FTP, Telnet and SSH

What it is

Network services are application layer protocols that run on top of TCP or UDP, mostly in a client and server model. Each service listens on a well known port so clients know where to connect.

This page covers the three services an engineer uses daily to manage Huawei devices: FTP to move files such as system software and configuration files, Telnet for remote command line access, and SSH for secure remote access and file transfer.

How it works

Common service ports

FTP

FTP uses two TCP connections. The control connection to server port 21 carries commands and replies and stays up for the whole session. A data connection is opened for each file transfer or directory listing.

Passive mode works better when the client sits behind a firewall or NAT, because the client opens both connections.

FTP has two transfer types. ASCII is for text files, and binary is for system software and other non text files.

TFTP is a lighter alternative over UDP 69. It has no user login and no directory listing, so it suits simple transfers in a trusted network.

Configuring the device as an FTP server

[R1] ftp server enable
[R1] aaa
[R1-aaa] local-user ftpuser password irreversible-cipher Huawei@123
[R1-aaa] local-user ftpuser service-type ftp
[R1-aaa] local-user ftpuser privilege level 15
[R1-aaa] local-user ftpuser ftp-directory flash:/

A client logs in with ftp 10.0.12.1 from the user view, then uses binary, get to download, put to upload, and bye to leave. The ftp-directory command sets the folder the user starts in.

Telnet

Telnet gives remote access to the device's command line over TCP port 23. Everything, including the user name and password, crosses the network in plain text, so anyone who captures the traffic can read it.

Remote sessions arrive on VTY user interfaces. user-interface vty 0 4 configures the first five lines, so five users can log in at the same time by default.

[R1] telnet server enable
[R1] user-interface vty 0 4
[R1-ui-vty0-4] authentication-mode aaa
[R1-ui-vty0-4] protocol inbound telnet

The local user also needs service-type telnet in the aaa view. A device connects as a client with telnet 10.0.12.1.

SSH

SSH (Secure Shell) encrypts the whole session, including the login, over TCP port 22. Huawei calls remote CLI login over SSH STelnet (Secure Telnet). SSH also carries SFTP for encrypted file transfer. SSH version 2 is the version to use; SSH version 1 has known weaknesses.

The client and server negotiate the version and algorithms, exchange keys to build an encrypted channel, and then authenticate the user by password or by public key.

[R1] rsa local-key-pair create
[R1] stelnet server enable
[R1] user-interface vty 0 4
[R1-ui-vty0-4] authentication-mode aaa
[R1-ui-vty0-4] protocol inbound ssh
[R1-ui-vty0-4] quit
[R1] aaa
[R1-aaa] local-user admin password irreversible-cipher Huawei@123
[R1-aaa] local-user admin service-type ssh
[R1-aaa] local-user admin privilege level 15
[R1-aaa] quit
[R1] ssh user admin authentication-type password
[R1] ssh user admin service-type stelnet

On a VRP device acting as the SSH client, enable ssh client first-time enable so it accepts the server's key on the first connection, then connect with stelnet 10.0.12.1. Use sftp server enable to allow SFTP. Check the server with display ssh server status.

A worked example

A switch accepts Telnet but an SSH client is refused. The VTY lines have protocol inbound telnet, which allows only Telnet.

Changing it to protocol inbound ssh (or all), enabling stelnet server enable and creating the RSA key pair allows SSH logins. Telnet is then refused if ssh alone was chosen, which is the secure result.

How the exam asks about this

• "Which port does an FTP client connect to for the control connection?" → TCP 21.
• "Why is SSH preferred to Telnet for device management?" → SSH encrypts the session including the password, while Telnet sends everything in plain text.
• "Which FTP mode lets the client open the data connection?" → Passive mode (PASV).