SSH, Telnet, and Console Access

Three Ways to Reach the CLI

HCIA-Datacom expects you to classify management access methods and know when each is appropriate.

Out-of-band means the management channel does not depend on the data-plane IP path you are troubleshooting. Console still works if routing is broken—provided you have physical or terminal-server access. In-band means you reach a device IP address across the network; if that path fails, remote CLI fails with it.

Console Access

Console is the bootstrap path:

1. Connect RJ45/USB console cable per hardware guide.
2. Use terminal software (115200/8/N/1 is common on modern Huawei gear—confirm for your model).
3. Authenticate if a console password or AAA is configured.
4. Land in user-view and proceed to system-view as needed.

On new or factory-default devices, console may allow access with minimal authentication depending on defaults and software version. Production hardening adds authentication on the console user-interface. Conceptually remember: physical presence (or remote serial concentrator) required.

Console is also how you recover when you lock yourself out of SSH or delete the management IP—another reason labs should never rely only on Telnet mid-reconfiguration.

Telnet: Simple and Insecure

Telnet remote login is easy to demonstrate in a closed lab:

• Device needs a reachable IP (management interface, VLANIF, or routed interface).
• Telnet server function enabled.
• VTY user-interface configured to accept Telnet and an authentication mode.
• User credentials exist (local user or AAA server).

From a client:

telnet 192.0.2.10

Security problem: Telnet transmits usernames, passwords, and all CLI traffic in clear text. Anyone sniffing the path can capture credentials. For HCIA, the correct security recommendation is prefer SSH; use Telnet only in isolated labs or legacy constraints.

Exam language may say “Telnet is not recommended on public networks” or ask which protocol encrypts management traffic—answer SSH.

SSH / STelnet on Huawei

Huawei documentation often uses STelnet for SSH-based terminal login. Conceptual enablement chain:

1. Ensure the device has a management IP and routing/reachability.
2. Generate or ensure existence of a local RSA/key pair used by SSH (command families such as rsa local-key-pair create appear in training labs).
3. Enable the SSH/STelnet server (stelnet server enable style commands).
4. Configure VTY user-interfaces for SSH protocol inbound.
5. Create local users (or external AAA) with SSH service permission and a privilege level.
6. Optionally harden algorithms and idle timeouts per security policy.

Client side:

ssh user@192.0.2.10

or platform GUI tools. First connection may require accepting a host key fingerprint—similar to any SSH server.

Compared with Telnet, SSH provides confidentiality and integrity for the management session. That single sentence is enough to answer many security-oriented H12-811 items.

User-Interface Lines (Console and VTY)

VRP models access channels as user-interfaces:

Under a user-interface you typically set:

• Authentication mode (password vs AAA / scheme—exact keywords vary by version)
• Protocol inbound permissions (Telnet, SSH)
• Idle timeout
• User privilege level for the line (where applicable)

HCIA does not require memorizing every subcommand on every release, but you must know that VTY configuration gates remote access even if a local user exists, and console configuration gates local serial access.

Local-User AAA Basics

For associate level, focus on local AAA users stored on the device:

[Huawei] aaa
[Huawei-aaa] local-user admin password irreversible-cipher ********
[Huawei-aaa] local-user admin privilege level 15
[Huawei-aaa] local-user admin service-type terminal ssh

(Exact password keyword variants exist across versions—irreversible-cipher is common in modern examples; older materials may show other forms. Learn the attributes, not only one cipher keyword.)

If service-type omits ssh, an SSH login can fail even with a correct password. If privilege is too low, the user may authenticate but cannot enter configuration commands. Both are realistic troubleshooting cases.

External AAA (RADIUS / HWTACACS) appears later in network services chapters. For device management basics, local-user remains the core building block.

Privilege Levels Revisited for Access Control

Operators sometimes create a level-1 user for read-mostly staff and a level-15 user for engineers. Remote sessions inherit privileges from the authenticated user (and line settings). Misconfigured level is a reason “login works but system-view commands fail.”

Building Blocks Checklist for Remote Login

Use this checklist when a lab “cannot Telnet/SSH”:

1. Reachability — ping from client to device management IP; correct VRF/gateway if used.
2. Interface up / IP correct — display ip interface brief.
3. Server feature enabled — Telnet or STelnet server on.
4. ACL on VTY — if present, must permit client (advanced but real).
5. User-interface protocol — VTY allows the intended protocol.
6. Authentication — local user or AAA operational.
7. service-type — user allowed for telnet/ssh/terminal.
8. Firewall en route — management ports not blocked.

Console bypasses steps that depend on IP, which is why it is the recovery path.

Security Comparison for the Exam

Common Configuration Intent (Conceptual Sequence)

A teaching-order sequence for secure remote access after basic L3 setup:

1. Configure management IP / VLANIF.
2. Create local user level 15 with ssh (and terminal) service-type.
3. Create RSA key pair.
4. Enable STelnet server.
5. Under VTY, set authentication and permit SSH.
6. Test SSH from a client before disabling console experimentation.
7. save.

Disabling Telnet after SSH works is a hardening step aligned with best practice, even when the exam mainly tests knowledge rather than a full hardening checklist.

Exam Traps

• Claiming Telnet is encrypted.
• Forgetting that remote methods need a device IP and routing.
• Creating a local user without the correct service-type.
• Confusing privilege level with VLAN ID or OSPF process ID.
• Assuming console authentication is identical to SSH without checking user-interface console settings.
• Leaving default passwords or level-15 open Telnet in “production” scenario questions—prefer SSH and strong local users.

What to Practice

• Document the difference between out-of-band console and in-band SSH in one sentence each.
• Create a local user with level 15 and restricted service-types in a lab.
• Enable SSH, log in, then intentionally break service-type or VTY protocol and observe failure modes.
• Always keep console available while changing remote authentication.

Remote management competence is not only a security topic—it is how you will spend most of your career on Huawei gear after the first rack-and-stack day.