Huawei VRP

This page covers administrative access on Huawei VRP switches over HWTACACS — Huawei’s TACACS+ implementation. It is the device-side counterpart to TACACS+.

VRP structures AAA differently from Cisco. Instead of attaching method lists directly to lines, you build named schemes (authentication, authorization, accounting, recording), bind them to a domain, and point the VTY lines at AAA. It is more indirection, but it keeps administrative AAA cleanly separated from everything else on the box.

Taranac ships a Huawei VRP TACACS+ template out of the box, with priv-lvl defaulting to 15 and per-command authorization enabled (exact match style). On a V200 switch the configuration below works against that template with no Taranac-side editing. On V600 the one thing you must change is that default — see Privilege levels.

VRP builds this up in layers. Each block below is a layer; apply them in order.

hwtacacs-server template TARANAC-TACACS
 hwtacacs-server authentication 10.0.0.20
 hwtacacs-server authorization  10.0.0.20
 hwtacacs-server accounting     10.0.0.20
 hwtacacs-server source-ip source-vlanif 1
 hwtacacs-server shared-key cipher <TACACS_SECRET>

Authentication, authorization and accounting are named separately, even when they all point at the same server. Omitting one of the three lines disables that function without any warning at configuration time.

The address lines carry no port, so they use the HWTACACS default of TCP 49 — which is what a standard Taranac deployment listens on. A deployment that remapped the TACACS+ port must specify it on each of the three lines.

hwtacacs-server source-ip source-vlanif 1 pins the source address, which is what Taranac matches against the registered device. This matters as much here as anywhere: if the source address does not match the address on the device’s entry in Taranac, the request is dropped as coming from an unknown client, and nothing is written to the Taranac logs — the switch reports a timeout while the server appears idle. See Network devices.

Pinning it explicitly matters most on a switch with several Layer 3 interfaces, where the source address otherwise follows the egress interface the routing table happens to pick, and on an HA pair, where it keeps the NAS address the same whichever member is handling management traffic.

hwtacacs-server template TARANAC-TACACS
 hwtacacs-server timer response-timeout 30

VRP’s default response timeout is 5 seconds. Taranac holds the AAA exchange open while the admin taps approve on their phone — up to about 30 — so the default gives up first and falls through to local before the approval can arrive. Raise it on the NAS and on the server together: whichever of the two is shorter is the one that decides.

aaa
 authentication-scheme TARANAC-TACACS-AUTH
  authentication-mode hwtacacs local

hwtacacs local tries HWTACACS first and falls back to the local user database — but only when the server is unreachable or times out.

aaa
 authorization-scheme TARANAC-TACACS-AUTHOR
  authorization-mode hwtacacs local
  authorization-cmd 0  hwtacacs local
  authorization-cmd 1  hwtacacs local
  authorization-cmd 2  hwtacacs local
  authorization-cmd 3  hwtacacs local
  authorization-cmd 4  hwtacacs local
  authorization-cmd 5  hwtacacs local
  authorization-cmd 6  hwtacacs local
  authorization-cmd 7  hwtacacs local
  authorization-cmd 8  hwtacacs local
  authorization-cmd 9  hwtacacs local
  authorization-cmd 10 hwtacacs local
  authorization-cmd 11 hwtacacs local
  authorization-cmd 12 hwtacacs local
  authorization-cmd 13 hwtacacs local
  authorization-cmd 14 hwtacacs local
  authorization-cmd 15 hwtacacs local

Sixteen lines, and all sixteen are load-bearing.

This is the same trap as on Cisco IOS, and it fails the same way — silently, in the permissive direction. Only the spelling differs. Among the vendors documented here, Arista EOS is the outlier that offers a commands all shorthand; Cisco and Huawei both make you enumerate.

On V600 the range stops at 3, so the scheme is four lines rather than sixteen — the levels above it do not exist on that branch:

aaa
 authorization-scheme TARANAC-TACACS-AUTHOR
  authorization-mode hwtacacs local
  authorization-cmd 0 hwtacacs local
  authorization-cmd 1 hwtacacs local
  authorization-cmd 2 hwtacacs local
  authorization-cmd 3 hwtacacs local

aaa
 accounting-scheme TARANAC-TACACS-ACCT
  accounting-mode hwtacacs
!
 recording-scheme TARANAC-TACACS-RECORD
  recording-mode hwtacacs TARANAC-TACACS
!
 cmd recording-scheme TARANAC-TACACS-RECORD

Note that recording-mode hwtacacs TARANAC-TACACS references the server template by name directly, unlike the other schemes which get their server from the domain binding.

aaa
 domain default_admin
  authentication-scheme TARANAC-TACACS-AUTH
  authorization-scheme  TARANAC-TACACS-AUTHOR
  accounting-scheme     TARANAC-TACACS-ACCT
  hwtacacs-server       TARANAC-TACACS

default_admin is VRP’s built-in domain for device-management logins. Binding the schemes here is what actually puts them into service — a scheme that exists but is bound to no domain does nothing.

user-interface vty 0 4
 authentication-mode aaa
 protocol inbound ssh

The tested production configuration ran protocol inbound all, permitting Telnet alongside SSH. For a new deployment use ssh only — TACACS+ protects the AAA exchange between switch and server, not the admin’s session to the switch, so Telnet still puts credentials and every command on the wire in clear text.

The V600 configuration additionally pins the line’s own privilege level and widens the VTY pool:

user-interface maximum-vty 5

user-interface vty 0 4
 authentication-mode aaa
 user privilege level 3
 protocol inbound ssh

aaa
 local-user <BREAK_GLASS_ADMIN> password irreversible-cipher <PASSWORD_HASH>
 local-user <BREAK_GLASS_ADMIN> privilege level 15
 local-user <BREAK_GLASS_ADMIN> service-type terminal ssh

The local keyword in every scheme above is worthless without a local account to fall back to. Give it the branch’s full-administrator level: 15 on V200, 3 on V600.

Both columns were verified against Taranac on the hardware listed above. On V600, 3 is not merely the level the administrator happens to receive — it is the maximum the branch has, which is why a profile written for V200 cannot simply be pointed at a V600 switch.

The practical consequence is that one shell profile cannot serve both branches — a profile returning priv-lvl = 15 to a V600 device asks for a level that does not exist there. Use separate profiles, and separate the devices so a policy rule can tell them apart: either a device group per branch, or distinct rules matching on device. See AAA policy.

This is a good use for device groups generally. Grouping by platform branch means the privilege model is decided once, at the group, rather than remembered per device.

Tested on the V600 switch above with a 5-second response timeout, by blocking TCP/49 from the switch to Taranac while sessions were open. Command authorization fails closed:

The denial looks like an ordinary syntax complaint, which is worth recognising before you go hunting for a typo:

Error: Do not have permission to run the command or the command is incomplete.

Two things follow. The break-glass account still works during an outage, but every command in that session stalls for the full timeout first — the switch asks the dead server before falling back, each time. And the fallback only ever fires on silence: a reject that Taranac actually returned is final, on authorization exactly as on authentication. That is not Huawei-specific — the same caveat holds on Cisco IOS-XE and Arista EOS, and it is a property of how TACACS+ method lists work rather than a per-vendor quirk.

display version
display current-configuration configuration aaa
display current-configuration configuration user-interface
display current-configuration | include hwtacacs

For the server side of it — whether the switch believes Taranac is actually there — ask the template by name:

display hwtacacs-server template name TARANAC-TACACS

Primary-authentication-server : 10.0.0.20:49 Status:UP
Primary-authorization-server  : 10.0.0.20:49 Status:UP
Primary-accounting-server     : 10.0.0.20:49 Status:UP
Current-authentication-server : 10.0.0.20:49 Status:UP
Current-authorization-server  : 10.0.0.20:49 Status:UP
Current-accounting-server     : 10.0.0.20:49 Status:UP
Source-Vlanif                 : 1
Response-timeout-Interval(sec): 5

Three things are worth reading here rather than skimming. All three functions must be listed and UP — a missing line is the omitted hwtacacs-server statement from step 1, not a network problem. Source-Vlanif must be the interface whose address is registered for this device in Taranac. And Response-timeout-Interval is the timer discussed above: 5 here means push MFA cannot work, and it is also the delay you will sit through on every command during an outage.

For long output, disable paging for the session only:

screen-length 0 temporary

The temporary keyword matters — it reverts on logout instead of persisting into the saved configuration.

As with any platform, a successful login proves authentication and nothing more. To prove the rest: log in from a second session and run a command your policy should deny — a denial arriving from Taranac is the only real evidence that command authorization is live. Then check that the command appears in Taranac’s accounting, which is what confirms the recording scheme took effect.

Named explicitly, because a gap presented as a gap is useful and a gap presented as working is a trap:

• Push MFA on VRP. The response-timeout requirement is understood and the timer is documented above, but no VRP switch has yet completed a push-approved login end to end. Expect the timer to be necessary; do not assume 30 seconds is sufficient until someone has confirmed it.
• Privilege escalation. Taranac’s Huawei VRP template declares enable support, but the super path was not tested on either branch. On V200 the administrator arrives at level 15 already, which makes escalation moot in practice — that is why it went untested, not evidence that it works.
• 802.1X and MAB. Not covered here. Taranac’s vendor dictionary carries Huawei NAC mappings — VLAN, Filter-Id, HW-Data-Filter for downloadable ACLs — and records that Huawei has no port-bounce or port-disable CoA, with reauthentication performed as a disconnect instead. Those entries come from vendor documentation and have not been confirmed on hardware.

If you run VRP and can close any of these, we would like to hear from you.

• Device configuration — conventions and the rest of the cookbook
• Cisco IOS / IOS-XE — the same ground on another platform
• Network devices — registering the device and its secret
• TACACS+ — profiles, command sets, privilege levels
• AAA policy — the rules that decide what a login gets