R0106-HP MSR Router Series Security Command Reference(V7)

412
port-number: Specifies the port number of the server, in the range of 1 to 65535. The default is 22.
vpn-instance vpn-instance-name: Specifies the MPLS L3VPN instance to which the server belongs, where
the vpn-instance-name argument is a case-sensitive string of 1 to 31 characters.
-i interface-type interface-number: Specifies an output interface by its type and number for IPv6 SFTP
packets. The specified output interface must have a link-local address. This option is used when the server
uses a link-local address to provide the SFTP service for the client.
identity-key: Specifies a public key algorithm for the client, either dsa or rsa. The default is dsa. If the
server uses publickey authentication, this keyword must be specified.
• dsa: Specifies the public key algorithm dsa.
• rsa: Specifies the public key algorithm rsa.
prefer-compress: Specifies the preferred compression algorithm between the server and the client. By
default, compression is not supported.
zlib: Specifies the compression algorithm zlib.
prefer-ctos-cipher: Specifies the preferred client-to-server encryption algorithm. The default is des in low
encryption and aes128 in high encryption. Algorithms des, 3des, aes128, and aes256 are arranged in
ascending order in the aspects of security strength and calculation time.
• 3des: Specifies the encryption algorithm 3des-cbc.
• aes128: Specifies the encryption algorithm aes128-cbc.
• aes256: Specifies the encryption algorithm aes256-cbc.
• des: Specifies the encryption algorithm des-cbc.
prefer-ctos-hmac: Specifies the preferred client-to-server HMAC algorithm. The default is sha1.
Algorithm sha1 features stronger security but costs more time in calculation than md5.
• md5: Specifies the HMAC algorithm hmac-md5.
•
md5-9
6: Specifies the HMAC algorithm hmac-md5-96.
• sha1: Specifies the HMAC algorithm hmac-sha1.
• sha1-96: Specifies the HMAC algorithm hmac-sha1-96.
prefer-kex: Specifies the preferred key exchange algorithm. The default is dh-group-exchange in
non-FIPS mode and dh-group14 in FIPS mode. Algorithm dh-group14 features stronger security but costs
more time in calculation than dh-group1.
• dh-group-exchange: Specifies the key exchange algorithm diffie-hellman-group-exchange-sha1.
• dh-group1: Specifies the key exchange algorithm diffie-hellman-group1-sha1.
• dh-group14: Specifies the key exchange algorithm diffie-hellman-group14-sha1.
prefer-stoc-cipher: Specifies the preferred server-to-client encryption algorithm. The default is des in low
encryption and aes128 in high encryption.
prefer-stoc-hmac: Specifies the preferred server-to-client HMAC algorithm. The default is sha1.
dscp dscp-value: Specifies the DSCP value in the IPv6 SFTP packets sent by the SFTP client, in the range
of 0 to 63. The default value is 48. The DSCP value determines the transmission priority of the packet.
publickey keyname: Specifies the host public key of the server, which is used to authenticate the server.
The keyname argument is a case-insensitive string of 1 to 64 characters.
source: Specifies a source IP address or source interface for IPv6 SFTP packets. By default, the IPv6 SFTP
packets automatically select an IPv6 address as their source address in compliance with RFC 3484. For
successful IPv6 SFTP connections, use one of the following methods: