp
authentication fails on the RADIUS server
securityobject <string> security additionalauthmethod mobiledevicemanager aerohive apikey

<string> apiinstanceid <string>
securityobject
suite
Set connection and access parameters for the aerohive MDM (Aerohive MDM server) to
aerohive
enforce client management such as mobile device enrollment
apikey Set the API key for location group to enable API access on the aerohive MDM
<string> Enter the API key (16 chars)
apiinstanceid Set the API instance ID
<string> Enter the instance ID (164 chars)
securityobject <string> security additionalauthmethod mobiledevicemanager aerohive onboard

accessssid <string>
securityobject
suite
aerohive
onboard Enable onboard procedures
accessssid Set SSID for onboard accessing
securityobject <string> security additionalauthmethod mobiledevicemanager airwatch apikey

<string>
securityobject
suite
Set connection and access parameters for the AirWatch (AirWatch MDM server) to enforce
airwatch
client management such as mobile device enrollment
apikey Set the API key for location group to enable API access on the AirWatch
<string> Enter the API key for location group
securityobject <string> security additionalauthmethod mobiledevicemanager airwatch noncompliant

disconnectforvlanchange
securityobject
suite
airwatch
noncompliant Set the noncompliant parameters
disconnectforvlan
Disconnect the station when the VLAN is changed
change

guestupid <number>
securityobject
suite
airwatch
guestupid Set the user profile attribute number for noncompliant device
<number> Enter the default user profile attribute number (Range: 04095)

sendmessage content <string>
securityobject
suite
airwatch
sendmessage Set the send message parameters
content Set the content of message
<string> Enter the content of the message (1140 chars)

sendmessage title <string>
securityobject
suite
airwatch
Set Set the subject of the message (Note: The title only takes effect when message type
title
is email.)
<string> Enter the subject of the message (132 chars)
sendmessage type {email|sms|push|all}
securityobject
suite
airwatch
type Set the message type
email Send message using email
sms Send message using SMS (Short Message Service)
push Send message using push
all Send message using all of push, email and SMS
securityobject <string> security additionalauthmethod mobiledevicemanager airwatch urlenrollment

<url>
securityobject
suite
airwatch
urlenrollment Set the enrollment URL path on the AirWatch
<url> (Default port: 80; 1256 chars; Format: http://domain/path or http://domain:port/path;
Note: You can substitute "https" for "http".)
securityobject <string> security additionalauthmethod mobiledevicemanager airwatch urlrestapi

<url>
securityobject
suite
airwatch
urlrestapi Set the REST API URL path on the AirWatch
securityobject <string> security additionalauthmethod mobiledevicemanager {jss|aerohive} url

rootpath <url>
securityobject
suite
Set connection and access parameters for the JSS (JAMF software server) to enforce
jss
aerohive
Set the root URL path to the "/enroll" page on the JSS (Note: A JSS always displays the
urlrootpath device enrollment page at "/enroll", so enter just the root URL path that precedes
"/enroll".)
securityobject <string> security additionalauthmethod mobiledevicemanager {jss|airwatch|aerohive}

enable
securityobject
suite
jss
airwatch
aerohive
enable Enable client management through MDM
securityobject <string> security additionalauthmethod mobiledevicemanager {jss|airwatch|aerohive}

osobject <string> [ {ios|macos} ]
securityobject
suite
jss
airwatch
aerohive
Set the name of an OS of clients whose network traffic you want the Aerohive device to
osobject
redirect to the MDM server for enrollment
<string> Enter the OS object name (132 chars)
Define the type of OS object as Apple iOS (Default client OS type: iOS; Note: JSS only
ios
supports iOSv4 or later.)
macos Define the type of OS object as Apple Mac OS (Default client OS type: iOS)
securityobject <string> security additionalauthmethod mobiledevicemanager {jss|airwatch} http

auth user <string> password <string>
securityobject
suite
jss
airwatch
httpauth Set parameters for HTTP authentication when the HiveAP connects to the MDM server
user Set the user name for HTTP authentication
password Set the password for HTTP authentication
securityobject <string> security additionalauthmethod mobiledevicemanager {jss|airwatch} poll

status [ interval <number> ]
securityobject
suite
jss
airwatch
pollstatus Query the station for enrollment and compliance status periodically
interval Set the query interval
<number> Enter the query interval in seconds (Default: 60; Range: 30600)
securityobject <string> security authmode hostbased

securityobject
authmode Set the authentication mode (Default: host based)
Permit 802.1X authentication for multiple hosts on the same port (Note: For a single
hostbased domain, the RADIUS server must assign all hosts to the same VLAN. Traffic from an
authenticated host assigned to a different VLAN is dropped.)
securityobject <string> security authmode {portbased} [ failureuserprofileattr <number> ]

securityobject
authmode Set the authentication mode (Default: host based)
portbased Limit 802.1X authentication to a single host per port
failureuserprofile
Set the user profile attribute to assign users who do not pass the authentication check
attr
<number> Enter the failure user profile attribute (Range: 04095)
securityobject <string> security eap retries <number>

securityobject
eap Set parameters for exchanging EAP packets during 802.1X authentication
Set the number of times that the HiveAP will resend an EAP packet when it receives no
retries
response from a client
<number> Enter the number of retries (Default: 3; Range: 15)
securityobject <string> security eap timeout <number>

securityobject
eap Set parameters for exchanging EAP packets during 802.1X authentication
Set the interval that the HiveAP waits for a client to respond before resending an EAP
timeout
packet
<number> Enter the EAP timeout in seconds (Default: 30; Range: 5300)
securityobject <string> security ft

securityobject
ft Enable 802.11r fast BSS (basic service sets) transition
securityobject <string> security ft mobilitydomainid <number>

securityobject
ft Enable 802.11r fast BSS (basic service sets) transition
Set the mobility domain identifier which is used to indicate a group of BSSs (within the
mobilitydomainid
same ESS) between which a station can use 802.11r fast BSS transition
<number> Enter the mobility domain identifier (Default: 19771; Range: 065535)
securityobject <string> security initialauthmethod macbasedauth

securityobject
initialauthmethod Set the user authentication method to apply first
Apply MACbased authentcation first (Note: By default, 802.1X authentication is applied
macbasedauth
first.)
securityobject <string> security localcache timeout <number>

securityobject
localcache Set parameters for storing PMK (pairwise master key) entries in the local cache
timeout Set the length of time to keep PMK entries before deleting them
Enter the timeout in seconds (Default: 86400; that is, 1 day; Range: 60604800; that is,
<number>
1 minute to 7 days)
securityobject <string> security macwhitelist bypasscwp

securityobject
Set parameters for a list of MAC addresses, in which the login station would have some
macwhitelist special liberty once its MAC address exists (Note: The whitelist can have up to 8
entries.)
Enable bypassing CWP(captive web portal) authentication process for the stations which
bypasscwp
MAC addresses exist in current security object's MAC white list (Default: Disabled)
securityobject <string> security macwhitelist macobject <string>

securityobject
Set parameters for a list of MAC addresses, in which the login station would have some
macwhitelist special liberty once its MAC address exists (Note: The whitelist can have up to 8
entries.)
macobject Add a MAC object to current MAC white list
securityobject <string> security preauth [ interface <ethx|wifix.y|redx|aggx> ]

securityobject
preauth Set an interface to accept preauthenticated 802.1X frames for fast roaming
interface Set an interface to accept preauthenticated 802.1X frames for fast roaming
securityobject <string> security privatepsk

securityobject
privatepsk Set the parameters for creating individual user PSKs (preshared keys)
securityobject <string> security privatepsk defaultpskdisabled

securityobject
defaultpskdisabled Disable the default PSK (Default: Enabled)
securityobject <string> security privatepsk externalserver [ {webportal} ]

securityobject
externalserver Look up private PSKs that users submit on an external private PSK server
Enable the creation of a new private PSK when the current PSK expires (Default:
webportal
disabled)
securityobject <string> security privatepsk macbindingenable
securityobject
macbindingenable Enable the automatic binding of a private PSK to a MAC address (Default: Disabled)
securityobject <string> security privatepsk macbindingkeyspermac <number>

securityobject
macbindingkeysper
Set the number of PPSKs that are permitted to bind to the same MAC address
mac
<number> Enter the number of PPSKs (Default: 1; Range: 15)
securityobject <string> security privatepsk macbindingmacsperkey <number>

securityobject
macbindingmacsper
Set the number of MAC addresses that are permitted to bind one PPSK
key
<number> Enter the number of MAC addresses (Default: 1; Range: 15)
securityobject <string> security privatepsk ppskserver <ip_addr>

securityobject
Set the HiveAP private PSK server to which other hive members redirect users to self
ppskserver
register and receive private PSK assignments automatically
<ip_addr> Enter the mgt0 IP address of the HiveAP private PSK server
securityobject <string> security privatepsk radiusauth [ {pap|chap|mschapv2} ]

securityobject
Enable the HiveAP to forward authentication checks for private PSKs to an external
radiusauth RADIUS server and set the method for authenticating communications with it (Default:
disabled)
pap
chap
mschapv2
securityobject <string> security privatepsk sameuserlimit <number>
securityobject Set parameters for a security object controlling network access through the SSIDs and
Set a limit for the number of private PSK users that can be authenticated with the same
sameuserlimit
user name and PSK concurrently
Enter the maximum number of private PSK users that can use the same user name and PSK
<number>
concurrently (Default: 0, which means there is no limit; Range: 015)
securityobject <string> security privatepsk selfregenable

securityobject
selfregenable Enable support of user selfregistration (Default: Enabled)
securityobject <string> security protocolsuite 802.1x

securityobject
protocolsuite Set the security protocol suite for the security object
802.1x Set the security protocol suite as 802.1X authentication
securityobject <string> security protocolsuite open

securityobject
Set network access as 'open', meaning that user traffic is neither authenticated nor
open
encrypted
securityobject <string> security protocolsuite wepopen <number> {hexkey|asciikey} <string> [

default ]
securityobject
Set the security protocol suite as presharedkey key management, WEP40/WEP104
wepopen
encryption, and open authentication
<number> Enter the index to identify one of 4 possible WEP keys (Default: 0; Range: 03)
hexkey Set key type as hexadecimal
asciikey Set key type as ASCII (American Standard Code for Information Interchange)
Enter key value (asciikey: a 5(WEP40)/13(WEP104) characters key; hexkey: a
<string>
10(WEP40)/26(WEP104) digit hex key)
default Set the current key as the default WEP key
securityobject <string> security protocolsuite wepshared <number> {hexkey|asciikey} <string> [

default ]
securityobject

Set the security protocol suite as presharedkey key management, WEP40/WEP104
wepshared
encryption, and presharedkey authentication
<number> Enter the index to identify one of 4 possible WEP keys (Range: 03)
Enter key value (asciikey: a 5(WEP40)/13(WEP104) characters key; hexkey: a
<string>
10(WEP40)/26(WEP104) digit hex key)
default Set the current key as the default WEP key

securityobject
Set the security protocol suite as 104bit WEP encryption and EAP (802.1x)
wep1048021x
authentication
rekeyperiod Set the period after which a new group temporal key replaces the current one
Enter the period after which a new group temporal key replaces current one (Default:
<number>
600secs; Min: 600; Max: 50000000)

securityobject
wep408021x Set the security protocol suite as 40bit WEP encryption and EAP (802.1x) authentication
Enter the period after which a new group temporal key replaces current one (Default:
<number>
600secs; Min: 600; Max: 50000000)
securityobject <string> security protocolsuite wpaauto8021x [ rekeyperiod <number> ] [ {non

strict|strict} ] [ gmkrekeyperiod <number> ] [ ptktimeout <number> ] [ ptkretry <number> ] [ gtk
timeout <number> ] [ gtkretry <number> ] [ roaming proactivepmkidresponse ] [ ptkrekeyperiod
<number> ]
securityobject
Set security protocol suite as WPA/WPA2EAP (802.1X) key management, TKIP/AESCCMP
wpaauto8021x
encryption, and EAP (802.1X) authentication
Enter the period in seconds after which a new group temporal key replaces the current
<number>
one (Range: 0 or 60050000000, where 0 means disabled; Default: 0)
Refresh the GTK (group temporal key) whenever the rekey period elapses, regardless of
nonstrict
whether any clients disassociate (Default: nonstrict)
Refresh the GTK whenever a client to which the security object settings are applied
strict disconnects from the HiveAP (Default: nonstrict)
gmkrekeyperiod Set the GMK (group master key) rekey periodDefault: 0)

Enter the interval in seconds for rekeying the GMK (Range: 0 or 60050000000, where 0
<number>
means disabled; Default: 0)
Set the interval that the HiveAP waits for client replies during the 4way handshake in
ptktimeout which they derive a PTK (pairwise transient key) for encrypting and decrypting unicast
traffic
<number> Enter the timeout in milliseconds (Range: 1008000; Default: 4000 milliseconds)
ptkretry Set the maximum number of times the HiveAP will retry sending PTK messages
gtktimeout which the HiveAP sends a GTK (group temporal key) to the client for encrypting and
decrypting multicast traffic
gtkretry Set the maximum number of times the HiveAP will retry sending GTK messages
roaming Set roaming parameters for the protocol suite
proactivepmkid Respond to a client sending an empty PMK (pairwise master key) ID list with a cached PMK
response ID (Default: Disabled)
ptkrekeyperiod Set the period after which a new PTK (pairwise transient key) replaces the current one
Enter the period in seconds after which a new PTK replaces the current one (Range: 0 or
<number>
1050000000, where 0 means disabled; Default: 0)
securityobject <string> security protocolsuite wpaautopsk {hexkey|asciikey} <string> [ rekey

period <number> ] [ {nonstrict|strict} ] [ gmkrekeyperiod <number> ] [ ptktimeout <number> ] [
ptkretry <number> ] [ gtktimeout <number> ] [ gtkretry <number> ] [ ptkrekeyperiod <number> ]
securityobject
Set security protocol suite as WPA/WPA2PSK (preshared key) key management, TKIP or
wpaautopsk
AESCCMP encryption, open authentication
<string> Enter key value (ASCII key length: 863 chars; hexadecimal key length: 64 hex digits)
<number>
nonstrict
strict
disconnects from the HiveAP (Default: nonstrict)
Enter the interval for rekeying GMK (Group Master Key; Default: 0; Range: 0 or 600
<number>
50000000 Seconds, where 0 means disabled)
traffic
<number>
securityobject <string> security protocolsuite wpa2aes8021x [ rekeyperiod <number> ] [ {non
<number> ]
securityobject
Set the security protocol suite as WPA2EAP (802.1X) key management, AESCCMP
wpa2aes8021x
<number>
nonstrict
strict
Enter the interval in seconds for rekeying GMK (Group Master Key; Default: 0; Range: 0
<number>
or 600Seconds, where 0 means disabled)
traffic
proactivepmkid Respond to a client sending an empty PMK (Pairwise Master Key) ID list with a cached PMK
response ID (Default: disabled)
<number>
securityobject <string> security protocolsuite wpa2aespsk {hexkey|asciikey} <string> [ rekey

securityobject
Set the security protocol suite as WPA2PSK (preshared key) key management, AESCCMP
wpa2aespsk
Enter the period after which a new group temporal key replaces the current one (Default:
<number>
0; Range: 0 or 60050000000 Seconds, where 0 means disabled)
nonstrict
strict Refresh the GTK whenever a client to which the security object settings are applied
<number>
traffic
<number>
securityobject <string> security protocolsuite wpa2tkip8021x [ rekeyperiod <number> ] [ {non

<number> ]
securityobject
Set the security protocol suite as WPA2EAP (802.1X) key management, TKIP encryption,
wpa2tkip8021x
and EAP (802.1X) authentication
<number>
nonstrict
strict
<number>
traffic
proactivepmkid Respond to a client sending an empty PMK (pairwise master key) ID list with a cached PMK
response ID (Default: Disabled)
<number> Enter the period in seconds after which a new PTK replaces the current one (Range: 0 or
securityobject <string> security protocolsuite wpa2tkippsk {hexkey|asciikey} <string> [ rekey

securityobject
Set the security protocol suite as WPA2PSK (preshared key) key management, TKIP
wpa2tkippsk
<number>
nonstrict
strict
<number>
traffic
<number>
securityobject <string> security protocolsuite {wpaauto8021x[wpa2tkip8021x[wpa2aes8021x}

reauthinterval <number>
securityobject
wpaauto8021x[wpa2
pa2aes8021x Set the default interval for reauthenticating users (no)
tkip8021x[w
itv::[600~86400]Enter
t reauth interval in seconds (Range: 60086400; Default: Disabled)
the defaul
reauthinterval Set the default interval for reauthenticating users
<number> Enter the default reauth interval in seconds (Range: 60086400; Default: Disabled)
securityobject <string> security protocolsuite {wpaauto8021x[wpa2tkip8021x|wpaautopsk[wpa2
tkippsk[wpa2aespsk[wpa2aes8021x} replaywindow <number>
securityobject
wpaauto8021x[wpa2 Set a window size within which the HiveAP accepts replies to previously sent messages
tkip8021x during 4way handshakes (no)
wnd::[0~10]Enter the ackets prior to the one most recently sent to which the HiveAP will accept a reply
number of p (Default: 0; Range: 010)
wpaautopsk[wpa2 aespsk[wpa2aes8021x Set a window size within which the HiveAP accepts replies to
tkippsk[wpa2 previously sent messages during 4way handshakes (no)
wnd::[0~10]Enter the ackets prior to the one most recently sent to which the HiveAP will accept a reply
number of p (Default: 0; Range: 010)
Set a window size within which the HiveAP accepts replies to previously sent messages
replaywindow
during 4way handshakes
Enter the number of packets prior to the one most recently sent to which the HiveAP will
<number>
accept a reply (Default: 0; Range: 010)

tkippsk} localtkipcountermeasure
securityobject
Enable the deauthentication of all previously authenticated clients when the local
wpaauto8021x[wpa2
HiveAP detects MIC (message integrity check) failures during TKIP operations (Default:
tkip8021x
enabled)(no)
wpaautopsk[wpa2
tkippsk
enabled)(no)
localtkipcounter
measure
enabled)

tkippsk} remotetkipcountermeasure
securityobject
Enable the deauthentication of all previously authenticated clients when a client
wpaauto8021x[wpa2
reports MIC (message integrity check) failures during TKIP operations (Default:
tkip8021x
enabled)](no)
wpaautopsk[wpa2
tkippsk
enabled)](no)
remotetkipcounter
measure
enabled)]
securityobject <string> security protocolsuite {wpa2aespsk|wpa2aes8021x} mfp

{mandatory|optional} [ bip ]
securityobject
wpa2aespsk Set the security protocol suite as WPA2PSK (preshared key) key management, AESCCMP
Set the security protocol suite as WPA2EAP (802.1X) key management, AESCCMP
wpa2aes8021x
mfp Enable 802.11w support of MFP (Management Frame Protection)
mandatory Require that clients support MFP
optional Use MFP only if clients support it
bip Set broadcast/multicast integrity protocol
securityobject <string> security roaming cache updateinterval <number> ageout <number>

securityobject
roaming Set roaming parameters for clients to which the security object is applied
Set the interval between updates and the number of times to update a station's roaming
cache
cache
updateinterval Set the interval for sending roaming cache updates to neighbors
<number> Enter the roaming cache update interval in seconds (Default: 60; Range: 1036000)
Set how many times an entry must be absent from a neighbor's updates before removing it
ageout
from the roaming cache
<number> Enter the number of absences required to remove an entry (Default: 60; Range: 11000)
securityobject <string> userprofileallowed <string>

securityobject
Allow network access for members of all or specified user profiles bound to the security
userprofileallowed
object
securityobject <string> userprofileallowed {all}

securityobject
Allow network access for members of all or specified user profiles bound to the security
userprofileallowed
object
all Allow network access to members of all user profiles
securityobject <string> userprofiledeny action ban [ <number> ] [ strict ]

securityobject
Set parameters for denying network access to users if they do not belong to an allowed
userprofiledeny
user profile
action Set an action which will be taken if a user profile is not allowed to access this SSID
ban Set the action to ban network access for a specified length of time
Enter the amount of time in seconds to perform the action (Default: 60; Range: 1
<number>
100000000)
Set the behavior to deauthenticate all connected stations whenever a user profile bound
strict to the security object changes (Note: When stations reauthenticate, the user profile
changes take effect.)
securityobject <string> userprofiledeny action {banforever|disconnect} [ strict ]

securityobject
Set parameters for denying network access to users if they do not belong to an allowed
userprofiledeny
user profile
action Set an action which will be taken if a user profile is not allowed to access this SSID
banforever Set the action to ban network access indefinitely
disconnect Set the action to disconnect the station from the HiveAP
Set the behavior to deauthenticate all connected stations whenever a user profile bound
strict to the security object changes (Note: When stations reauthenticate, the user profile
changes take effect.)
securityobject <string> userprofilepolicy <string>

securityobject
userprofilepolicy Set the user profile mapping policy
<string> Enter a policy name (132 chars)
securityobject <string> userprofilesequence {cwpssidmac|cwpmacssid|ssidcwpmac|ssidmac

cwp|macssidcwp|maccwpssid}
securityobject
Set the sequential order to apply user profiles when the authentication process involves
userprofilesequence multiple components referencing different profiles (Default: macssidcwp; Note: The
user profile applied last is the one that is ultimately used.)
Apply the user profile for a captive web portal first, SSID second, and MAC
cwpssidmac
authentication last
Apply the user profile for a captive web portal first, MAC authentication second, and
cwpmacssid
SSID last
Apply the user profile for an SSID first, captive web portal second, and MAC
ssidcwpmac
authentication last
Apply the user profile for an SSID first, MAC authentication second, and captive web
ssidmaccwp
portal last
Apply the user profile for MAC authentication first, SSID second, and captive web portal
macssidcwp
last
Apply the user profile for MAC authentication first, captive web portal second, and SSID
maccwpssid
last
securityobject <string> walledgarden hostname <string> [ service {all|web} ]

securityobject
Set the parameters for a walled garden in which unregistered users can access specified
walledgarden
servers (Maximum: 64 IP address and host name entries combined)
hostname Set the host name of a server in the walled garden
Set the service permitted to reach the server (Maximum: 8 services per IP address or
service
host name entry)
all Permit all services
web Permit HTTP and HTTPS
securityobject <string> walledgarden hostname <string> service protocol <number> port <number>
securityobject
walledgarden Set the parameters for a walled garden in which unregistered users can access specified
hostname Set the host name of a server in the walled garden
service
host name entry)
protocol Set the protocol of the service that you want to permit
<number> Enter the protocol number (Note: UDP: 17; TCP: 6; All: 0; Range: 0255)
port Set the port number
securityobject <string> walledgarden ipaddress <ip_addr|ip_addr/mask> [ service {all|web} ]

securityobject
walledgarden
ipaddress Set the IP address of a server or a subnet in the walled garden
Enter the IP address or subnet (Note: To define a subnet, enter the first address in the
<ip_addr> subnet, followed by a slash, and then the routing prefix bit length. Example:
10.1.1.0/24)
<ip_addr/netmask> subnet, followed by a slash, and then the routing prefix bit length. Example:
10.1.1.0/24)
service
host name entry)
all Permit all services
web Permit HTTP and HTTPS
securityobject <string> walledgarden ipaddress <ip_addr|ip_addr/mask> service protocol <number>

port <number>
securityobject
walledgarden
ipaddress Set the IP address of a server or a subnet in the walled garden
<ip_addr> subnet, followed by a slash, and then the routing prefix bit length. Example:
10.1.1.0/24)
<ip_addr/netmask> subnet, followed by a slash, and then the routing prefix bit length. Example:
10.1.1.0/24)
service
host name entry)
protocol Set the protocol of the service that you want to permit
<number> Enter the protocol number (Note: UDP: 17; TCP: 6; ICMP: 1; All: 0; Range: 0255)
port Set the port number
securityobject <string> webdirectory <string>

securityobject
webdirectory Enter the web directory name for the captive web portal specified in the security object
<string> Enter the web directory name for the security object
securityobject <string> webserver [ port <number> ] [ indexfile <string> ] [ successfile <string>

] [ failurefile <string> ] [ ssl serverkey <number> ]
securityobject Set parameters for a security object controlling network access through the SSIDs and

webserver Enable the internal web server
port Set the HTTP port number for the web server
Enter the HTTP port number for the web server. Set the port number to 0 is disable the
<number>
HTTP method (Default: 80; Range: 065535)
indexfile Specify the .html file as the default index page
<string> Enter the .html file name (Default: index.html; Range: 132 chars)
Specify the .html file that you want to appear after a user successfully registers
successfile
through the captive web portal
<string> Enter the .html file name (Default: success.html; Range: 132 chars)
Specify the .html file that you want to appear after a user failed registers through the
failurefile
captive web portal
<string> Enter the .html file name (Default: failure.html; Range: 132 chars)
ssl Enable the SSL (Secure Socket Layer) method
serverkey Set the server key (a X509 certificate) for SSL
<number> Enter the server key index (Default: 0; Range: 015)
securityobject <string> webserver webpage {mandatoryfield} <number> [ optionalfield <number> ]

securityobject
webserver Enable the internal web server
webpage Set the web pages parameters
mandatoryfield Set the mandatory field numbers in login web page
<number> Enter the mandatory field numbers in login web page (Default: 4; Range: 08)
optionalfield Set the optional field numbers in login web page
<number> Enter the optional field numbers in login web page (Default: 2; Range: 08)
service <string> alg {ftp|tftp|sip|dns|http}

service Set a custom service
alg Assign an ALG (Application Level Gateway) to the service
ftp Assign an FTP (File Transfer Protocol) ALG to the service
tftp Assign a TFTP (Trivial File Transfer Protocol) ALG to the service
sip Assign a SIP (Session Initiation Protocol) ALG to the service
dns Assign a DNS (Domain Name System) ALG to the service
http Assign an HTTP (Hypertext Transfer Protocol) ALG to the service
service <string> appid <number> [ timeout <number> ]

appid Assign an L7 application ID to the service
<number> Assign an L7 application ID to the service
timeout Set the service session timeout
<number> Set the session timeout value in seconds (Range: 065535; Default 300)
service <string> protocol <number> [ port <number> ] [ timeout <number> ]

protocol Set the protocol used by the custom service
<number> Enter the protocol number (Range: 1255)
port Set the destination port number for the transport protocol
Set the session timeout value in seconds (Range: 065535; Default TCP: 300; UDP: 100;
<number>
Other: 100)
service <string> protocol {tcp|udp|svp} [ port <number> ] [ timeout <number> ]

protocol Set the protocol used by the custom service
tcp Enter the transport protocol as TCP (Transmission Control Protocol)
udp Enter the transport protocol as UDP (User Datagram Protocol)
svp Enter the transport protocol as SVP (SpectraLink Voice Priority)
port Set the destination port number for the transport protocol
Set the session timeout value in seconds (Range: 065535; Default TCP: 300; UDP: 100;
<number>
Other: 100)
sflow enable
sflow Set sflow related parameters
enable Enable sflow (Default: Disabled)
sflow instance <string> interface <ethx|wifix> collectoraddr <ip_addr> [ collectorport <number> ] [

samplingrate <number> ] [ pollinginterval <number> ] [ direction {ingress|egress|both} ]
sflow Set sflow related parameters
instance Set sflow instance name (132 chars)
<string> Enter the instance name (132 chars)
interface Set the interface sflow monitors
collectoraddr Set the collector address
<ip_addr> Enter the collector IP address
collectorport Set the collector port number (Default: 6343, Range: 165535)
<number> Enter the collector port number (Default: 6343, Range: 165535)
samplingrate Set sflow sampling rate (Default: 256, Range: 505000)
<number> Enter the instance sampling rate (Default: 256, Range: 505000)
pollinginterval Set sflow counters polling interval in seconds (Default: 20, Range: 53600)
<number> Enter the instance counters polling interval in seconds (Default: 20, Range: 53600)
direction Set desired direction of sampled packets (Default: both)
ingress Set desired direction of sampled packets (Default: both) ingress
egress Set desired direction of sampled packets (Default: both) egress
both Set desired direction of sampled packets (Default: both) both
show 802.1xmactable [ interface <ethx> ] [ mac <mac_addr> ]

show Show settings, parameters, or dynamically generated information
802.1xmactable Show the MAC table used for 802.1X/EAP user authentication on an Ethernet interface
interface Show interface and subinterface parameters
<ethx>
mac Specify a station MAC address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show aaa
aaa Show parameters for AAA (authentication, authorization, accounting)
show aaa radiusserver

radiusserver Show RADIUS server parameters
show aaa radiusserver NAS [ <string> ]

NAS Show the shared keys for all RADIUS NASs
<string> Enter a RADIUS NAS name
show aaa radiusserver activesession [ username <string> ]

activesession Show active sessions on the RADIUS server
username Set the username which the active session using for doing RADIUS authentication
show aaa radiusserver cache

cache Show RADIUS server cache entries
show aaa radiusserver domain

domain Show which Active Directory domain the AP has joined
show aaa radiusserver proxy [ server ]

proxy Show all realms parameters
server Show all RADIUS servers parameters
show aaa radiusserverkey {radiusserver|ldapclient}

aaa
Show parameters for AAA (authentication, authorization, accounting)
radiusserverkey Show all certificates that the local AP uses as a RADIUS server and LDAP client
radiusserver Show certificates that the local AP uses as a RADIUS server
ldapclient Show certificates that the local AP uses as a LDAP client
show accessconsole
accessconsole Show access console status and parameters
show acsp
acsp Show parameters for ACSP (Advanced Channel Selection Protocol)
show acsp channelinfo [ {detail|arbiter} ]

channelinfo Show channel information for ACSP
Show detailed channel information about the calculated cost of each channel and the
detail
factors used to determine that cost
arbiter Show information regarding the assignment of channels to hive members
show acsp neighbor

neighbor Show acsp neighbor list
show admin [ active ]

admin Show admin parameters
active Show currently connected admin users
show admin auth

auth Show admin authentication method
show admin managerip

managerip Show IP addresses from which administrative traffic is accepted
show alg [ {ftp|tftp|sip|dns|http} ]

alg Show ALG (Application Level Gateway) information
ftp Show FTP (File Transfer Protocol) information
tftp Show TFTP (Trivial File Transfer Protocol) information
sip Show SIP (Session Initiation Protocol) information
dns Show DNS (Domain Name System) information
http Show settings for the HTTP ALG
show alg sip calls [ <string> ]
alg Show ALG (Application Level Gateway) information
sip Show SIP (Session Initiation Protocol) information
calls Show information for all currently active SIP calls
<string> Enter the call ID to show information for a specific SIP call (1 128 chars)
show amrp
amrp Show AMRP (Advanced Mobility Routing Protocol) parameters
show amrp Ethlink

Show the number of AMRP Ethernet links, and the number of hive members and interfaces on
Ethlink
each link
show amrp Ethlink <mac_addr>

Show the number of AMRP Ethernet links, and the number of hive members and interfaces on
Ethlink
each link
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show amrp bonjour [ <ip_addr> ]

bonjour Show Bonjour information
<ip_addr> Enter the BDD IPv4address
show amrp client [ <mac_addr> ]

client Show information about currently active clients associated with all hive members
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show amrp dnxp cache [ <mac_addr> ]

dnxp Show DNXP (Dynamic Network Extension Protocol) information
cache Show the entire DNXP cache or the cached entry for a specific client
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show amrp dnxp neighbor [ <mac_addr> ]

dnxp Show DNXP (Dynamic Network Extension Protocol) information
neighbor Show information about all DNXP neighbors or a specific neighbor to which the local
HiveAP can tunnel the traffic of roaming clients
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show amrp interface
Show AMRP statistics for access interfaces reporting client associations and backhaul
interface
interfaces exchanging route information with other AMRP nodes
show amrp interface <ethx|redx|aggx> bmttable

interface
bmttable Broadcast Master Table
show amrp interface <ethx|redx|aggx> maclearning

interface
maclearning Show the MAC addresses learned on this interface
show amrp interface <ethx|redx|aggx|mgtx|wifix.y>

interface
show amrp neighbor [ {Ethernet|WiFi} ]

Show AMRP neighbor information (Note: An AMRP neighbor is another hive member that is
neighbor
one hop away.)
Ethernet Show AMRP neighbors that connect to the local HiveAP through its Ethernet interfaces
WiFi Show AMRP neighbors that connect to the local HiveAP through its WiFi interfaces
show amrp node <ip_addr|mac_addr>

Show information about all AMRP nodes or a specific node (Note: An AMRP node is another
node
hive member in the same layer2 domain.)
<ip_addr> Enter node address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show amrp node [ all ]

Show information about all AMRP nodes or a specific node (Note: An AMRP node is another
node
hive member in the same layer2 domain.)
all Show amrp all node detail
show amrp staticneighbor

staticneighbor Show AMRP information for neighbors with statically defined route metrics
show amrp tunnel [ <ip_addr> ]

Show a information about all DNXP, INXP (Identity Network Extension Protocol), and VPN
tunnel
tunnels or about a tunnel to a specific peer
<ip_addr> Enter the tunnel peer IPv4 address
show amrp tunnel route [ <ip_addr> ]

Show a information about all DNXP, INXP (Identity Network Extension Protocol), and VPN
tunnel
tunnels or about a tunnel to a specific peer
route Show tunneled route
<ip_addr> Enter the tunneled route IPv4 address
show application identification [ cdpindex <number> ] [ cdpname <string> ]

application Show L7 information
identification Show L7 identification related parameters
cdpname Show L7 custom applications
<string> Enter the name of the custom defined application (1 to 8 characters)
show application reporting appstats

reporting Show L7 application reporting information
appstats Show L7 application reporting application statistics
show application reporting applications

applications Show L7 application reporting application information
show application reporting configuration
configuration Show L7 application reporting configuration
show application reporting statistics

statistics Show L7 application reporting statistics
show arpcache
arpcache Show arp cache table
show auth [ interface <wifix.y|ethx> ]

auth Show authentication parameters per interface
interface Show authentication parameters for special interface
show auth macbinding <string> [ <mac_addr> ] [ <string> ]

macbinding Show MAC address binding information
<string> Show MAC address binding for the SSID, enter an SSID profile name (132 chars)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
<string> Show MAC address binding for the user, enter the username of PPSK (132 chars)
show auth privatepsk

privatepsk Show private PSK (preshared key) entries
show bandsteering status

bandsteering Show settings, parameters, or dynamically generated information
status Show parameters for band steering in the WLAN
show bonjourgateway filter

bonjourgateway Show the settings and status of the Bonjour gateway
Show the rules that filter which services the local Bonjour gateway transmits to Bonjour
filter
show bonjourgateway service local [ vlan <number> ] [ detail ]

service Show the Bonjour services that the local gateway discovered locally and those it learned
from other gateways
Show all the services that the local Bonjour gateway collected from hosts onits
local
immediate subnet
vlan Show the services that the local Bonjour gateway knows are available on a specific VLAN
detail Show detailed information about Bonjour services
show bonjourgateway service remote [ vlan <number> ] [ detail ]

Show the Bonjour services that the local gateway discovered locally and those it learned
service
from other gateways
Show the services that the local Bonjour gateway learned about through communications
remote
with remote gateways on different subnets
vlan Show the services that the local Bonjour gateway knows are available on a specific VLAN
detail Show detailed information about Bonjour services
show bonjourgateway status

status Show the status of the local Bonjour gateway
show bonjourgateway vlan

vlan Show Bonjour Gateway VLANs status
show bootparam
bootparam Show boot parameter information
show bootparam countrycode

bootparam Show boot parameter information
countrycode Show the country code to control channel and power selections
show cac summary

cac Show CAC (Call Admission Control) parameters
summary Show a summary of CAC settings and statistics
show capture interface <wifix>

capture Show packet capture parameters
interface Show the status of packet capturing on a radio interface
show capture local

local Show local captured files
show capture remotesniffer

remotesniffer Show the status and connection settings for the remote packet sniffer
show capwap client

Show the settings and current status for CAPWAP (Control and Provisioning of Wireless
capwap
Access Points)
client Show CAPWAP client settings and current status
show clientinfocollection [ ip <ip_addr> ]

clientinfocollection Show client information collection result
ip Show client information by IP address
<ip_addr> Enter client IP address
show clientloadbalance status

clientloadbalance Show settings, parameters, or dynamically generated information
status Show parameters for client load balancing in the WLAN
show clientmonitor info

clientmonitor Show Client Monitor parameters
info Show client monitor v2.0 running data and history data
show clientmonitor policy [ <string> ]

clientmonitor Show Client Monitor parameters
policy Show the parameters of all Client Monitor policies or one specified policy
<string> Enter the name of a Client Monitor policy (132 chars)
show clock
clock Show the date, time of the internal clock
show cmds
cmds Show CLI (Command Line Interface) commands including ones derived from optional keywords
show config rollback

Show parameters for the current configuration file, which is a flash file containing
config
Show the configuration rollback status, the mechanism for triggering it, and the length
rollback
of time to wait before performing a rollback operation
show config running
config
running Show the running configuration
show config running password

config
running Show the running configuration
Show passwords and sensitive networking keys as obscured text strings in the output
password (Default: Passwords and keys are represented by asterisks; Note: A HiveAP can recover an
original string from an obscured one, but not if the string is replaced with asterisks.)
show config version

config
version Show the version number of the current configuration file
show config {current|backup|bootstrap|default|failed}

config
current Show the current configuration
backup Show the backup configuration
bootstrap Show the bootstrap configuration
default Show the default configuration
failed Show the failed configuration
show console
console Show console parameter
show cpu [ {detail} ]

Show the percentage of the CPU used in total, for system operations, and for processing
cpu
user traffic
detail Show CPU utilization in detail
show datacollection
Show parameters for collecting data about the types and capabilities of devices on the
datacollection
network and their network usage
show devicegroup [ <string> ]

devicegroup Show all device group names or the settings of an individual device group
show dns
dns Show DNS (Domain Name System) parameters
show dns dynamicdns

dns Show DNS (Domain Name System) parameters
dynamicdns Show dynamic DNS parameters
show domainobject [ <string> ]

Show all domain object names or the device domains assigned to an individual domain
domainobject
object
<string> Enter an domain object name (132 chars)
show filter [ <number> ]

filter Show capture filter parameters
show forwardingengine counters [ interface <wifix|wifix.y|ethx|mgtx|aggx|redx> ] [ station <mac_addr>

] [ drop ]
forwardingengine Show forwarding engine parameters
counters Show forwarding engine counter statistics
interface Show forwarding engine counter by interface
station Show forwarding engine counter by station MAC
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
drop Show the drop packet counter
show forwardingengine interssidflood

interssidflood Show status of flooding multicast or broadcast packets between access interfaces
show forwardingengine ipgates

ipgates Show IP gates information
show forwardingengine ipsessions [ srcip <ip_addr> ] [ dstip <ip_addr> ] [ srcport <number> ] [

dstport <number> ] [ protocol <number> ] [ qos <number> ]
ipsessions Show IP session information
srcip Filter by source IP
<ip_addr> Source IP address
dstip Filter by destination IP
<ip_addr> Destination IP address
srcport Filter by source port
dstport Filter by destination port
<number> destination IP port (Range: 165535)
protocol Filter by protocol
<number> protocol (Range: 1255)
qos Filter by QoS value
<number> QoS value (Range: 07)
show forwardingengine ipsessions id <number>

ipsessions Show IP session information
id Show a IP session by ID
<number> Enter the flow ID (Range: 19999)
show forwardingengine macsessions [ srcmac <mac_addr> ] [ dstmac <mac_addr> ] [ vlan <number> ]

macsessions Show MAC session information
srcmac Filter by source MAC
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
dstmac Filter by destination MAC
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
vlan Filter by VLAN ID of station
<number> VLAN ID (Range: 14094)
show forwardingengine macsessions id <number>

macsessions Show MAC session information
id Show a MAC session by ID
<number> Enter the flow ID (Range: 19999)
show forwardingengine maxipsessperstation

maxipsessper
Show the maximum number of IP sessions that can be created to or from a station
station
show forwardingengine maxmacsessperstation

maxmacsessper
Show the maximum number of MAC sessions that can be created to or from a station
station
show forwardingengine openportstoself
Show permitted services destined for the HiveAP itself when it is set to drop all non
openportstoself
management traffic
show forwardingengine policy

policy Show policy information
show forwardingengine staticrule

staticrule Show static packetforwarding rules that preempts dynamic forwarding decisions
show forwardingengine tunnel selectivemulticastforward

tunnel Show tunnel (GRE tunnel or GREoverIPsec tunnel) parameters
selectivemulticast
Show the settings for selective multicast forwarding through GRE tunnels
forward
show forwardingengine tunnel tcpmssthreshold

tunnel Show tunnel (GRE tunnel or GREoverIPsec tunnel) parameters
tcpmssthreshold Show TCP MSS threshold parameters
show gretunnel
gretunnel Show GRE (Generic Routing Encapsulation) tunnel information
show highdensity status

highdensity Show parameters for optimizing performance in a highdensity WLAN
Show highdensity settings and the running status of operations pertaining to them on
status
both the 2.4 and 5 GHz radio bands
show history
history Show command history
show hive <string> connectingthreshold

hive Show hive parameters
connectingthreshold Show hive neighbor connecting threshold parameters
show hive <string> counter neighbor [ <mac_addr> ]

counter Show detailed statistics (counters) for neighboring hive members
neighbor Show statistics for all neighbors or a single neighbor in this hive
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show hive <string> manage

manage Show management options enabled on wireless backhaul interfaces in this hive
show hive <string> neighbor [ mac <mac_addr> ]

Show information about all neighbors currently associated with the Hive or about the
neighbor
ongoing wireless activity of a specific neighbor
Show the ongoing wireless activity of a neighbor that is currently associated with the
mac
Hive (Note: To stop the display of output, press CTRL+C.)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show hive <string> security wlan dos

security Show hive security parameters
wlan Show WLAN parameters
dos Show WLAN Dos parameters
show hive [ <string> ]

show hivemanager
hivemanager Show HiveManager parameters
show hiveui cas client

Show settings of the NetConfig UI for defining network settings, configuring settings to
hiveui
connect to HiveManager, and uploading a new HiveOS image
Show client and server parameters for CAS (Central Authentication Service), a protocol
cas
for authenticating users such as teachers accessing TeacherView
client Show parameters for the local AP to act as a CAS client
show hwinfo
hwinfo Show hardware information
show icsa
icsa Show ICSA (International Computer Security Association) parameters
show idm
idm Show ID Manager information
show interface <blex> ibeacon

ibeacon Show the Bluetooth iBeacon device
show interface <blex> ibeaconmonitor list

ibeaconmonitor Show the dectected Bluetooth iBeacon device
list Show the dectected Bluetooth iBeacon device list
show interface <ethx> defaultroutevlan

defaultroutevlan Show all VLAN IDs for the default Layer 2 route on the interface
show interface <ethx> pppoe

pppoe Show PPPoE settings and status
show interface <ethx|aggx|redx> allowedvlan

allowedvlan Show all allowed VLAN IDs on the interface
show interface <ethx|aggx|redx> maclearning {static|dynamic|all}

maclearning Show entries in the MAC address learning table
static Show statically defined MAC address entries
dynamic Show dynamically learned MAC address entries
all Show statically defined and dynamically learned MAC address entries
show interface <ethx|aggx|redx> manage

manage Show management options enabled on this interface
show interface <ethx|aggx|redx> qosclassifier

qosclassifier Show the QoS classification profile (classifier) assigned to the interface
show interface <ethx|aggx|redx> qosmarker

qosmarker Show the QoS marker profile assigned to the interface
show interface <ethx|aggx|redx> ratelimit

ratelimit Show the settings for interfacebased rate limiting
show interface <mgtx.y> manage

manage Show management options enabled on this interface
show interface <mgtx> dhcp keepalive

dhcp Show DHCP parameters
Show the status for keepalives to DHCP servers in the native VLAN, management interface
keepalive
VLAN, and all VLANs set in the DHCP keepalive range
show interface <mgtx> dhcpprobe resultssummary
dhcpprobe Show DHCP probe parameters
resultssummary Show a summary of DHCP probe results
show interface <mgtx> ipv6 dhcp client

ipv6 Show mgt0 IPv6 dhcp clent
client Show DHCP client parameters
show interface <mgtx|ethx|bgdx.y|usbnetx|wifix.y> dhcp client

<bgdx.y> Enter the name of the BGD (Bonjour Gateway Daemon) interface (Ranges: x: 0; y: 116)
client Show DHCP client parameters
show interface <mgtx|mgtx.y> dhcpserver [ detail ]

dhcpserver Show the DHCP server parameters
detail Show details about the DHCP leases for currently active clients
show interface <mgtx|mgtx.y> dhcpserver ipbinding

ipbinding Show binding parameters between the IP address and MAC address of a client
show interface <mgtx|mgtx.y> dhcpserver reservedaddress

reservedaddress Show ranges of reserved addresses
show interface <mgtx|mgtx.y> iphelper
iphelper Show IP helper address information
show interface <mgtx|mgtx.y> iphelper maxhops

iphelper Show IP helper address information
maxhops Show max hops
show interface <wifix.y> multicast

multicast Show multicast settings, statistics, groups, and group members
show interface <wifix> channel

channel Show channel list of the radio interface
show interface <wifix> dfs

dfs Show DFS (Dynamic Frequency Selection) status
show interface <wifix> multicast

multicast Show multicast settings, statistics, groups, and group members
show interface <wifix> wlanidp apinfo

wlanidp Show WLAN IDP (intrusion detection and prevention) parameters
apinfo Show IDP AP statistics for the radio interface
show interface <wifix> wlanidp apinfo compliance {compliant|noncompliant}

compliance Show one compliance type of IDP AP statistics for the radio interface
compliant Show compliant type of IDP AP statistics for the radio interface
noncompliant Show noncompliant type of IDP AP statistics for the radio interface
show interface <wifix> wlanidp apinfo type {rogue|valid|external}

type Show one type of IDP AP statistics for the radio interface
rogue Show rogue type of IDP AP statistics for the radio interface
valid Show valid type of IDP AP statistics for the radio interface
external Show external type of IDP AP statistics for the radio interface
show interface <wifix> wlanidp clientinfo

clientinfo Show IDP client statistics for the radio interface
show interface <wifix> wlanidp mitigate rogueap [ <mac_addr> ]

mitigate Show mitigated rogue APs and their clients
rogueap Show rogue APs currently being mitigated or clients connected to a specific rogue AP
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show interface <wifix|wifix.y> counter

counter Show detailed statistics (counters) for traffic traversing the interface
show interface [ <ethx|mgtx|mgtx.y|wifix|wifix.y|redx|aggx|tunnelx|bgdx.y> ]

<tunnelx> Enter the name of the tunnel interface, where x = 0 or 1
<bgdx.y> Enter the name of the BGD (Bonjour Gateway Daemon) interface (Ranges: x: 0; y: 116)
show ip natpolicy
ip Show IP parameters
natpolicy Show parameters for a IP nat policy
show ip natpolicy <string>

show ip natpolicy serviceportlist

serviceportlist List all the service ports currently used by system and natpolicy virtualhost config
show ip pathmtudiscovery
pathmtudiscovery Show the Path MTU Discovery status
show ip policyroute [ {l3tunnelall|l3tunnelexception|l3tunnelsplit|l3tunneldrop} ]

Show all IP policy routing tables or a specific table (Note: If you do not specify a
policyroute
type of routing table, all tables are shown.)
l3tunnelall Show the IP policy routing table for tunneling all outbound traffic
Show the IP policy routing table for tunneling all outbound traffic other than that
l3tunnelexception
listed as a layer3 tunnel exception
Show the IP policy routing table for tunneling traffic whose destination is the network
l3tunnelsplit behind the VPN gateway while forwarding all other outbound traffic to the default
gateway defined on the branch router
Show the IP policy routing table for dropping all traffic whose destination is the
l3tunneldrop
network behind the VPN gateway
show ip route
route Show IP routing table
show ip session natpolicy

session Show status of ip sessions
natpolicy Show status of ip sessions related to nat policy
show ip session natpolicy <string>

session Show status of ip sessions
natpolicy Show status of ip sessions related to nat policy
show ip tcpmssthreshold
tcpmssthreshold Show the TCP MSS threshold parameters
show ippolicy
ippolicy Show parameters for IP policy
show ippolicy <string>

show ippolicy userprofile <number|string> [ {fromaccess|toaccess} ] [ from <ip_addr|string> <mask>

] [ to <ip_addr|string> <mask> ] [ service <string> ] [ action {permit|deny|interstationtraffic
drop} ] [ lines <number> ]
userprofile Show parameters for a user profile
<number> Enter the user profile name or ID
<string> Enter the user profile name or ID
fromaccess Show IP policy for data sent from this station
toaccess how IP policy for data arriving at this station
from Show the specific source IP (Default: any)
<ip_addr> Enable an IP or net address
<string> Enable an IP or net address
to Show the specific destination IP (Default: any)
<ip_addr> Enter an IP or net address
<string> Enter an IP or net address
service Show the specific service (Default: any)
action Show the action (Default:any)
permit Set the action
deny Set the action

interstationtraffic
Set the action
drop
lines Set the most number of IP policy to show
<number> Enter a num (Range: 132)
show ipv6 route

ipv6 Show IPV6 parameters
route Show IPV6 routing table
show l3 interface [ ipv6 ]

l3 Show Layer 3 information
interface Show all Layer 3 interfaces
ipv6 ipv6::Show all ipv6 Layer 3 interfaces
show librarysippolicy [ <string> ]

librarysippolicy Display library SIP policy settings
show license
license Show license information
show lldp [ {cdp} ] [ {neighbor} ]

neighbor Show the LLDP or CDP neighbor table
show location [ {aeroscout|tzsp} ]

location Show parameters for location tracking
aeroscout Show parameters for the location processing engine
tzsp Show parameters for the location processing engine
show location aerohive

aerohive Show parameters for the Aerohive location processing engine
show location aerohive list

list Show the entries in the track list
show location aerohive rssi

rssi Show the RSSI readings of tracked stations
show location aerohive rssi mac <mac_addr>

mac Show the RSSI readings of a specific tracked station as determined by its MAC address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show location aerohive rssi oui <oui>

Show the RSSI readings of specific tracked stations as determined by the OUI
oui
(organizationally unique identifier) portion of their MAC addresses
<oui>
show location {aeroscout|tzsp} counter

aeroscout Show parameters for the location processing engine
tzsp Show parameters for the location processing engine
counter Show statistics for location reports sent to the location processing engine
show logging
logging Show logging information
show logging {buffered|flash|debug} [ level

{emergency|alert|critical|error|warning|notification|info|debug} ] [ tail <number> ] [ date <date> ] [
time <time> ]
logging Show logging information
buffered Show buffered messages
flash Show flash messages
debug Show debug messages
level Specify a logging level
emergency Show emergencylevel log entries (Default: debug)
alert Show log entries from alert to emergency levels (Default: debug)
critical Show log entries from critical to emergency levels (Default: debug)
error Show log entries from error to emergency levels (Default: debug)
warning Show log entries from warning to emergency levels (Default: debug)
notification Show log entries from notification to emergency levels (Default: debug)
info Show log entries from info to emergency levels (Default: debug)
debug Show log entries for all severity levels (Default: debug)
tail Show log number

<number> Show log number (Range: 165535)
date Show messages start date
<date> Show messages date (Format: yyyymmdd; Range: 19700101 to 20351231)
time Show messages start time
<time> Show messages time (Format: hh:mm:ss)
show macobject [ <string> ]

macobject Show all MAC object names or the parameters of an individual MAC object
<string> Enter an MAC object name (132 chars)
show macpolicy
macpolicy Show parameters for MAC policy
show macpolicy <string> [ from <mac_addr> [ <number> ] ] [ to <mac_addr> [ <number> ] ] [ action

{permit|deny} ] [ lines <number> ]
from Show the specific source MAC (Default: any)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
to Show the specific destination MAC (Default: any)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
action Show the specific action (Default:any)
deny Set the action
lines Set the most number of MAC policy to show
show macpolicy userprofile <number|string> [ {fromaccess|toaccess} ] [ from <mac_addr> [ <number>

] ] [ to <mac_addr> [ <number> ] ] [ action {permit|deny} ] [ lines <number> ]
<number> Enter the user profile name or ID
<string> Enter the user profile name or ID
fromaccess Show MAC policy for data sent from this station
toaccess how IP policy for data arriving at this station
from Show the specific source MAC (Default: any)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
to Show the specific destination MAC (Default: any)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
action Show the specific action (Default:any)
deny Set the action
lines Set the most number of MAC policy to show
show mdnsd [ {cache|authrecord|duplicaterecord|authrecordproxied|duplicaterecordproxied|active

clientrequests|interface|questions|memory|others} ]
mdnsd Show MDNS daemon information
cache Show MDNS daemon cache information
authrecord Show MDNS daemon authrecord information
duplicaterecord Show MDNS daemon duplicaterecord information
authrecordproxied Show MDNS daemon authrecordproxied information
duplicaterecord
Show MDNS daemon duplicaterecordproxied information
proxied
activeclientrequests Show MDNS daemon activeclientrequests information
interface Show MDNS daemon interface information
questions Show MDNS daemon questions information
memory Show MDNS daemon memory information
others Show MDNS daemon others information
show mdnsd counter [ vlan <number> ]

mdnsd Show MDNS daemon information
counter Show MDNS packet counters
vlan Show MDNS packet counters on a specific VLAN
show memory [ {detail} ]

memory Show total, free, and used system memory statistics
detail Show system memory statistics in detail
show minpasswordlength
minpasswordlength Show the minimum password length
show mobiledevicepolicy [ <string> ]

mobiledevicepolicy Show all mobile device policy names or the settings of an individual policy
<string> Enter a mobile device policy name (132 chars)
show mobilitypolicy [ <string> ]

Show the parameters of all mobility policies or enter the name of a specific policy to
mobilitypolicy
see the parameters for just that one
<string> Enter the name of a specific mobility policy
show mobilitythreshold gretunnel permittedload

mobilitythreshold Show the settings for tunneling mobile user traffic
Show the settings for the volume of traffic that the local AP accepts through GRE
gretunnel tunnels (Note: This only applies to portals in a L3 roaming environment.)
Show the level determining how much tunneled traffic from mobile users the local AP
permittedload
accepts
show networkfirewall
networkfirewall Show all rules in the Layer 3 firewall policy
show ntp
ntp Show NTP (Network Time Protocol) parameters
show osdetection [ {option55toosdatabase|dhcpfingerprintversion} ]

osdetection Display the OS (Operating System) detection configuration
option55toos Display the contents of the database that contains the option55todatabase mapping
database (Note: The command displays user configuration database and default database contents.)
dhcpfingerprint
Display DHCP fingerprint file version
version
show osobject [ <string> ]

osobject Show all OS object names or the operating systems assigned to an individual OS object
<string> Enter an OS object name (132 chars)
show performancesentinel
performancesentinel Show performance sentinel parameters
show ppsk schedule [ <string> ]

ppsk Show parameters of privatePSK
schedule Show information about previously defined privatePSK schedules
<string> Enter a name to see information about a specific schedule (132 chars)
show proxy
proxy Show proxy parameters
show qos
qos Show QoS (Quality of Service) parameters
show qos classifiermap 80211e [ <number> ]

classifiermap Show the mapping of QoS priority markers on incoming packets to Aerohive QoS classes
Show mapping of IEEE 802.11e priority markers on incoming packets to Aerohive QoS
80211e
classes
<number> Enter the IEEE 802.11e user priority (Range: 07)
show qos classifiermap 8021p [ <number> ]
8021p Show mapping of IEEE 802.1p priority markers on incoming packets to Aerohive QoS classes
<number> Enter IEEE 802.1p priority (Range: 07)
show qos classifiermap diffserv [ <number> ]

Show mapping of diffserv DSCP (Differentiated Services Code Point) values on incoming
diffserv
packets to Aerohive QoS classes
<number> Enter The DSCP class (Range: 063)
show qos classifiermap interface <ethx|aggx|redx>

interface Show interfacebased classification table
show qos classifiermap oui [ <oui> ]

oui Show the MAC OUI (Organizational Unique Identifier) classification table
<oui>
show qos classifiermap service [ <string> ]

Show the servicebased classification table or enter the name of a specific service to
service
see the QoS classification for just that one
<string> Enter the name of a specific service
show qos classifiermap ssid <string>

ssid Show SSID (Service Set Identifier) profile names and individual profile parameters
show qos classifierprofile [ <string> ]

Show the parameters of all QoS classification profiles or enter the name of a specific
classifierprofile profile to see the parameters of just that one
<string> Enter the name of a specific QoS classifier profile
show qos counter user [ <mac_addr> ]

counter Show QoS statistics counters
user Show station QoS statistics counters
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show qos counter userprofile [ <string> ]

counter Show QoS statistics counters
Show QoS statistics counters for all user profiles or enter the name of a specific user
userprofile
profile to see counters for just that one
<string> Enter the name of a specific user profile
show qos l3police [ detail ]

l3police Show configuration or statistics for simplified Layer 3 (VoIP QoS) policing
detail detail::Show detailed configuration for all interfaces
show qos l3police interface <string> [ detail ]

interface Show configuration for a single interface
detail detail::Show detailed configuration for the specified interface
show qos l3police statistics [ detail ]

statistics Show statistics for simplified Layer 3 (VoIP QoS) policing
detail detail::Show detailed statistics for all interfaces
show qos l3police statistics interface <string> [ detail ]

statistics Show statistics for simplified Layer 3 (VoIP QoS) policing
interface Show statistics for a single interface
detail detail::Show detailed statistics for the specified interface
show qos markermap 80211e [ <number> ]
markermap Show the mapping of Aerohive QoS classes to QoS priority markers on outgoing packets
Show mapping of Aerohive QoS classes to IEEE 802.11e priority markers on outgoing
80211e
packets
show qos markermap 8021p [ <number> ]

8021p Show mapping of Aerohive QoS classes to IEEE 802.1p priority markers on outgoing packets
show qos markermap diffserv [ <number> ]

Show map of Aerohive QoS classes to diffserv DSCP (Differentiated Services Code Point)
diffserv
values on outgoing packets
show qos markermap {diffserv|8021p} <string>

Show map of Aerohive QoS classes to diffserv DSCP (Differentiated Services Code Point)
diffserv
values on outgoing packets
8021p Show mapping of Aerohive QoS classes to IEEE 802.1p priority markers on outgoing packets
show qos markerprofile [ <string> ]

Show the parameters for all QoS marker profiles or enter a name to see those of a
markerprofile
specific one
<string> Enter the name of a specific QoS marker profile
show qos policy [ <string> ]

policy Show the parameters for all QoS policies or enter a name to see those of a specific one
<string> Enter the name of a specific a QoS policy
show radio profile [ <string> ]

radio Show radio profile parameters
profile Show radio profile parameters for an interface
<string> Enter a radio profile name
show reboot schedule
reboot Show if the system is scheduled to reboot

schedule Show the next scheduled reboot time, if set
show report statistic

report Show report parameters for traffic statistics
statistic Show parameters for reporting interfacelevel and clientlevel traffic statistics
show resetbutton
Show the state of reset button to reset the AP to its factory default settings or, if
resetbutton
set, to a bootstrap config
show roaming cache

roaming Show the roaming cache and neighbors
cache Show the roaming cache containing MAC addresses and PMKs (Pairwise Master Keys)
show roaming cache mac <mac_addr>

cache Show the roaming cache containing MAC addresses and PMKs (Pairwise Master Keys)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show roaming neighbor [ mac <mac_addr> ] [ ip <ip_addr> ]

neighbor Show the neighbors to which associated stations can roam
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
ip Specify station IP
<ip_addr> Specify IP address
show route
route Show route parameters
show routing internalsubnetwork

routing Show routing parameters
internalsubnetwork Show all internal subnetworks used in branch offices
show routing policy

policy Show parameters for a routing policy
show routing policy <string>
show routing policy <string> route

route Show route for routing policy
show routing routerequest

routerequest Show parameters for requesting routing information
show routing {matchmap|routemap} [ <string> ]

matchmap Show the match map of routing policy
routemap Show the route map of routing policy
<string> Show the name of match map or route map
show runningconfig
runningconfig Show currently running configurations
show runningconfig password

show runningconfig users [ password ] [ all ]

users Show users configurations
all Show all the user configurations including temporary users
show runningconfig xauthclients [ password ]

Show the configuration of VPN clients and the passwords that they submit to the VPN
xauthclients
server during the Xauth procedure between IKE phase 1 and phase 2 negotiations
show schedule [ <string> ]

schedule Show information about previously defined schedules
<string> Enter a name to see information about a specific schedule (132 chars)
show scheduleindetail
scheduleindetail Show detailed information about all previously defined schedules
show security macfilter [ <string> ]

security Show security parameters
macfilter Show MACfilter parameters
<string> Specify MACfilter name
show security protocolsuite

security Show security parameters
protocolsuite Show predefine security protocol suites
show securityobject <string> dhcpserver

securityobject Show security object names and individual parameters
<string> Enter a security object name (132 chars)
dhcpserver Show DHCPserver parameters
show securityobject <string> dnsserver

dnsserver Show DNSserver parameters
show securityobject <string> mobiledevicemanager {jss|airwatch|aerohive}

mobiledevicemanager Show mobile device manager parameters
jss JAMP software server
airwatch AirWatch MDM server
aerohive Aerohive MDM server
show securityobject <string> mobiledevicepolicy

mobiledevicepolicy Show the mobile device policy to which the security object is bound
show securityobject <string> security aaa


security Show security settings
aaa Show AAA (authentication, authorization, and accounting) settings
show securityobject <string> security macwhitelist

macwhitelist Show the members in MAC white list
show securityobject <string> security protocolsuite

protocolsuite Show the security protocol suite
show securityobject <string> walledgarden

walledgarden Show the list of walled gardens
show securityobject <string> webserver

webserver Show the internal web server configuration in the interface
show securityobject [ <string> ]

show service [ <string> ]

service Show details or counters about predefined and custom services
<string> Show the transport protocol, port, and timeout for a specific service
show service [ <string> ] counter

service Show details or counters about predefined and custom services
<string> Show the transport protocol, port, and timeout for a specific service
counter Show counter statistics for all services or for a specific service
show sflow
sflow Show sflow related parameters
show sflow instance [ <string> ]

sflow Show sflow related parameters
instance Set sflow instance name (132 chars)
<string> Enter the instance name
show snmp [ {v3admin} ]

snmp Show SNMP (Simple Network Management Protocol) parameters
v3admin Show parameters for SNMP v3 administrators
show snmp community [ {readonly} ]

community Show previously defined SNMP communities and their parameters
readonly Enter a community privilege to show previously defined SNMP communities parameters
show snmp contact

contact Show SNMP contact information
show snmp location

location Show the AP location for SNMP
show snmp traphost

traphost Show parameters for SNMP trap host
show sshtunnel
sshtunnel Show SSH (Secure Shell) tunnel parameters
show ssid <string> admctl tsinfo [ sta <mac_addr> ]

admctl Show WMMAdmission Control parameters
tsinfo Show TS info for SSID [with station ]
sta Enter STA with MAC address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show ssid <string> counter station [ <mac_addr> ]
Show detailed statistics (counters) for stations (wireless clients) associated with the
counter
SSID
station Show statistics for all stations or a specific station associated with the SSID
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show ssid <string> manage

manage Show management options enabled on subinterfaces bound to the SSID
show ssid <string> multicast

multicast Show multicast settings
show ssid <string> qosclassifier

qosclassifier Show the QoS classification profile (classifier) assigned to the interface
show ssid <string> qosmarker

qosmarker Show the QoS marker profile assigned to the interface
show ssid <string> schedule [ detail ]

schedule Show all schedules bound to the SSID
detail Show detailed information about all schedules bound to the SSID
show ssid <string> security screening [ detail ]

security Show SSID security parameters
screening Show SSID security screening parameters
detail Show more information
show ssid <string> security wlan dos

security Show SSID security parameters
wlan Show SSID WLAN parameters
dos Show SSID DoS parameters
show ssid <string> station [ mac <mac_addr> ]

Show information about all stations currently associated with the SSID or about the
station
ongoing wireless activity of a specific station
Show the ongoing wireless activity of a station that is currently associated with the
mac
SSID (Note: To stop the display of output, press CTRL+C.)
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show ssid <string> station ipv6

Show information about all stations currently associated with the SSID or about the
station
ongoing wireless activity of a specific station
ipv6 Show IPv6 related information
show ssid <string> usergroup

usergroup Show SSID bind usergroups
show ssid [ <string> ]

show ssidschedule
ssidschedule Show the status of all SSID schedules
show station [ <mac_addr> ]

Show information about all stations or about the ongoing wireless activity of a specific
station
station
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show station [ <mac_addr> ] counter

station
station
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
counter Show detailed statistics (counters) for stations (wireless clients) associated with the
HiveAP
show station ipv6

station
station
ipv6 Show IPv6 related information
show supplicant certfile [ <string> ]

supplicant Show supplicant parameters
certfile Show cert files for supplicant
show supplicant name [ <string> ]

supplicant Show supplicant parameters
name Show supplicant names
<string> Enter a supplicant object name (132 chars)
show system
system Show system information
show system connectiontrap delay

system Show system parameters
connectiontrap Show system connectiontrap parameters
delay Show system connectiontrap delay value
show system diskinfo

diskinfo Show disk information
show system led

led Show LED configuration parameters and current status
show system power mode

power Show power information
mode Show power mode information
show system power status

power Show power information
status Show power status information
show system processes [ state ]

processes Show processes information
state Show processes running state
show system temperature

temperature Show the current system temperature and temperature monitoring parameters
show teacherview resourcemap

Show parameters for TeacherView, a tool for controlling student access to the network
teacherview
and monitoring their activity
Show all previously defined mappings of network resources to IP addresses and port
resourcemap
numbers
show tech
Show the output of many "show" commands that display all the important settings and
tech
runtime data
show tech <url> [ admin <string> password <string> {basic|digest} ] [ proxy <string> [ proxyadmin
Show the output of many "show" commands that display all the important settings and
tech
runtime data
basic
digest
ip_addr:port)
show timezone
timezone Show time zone
show track [ <string> ]
track Show IP tracking information
<string> Show IP tracking information for the group (132 chars)
show trackwan
trackwan Show Wan interface IP tracking information
show usbdevice
Show the following information about the internal USB hub and any device connected to
the USB port: bus number, device number, vendor ID, and product ID (Note: You can learn
usbdevice
the vendor name by looking up the vendor ID and product ID in the USB ID list at
http://www.linuxusb.org/usb.ids)
show usbmodem [ modemid <string> ]

usbmodem Show parameters of usbmodem
modemid Show modem identifier
<string> Enter the name of modemid (132 chars)
show usbmodem descriptor

descriptor Show descriptor information for the USB modem
show usbmodem info

Show the manufacturer, model, revision, IMEI (International Mobile Equipment Identity),
info and capabilities of the attached USB modem (Note: This information might not be
available when the modem has an active PPP connection.)
show usbmodem modeswitch

modeswitch Show modeswitch configure for the USB modem
show usbmodem networkmode

networkmode Show the network mode preference of usbmodem
show usbmodem networkservice

networkservice Show the network service information of usbmodem
show usbmodem rssi

Show RSSI (Received Signal Strength Indication) and BER (Bit Error Rate) of the attached
rssi USB modem (Note: This information might not be available when the modem has an active
PPP connection.)
show usbmodem siminfo

siminfo Show the SIM card information of usbmodem
show usbmodem status

Show information about the attached USB modem, the PPP process and statistics,
status
primary/backup WAN interface status, and internal failover/failback states
show user
user Show all user
show usergroup <string> pskdigest [ <string> ]

usergroup Show a user group parameters
pskdigest Show the digest string for the autoPSK
show usergroup [ <string> ]

usergroup Show a user group parameters
show userprofile <string> cac airtimepercentage

cac Show CAC (Call Admission Control) parameters and statistics
airtimepercentage Show the percentage of airtime for VoIP calls
show userprofile <string> schedule [ detail ]

schedule Show all schedules bound to the user profile
detail Show detailed information about all schedules bound to the user profile
show userprofile [ <string> ]

show userprofilepolicy [ <string> ]
userprofilepolicy Show parameters for a user profile mapping policy
<string> Enter a policy name
show userprofileschedule
userprofileschedule Show the status of all user profile schedules
show version [ {detail} ]

Show information about the current and backup HiveOS versions on the HiveAP and the
version
HiveAP platform type
Show detailed information about the current and backup HiveOS versions on the HiveAP and
detail
the HiveAP platform type
show video ip <ip_addr> <number>

video Show information about streaming video traffic
ip Set the IP multicast group address that is the source of the video stream
<number> Enter a destination port number to which the video traffic was sent (Range: 0 65535)
show video ip <ip_addr> dstportrange <number> <number>

video Show information about streaming video traffic
ip Set the IP multicast group address that is the source of the video stream
dstportrange Set a range of destination port numbers
<number> Enter the first destination port number in the range (Range: 0 65535)
Set a range of destination port numbers
<number> Enter the last destination port number in the range (Range: 0 65535)
show vlangroup
vlangroup Show the settings and status of the Bonjour gateway
show vpn gretunnel

vpn Show VPN information and VPN objects
gretunnel Show GRE (Generic Routing Encapsulation) tunnel information
show vpn ike configuration

ike Show IKE information
configuration Show VPN configuration settings
show vpn ike {sa|event}

sa Show the cookies and creation times of IKE phase1 security associations
event Show the most recent IKE events (Note: You can see up to a maximum of 32 IKE events.)
show vpn ike {sp}

sp Show IPsec security policies
show vpn ipsec sa

ipsec Show IPSec information
sa Show IKE phase 2 IPsec security associations
show vpn ipsectunnel

ipsectunnel Show IPSec tunnel information
show vpn l3tunnelexception

l3tunnelexception Show layer3 tunnel exception list
show vpn layer3tunnel

layer3tunnel Show layer3 tunnel information
show vpn tunnelid [ <number> ]

Show VPN tunnel destination parameters and status, or show detailed information about a
tunnelid
specific tunnel by entering its ID number
<number> Enter the tunnel ID number (Range: 12147483647)
show vpn tunnelpolicy

tunnelpolicy Show tunnel policy information
show vpn {socket|timer|memory|queue|ph2|sp|rekey}

socket #hidden
timer #hidden
memory #hidden
queue #hidden
ph2 #hidden
sp #hidden
rekey #hidden
show wan db
wan Show brd wan info
db Show brd wan database info
show wan failover

failover Show brd wan failover info
show wan interface

interface Show brd wan interface info
show wan interface <ethx|usbnetx|wifix|tunnelx>

interface Show brd wan interface info
<tunnelx> Enter the name of the tunnel interface, where x = 0 or 1
show webdirectory [ ppskselfreg ] [ <string> ]

webdirectory Show the files in a web directory
ppskselfreg Show the files in the private PSK selfregistration web directory
show websecurityproxy {websensev1|barracudav1}

websecurityproxy Show the web security proxy configuration
websensev1 Show the configuration for Websense
barracudav1 Show the configuration for Barracuda
show webserverkey
webserverkey Show web server key files information
show wlanidp mitigate [ <mac_addr> ]

Show one or a list of rogue APs against which mitigation was performed, the HiveAPs that
mitigate
reported them, and those that attacked them
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
show wlanidp profile [ <string> ]

profile Show IDP profile parameters
snmp contact <string>

snmp Set SNMP (Simple Network Management Protocol) parameters
contact Set SNMP contact information
<string> Enter SNMP contact information (132 chars)
snmp location <string>

location Set the AP location for SNMP
<string> Enter the SNMP location string (1255 chars; Default: changeme)
snmp reader version v3 admin <string> [ auth {md5|sha} password <string> ] [ encryption {aes|des}
password <string> ]
Set the SNMP community mode as readonly (Note: This setting allows the NMS, or network
reader
management station, to read MIB data on the AP but not receive traps from it.)
version Set the SNMP community version
v3 Set the SNMP community version as SNMP v3
admin Set the admin with readonly privileges for viewing MIB data
<string> Enter the admin name (132 chars)
Set the algorithm for authenticating communications between the SNMP agent on the AP and
auth
the NMS
md5 Set the authentication algorithm as MD5 (Message Digest Algorithm 5)
sha Set the authentication algorithm as SHA1 (Secure Hash Algorithm 1)
password Set the password used during the authentication process
<string> Enter the authentication password (864 chars)
Set the algorithm for encrypting communications between the SNMP agent on the AP and the
encryption
NMS
aes Set the encryption algorithm as AES (Advanced Encryption Standard)
des Set the encryption algorithm as DES (Data Encryption Standard)
password Set the password used during the encryption process
snmp reader version {v1|v2c|any} community <string> [ <string> ]

Set the SNMP community mode as readonly (Note: This setting allows the NMS, or network
reader
management station, to read MIB data on the AP but not receive traps from it.)
version Set the SNMP community version
v1 Set the community version as SNMP v1
v2c Set the community version as SNMP v2c
any Set the community version to support both SNMP v1 and v2c
community Set SNMP community parameters

Set the SNMP community string for authenticating communications between the SNMP agent
<string>
on the AP and the NMS (Note: This string acts like a password or a shared secret.)
<string> Enter the domain name (132 chars) or the IP address and netmask for the NMS
snmp traphost {v1|v2c} <ip_addr|string> [ port <number> ] [ {viavpntunnel} ] [ community <string> ]

Set parameters for the SNMP trap host (Note: This is an NMS, or network management
traphost
station, that can receive SNMP traps from the AP.)
v1 Set the trap format for SNMP v1
v2c Set the trap format for SNMP v2c
<ip_addr> Enter the domain name (132 chars) or the IP address for the NMS
<string> Enter the domain name (132 chars) or the IP address for the NMS
port Set the port number on which the NMS listens for traps that the AP sends it
<number> Enter the port number (Default: 162, Range: 165535)
Send all SNMP traps through a VPN tunnel (Note: Set this option on VPN clients when the
viavpntunnel NMS is in a different subnet from the tunnel interface. When they are in the same
Set the community string for authenticating communications between the AP and NMS (Note:
community
This string acts like a password or a shared secret.)
<string> Enter the community string (132 characters; Default: hivecommunity)
snmp traphost {v3} <ip_addr|string> [ port <number> ] [ {viavpntunnel} ] admin <string>

traphost
<ip_addr> Enter the domain name (132 chars) or the IP address for the NMS
<string> Enter the domain name (132 chars) or the IP address for the NMS
port Set the port number on which the NMS listens for traps that the AP sends it
<number> Enter the port number (Default: 162, Range: 165535)
Send all SNMP traps through a VPN tunnel (Note: Set this option on VPN clients when the
viavpntunnel NMS is in a different subnet from the tunnel interface. When they are in the same
admin Set the name of the SNMP admin that can receive traps from AP
snmp traphost {v3} admin <string> auth {md5|sha} password <string> [ encryption {aes|des} password
<string> ]
traphost
admin Set the admin with privileges for receiving traps
Set the algorithm for authenticating communications between the SNMP agent on the AP and
auth
the NMS
md5 Set the authentication algorithm as md5 (Message Digest Algorithm 5)
sha Set the authentication algorithm as SHA1 (Secure Hash Algorithm 1)
password Set the password used during the authentication process
<string> Enter the authentication password (864 chars)
Set the algorithm for encrypting communications between the SNMP agent on the AP and the
encryption
NMS
aes Set the encryption algorithm as AES (Advanced Encryption Standard)
des Set the encryption algorithm as DES (Data Encryption Standard)

password Set the password used during the encryption process
snmp trapinfo {oversnmp|overcapwap}

trapinfo Set parameters for the delivery of SNMP trap information
oversnmp Send trap inion over SNMP (Default: Disabled)
overcapwap Send trap information over CAPWAP (Default: Enabled)
sshtunnel server <string> tunnelport <number> user <string> password <string> [ timeout <number> ]
Set SSH (Secure Shell) tunnel parameters so that Aerohive Technical Support can access
sshtunnel
the AP remotely
Set the domain name or IP address of the Aerohive SSH server and, optionally, its port
server
number
Enter the domain name (164 chars) or IP address and, optionally, the port number
<string>
(Default port: 22; Range: 102565535; Format: name:port or ip:port)
tunnelport Set the port number that the SSH server uses to identify the tunnel
<number> Enter the port for identifying the SSH tunnel (Range: 102565535)
user Set the user name for logging in to the SSH server
password Set password for logging in to the SSH server
Set the length of time during which the tunnel between the AP and the Aerohive SSH
timeout
server will be up
<number> Enter the tunnel timeout value in minutes (Range: 06000, Default: 0 (disable))
ssid <string>
ssid Set SSID (Service Set Identifier) parameters
ssid <string> 11arateset [ {6|6basic} ] [ {9|9basic} ] [ {12|12basic} ] [ {18|18basic} ] [

{24|24basic} ] [ {36|36basic} ] [ {48|48basic} ] [ {54|54basic} ]
Set the basic (mandatory) and optional 11a data rates for the radio (Default rates in
11arateset
Mbps: basic=6, 12, 24, opt=9, 18, 36, 48, 54)
6 Set 6 Mbps as a basic (mandatory) or optional data rate
6basic Set 6 Mbps as a basic (mandatory) or optional data rate

ssid <string> 11acmcsrateset <string>
11acmcsrateset Set the 802.11ac MCS rate indexes for which the SSID advertizes its support
Enter specific MCS rates (Range: 1256 chars; Format: Use commas as separators. Example:
<string>
mcs2/1,mcs8/1,mcs4/2,mcs8/2,mcs9/2,mcs3/3)
ssid <string> 11grateset [ {1|1basic} ] [ {2|2basic} ] [ {5.5|5.5basic} ] [ {11|11basic} ] [

{6|6basic} ] [ {9|9basic} ] [ {12|12basic} ] [ {18|18basic} ] [ {24|24basic} ] [ {36|36basic} ]
[ {48|48basic} ] [ {54|54basic} ]
Set the basic (mandatory) and optional 11g data rates for the radio (Default rates in
11grateset
Mbps: basic=1, 2, 5.5, 11, opt=6, 9, 12, 18, 24, 36, 48, 54)
5.5 Set 5.5 Mbps as a basic (mandatory) or optional data rate
5.5basic Set 5.5 Mbps as a basic (mandatory) or optional data rate
ssid <string> 11nmcsexpandrateset <string>

Set the 802.11n MCS rate indexes for which the SSID advertizes its support(By default,
11nmcsexpandrate all MCS rates for three spatial streams on the HiveAP 330 and 350 are supported: 023.
set On the HiveAP 110, 120, 320, and 340, which support a maximum of two spatial streams,
use the 11nmcsrateset option instead.)
Enter specific MCS rates (Range: 1256 chars; Format: Use commas as separators. Example:
<string>
mcs2/1,mcs5/1,mcs4/2,mcs3/3)
ssid <string> admctl ac <number> enable

admctl Set WMMAdmission Control parameters
ac Set the AC (Access Category)

<number> Enter the AC number (03 int), 0 as BE, 1 as BK, 2 as VI, 3 as VO
enable Enable admctl for SSID
ssid <string> admctl delts sta <mac_addr> tid <number>

admctl Set WMMAdmission Control parameters
delts Generate DELTS message to sta with and TID of SSID
sta Set STA with MAC address
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
tid Set the TID
<number> Enter the TID number (07 int)
ssid <string> blocktowifimcast

Set the HiveAP to block multicast or broadcast traffic sent to the SSID (Default:
blocktowifimcast
Disabled)
ssid <string> clientageout <number>

clientageout Set the length of time to age out inactive clients and automatically disassociate them
<number> Enter the client ageout time in minutes (Default: 5; Range: 130)
ssid <string> clientmonitorpolicy <string>

Assign a Client Monitor policy to automatically detect, analyze and report problems
clientmonitorpolicy
about the clients which access the network through the specified ssid
ssid <string> dtimperiod <number>

dtimperiod Set the DTIM (delivery traffic indication message) period
<number> Set the number of beacons between DTIM frames (Default: 1; Range: 1255)
ssid <string> fragthreshold <number>

fragthreshold Set the fragment threshold for the SSID
<number> Enter the fragment threshold in bytes for the SSID (Default: 2346; Range: 2562346)
ssid <string> hidessid

hidessid Hide the SSID in beacons and ignore broadcast probe requests
ssid <string> ignorebroadcastprobe
ignorebroadcastprobe Ignore broadcasted probe requests
ssid <string> interstationtraffic

Set the HiveAP to permit traffic between stations connected to one or more of its access
interstationtraffic
interfaces (Default: Enabled)
ssid <string> manage all

all_service::Enable all manageability options (ping, SNMP, SSH, and Telnet) for mgt0
all through subinterfaces bound to the SSID (Defaults: ping enabled, SNMP disabled, SSH
enabled, Telnet disabled)
ssid <string> manage {Telnet|SSH|SNMP|ping}

Enable Telnet manageability of mgt0 through subinterfaces bound to the SSID (Default:
Telnet
Disabled)
Enable SSH manageability of mgt0 through subinterfaces bound to the SSID (Default:
SSH
Enabled)
Enable SNMP manageability of mgt0 through subinterfaces bound to the SSID (Default:
SNMP
Disabled)
Enable mgt0 to respond to pings through subinterfaces bound to the SSID (Default:
ping
Enabled)
ssid <string> maxclient <number>

maxclient Set the maximum number of clients that can associate with the SSID
Enter the maximum number of clients that can associate (Default: 100; Range: 1100;
<number> Note: A radio profile can support a maximum of 100 clients by default, and there can be
a maximum of 16 SSIDs per radio.)
ssid <string> mode compliance

mode Set SSID mode parameter
compliance Set SSID mode compliance with 11n standard
ssid <string> mode legacy

mode Set SSID mode parameter
Set this mode to disable the advertisement of 802.11n capabilities when there are legacy
legacy 802.11a/b/g clients that cannot support 802.11n IEs (information elements) in management
frames
ssid <string> multicast conversiontounicast {auto|always|disable}
Set parameters for sending IP datagrams to a group of interested receivers in a single
multicast
transmission
conversiontounicast Set the method for converting multicast frames to unicast frames (Default: Disabled)
Convert from multicast to unicast automatically whenever the channel utilization or
auto
multicast group membership count is below their respective thresholds
Always convert from multicast to unicast regardless of channel utilization and group
always
membership numbers
disable Disable convert from multicast to unicast
ssid <string> multicast cuthreshold <number>

multicast
transmission
Set the channel utilization threshold that determines when to convert multicast to
cuthreshold
unicast frames
Enter the channel utilization threshold as a percent (Default: 60; Range: 1100; Note:
<number> Conversion from multicast to unicast frames occurs when the percent of channel
utilization is below or equal to this value.)
ssid <string> multicast memberthreshold <number>

multicast
transmission
Set the membership count threshold that determines when to convert multicast to unicast
memberthreshold
frames
Enter the multicast group membership threshold (Default: 10; Range: 130; Note:
<number> Converting multicast frames to unicast frames occurs when the number of group members is
below or equal to this value.)
ssid <string> qosclassifier <string>

qosclassifier Assign a QoS classification profile (classifier) to the interface
<string> Enter the QoS classifier profile name (132 chars)
ssid <string> qosmarker <string>

qosmarker Assign a QoS marker profile to the interface
<string> Enter the QoS marker profile name (132 chars)
ssid <string> rrm enable

rrm Set RRM (Radio Resource Management) parameters
enable Enable RRM for SSID
ssid <string> rtsthreshold <number>

rtsthreshold Set the RTS (request to send) threshold for the SSID
Enter the packet size for the RTS (request to send) threshold for the SSID (Default:
<number>
2346 bytes; Range: 12346)
ssid <string> schedule <string>

schedule Set a schedule during which the SSID will be available for use
ssid <string> security macfilter <string>

security Set the security parameters for the SSID
macfilter Assign a filter for MAC addresses or OUIs (organizational unique identifiers)
<string> Enter the filter name for MAC addresses or OUIs (organizational unique identifiers)
ssid <string> security screening radiusattack

screening Set the security screen parameters
radiusattack Enable the screening method of RADIUS attack procection (Default: Disabled)
ssid <string> security screening radiusattack action banforever

action Set the action to perform if an alarm is triggered (Default: alarm)
banforever Disconnect the station and ban it from reconnecting indefinitely
ssid <string> security screening radiusattack action {alarm|ban} [ [ <number> ] ]

alarm Send an alarm but continue to pass traffic
ban Disconnect the station and ban it from reconnecting for a period of time
Enter the amount of time in seconds to perform the action (Range: 1100000000; Default:
<number>
10 for an alarm, 3600 for a ban)
ssid <string> security screening radiusattack threshold <number> [ action {alarm|ban} [ <number> ] ]
Set the length of time during which 10 RADIUS rejections for the same source MAC address
threshold
is considered unacceptable
<number> Enter the length of time in seconds (Range: 13600; Default: 5)
<number>
10 for an alarm, 3600 for a ban)
ssid <string> security screening radiusattack threshold <number> action banforever

Set the length of time during which 10 RADIUS rejections for the same source MAC address
threshold
is considered unacceptable
<number> Enter the length of time in seconds (Range: 13600; Default: 5)
ssid <string> security screening tcpsyncheck

Enable checking that the SYN flag is set in TCP segments before creating new IP sessions
tcpsyncheck (Default: Disabled, Note: When enabled, the IP session idle timeout is 10 seconds until
the TCP threeway handshake is complete.)
ssid <string> security screening {icmpflood|udpflood|synflood|arpflood|addresssweep|portscan|ip

spoof} [ threshold <number> ]
icmpflood Enable the screening method for protection against ICMP floods (Default: Disabled)
udpflood Enable the screening method for protection against UDP floods (Default: Disabled)
synflood Enable the screening method for protection against TCP SYN floods (Default: Disabled)
arpflood Enable the screening method for protection against ARP floods (Default: Disabled)
addresssweep Enable the screening method for protection against IP address sweeps (Default: Disabled)
portscan Enable the screening method for protection against port scans (Default: Disabled)
ipspoof Enable the screening method for protection against IP spoofing (Default: Disabled)
Set the threshold: packets per second for synflood and arpflood, air time for icmp
threshold flood and udpflood, milliseconds every 10 packets for addresssweep and portscan, IP
addresses for ipspoof
Enter the threshold value (Defaults and Ranges: ICMP flood: 20%, 1100%; UDP flood 50%,
1100%; SYN flood: 1000 pkts/sec, 11000000 pkts/sec; ARP flood 100 pkts/sec, 11000000
<number>
pkts/sec; address sweep and port scan: 100 ms/10 pkts, 110000 ms; IP spoof: 3 src
IPs/src MAC, 210 IPs; RADIUS attack: 5 secs/10 rejects, 13600 secs)
spoof} action banforever

spoof} action disconnect
disconnect Disconnect the station but do not ban it from reconnecting

spoof} action {alarm|drop|ban} <number>
drop Drop traffic for a period of time

<number>
10 for alarm, 1 for drop, 3600 for ban)
spoof} threshold <number> action banforever
<number>

spoof} threshold <number> action disconnect
<number>
disconnect Disconnect the station but do not ban it from reconnecting

spoof} threshold <number> action {alarm|drop|ban} <number>
<number>
drop Drop traffic for a period of time
<number>
10 for alarm, 1 for drop, 3600 for ban)
ssid <string> security wlan dos stationlevel frametype {assocreq|auth|eapol} ban <number>
Enter the period of time in seconds to ignore frames after a theshold has been crossed
<number>
(Default: 60; Min: 0 Max: None)
ssid <string> security wlan dos stationlevel frametype {assocreq|auth|eapol} ban forever
forever Set ban forever
ssid <string> security wlan dos {ssidlevel|stationlevel} frametype {probereq|proberesp|assoc

req|assocresp|disassoc|auth|deauth|eapol|all}
ssidlevel Set DoS parameters at ssidlevel

req|assocresp|disassoc|auth|deauth|eapol|all} alarm <number>
alarm Set the interval in seconds between alarms to indicate continuous DoS conditions
Enter the interval in seconds between alarms to indicate continuous DoS conditions
<number>
(Default: 60 secs; Min: 0 Max: None)

req|assocresp|disassoc|auth|deauth|eapol|all} threshold <number>
Set the frame threshold in ppm (packets per minute) that must be crossed to trigger an
threshold
alarm
Enter threshold in ppm (Default: ssidlevel probereq 12000, proberesp 24000, eapol
6000, auth 6000, assocreq 6000, assocresp 2400, all others 1200; stalevel probereq
<number>
1200 ppm, proberesp 2400, eapol 600, auth 600, assocreq 600, assocresp 240, all
others 120; Min: 0 Max: None)
ssid <string> securityobject <string>

securityobject Assign a security object to control network access through this SSID
ssid <string> uapsd

Enable UAPSD (Unscheduled Automatic Power Save Delivery) to support stations using WMM
uapsd
(WiFi Multimedia) Power Save
ssid <string> usergroup <string>

usergroup Set the usergroup for privatePSK on the SSID
<string> Enter the group name (132 chars)
ssid <string> wmm

wmm Enable the SSID to support WMM (WiFi Multimedia) traffic prioritization
ssid <string> wnm enable

wnm Set WNM (802.11v) parameters
enable Enable WNM for SSID
ssid <string> wnm sta <mac_addr> send bstmreq

wnm Set WNM (802.11v) parameters
sta Specify the station
<mac_addr>
Examples: 1111:1111:1111, 111111111111, 1111.1111.1111 ...)
send Action of sending frames
bstmreq Frame to be send: BSTM Request frames
supplicant <string>
supplicant Set parameters for a supplicant object for HiveOS
supplicant <string> cacert <string>

cacert Set a cacert index for supplicant to verify server cert
<string> Specify cacert file name (132 chars)
supplicant <string> clientcert <string> privatekey <string> [ privatekeypassword <string> ]

clientcert Set a clientcert name for supplicant
<string> Specify clientcert name (132 chars)
privatekey Set the private key used when forming a TLS tunnel
privatekeypassword Set the password for encrypting the private key used when forming a TLS tunnel
supplicant <string> eaptype {md5|peap|tls|ttls}

eaptype Choose eaptype used for 802.1x client
md5 set eaptype to md5
peap set eaptype to peap(default)
tls set eaptype to tls
ttls set eaptype to ttls
supplicant <string> password <string>

password Set the password for 802.1x client
supplicant <string> username <string> [ password <string> ]

username Set the username for 802.1x client
password Set the password for 802.1x client
system connectiontrap delay <number>

system Set system parameters
connectiontrap Set system connectiontrap parameters
delay Set system connectiontrap delay parameters
<number> Enter the value (Range: 130; Default:30)
system disablemulticastping
disablemulticastping Disable responses to multicast pings (Default: Enabled)
system environment {indoor|outdoor}

environment Set the environment in which the system will operate
indoor Set the system for indoor operations (Default: indoor)
outdoor Set the system for outdoor operations (Default: indoor)
system icmpredirect enable

icmpredirect Accept ICMP redirect messages
enable Enable the accepting of ICMP redirect messages (Default: Disable)
system led brightness {bright|soft|dim|off}

led Set status LED configuration parameters
brightness Set the brightness level for the status LEDs (Default: bright)
bright Set brightness level to bright
soft Set brightness level to soft
dim Set brightness level to dim
off Set brightness level to off
system powermode {802.3at|802.3af|auto}

powermode Set power mode
802.3at
802.3af
auto
system webserver enable

webserver Set the web server parameters
enable Enable the web server (Default: Enabled)
teacherview promptfordenyurl
Set parameters for TeacherView, a tool for controlling student access to the network and
teacherview
monitoring their activity
Enable the use of an access denial notification, which the student receives when
promptfordenyurl accessing a blocked URL (Default: Enabled; Note: When disabled, the student does not
receive a denial of access. Instead, the connection simply times out.)
teacherview resourcemap name <string> ip <ip_addr> port <port>

Set parameters for TeacherView, a tool for controlling student access to the network and
teacherview
monitoring their activity
resourcemap Map the name of a network resource to an IP address and port number
name Set the resource name
<string> Enter the resource name (max 32 chars)
ip Set the IP address where the resource is located
port Set the port number associated with the resource
<port> [1~65535]Enter the port number (Range: 165535)
timeobject <string> once <date> <time> to <date> <time> [ timezone <number> ]

timeobject Set a time object
<string> Enter a time object name (132 chars)
once Set a once schedule
<date>
31)
<time>
59)
<time>
59)
timezone
timeobject <string> recurrent [ daterange <date> [ to <date> ] ] [ weekdayrange

{Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday} ] ] timerange <time> to <time> [ time
range <time> to <time> ] [ timezone <number> ]
timeobject Set a time object
<string> Enter a time object name (132 chars)
daterange
<date>
31)
Apply the schedule on specific days of the week (To apply the schedule everyday, do not
weekdayrange
use this option.)
Set a range of weekdays during which the schedule will be applied (Example: monday to
to
friday)
<time> 59)
to Set a time range

<time>
59)
<time>
Range: 0059)
to Set a time range
<time>
Range: 0059)
timezone
tracert <ip_addr> [ maxhops <number> ] [ timeout <number> ] [ noresolve ]

tracert Perform a traceroute
<ip_addr> Enter a destination IP address
maxhops Set the maximum number of hops to cross when searching for a target
Enter the maximum number of hops to cross when searching for a target (Default: 30,
<number>
Range: 1255)
timeout Set the timeout for a response to a probe
<number> Enter the timeout in seconds for a response to a probe (Range: 265535)
noresolve Do not resolve addresses to domain names
tracert <string> [ maxhops <number> ] [ timeout <number> ] [ noresolve ]

tracert Perform a traceroute
<string> Enter a destination hostname (132 chars)
maxhops Set the maximum number of hops to cross when searching for a target
Enter the maximum number of hops to cross when searching for a target (Default: 30,
<number>
Range: 1255)
timeout Set the timeout for a response to a probe
<number> Enter the timeout in seconds for a response to a probe (Range: 265535)
noresolve Do not resolve addresses to domain names
track <string> [ ip <ip_addr> ]

track Set parameters to track the reachability of one or more devices on the network
<string> Enter the name for a group of one or more targets to track (132 chars)
ip Set an IP address for tracking
<ip_addr> Enter an IP address for tracking
track <string> action startmeshfailover

Set the action to take when there are no longer responses from any tracked targets in a
action
group
startmeshfailover Start the mesh failover procedure
track <string> action {enableaccessconsole|disableaccessradio}

Set the action to take when there are no longer responses from any tracked targets in a
action group
enableaccessconsole Enable the virtual access console
disableaccessradio Disable all radios in access mode
track <string> defaultgateway

defaultgateway Set the default gateway for tracking
track <string> enable

enable Enable the group name for tracking (Default: Enable)
track <string> interval <number>

interval Set the interval for sending probes to track the IP address of a target
Enter the tracking interval (Default: 6 seconds; Range: 1180; Note: The tracking
<number>
interval must not be shorter than the probe timeout.)
track <string> multidstlogic {and|or}

Determine if one or all tracked targets within a group must become unresponsive before
multidstlogic
taking action
and Take action if none of the members in the group is responding (Default:or)
or Take action if any single member in the group is not responding (Default:or)
track <string> retry <number>

retry Set the number of times to retry probing an unresponsive target
<number> Enter the retry value (Default: 2 times; Range: 01024)
trackwan <string>
Set parameters to track the reachability of one or more devices through the WAN
trackwan
interface
trackwan <string> defaultgateway

trackwan
interface
defaultgateway Set the default gateway for tracking
trackwan <string> enable

trackwan
interface
enable Enable the group name for tracking (Default: Disable)
trackwan <string> interface <ethx|usbnetx|wifix>
trackwan Set parameters to track the reachability of one or more devices through the WAN
interface
interface Set the WAN interface through which to track targets
trackwan <string> interval <number>

trackwan
interface
interval Set the interval for sending probes to track the IP address of a target
<number> Enter the tracking interval (Default: 10 seconds; Range: 1180)
trackwan <string> ip <ip_addr>

trackwan
interface
ip Set an IP address for tracking
<ip_addr> Enter the IP address of a target
trackwan <string> multidstlogic {and|or}

trackwan
interface
Determine if one or all tracked targets within a group must become unresponsive before
multidstlogic
taking action
and Take action if none of the members in the group is responding (Default:or)
or Take action if any single member in the group is not responding (Default:or)
trackwan <string> retry <number>

trackwan
interface
retry Set the number of times to retry probing an unresponsive target
<number> Enter the retry value (Default: 2 times; Range: 01024)
usbmodem enable
usbmodem Set parameters of usbmodem
enable Enable usbmodem (Default: Enabled)
usbmodem mode {ondemand|alwaysconnected|primarywan}

mode Set the connection mode of the modem (Default: ondemand)
ondemand Connect through the modem only after the primary WAN interface (eth0) fails
Maintain a connection through the modem at all times and connect through it after the
alwaysconnected
primary WAN interface (eth0) fails
primarywan Connect through the modem as the primary WAN interface and switch to eth0 as the backup
usbmodem modemid <string>

modemid Set modem identifier
usbmodem modemid <string> apn [ <string> ]

apn Set access point name
<string> Enter the name of access point (1100 chars)
usbmodem modemid <string> atcmdget {cardinfo|signalstrength} <string>

atcmdget Set the USB modem get AT commands info and save them into USB modem db
cardinfo Enter the at command to get card info
signalstrength Enter the at command to get signal strength
<string> Enter the at command (up to 256 chars)
usbmodem modemid <string> atcmdset {networkmodeauto|networkmodelte|networkmode3g|network

mode2g|modemreset} <string>
atcmdset Set the USB modem set AT commands info and save them into USB modem db
networkmodeauto Enter the at command to set network mode to auto mode
networkmodelte Enter the at command to set network mode to lte mode
networkmode3g Enter the at command to set network mode to 3g mode
networkmode2g Enter the at command to set network mode to 2g mode
modemreset Enter the at command to reset modem
<string> Enter the at command (up to 256 chars)
usbmodem modemid <string> connectcmd <string>

connectcmd Set a USB modem connect command and save them into USB modem db
<string> Enter the USB modem connect command (up to 256 chars)
usbmodem modemid <string> connectstatuscmd <string> connectedpattern <string> disconnectpattern

<string>
Set a USB modem connect status AT command, the connected and disconnected status string
connectstatuscmd
pattern, and then save them into USB modem db
<string> Enter the USB modem connect status command (up to 256 chars),
connectedpattern Set a USB modem connected status string pattern
<string> Enter the connected status string pattern (up to 64 chars)
disconnectpattern Set a USB modem disconnect status string pattern
<string> Enter the disconnect status string pattern (up to 64 chars)
usbmodem modemid <string> connecttype {pppdialup|atcmddirectip|qmidirectip}
connecttype Set a USB modem connecttype and save them into USB modem db
pppdialup Choose the USB modem connection type as pppdialup
atcmddirectip Choose the USB modem connection type as atcmddirectip
qmidirectip
usbmodem modemid <string> dialupnumber [ <string> ]

dialupnumber Set dialup number
<string> Enter the dialup number (132 chars)
usbmodem modemid <string> dialuppassword [ <string> ]

dialuppassword Set dialup password
<string> Enter the dialuppassword(132 chars)
usbmodem modemid <string> dialupusername [ <string> ]

dialupusername Set dialup username
<string> Enter the dialupusername(132 chars)
usbmodem modemid <string> disconnectcmd <string>

disconnectcmd Set a USB modem disconnect command and save them into USB modem db
<string> Enter the USB modem disconnect command (up to 256 chars)
usbmodem modemid <string> usbnet {cdcether|sierranet}

usbnet Set the USB modem network driver info and save them into USB modem db
cdcether Choose the USB modem network driver as cdcether
sierranet Choose the USB modem network driver as sierranet
usbmodem modemid <string> usbserial {option|sierra|cdcacm}

usbserial Set the USB modem serial driver info and save them into USB modem db
option Choose the USB modem serial driver as option

sierra Choose the USB modem serial driver as sierra
cdcacm Choose the USB modem serial driver as cdcacm
usbmodem modemid <string> vendorid <string> productid <string>

vendorid Set the USB modem vendor id
<string> Enter the USB modem vendor id (4 hex digit of each)
productid Set the USB modem product id
<string> Enter the USB modem product id (4 hex digit of each)
usbmodem modeswitch vendorid <string> productid <string> message <string>

modeswitch Set a modeswitch command for the USB modem
vendorid Set the USB modem vendor id
<string> Enter the USB modem vendor id (4 hex digit of each)
productid Set the USB modem product id
<string> Enter the USB modem product id (4 hex digit of each)
message Configrue the message for USB modem mode switch
<string> Enter the message for USB modem mode switch (up to 256 chars)
usbmodem networkmode {auto|lte|3g|2g}

networkmode Set the network mode preference of the modem (Default: auto)
auto set network mode preference as automatic switching mode
lte set network mode preference as LTE only mode
3g set network mode preference as 3G only mode
2g set network mode preference as 2G only mode
usbmodem power cycle

power Set the power action on the modem (Default: enable)
cycle Cycle usbmodem power
usbmodem power enable

power Set the power action on the modem (Default: enable)
enable Enable usbmodem power
usbmodem resetdevice
resetdevice Reset the usbmodem device
usbmodem rssithreshold <number>

Set the RSSI (Received Signal Strength Indicator) threshold to determine when the USB
rssithreshold
modem signal strength LED indicates that the signal it receives is strong or weak
<number> Enter rssi threshold (Range: 125 ~ 1; Default: 82)
usbport power {auto|enable|disable}

usbport Set the USB port
power Set the power action for the USB port
Set to determine USB power enable/disable behavior automatically; if the system power
auto mode is for 802.3at or dc, the USB power is enabled and if it is for 802.3af, the USB
port is disabled
enable Enable the USB port power regardless of the system powermode 802.3af/at
disable Disable the USB port power
user <string>
user Add one user or change user parameters
user <string> group <string>

group Attach the user to a usergroup
<string> Enter the group name (132 chars)
user <string> password <string>

password Set the password for user
<string> Enter the secret string (863 chars)
usergroup <string>
usergroup Set user group parameters
usergroup <string> autogeneration bulknumber <number> bulkinterval <number> <time>

autogeneration Generate the password automatically
bulknumber Set the user number of the bulk group
<number> Enter the user number of the bulk group (Default: 1 ; Range: 19999)
bulkinterval Set the interval of the bulk group
<number> Enter the day interval of the bulk group (Default: 0 day; Range: 0365)
Enter the hour and minute interval of the bulk group(Format: hh:mm; Hour Range: 0023;
<time>
Minute Range: 0059)
usergroup <string> autogeneration indexrange <number> [ <number> ]

Set the index range for the users for whom you want to generate network access
indexrange
credentials (user name, password, and PSK)
Enter the start of the index range (Range: AP120/AP121/AP141/AP170/AP110=14096, Others
<number>
Platforms=19999)
Enter the end of the index range (Range: starting index number4096
<number>
(AP120/AP121/AP141/AP170/AP110), starting index number9999(Others Platforms))
usergroup <string> autogeneration location <string>
Set the user's physical location, which is combined with other factors (user name,
location
shared secret, ...) when generating the password automatically
<string> Enter the location (132 chars)
usergroup <string> autogeneration passwordlength <number>

passwordlength Set the length of the automatically generated password
<number> Enter the password length (Range: 863; Default: 8)
usergroup <string> autogeneration prefix <string>

prefix Set the prefix username for automatically generate password
<string> Enter the prefix (128 chars)
usergroup <string> autogeneration revokeuser <number> [ <number> ]

revokeuser Set the index range for the revoked users
<number> Enter the start of the index range (Range: 11024)
<number> Enter the end of the index range (Range: starting index number1024)
usergroup <string> autogeneration schedule <string>

schedule Bind a schedule to change password automatically by it
<string> Enter the name of the schedule (132 chars)
usergroup <string> autogeneration sharedsecret <string>

Set the shared secret that is combined with other factors (user name, location, ...)
sharedsecret
when generating the password automatically
usergroup <string> cachemode {temporary|mandatory}

cachemode Set usergroup cache mode
temporary Set usergroup cache mode to temporary
mandatory Set usergroup cache mode to mandatory
usergroup <string> expiredtime <date/time>

expiredtime Set the end of the time period during which the PSK is valid
Enter the date and time when the PSK expires (Format: YYYYMMDD/hh:mm:ss; Range: 1970
<date/time>
0101 to 20351231/hh (0023), mm (00059), ss (00059))
usergroup <string> passwordgenerationmethod {manual|auto}

passwordgeneration
Set password generation method for the user group
method
manual Set password generation method to manual
auto Set password generation method to auto
usergroup <string> pmkautosave

pmkautosave Enable automatically save PMK to flash
usergroup <string> pskformat characterpattern {letters|digits|specialcharacters}

pskformat Set the format parameters for creating individual user PSKs (preshared keys)
Set the types of characters that can be used in automatically generated and manually
characterpattern
configured PSKs and how the character types can be combined
letters Use letters in PSKs
digits Use digits in PSKs
specialcharacters Use special characters in PSKs
usergroup <string> pskformat combopattern {or|and|no}

combopattern Set the way in which various types of characters can be combined in PSKs
or Include one character type or a combination of different types in the PSKs (Default)
and Include a combination of all specified character types in the PSKs
Include one character type in the PSKs (Note: If you specify multiple character types
no and set this option, only letters are used, if specified. If not, then only digits are
used.)
usergroup <string> pskformat version {0|1}

version Set the algorithm version
0 Use old algorithm version (Default)
1 Use version 1 algorithm
usergroup <string> pskgenerationmethod usernameandpassword concatenatedcharacters <string>

Set the elements from which the private PSK will be derived: password only or username
pskgenerationmethod
and password
usernameandpassword Set privatePSK generation method to usernameandpassword
concatenated Set format for concatenating the characters in the PSK that comprises a user name and
characters password
Enter the characters used to concatenate the user name and password (Default: None;
<string>
Range: 18 chars)
usergroup <string> pskgenerationmethod {passwordonly|usernameandpassword}

Set the elements from which the private PSK will be derived: password only or username
pskgenerationmethod
and password
passwordonly Set privatePSK generation method to passwordonly (Default)
usernameandpassword Set privatePSK generation method to usernameandpassword
usergroup <string> reauthinterval <number>

reauthinterval Set an interval after which a user in an ongoing RADIUS session must reauthenticate
Enter the length of time in seconds before reauthentication (Default: 1800; Range: 600
<number>
86400, or 0 to remove the user reauthentication requirement)
usergroup <string> starttime <date/time>

starttime Set the start of the time period during which the PSK is valid
Enter the start date and time of the date (Format: YYYYMMDD/hh:mm:ss; Range: 197001
<date/time>
01 to 20351231/hh (0023), mm (00059), ss (00059))
usergroup <string> userattribute <number>

userattribute Set a RADIUS attribute or a range of attributes to the user group
<number> Enter a numeric value for a single RADIUS attribute (Default: none; Range: 04095)
usergroup <string> vlanid <number>

vlanid Set a VLAN ID for the user group
<number> Enter the default VLAN ID for the user group (Default: none; Range: 14094)
usergroup <string> voicedevice

Set the local device, when functioning as a RADIUS server, to return the voicedevice
voicedevice attribute when authenticating members of this user group (Note: This attribute is
required to support certain IP phones.)
userprofile <string> [ qospolicy <string> ] [ vlanid <number> ] [ mobilitypolicy <string> ] [

attribute <number> [ <number> ] ]
userprofile Set parameters for a user profile
qospolicy Assign QoS policy to the user profile
<string> Enter the QoS policy name (132 chars)
vlanid Set the default VLAN ID for the user profile
<number> Enter the default VLAN ID for the user profile (Range: 14094)
mobilitypolicy Assign mobility policy to the user profile
<string> Enter the mobility policy name (132 chars)
attribute Map a RADIUS attribute or a range of attributes to the user profile
Enter a numeric value for a single RADIUS attribute or the starting value for a range
<number>
(Range: 04095)
Set a range of RADIUS attributes
<number> Enter the ending value for a RADIUS attribute range (Range: 04095)
userprofile <string> cac airtimepercentage <number> [ sharetime ]

cac
calls
Set the percentage of airtime reserved for the VoIP calls of users belonging to the user
airtimepercentage
profile
<number> Enter the percentage (Range: 0100; Default: 0)
Enable the user profile to share any unused airtime with other user profiles (Default:
sharetime
Disabled)
userprofile <string> denyactionforschedule {ban|quarantine}

denyactionfor
Set the deny action for schedule (Default: ban)
schedule
Prevent the client from connecting to the AP permanently during the scheduled time frame
ban if not in the schedule (Note: If you ban a client, then you cannot grant that client
access to the AP afterward.)
Prevent the client from connecting to the network temporarily if not in the schedule
quarantine (Note: When you quarantine a client, then you can allow client traffic afterward by
changing the permissions from deny to permit.)
userprofile <string> ippolicydefaultaction {permit|deny|interstationtrafficdrop}

ippolicydefault
Set the IP policy default action for the user profile
action
permit Set the default action to permit
deny Set the default action to deny
userprofile <string> ippolicyredirecturl <string>

ippolicyredirecturl Set the redirect URL
<string> Enter the URL(max length is 256)
userprofile <string> l3tunnelaction {all|withexception|split|droptunneltraffic}
l3tunnelaction Set the behavior for routing traffic through Layer3 VPN tunnels (Default: split)
all Tunnel all outbound traffic to the VPN gateway
Tunnel all outbound traffic to the VPN gateway other than that listed as a Layer3 tunnel
withexception
exception
Tunnel traffic whose destination is the network behind the VPN gateway and forward all
split
other outbound traffic to the default gateway defined on the branch router
droptunneltraffic Drop all traffic whose destination is the network behind the VPN gateway
userprofile <string> macpolicydefaultaction {permit|deny}

macpolicydefault
Set the MAC policy default action for the user profile
action
permit Set the default action to permit
deny Set the default action to deny
userprofile <string> qosmarkermap {diffserv|8021p} <string>

qosmarkermap Assign a QoS markermap to the user profile
diffserv diffserv markermap
8021p 802.1p marker mapMap
<string> Enter the QoS markermap name (132 chars)
userprofile <string> schedule <string>

schedule Set a schedule during which the HiveAP will apply the user profile
userprofile <string> security deny {ipv4|ipv6}

security Set the security parameters for the user profile
deny Set the deny action to block IPv4 or IPv6 traffic belonging to the user profile
ipv4 Choose IPv4 traffic to block
ipv6 Choose IPv6 traffic to block
userprofile <string> security ippolicy [ fromaccess <string> ] [ toaccess <string> ]

Apply Layer 3 IP firewall policies to traffic belonging to the user profile that is
ippolicy
received and transmitted on an access interface
fromaccess Set the IP policy for traffic from wired or wireless clients
<string> Enter the name of a previously defined IP firewall policy
toaccess
Set the IP policy for traffic transmitted to wired or wireless clients
<string> Enter the name of a previously defined IP firewall policy
userprofile <string> security macpolicy [ fromaccess <string> ] [ toaccess <string> ]
Apply Layer 2 MAC firewall policies to traffic belonging to the user profile that is
macpolicy
received and transmitted on an access interface
fromaccess Set the MAC policy for traffic from wired or wireless clients
<string> Enter the name of a previously defined MAC firewall policy
toaccess Set the MAC policy for traffic transmitted to wired or wireless clients
<string> Enter the name of a previously defined MAC firewall policy
userprofile <string> tunnelpolicy <string>

tunnelpolicy Set the tunnel policy to apply to traffic belonging to members of the user profile
<string> Enter the name of the tunnel policy name (132 chars)
userprofile <string> vlangroup <string>

vlangroup Set the VLAN group for the user profile
<string> Enter the VLAN group name (132 chars)
userprofile <string> {after|before} <string>

after Move the user profile after another user profile
before Move the user profile before another user profile
userprofile <string> {performancesentinel} action {log|boost}

action Set an action to take in response to a performance sentinel violation
log Generate a log entry about the performance sentinel violation (Default: Log)
Increase the performance available for clients so they can obtain their minimum
boost
guaranteed bandwidth (Default: Log)
userprofile <string> {performancesentinel} enable

enable Enable performance sentinel (Default: Disabled)
userprofile <string> {performancesentinel} guaranteedbandwidth <number>

guaranteedbandwidth Set the minimum guaranteed bandwidth per user
<number> Enter the minimum guaranteed bandwidth (Default: 500 Kbps; Range: 100500000)
userprofilepolicy <string>
userprofilepolicy <string> actionforupidchange {switch|sustain|ignore}

actionforupidchange Set the process used to change the user profile attribute ID (Default: ignore)
Change the user profile ID immediately, and if the VLAN must be changed, then disconnect
switch
the station from the network
Change the user profile ID immediately, but do not change the VLAN until the managed
sustain
mobile device reconnects to the network
Do not change the user profile ID nor the VLAN until the managed mobile device
ignore
reconnects to the network
userprofilepolicy <string> mdmtimeout <number>

mdmtimeout Set the time span during which an MDM query remains valid
<number> Enter the timeout in seconds (Range: 1300; Default: 10)
userprofilepolicy <string> rule <number> authattrs <string>

rule Set a rule for user profile mapping policy
<number> Enter the rule number (Range: 116)
Set the attribute value list that the authentication process must return for this test
authattrs
condition to be true
<string> Enter auth user profile attribute ID list (132 chars)
userprofilepolicy <string> rule <number> devicelocation <string>

Set the device location value that must match the value contained in the location field
devicelocation
of the device for this test condition to be true
<string> Enter the device location (1128 chars)
userprofilepolicy <string> rule <number> groupname <string>

Set the group name that the authentication process must return for this test condition
groupname
to be true
<string> Enter group name (132 chars)
userprofilepolicy <string> rule <number> macobject <string>

<string> Enter a policy name (132 chars
Set the MAC object name that the authentication process must return for this test
macobject
<string> Enter MAC object name (132 chars)
userprofilepolicy <string> rule <number> mdmobject <string>

mdmobject Set the value that must match the configured MDM object name
<string> Enter the MDM object name (132 chars)
userprofilepolicy <string> rule <number> osobject <string>

Set the OS object name that the authentication process must return for this test
osobject
<string> Enter OS object name (132 chars)
userprofilepolicy <string> rule <number> timeobject <string>

timeobject Set the time object name
<string> Enter the time object name (132 chars)
userprofilepolicy <string> rule <number> userprofileattrid <number>

Set the new attribute number to which the user profile changes if the tests of this rule
userprofileattrid
match the actual network conditions
<number> Enter a user profile attribute ID (Range: 04095)
vlangroup <string> <number> [ <number> ]

vlangroup Set a VLAN group
<string> Enter the VLAN group name (132 chars)
Add a VLAN ID to the group (Range: 14094; Note: If you are defining a range of VLANs,
<number>
this is the starting point of that range.)
<number> Enter the last VLAN ID in the range (Range: 14094)
vpn clientippool <string> local <ip_addr> <ip_addr> netmask <ip_addr>

vpn Set parameters for VPN (virtual private network) tunneling
Set an IP pool from which the HiveAP assigns addresses to VPN clients (Note: Only set
clientippool this command on a HiveAP acting as a VPN server.)
<string> Enter the client IP pool name (132 chars)

local Set the client IP pool on the local HiveAP
<ip_addr> Enter the IP address at the start of the address range in the pool
<ip_addr> Enter the IP address at the end of the address range in the pool
netmask Set the netmask for the IP addresses in the pool
<ip_addr> Enter the netmask
vpn ipsectunnel <string> clientlist <string> [ clientippool <string> dnsserver <ip_addr> ]

ipsectunnel Set IPsec tunnel parameters
<string> Enter the name of the IPsec tunnel entry (132 chars)
clientlist Specify a list of VPN clients to check during Xauth authentication
<string> Enter the name of the VPN client list (132 chars)
Specify the VPN client IP pool used when assigning an IP address to the tunnel interface
clientippool on a VPN client (Note: This is required for a layer2 VPN and optional for a layer3
VPN.)
<string> Enter the name of the IP pool (132 chars)
Set the DNS server address that VPN clients can use to resolve domain names on the VPN
dnsserver server network (Note: This is required for a layer2 VPN and optional for a layer3
VPN.)
<ip_addr> Enter the IP address of the DNS server
vpn ipsectunnel <string> dpd idleinterval <number> retry <number> retryinterval <number>
dpd Set DPD (Dead Peer Detection) parameters for the IPsec tunnel
idleinterval Set the interval for sending DPD RUThere messages
<number> Enter the interval in seconds (Range: 065535; Default: 10; Note: 0 disables DPD)
Set the number of times to retry sending a DPD RUThere message when it does not elicit
retry
a response
<number> Enter the number of messages to retry sending (Range: 165535; Default: 5)
retryinterval Set the interval for resending DPD RUThere messages
<number> Enter the retry interval in seconds (Range: 160; Default: 3)
vpn ipsectunnel <string> gateway <ip_addr> clientname <string> password <string>

Set the address of the IKE gateway at the server end of the VPN tunnel (Note: Only
gateway
define an IKE gateway on VPN clients.)
<ip_addr> Enter an IKE gateway address
Set the name that the VPN client uses to authenticate itself to the VPN server using
clientname
Xauth
<string> Enter the client name (832 chars)
Set password that the VPN client uses to authenticate itself to the VPN server using
password
Xauth
<string> Enter the password string (1632 chars)
vpn ipsectunnel <string> ike phase1 authmethod {hybrid|rsasig|psk}

ike Set IKE (Internet Key Exchange) parameters
phase1 Set IKE phase 1 parameters
authmethod Set the authentication method for IKE phase 1 negotiations
Set peer authentication in hybrid mode (Default: Hybrid mode, in which the VPN server
hybrid authenticates itself with an RSA signature and the client authenticates itself through
Xauth.)
Set both VPN peersserver and clientto authenticate themselves with RSA signatures
rsasig
(Default: Hybrid mode)
psk Set both VPN peersserver and clientto authenticate themselves with a preshared key
vpn ipsectunnel <string> ike phase1 dhgroup {group1|group2|group5}

dhgroup Set the DiffieHellman group for generating a shared key during phase 1 negotiations
group1 Use DiffieHellman group 1 (Default: DiffieHellman group 2)
vpn ipsectunnel <string> ike phase1 mode {main|aggressive}

mode Set the mode of IKE phase1
main Main mode performs three twoway exchanges totaling six packets
aggressive two exchanges take place totaling three packets
vpn ipsectunnel <string> ike phase1 psk <string>

psk Set the preshared key used for VPN peer authentication
<string> Enter the preshared key string (1128 chars)
vpn ipsectunnel <string> ike phase2 pfsgroup {nopfs|group1|group2|group5}

pfsgroup Set the PFS (perfect forward secrecy) parameters for phase 2 negotiations
Do not perform a second DiffieHellman key exchange during phase 2 negotiations
nopfs
(Default: DiffieHellman group 2)
vpn ipsectunnel <string> ike {phase1|phase2} encryptionalgorithm {3des|aes128|aes192|aes256}

encryptionalgorithm Set the encryption algorithm
Use 3DES (Triple DES, Data Encryption Standard) as the encryption algorithm (Default:
3des
AES128)
Use AES (Advanced Encryption Standard) with a 128bit key as the encryption algorithm
aes128
(Default: AES128)
aes192 Use AES with a 192bit key as the encryption algorithm (Default: AES128)
aes256 Use AES with a 256bit key as the encryption algorithm (Default: AES128)
vpn ipsectunnel <string> ike {phase1|phase2} hash {md5|sha1}

hash Set the IKE hash algorithm
md5 Use MD5 (Message Digest, version 5) as the hash algorithm (Default: SHA1)
sha1 Use SHA1 (Secure Hash Algorithm) as the hash algorithm (Default: SHA1)
vpn ipsectunnel <string> ike {phase1|phase2} lifetime <number>

Set the SA (security association) lifetime (Note: Before the SA expires, the
lifetime
authentication and encryption keys are automatically refreshed with new ones.)
Enter the SA expiration time in seconds (Range: 18010000000;Phase 1 Default: 86400;
<number>
Phase 2 Default: 3600 )
vpn ipsectunnel <string> localikeid {asn1dn|address|fqdn|ufqdn|keyid} <string>

localikeid Set the IKE identity for the local HiveAP
Set the IKE identity type as an ASN.1 DN (Abstract Syntax Notation One Distinguished
asn1dn
Name; Example: C=US, ST=CA, L=SF, O=Aerohive, OU=Sales, CN=PaulSmith)
address Set the IKE identity type as an IP address (Example: 10.1.1.5)
Set the IKE identity type as an FQDN (fully qualified domain name; Example:
fqdn
www.aerohive.com)
ufqdn Set the IKE identity type as a user FQDN (Example: psmith@aerohive.com)
keyid Set the IKE identity type as a keyid (Example: tunnelgroupname as test)
Enter the IP address, or user FQDN (email address), or FQDN, or ASN.1 DN (1128 chars)
<string>
or KEYID (132 chars)
vpn ipsectunnel <string> natpolicy <string>

natpolicy Enable NAT (network address translation) policy on the interface
vpn ipsectunnel <string> nattraversal enable

nattraversal Set the VPN to be able to traverse NAT devices encountered along its data path
enable Enable NAT traversal (Default: Enabled)
vpn ipsectunnel <string> peerikeid {asn1dn|address|fqdn|ufqdn} <string>

peerikeid Set IKE identity for the remote VPN peer
Set the IKE identity type as an ASN.1 DN (Abstract Syntax Notation One Distinguished
asn1dn
Name; Example: C=US, ST=CA, L=SF, O=Aerohive, OU=Sales, CN=PaulSmith)
address Set the IKE identity type as an IP address (Example: 10.1.1.5)
Set the IKE identity type as an FQDN (fully qualified domain name; Example:
fqdn
www.aerohive.com)
ufqdn Set the IKE identity type as a user FQDN (Example: psmith@aerohive.com)
<string> Enter the IP address, or user FQDN (email address), or FQDN, or ASN.1 DN (1128 chars)
vpn l3tunnelexception <ip_addr|ip_addr/mask|string>

Set a destination to which outbound traffic is forwarded to the default gateway on the
branch router instead of being tunneled to the VPN gateway (Note: Only set a layer3
l3tunnelexception
tunnel exception if all outbound traffic is being tunneled but you want to forward
traffic directly to just a few select locations.)
Enter the domain name or host name (132 chars) or the IP address of the destination or
<ip_addr>
the subnet of the destination
<ip_addr/netmask>
<string>
vpn tunnelpolicy <string> client ipsectunnel <string> [ primary ]

tunnelpolicy Set the IPsec tunnel policy
<string> Enter a tunnel policy name (132 chars)
client Set the tunnel policy for a VPN client
ipsectunnel Set the IPsec tunnel entry to use in the tunnel policy
<string> Enter the IPsec tunnel entry name (132 chars)
primary Set the VPN entry as the primary VPN gateway
vpn tunnelpolicy <string> password <string>
Set the password for the GRE tunnel check (Note: The password on the server and client
password
must match for the GRE tunnel check to succeed.)
vpn tunnelpolicy <string> server ipsectunnel <string>

server Set the tunnel policy for a VPN server
ipsectunnel Set the IPsec tunnel entry to use in the tunnel policy
<string> Enter the IPsec tunnel entry name (132 chars)
vpn xauthclientlist <string> clientname <string> password <string>

xauthclientlist Set a list of VPN client names and passwords for Xauth
<string> Set a VPN client list name
clientname Set a VPN client name
<string> Enter the VPN client name (132 chars)
password Set the password for the VPN client
vpn xauthclientlist <string> local

xauthclientlist Set a list of VPN client names and passwords for Xauth
<string> Set a VPN client list name
local Set the location of the client list on the local HiveAP (Default: local)
vpn {clientipsectunnel|serveripsectunnel} <string> [ vpnmode {layer2|layer3} ]

clientipsectunnel Set the local HiveAP as a client that builds an IPsec tunnel to the VPN server
serveripsectunnel Set the local HiveAP as the VPN server to which remote HiveAPs build IPsec tunnels
<string> Enter the name of a VPN tunnel entry (132 chars)
Set the packetforwarding mode of the VPN tunnel (Default: Use a layer 2 packet
vpnmode
forwarding mechanism)
layer2 Forward packets through the VPN tunnel based on MAC (layer 2) tunnel policies
layer3 Forward packets through the VPN tunnel based on IP (layer 3) routing decisions
webdirectory <string> linktoresources <string> <string>

webdirectory Create a web directory for the internal web server
Enter the name of the web directory to store files used by a captive web portal or, when
<string>
preceded by "ppskselfreg", for use with private PSK selfregistration (132 chars)
Create a link to a web directory whose content can be shared by all captive web portals
linktoresources
or to a specific file in that shared directory
Enter the name of the link (Max: 32 chars; Note: Each web directory includes a default
<string>
link called "shared" that points to a predefined directory named "shared".)
<string> Enter the name of the target directory (Max: 32 chars; Example: shared)
webdirectory [ {ppskselfreg} ] <string>

webdirectory Create a web directory for the internal web server

Create a web directory for the private PSK server to use when receiving self
ppskselfreg
registration requests
Enter the name of the web directory to store files used by a captive web portal or, when
<string>
preceded by "ppskselfreg", for use with private PSK selfregistration (132 chars)
websecurityproxy clientinfocollection enable

Proxy HTTP and HTTPS traffic bound for the Internet to a web security server for
websecurityproxy
filtering
clientinfocollection Collect client information and send it DNS server
enable Enable the client information collection function (Default: Disabled)
websecurityproxy websensev1 accountkey <string>

websecurityproxy
filtering
websensev1 Use the Websense web filtering solution
accountkey Set the encryption key for your Websense customer account
<string> Enter the key (32 chars)
websecurityproxy {websensev1|barracudav1} accountid <string>

websecurityproxy
filtering
barracudav1 Use the Barracuda Networks web filtering solution
accountid Set the customer account ID for the web security service
<string> Enter the account ID (164 chars)
websecurityproxy {websensev1|barracudav1} defaultdomain <string>

websecurityproxy
filtering
Set the default domain to send to the web security server when a domain cannot be
defaultdomain
retrieved from the user authentication process
websecurityproxy {websensev1|barracudav1} defaultusername <string>

websecurityproxy
filtering
Set the default user name to send to the web security server when a name cannot be
defaultusername retrieved from the user authentication process (Note: The server uses the account ID and
user name to determine which filtering policy to apply.)
websecurityproxy {websensev1|barracudav1} enable

websecurityproxy
filtering
Enable the proxying of HTTP and HTTPS sessions to a web security server (Default:
enable
Disabled)
websecurityproxy {websensev1|barracudav1} httpproxyhost <string>
websecurityproxy
filtering
Set the domain name or IP address of the web security server to which HTTP packets are
httpproxyhost
proxied
<string> Enter the domain name or IP address of the server (164 chars)
websecurityproxy {websensev1|barracudav1} httpproxyport <port>

websecurityproxy
filtering
httpproxyport Set the port number to which HTTP packets are proxied for web filtering
<port> [1~65535]Enter the port number (Range: 165535; Default: 8080)
websecurityproxy {websensev1|barracudav1} httpsproxyhost <string>

websecurityproxy
filtering
Set the domain name or IP address of the web security server to which HTTPS packets are
httpsproxyhost
proxied
<string> Enter the domain name or IP address of the server (164 chars)
websecurityproxy {websensev1|barracudav1} httpsproxyport <port>

websecurityproxy
filtering
httpsproxyport Set the port number to which HTTPS packets are proxied for web filtering
<port> [1~65535]Enter the port number (Range: 165535; Default: 8443)
websecurityproxy {websensev1|barracudav1} subnet <ip_addr/netmask> [ actionifunreachable

{allow|block} ]
websecurityproxy
filtering
subnet Set the subnet from which HTTP and HTTPS traffic are proxied for web filtering
<ip_addr/netmask> Enter the IP address/netmask for the source subnet
Set the action if connectivity from this subnet to the web security server is lost
actionifunreachable
(Default: Block unfiltered HTTP and HTTPS traffic)
Allow unfiltered outbound HTTP and HTTPS traffic if connectivity to the web security
allow
server is lost
Block unfiltered outbound HTTP and HTTPS traffic if connectivity to the web security
block
server is lost
websecurityproxy {websensev1|barracudav1} whitelist <string>

websecurityproxy
filtering
Set the FQDN or domain suffix for destinations to which HTTP packets will not be proxied
whitelist
(Note: The whitelist can have up to 32 entries.)
<string> Enter the FQDN or domain name suffix to be added to the whitelist (164 chars)
Accessing and Using the CLI
Through the Aerohive CLI, you can log in to a HiveAP and perform the following operations:
Configure firmware features and hardware components

View settings
View and clear dynamically generated data
Update firmware
Save a configuration to and from the device
Reset the device
To access the CLI, you can make a direct serial connection through the console port (on HiveAP models that have one) or a Telnet or SSH
connection over the network through the Ethernet interface or an SSID on a Wifi subinterface to the mgt0 interface. Each method is
described in the following sections:
Using the Console Port

Using Telnet
Using SSH
For an introduction to the CLI and some useful tips, see the following sections:
Using the Aerohive CLI

Exploring the CLI
Searching for a Text String
Filtering Command Output
Using Command Line Completion
Useful Keyboard Shortcuts
Using the Console Port
You can make a direct serial connection from your management system to the HiveAP and log in to the CLI. For details and pin assignments,
see the Aerohive Deployment Guide. Follow these steps:
1. Connect the power cable to the HiveAP and turn on the power.
2. Depending on the HiveAP model, connect one end of an RS‐232 (or "null modem") serial cable or an RJ‐45‐to‐DB‐9 serial cable to the
serial port (or Com port) on your management system.
3. Connect the other end of the cable to the console port on the HiveAP.
4. On your management system, run a VT100 terminal emulation program, such as Tera Term Pro (a free terminal emulator) or Hilgraeve
Hyperterminal (provided with Windows operating systems). Use the following settings:
Bits per second (baud rate):9600

Data bits: 8
Parity: none
Stop bits: 1
Flow control: none
5. Press the ENTER key to see the login prompt.

6. Log in using the default user name admin and passwordaerohive.
Using Telnet
You can make a Telnet connection from your management system to the HiveAP across an Ethernet or WiFi network (or even just across an
Ethernet cable between your management system and the HiveAP). Because Telnet uses a client/server relationship, you need a Telnet
client on your management system. (All Windows operating systems include a Telnet client.) The client connects to the Telnet server on
the HiveAP using TCP port 23.
Because a Telnet connection requires that the HiveAP already have an IP address, you must first make a serial connection to the device and
assign it an address using the interface command:
interface mgt0 ip_addr netmask
where ip_addr netmask define an address on the network that is accessible from your management system. See "Using the Console Port".
By default, Telnet manageability is disabled on HiveAPs. You must first access the HiveAP by another means‐ console, SSH, HiveManager, or
a management AP‐and enable it. Use the following commands to enable Telnet through an Ethernet interface and through an SSID (for
wireless Telnet access):
interface { eth0 | eth1 } manage telnet
ssid <string> manage telnet
1. With the HiveAP connected to a power source, connect an Ethernet cable from the Ethernet port on the HiveAP to a switch that is on
the same network as your management system. Optionally, you can connect the Ethernet cable from the HiveAP directly to your
management system.
Note: Because the Ethernet port on the HiveAP is autosensing, the cable can have either straight‐through or cross‐over wiring. For
details, see the Aerohive Deployment Guide.
After you have created an SSID and enabled Telnet access to the mgt0 interface through that SSID, you can form a wireless association with
the HiveAP and use Telnet to access the CLI wirelessly.
2. On your management system, run the Telnet client and connect to the Telnet server on the HiveAP. In Windows, for example, do the
following:
1. Click Start > Run.
2. In the command prompt, type telnet, and then click OK.
The following appears:
Welcome to Microsoft Telnet Client
Escape Character is 'CTRL+]'
Microsoft Telnet>
3. At the Microsoft Telnet> prompt, enter the IP address of the mgt0 interface, and then press Enter. The Telnet client on the
management system connects to the Telnet server on the HiveAP. The login prompt appears.
3. Log in using your user name and password. The default user name is admin and the default password is aerohive.
Using SSH
You can make an SSH2 (Secure Shell version 2) connection from an SSH client on your management system to the SSH server on the HiveAP
across an Ethernet or WiFi network. SSH allows you to open a remote command shell securely and run commands on the SSH server. You
need an SSHv2 client, such as puTTY (a free SSHv2 client), on your management system. The client connects to the SSHv2 server on the
HiveAP using TCP port 22.
Because an SSH connection requires that the HiveAP already have an IP address, you must first make a serial connection to the device and
assign it an address using the interface command:
interface mgt0 ip_addr netmask
where ip_addr netmask define an address on the network that is accessible from your management system. See "Using the Console Port".
By default, SSH manageability is enabled on Ethernet interfaces and SSIDs.
1. With the HiveAP connected to a power source, connect an Ethernet cable from the Ethernet port on the HiveAP to a switch that is on
the same network as your management system. Optionally, you can connect the Ethernet cable from the HiveAP directly to your
management system.
Note: Because the Ethernet port on the HiveAP is autosensing, the cable can have either straight‐through or cross‐over wiring. For
details, see the Aerohive Deployment Guide.
After you have created an SSID, you can form a wireless association with the HiveAP and use SSH to access the CLI wirelessly.
2. On your management system, run the SSHv2 client and connect to the SSHv2 server on the HiveAP. Using puTTY, for example, do the
following:
1. Launch puTTY, and then click Session in the Category menu tree.
2. In the Host Name (or IP address) field, enter the IP address of the mgt0 interface, and then select SSH.
3. Click SSH in the Category menu tree, and make sure that the Preferred SSH protocol version is 2 or 2 only.
4. To initiate an SSH connection to the HiveAP, click Open.
The SSH client on the management system connects to the SSH server on the HiveAP. The login prompt appears.
3. Log in using your user name and password. The default user name is admin and the default password is aerohive.
Using the Aerohive CLI
There are three main types of commands in the Aerohive CLI:
keyword commands for setting various parameters. Examples are the admin and interface commands.
show commands for displaying parameters or dynamically generated data. Examples are the show service and show memory
commands.
action commands for executing some type of action. Examples are ping, save, and reboot commands.
Exploring the CLI
To see a list of commands, and their accompanying CLI Help, type a question mark ( ? ). For example, to display all the keyword and action
commands, enter a question mark at the command prompt:
aerohive#?

access‐console Set access console parameters
admin Set administrators and passwords
... ...
To display all the show commands, enter the following:
aerohive#show ?

access‐console Show access console status and parameters
acsp Show parameters for ACSP (Aerohive Channel Selection Protocol)
... ...
To see all the commands beginning with a particular character or string of characters, enter the character or character string followed
immediately by a question mark; that is, do not include a space between the last character and the question mark. For example, to see all
the commands beginning with "a", enter the following:
aerohive#a?

access‐console Set access console parameters
admin Set administrators and passwords
Similar to the above methods for seeing lists of commands, you can use a question mark within commands to see subsequent choices. For
example, to see the options following clock, enter the following:
aerohive#clock ?
date‐time Set the date and time for the internal clock
time‐zone Set the time zone for the internal clock
Searching for a Text String
If you want to find a command that uses a particular character or string of characters, you can do a search using the following command:
show cmds | include string
where string is the word or string of characters you want to find. For example, if you want to see all the commands in which the word
"enable" appears, enter the following:
aerohive#show cmds | include enable
qos enable
qos airtime enable
...
Searching for just the string of letters "ena" produces similar results:
aerohive#show cmds | include ena
qos enable
qos airtime enable
Note: You can search for more than one word by enclosing them within quotation marks. For example, you can do a search for "qos class"
to see the commands containing "qos classifier".
Filtering Command Output
You can filter the output of a show command to include or exclude certain text strings. To do this use the following syntax: show cmd | {
exclude | include } string. For example, to find the MAC address 0016:cf8d:56bc among a number of associated stations in SSID "west",
enter the following command:
aerohive#show ssid west stations | include 0016:cf8d:56bc

0016:cf8d:56bc 11 1M 68 8021x aes ccm00:21:17 1 Yes
If you want to filter a space‐separated string, put the string within quotation marks. For example, to filter a MAC address ending with "20"
on the eth0 interface, enter the following:
aerohive#show route | include "0 4096"

0019:770e:55a0 0019:770e:5580 wifi1.1 0 4096 IL
Using Command Line Completion
The Aerohive CLI supports command line completion (or "tab completion"), which allows you to complete the remainder of an unambiguous
word by pressing the TAB key. For example:
aerohive#show qos co (Press TAB here.)
aerohive#show qos counter (The word "counter" is automatically completed.)
If the remainder of the word is ambiguous, pressing TAB twice shows the possibilities. For example:
aerohive#show qos c (Press TAB here.)
aerohive#show qos c (Press TAB again.)
aerohive#show qos c
classifier‐map classifier‐profile counter (The three subsequent choices appear.)
Useful Keyboard Shortcuts
The following keyboard commands are useful to know and can make your work with the CLI more efficient. Note that the plus sign ( + )
indicates that both keys must be pressed simultaneously. For example, CTRL + s means "press the CTRL key and the s key at the same
time". If there is no plus sign between adjacent key names, press them sequentially. For example, ESC b means "press the ESC key and then
press the b key".
To perform this task Press this key or key combination

Lock the console CTRL + s
Unlock the console CTRL + q
Stopping the display of output, such as the output of the show log
q
buffered command
Advance the display of lengthy output, such as the output from the
ENTER
show logging messages command, by one line
Advance the display of lengthy output by sets of multiple lines at a
TAB
time
Autocomplete an unambiguous keyword when typing a command TAB
Stopping the execution of a task, such as sending ICMP echo requests CTRL+c
UP ARROW or CTRL + p (to move backward) and DOWN ARROW or
Moving backward or forward through command history
CTRL + n (to move forward)
LEFT ARROW or CTRL + b (to move backward) and RIGHT ARROW or
Moving backward or forward in a command
CTRL + f (to move forward)
Move the cursor backward or forward through a command word by
ESC b (to move backward) and ESC f (to move forward)
word
CTRL + a (to move to the beginning) and CTRL + e (to move to the
Move the cursor to the beginning or end of a command
end)
Erase the character under the cursor CTRL + d
Erase the character to the left of the cursor BACKSPACE or CTRL + h
Erase the previous word CTRL + w
Erase everything on the line to the left of the cursor CTRL + u
Erase everything on the line under and to the right of the cursor CTRL + k
Reverse the last two characters in a command; for example, to
CTRL + t
change show ssdi to show ssid
Execute a command ENTER or CTRL + j or CTRL + m
Log out of the console session CTRL + \
Copyright © 2012 Aerohive Networks, Inc.

OTROS - Aerohive CLI Guide

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

OTROS - Aerohive CLI Guide

Uploaded by

Copyright:

Available Formats

27/4/2016 Aerohive CLI Guide

802.1x­mac­table expire­time <number>

802.1x­mac­table expire­time <number>

802.1x­mac­table suppress­interval <number>

aaa attribute NAS­Identifier <string>

aaa attribute Operator­Name namespace­id <number>

namespace­id Set the namespace ID parameter of the Operator­Name (Default: realm)

aaa attribute Operator­Name namespace­id {TADIG|REALM|E212|ICC}

aaa attribute Operator­Name value <string>

aaa attribute user­profile­attribute vendor­id <number> attribute­id <number>

aaa mac­format case­sensitivity {lower­case|upper­case}

upper­case Use uppercase formatting (Example: 01AB23CD45EF; Default: lower­case)

aaa mac­format style {two­delimiter|five­delimiter|no­delimiter}

aaa ppsk­server auto­save­interval <number>

aaa ppsk­server radius­server {primary|backup1|backup2|backup3} <ip_addr|string> [ shared­secret

aaa radius­server account­interim­interval <number>

aaa radius­server accounting {primary|backup1|backup2|backup3} <ip_addr|string> [ shared­secret

aaa radius­server dynamic­auth­extension

aaa radius­server inject Operator­Name

aaa radius­server keepalive enable

aaa radius­server keepalive interval <number>

aaa radius­server keepalive retry <number>

aaa Set parameters for AAA (authentication, authorization, accounting)

aaa radius­server keepalive retry­interval <number>

aaa radius­server keepalive username <string> password <string>

aaa radius­server local acct­enable

aaa radius­server local attr­map group­attr­name <string>

aaa radius­server local attr­map reauth­attr­name <string>

aaa radius­server local attr­map user­profile­attr­name <string>

aaa radius­server local attr­map vlan­attr­name <string>

aaa radius­server local cache lifetime <number>

aaa radius­server local concurrent­session age­timeout <number>

aaa radius­server local concurrent­session limit <number>

aaa radius­server local db­type active­directory {primary|backup1|backup2|backup3} computer­ou

aaa radius­server local db­type active­directory {primary|backup1|backup2|backup3} domain <string>

aaa radius­server local db­type active­directory {primary|backup1|backup2|backup3} domain <string>

aaa radius­server local db­type active­directory {primary|backup1|backup2|backup3} domain <string>

aaa radius­server local db­type active­directory {primary|backup1|backup2|backup3} login admin­user

aaa radius­server local db­type active­directory {primary|backup1|backup2|backup3} {server} <string> [

aaa radius­server local db­type active­directory {primary|backup1|backup2|backup3} {tls­enable|global­

aaa radius­server local db­type ldap­server sub­type edirectory

aaa radius­server local db­type ldap­server sub­type edirectory acct­policy­check

aaa radius­server local db­type ldap­server {primary|backup1|backup2|backup3} basedn <string>

aaa radius­server local db­type ldap­server {primary|backup1|backup2|backup3} binddn <string> password

db­type Set the type and location of the user database

aaa radius­server local db­type ldap­server {primary|backup1|backup2|backup3} filter­attr <string>

aaa radius­server local db­type ldap­server {primary|backup1|backup2|backup3} no­strip­filter

aaa radius­server local db­type ldap­server {primary|backup1|backup2|backup3} port <number>

aaa radius­server local db­type ldap­server {primary|backup1|backup2|backup3} {server} <string> [

aaa radius­server local db­type library­sip­server {primary} institution­id <string>

aaa radius­server local db­type library­sip­server {primary} login­enable

aaa radius­server local db­type library­sip­server {primary} port <port>

aaa radius­server local db­type library­sip­server {primary} separator <string>

aaa radius­server local db­type library­sip­server {primary} {server} <string>

aaa radius­server local db­type open­directory {primary|backup1|backup2|backup3} admin­user <string>

aaa radius­server local db­type open­directory {primary|backup1|backup2|backup3} domain <string>

aaa radius­server local db­type open­directory {primary|backup1|backup2|backup3} domain <string>

aaa radius­server local db­type open­directory {primary|backup1|backup2|backup3} filter­attr <string>

aaa radius­server local db­type open­directory {primary|backup1|backup2|backup3} no­strip­filter

aaa radius­server local db­type open­directory {primary|backup1|backup2|backup3} tls­enable

aaa radius­server local ldap­auth {primary|backup1|backup2|backup3} type tls ca­cert <string> [

aaa radius­server local library­sip­policy <string>

aaa radius­server local local­check­period <number>

aaa radius­server local nas <string> shared­key <string>

802.1xmactable expiretime <number>

802.1xmactable expiretime <number>

802.1xmactable suppressinterval <number>

aaa attribute NASIdentifier <string>

aaa attribute OperatorName namespaceid <number>

namespaceid Set the namespace ID parameter of the OperatorName (Default: realm)

aaa attribute OperatorName namespaceid {TADIG|REALM|E212|ICC}

aaa attribute OperatorName value <string>

aaa attribute userprofileattribute vendorid <number> attributeid <number>

aaa macformat casesensitivity {lowercase|uppercase}

uppercase Use uppercase formatting (Example: 01AB23CD45EF; Default: lowercase)

aaa macformat style {twodelimiter|fivedelimiter|nodelimiter}

aaa ppskserver autosaveinterval <number>

aaa ppskserver radiusserver {primary|backup1|backup2|backup3} <ip_addr|string> [ sharedsecret

aaa radiusserver accountinteriminterval <number>

aaa radiusserver accounting {primary|backup1|backup2|backup3} <ip_addr|string> [ sharedsecret

aaa radiusserver dynamicauthextension

aaa radiusserver inject OperatorName

aaa radiusserver keepalive enable

aaa radiusserver keepalive interval <number>

aaa radiusserver keepalive retry <number>

aaa radiusserver keepalive retryinterval <number>

aaa radiusserver keepalive username <string> password <string>

aaa radiusserver local acctenable

aaa radiusserver local attrmap groupattrname <string>

aaa radiusserver local attrmap reauthattrname <string>

aaa radiusserver local attrmap userprofileattrname <string>

aaa radiusserver local attrmap vlanattrname <string>

aaa radiusserver local cache lifetime <number>

aaa radiusserver local concurrentsession agetimeout <number>

aaa radiusserver local concurrentsession limit <number>

aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} computerou

aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} domain <string>

aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} domain <string>

aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} domain <string>

aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} login adminuser

aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} {server} <string> [

aaa radiusserver local dbtype activedirectory {primary|backup1|backup2|backup3} {tlsenable|global

aaa radiusserver local dbtype ldapserver subtype edirectory

aaa radiusserver local dbtype ldapserver subtype edirectory acctpolicycheck

aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} basedn <string>

aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} binddn <string> password

dbtype Set the type and location of the user database

aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} filterattr <string>

aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} nostripfilter

aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} port <number>

aaa radiusserver local dbtype ldapserver {primary|backup1|backup2|backup3} {server} <string> [

aaa radiusserver local dbtype librarysipserver {primary} institutionid <string>

aaa radiusserver local dbtype librarysipserver {primary} loginenable

aaa radiusserver local dbtype librarysipserver {primary} port <port>

aaa radiusserver local dbtype librarysipserver {primary} separator <string>

aaa radiusserver local dbtype librarysipserver {primary} {server} <string>

aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} adminuser <string>

aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} domain <string>

aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} domain <string>

aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} filterattr <string>

aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} nostripfilter

aaa radiusserver local dbtype opendirectory {primary|backup1|backup2|backup3} tlsenable

aaa radiusserver local ldapauth {primary|backup1|backup2|backup3} type tls cacert <string> [

aaa radiusserver local librarysippolicy <string>

aaa radiusserver local localcheckperiod <number>

aaa radiusserver local nas <string> sharedkey <string>

aaa radiusserver local port <number>

aaa radiusserver local remotecheckperiod <number>

aaa radiusserver local requiremessageauthenticator

aaa radiusserver local retryinterval <number>

aaa radiusserver local sharedsecretautogen

aaa radiusserver local staauth defaulttype {leap|peap|tls|ttls|md5}

aaa radiusserver local staauth type tls {checkcertcn|checkindb}

aaa radiusserver local staauth type {leap|peap|tls|ttls|md5}

aaa radiusserver local usergroup <string>

aaa radiusserver local {enable|cache}

aaa radiusserver name <string> acctport <port>

aaa radiusserver name <string> authport <port>

aaa radiusserver name <string> server <string> sharedsecret <string>

aaa radiusserver name <string> server <string> tls

aaa radiusserver name <string> tlsport <port>

aaa radiusserver proxy deadtime <number>

aaa radiusserver proxy inject operatorname

aaa radiusserver proxy radsec acctport <port>